main/linux-grsec: upggradde to 3.3.5 kernel

(cherry picked from commit 87f0df4602f249095b72b7ff14a53ba00a89c721)

2 files changed, 666 insertions, 140 deletions

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 7d6d094a1..1a4e1e713 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,7 +2,7 @@
 
 _flavor=grsec
 pkgname=linux-${_flavor}
-pkgver=3.3.4
+pkgver=3.3.5
 _kernver=3.3
 pkgrel=0
 pkgdesc="Linux kernel with grsecurity"
@@ -14,7 +14,7 @@ _config=${config:-kernelconfig.${CARCH}}
 install=
 source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
 	http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
-	grsecurity-2.9-3.3.4-201204272006.patch
+	grsecurity-2.9-3.3.5-201205071839.patch
 	
 	0004-arp-flush-arp-cache-on-device-change.patch
 
@@ -138,8 +138,8 @@ dev() {
 }
 
 md5sums="7133f5a2086a7d7ef97abac610c094f5  linux-3.3.tar.xz
-9c4cc16f10b645fbb90f6c05ad388883  patch-3.3.4.xz
-82b2836bca19ed2c09bbc8c1d29c18f0  grsecurity-2.9-3.3.4-201204272006.patch
+d346edca5d3de7052f49996b01cef401  patch-3.3.5.xz
+1c2f2313347889b313f8af1212c708bf  grsecurity-2.9-3.3.5-201205071839.patch
 776adeeb5272093574f8836c5037dd7d  0004-arp-flush-arp-cache-on-device-change.patch
 5d2818cb5329aec600ee8ffc3896a728  kernelconfig.x86
 39552b468a33a04678113c12ec6c1a91  kernelconfig.x86_64"
diff --git a/main/linux-grsec/grsecurity-2.9-3.3.4-201204272006.patch b/main/linux-grsec/grsecurity-2.9-3.3.5-201205071839.patch
index 7c10a25a9..222eccde7 100644
--- a/main/linux-grsec/grsecurity-2.9-3.3.4-201204272006.patch
+++ b/main/linux-grsec/grsecurity-2.9-3.3.5-201205071839.patch
@@ -195,7 +195,7 @@ index d99fd9c..8689fef 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 44ef766..dac9410 100644
+index 64615e9..64d72ce 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -456,6 +456,23 @@ index da5449e..7418343 100644
  /* $0 is set by ld.so to a pointer to a function which might be 
     registered using atexit.  This provides a mean for the dynamic
     linker to call DT_FINI functions for shared libraries that have
+diff --git a/arch/alpha/include/asm/pgalloc.h b/arch/alpha/include/asm/pgalloc.h
+index bc2a0da..8ad11ee 100644
+--- a/arch/alpha/include/asm/pgalloc.h
++++ b/arch/alpha/include/asm/pgalloc.h
+@@ -29,6 +29,12 @@ pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
+ 	pgd_set(pgd, pmd);
+ }
+ 
++static inline void
++pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
++{
++	pgd_populate(mm, pgd, pmd);
++}
++
+ extern pgd_t *pgd_alloc(struct mm_struct *mm);
+ 
+ static inline void
 diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
 index de98a73..bd4f1f8 100644
 --- a/arch/alpha/include/asm/pgtable.h
@@ -1389,6 +1406,30 @@ index 97b440c..b7ff179 100644
  
  #ifdef MULTI_USER
  extern struct cpu_user_fns cpu_user;
+diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
+index 943504f..bf8d667 100644
+--- a/arch/arm/include/asm/pgalloc.h
++++ b/arch/arm/include/asm/pgalloc.h
+@@ -43,6 +43,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+ 	set_pud(pud, __pud(__pa(pmd) | PMD_TYPE_TABLE));
+ }
+ 
++static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
++{
++	pud_populate(mm, pud, pmd);
++}
++
+ #else	/* !CONFIG_ARM_LPAE */
+ 
+ /*
+@@ -51,6 +56,7 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+ #define pmd_alloc_one(mm,addr)		({ BUG(); ((pmd_t *)2); })
+ #define pmd_free(mm, pmd)		do { } while (0)
+ #define pud_populate(mm,pmd,pte)	BUG()
++#define pud_populate_kernel(mm,pmd,pte)	BUG()
+ 
+ #endif	/* CONFIG_ARM_LPAE */
+ 
 diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
 index e4c96cc..1145653 100644
 --- a/arch/arm/include/asm/system.h
@@ -2233,6 +2274,36 @@ index b5298eb..67c6e62 100644
  #define PT_IA_64_UNWIND		0x70000001
  
  /* IA-64 relocations: */
+diff --git a/arch/ia64/include/asm/pgalloc.h b/arch/ia64/include/asm/pgalloc.h
+index 96a8d92..617a1cf 100644
+--- a/arch/ia64/include/asm/pgalloc.h
++++ b/arch/ia64/include/asm/pgalloc.h
+@@ -39,6 +39,12 @@ pgd_populate(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
+ 	pgd_val(*pgd_entry) = __pa(pud);
+ }
+ 
++static inline void
++pgd_populate_kernel(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
++{
++	pgd_populate(mm, pgd_entry, pud);
++}
++
+ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
+ {
+ 	return quicklist_alloc(0, GFP_KERNEL, NULL);
+@@ -57,6 +63,12 @@ pud_populate(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
+ 	pud_val(*pud_entry) = __pa(pmd);
+ }
+ 
++static inline void
++pud_populate_kernel(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
++{
++	pud_populate(mm, pud_entry, pmd);
++}
++
+ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
+ {
+ 	return quicklist_alloc(0, GFP_KERNEL, NULL);
 diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
 index 1a97af3..7529d31 100644
 --- a/arch/ia64/include/asm/pgtable.h
@@ -2692,6 +2763,22 @@ index da9bd7d..91aa7ab 100644
    #else
       typedef struct { unsigned long long pte; } pte_t;
       #define pte_val(x)	((x).pte)
+diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
+index 881d18b..cea38bc 100644
+--- a/arch/mips/include/asm/pgalloc.h
++++ b/arch/mips/include/asm/pgalloc.h
+@@ -37,6 +37,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+ {
+ 	set_pud(pud, __pud((unsigned long)pmd));
+ }
++
++static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
++{
++	pud_populate(mm, pud, pmd);
++}
+ #endif
+ 
+ /*
 diff --git a/arch/mips/include/asm/system.h b/arch/mips/include/asm/system.h
 index 6018c80..7c37203 100644
 --- a/arch/mips/include/asm/system.h
@@ -2999,6 +3086,30 @@ index 19f6cb1..6c78cf2 100644
  /* This yields a mask that user programs can use to figure out what
     instruction set this CPU supports.  This could be done in user space,
     but it's not easy, and we've already done it here.  */
+diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
+index fc987a1..6e068ef 100644
+--- a/arch/parisc/include/asm/pgalloc.h
++++ b/arch/parisc/include/asm/pgalloc.h
+@@ -61,6 +61,11 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
+ 		        (__u32)(__pa((unsigned long)pmd) >> PxD_VALUE_SHIFT));
+ }
+ 
++static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
++{
++	pgd_populate(mm, pgd, pmd);
++}
++
+ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
+ {
+ 	pmd_t *pmd = (pmd_t *)__get_free_pages(GFP_KERNEL|__GFP_REPEAT,
+@@ -93,6 +98,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+ #define pmd_alloc_one(mm, addr)		({ BUG(); ((pmd_t *)2); })
+ #define pmd_free(mm, x)			do { } while (0)
+ #define pgd_populate(mm, pmd, pte)	BUG()
++#define pgd_populate_kernel(mm, pmd, pte)	BUG()
+ 
+ #endif
+ 
 diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
 index 22dadeb..f6c2be4 100644
 --- a/arch/parisc/include/asm/pgtable.h
@@ -3497,6 +3608,38 @@ index fed85e6..da5c71b 100644
  
  #include <asm-generic/getorder.h>
  
+diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
+index 292725c..f87ae14 100644
+--- a/arch/powerpc/include/asm/pgalloc-64.h
++++ b/arch/powerpc/include/asm/pgalloc-64.h
+@@ -50,6 +50,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
+ #ifndef CONFIG_PPC_64K_PAGES
+ 
+ #define pgd_populate(MM, PGD, PUD)	pgd_set(PGD, PUD)
++#define pgd_populate_kernel(MM, PGD, PUD)	pgd_populate((MM), (PGD), (PUD))
+ 
+ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
+ {
+@@ -67,6 +68,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+ 	pud_set(pud, (unsigned long)pmd);
+ }
+ 
++static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
++{
++	pud_populate(mm, pud, pmd);
++}
++
+ #define pmd_populate(mm, pmd, pte_page) \
+ 	pmd_populate_kernel(mm, pmd, page_address(pte_page))
+ #define pmd_populate_kernel(mm, pmd, pte) pmd_set(pmd, (unsigned long)(pte))
+@@ -76,6 +82,7 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+ #else /* CONFIG_PPC_64K_PAGES */
+ 
+ #define pud_populate(mm, pud, pmd)	pud_set(pud, (unsigned long)pmd)
++#define pud_populate_kernel(mm, pud, pmd)	pud_populate((mm), (pud), (pmd))
+ 
+ static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
+ 				       pte_t *pte)
 diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
 index 2e0e411..7899c68 100644
 --- a/arch/powerpc/include/asm/pgtable.h
@@ -4918,6 +5061,30 @@ index 7df8b7f..4946269 100644
  extern unsigned long sparc64_elf_hwcap;
  #define ELF_HWCAP	sparc64_elf_hwcap
  
+diff --git a/arch/sparc/include/asm/pgalloc_32.h b/arch/sparc/include/asm/pgalloc_32.h
+index ca2b344..c6084f89 100644
+--- a/arch/sparc/include/asm/pgalloc_32.h
++++ b/arch/sparc/include/asm/pgalloc_32.h
+@@ -37,6 +37,7 @@ BTFIXUPDEF_CALL(void, free_pgd_fast, pgd_t *)
+ BTFIXUPDEF_CALL(void, pgd_set, pgd_t *, pmd_t *)
+ #define pgd_set(pgdp,pmdp) BTFIXUP_CALL(pgd_set)(pgdp,pmdp)
+ #define pgd_populate(MM, PGD, PMD)      pgd_set(PGD, PMD)
++#define pgd_populate_kernel(MM, PGD, PMD)      pgd_populate((MM), (PGD), (PMD))
+ 
+ BTFIXUPDEF_CALL(pmd_t *, pmd_alloc_one, struct mm_struct *, unsigned long)
+ #define pmd_alloc_one(mm, address)	BTFIXUP_CALL(pmd_alloc_one)(mm, address)
+diff --git a/arch/sparc/include/asm/pgalloc_64.h b/arch/sparc/include/asm/pgalloc_64.h
+index 40b2d7a..22a665b 100644
+--- a/arch/sparc/include/asm/pgalloc_64.h
++++ b/arch/sparc/include/asm/pgalloc_64.h
+@@ -26,6 +26,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
+ }
+ 
+ #define pud_populate(MM, PUD, PMD)	pud_set(PUD, PMD)
++#define pud_populate_kernel(MM, PUD, PMD)	pud_populate((MM), (PUD), (PMD))
+ 
+ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
+ {
 diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
 index a790cc6..091ed94 100644
 --- a/arch/sparc/include/asm/pgtable_32.h
@@ -6993,6 +7160,18 @@ index 7cfc3ce..cbd1a58 100644
  #ifndef __ASSEMBLY__
  
  struct page;
+diff --git a/arch/um/include/asm/pgtable-3level.h b/arch/um/include/asm/pgtable-3level.h
+index 0032f92..cd151e0 100644
+--- a/arch/um/include/asm/pgtable-3level.h
++++ b/arch/um/include/asm/pgtable-3level.h
+@@ -58,6 +58,7 @@
+ #define pud_present(x)	(pud_val(x) & _PAGE_PRESENT)
+ #define pud_populate(mm, pud, pmd) \
+ 	set_pud(pud, __pud(_PAGE_TABLE + __pa(pmd)))
++#define pud_populate_kernel(mm, pud, pmd) pud_populate((mm), (pud), (pmd))
+ 
+ #ifdef CONFIG_64BIT
+ #define set_pud(pudptr, pudval) set_64bit((u64 *) (pudptr), pud_val(pudval))
 diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
 index 69f2490..2634831 100644
 --- a/arch/um/kernel/process.c
@@ -7192,10 +7371,10 @@ index 209ba12..15140db 100644
 +archprepare:
 +	$(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
 diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
-index 95365a8..52f857b 100644
+index 5a747dd..ff7b12c 100644
 --- a/arch/x86/boot/Makefile
 +++ b/arch/x86/boot/Makefile
-@@ -63,6 +63,9 @@ KBUILD_CFLAGS	:= $(LINUXINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
+@@ -64,6 +64,9 @@ KBUILD_CFLAGS	:= $(LINUXINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
  		   $(call cc-option, -fno-stack-protector) \
  		   $(call cc-option, -mpreferred-stack-boundary=2)
  KBUILD_CFLAGS	+= $(call cc-option, -m32)
@@ -7250,7 +7429,7 @@ index c7093bd..d4247ffe0 100644
  	return diff;
  }
 diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
-index b123b9a..2cf2f23 100644
+index fd55a2f..217b501 100644
 --- a/arch/x86/boot/compressed/Makefile
 +++ b/arch/x86/boot/compressed/Makefile
 @@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small
@@ -7264,10 +7443,10 @@ index b123b9a..2cf2f23 100644
  KBUILD_AFLAGS  := $(KBUILD_CFLAGS) -D__ASSEMBLY__
  GCOV_PROFILE := n
 diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
-index a055993..47e126c 100644
+index c85e3ac..6f5aa80 100644
 --- a/arch/x86/boot/compressed/head_32.S
 +++ b/arch/x86/boot/compressed/head_32.S
-@@ -98,7 +98,7 @@ preferred_addr:
+@@ -106,7 +106,7 @@ preferred_addr:
  	notl	%eax
  	andl    %eax, %ebx
  #else
@@ -7276,7 +7455,7 @@ index a055993..47e126c 100644
  #endif
  
  	/* Target address to relocate to for decompression */
-@@ -184,7 +184,7 @@ relocated:
+@@ -192,7 +192,7 @@ relocated:
   * and where it was actually loaded.
   */
  	movl	%ebp, %ebx
@@ -7285,7 +7464,7 @@ index a055993..47e126c 100644
  	jz	2f	/* Nothing to be done if loaded at compiled addr. */
  /*
   * Process relocations.
-@@ -192,8 +192,7 @@ relocated:
+@@ -200,8 +200,7 @@ relocated:
  
  1:	subl	$4, %edi
  	movl	(%edi), %ecx
@@ -7296,7 +7475,7 @@ index a055993..47e126c 100644
  	jmp	1b
  2:
 diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
-index 558d76c..606aa24 100644
+index 87e03a1..0d94c76 100644
 --- a/arch/x86/boot/compressed/head_64.S
 +++ b/arch/x86/boot/compressed/head_64.S
 @@ -91,7 +91,7 @@ ENTRY(startup_32)
@@ -7308,7 +7487,7 @@ index 558d76c..606aa24 100644
  #endif
  
  	/* Target address to relocate to for decompression */
-@@ -253,7 +253,7 @@ preferred_addr:
+@@ -263,7 +263,7 @@ preferred_addr:
  	notq	%rax
  	andq	%rax, %rbp
  #else
@@ -10780,7 +10959,7 @@ index 8e8b9a4..f07d725 100644
  /* This contains all the paravirt structures: we get a convenient
   * number for each function using the offset which we use to indicate
 diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
-index b4389a4..b7ff22c 100644
+index b4389a4..7024269 100644
 --- a/arch/x86/include/asm/pgalloc.h
 +++ b/arch/x86/include/asm/pgalloc.h
 @@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(struct mm_struct *mm,
@@ -10797,6 +10976,42 @@ index b4389a4..b7ff22c 100644
  	set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
  }
  
+@@ -99,12 +106,22 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+ 
+ #ifdef CONFIG_X86_PAE
+ extern void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd);
++static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
++{
++	pud_populate(mm, pudp, pmd);
++}
+ #else	/* !CONFIG_X86_PAE */
+ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+ {
+ 	paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
+ 	set_pud(pud, __pud(_PAGE_TABLE | __pa(pmd)));
+ }
++
++static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
++{
++	paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
++	set_pud(pud, __pud(_KERNPG_TABLE | __pa(pmd)));
++}
+ #endif	/* CONFIG_X86_PAE */
+ 
+ #if PAGETABLE_LEVELS > 3
+@@ -114,6 +131,12 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
+ 	set_pgd(pgd, __pgd(_PAGE_TABLE | __pa(pud)));
+ }
+ 
++static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
++{
++	paravirt_alloc_pud(mm, __pa(pud) >> PAGE_SHIFT);
++	set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(pud)));
++}
++
+ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
+ {
+ 	return (pud_t *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT);
 diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
 index 98391db..8f6984e 100644
 --- a/arch/x86/include/asm/pgtable-2level.h
@@ -11094,7 +11309,7 @@ index ed5903b..c7fe163 100644
  #define MODULES_END	VMALLOC_END
  #define MODULES_LEN	(MODULES_VADDR - MODULES_END)
 diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
-index 975f709..107976d 100644
+index 975f709..9f779c9 100644
 --- a/arch/x86/include/asm/pgtable_64.h
 +++ b/arch/x86/include/asm/pgtable_64.h
 @@ -16,10 +16,14 @@
@@ -11124,7 +11339,17 @@ index 975f709..107976d 100644
  }
  
  static inline void native_pmd_clear(pmd_t *pmd)
-@@ -107,6 +113,13 @@ static inline void native_pud_clear(pud_t *pud)
+@@ -97,7 +103,9 @@ static inline pmd_t native_pmdp_get_and_clear(pmd_t *xp)
+ 
+ static inline void native_set_pud(pud_t *pudp, pud_t pud)
+ {
++	pax_open_kernel();
+ 	*pudp = pud;
++	pax_close_kernel();
+ }
+ 
+ static inline void native_pud_clear(pud_t *pud)
+@@ -107,6 +115,13 @@ static inline void native_pud_clear(pud_t *pud)
  
  static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
  {
@@ -13001,7 +13226,7 @@ index bb05228..d763d5b 100644
  #endif
  
 diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
-index 517d476..a1cb4d9 100644
+index a609c39..7a68dc7 100644
 --- a/arch/x86/include/asm/x86_init.h
 +++ b/arch/x86/include/asm/x86_init.h
 @@ -29,7 +29,7 @@ struct x86_init_mpparse {
@@ -13365,7 +13590,7 @@ index 1f84794..e23f862 100644
  }
  
 diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
-index 2eec05b..fef012b 100644
+index 5b3f88e..61232b4 100644
 --- a/arch/x86/kernel/apic/apic.c
 +++ b/arch/x86/kernel/apic/apic.c
 @@ -184,7 +184,7 @@ int first_system_vector = 0xfe;
@@ -13377,7 +13602,7 @@ index 2eec05b..fef012b 100644
  
  int pic_mode;
  
-@@ -1908,7 +1908,7 @@ void smp_error_interrupt(struct pt_regs *regs)
+@@ -1912,7 +1912,7 @@ void smp_error_interrupt(struct pt_regs *regs)
  	apic_write(APIC_ESR, 0);
  	v1 = apic_read(APIC_ESR);
  	ack_APIC_irq();
@@ -13569,10 +13794,10 @@ index 25f24dc..4094a7f 100644
  obj-y			+= proc.o capflags.o powerflags.o common.o
  obj-y			+= vmware.o hypervisor.o sched.o mshyperv.o
 diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
-index f4773f4..b3fb13c 100644
+index 80ab83d..0a7b34e 100644
 --- a/arch/x86/kernel/cpu/amd.c
 +++ b/arch/x86/kernel/cpu/amd.c
-@@ -669,7 +669,7 @@ static unsigned int __cpuinit amd_size_cache(struct cpuinfo_x86 *c,
+@@ -670,7 +670,7 @@ static unsigned int __cpuinit amd_size_cache(struct cpuinfo_x86 *c,
  							unsigned int size)
  {
  	/* AMD errata T13 (order #21922) */
@@ -13582,7 +13807,7 @@ index f4773f4..b3fb13c 100644
  		if (c->x86_model == 3 && c->x86_mask == 0)
  			size = 64;
 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index c0f7d68..aa418f9 100644
+index 1a810e4..9fa8201 100644
 --- a/arch/x86/kernel/cpu/common.c
 +++ b/arch/x86/kernel/cpu/common.c
 @@ -84,60 +84,6 @@ static const struct cpu_dev __cpuinitconst default_cpu = {
@@ -13699,7 +13924,7 @@ index c0f7d68..aa418f9 100644
  
  	return regs;
  }
-@@ -1190,7 +1142,7 @@ void __cpuinit cpu_init(void)
+@@ -1181,7 +1133,7 @@ void __cpuinit cpu_init(void)
  	int i;
  
  	cpu = stack_smp_processor_id();
@@ -13708,7 +13933,7 @@ index c0f7d68..aa418f9 100644
  	oist = &per_cpu(orig_ist, cpu);
  
  #ifdef CONFIG_NUMA
-@@ -1216,7 +1168,7 @@ void __cpuinit cpu_init(void)
+@@ -1207,7 +1159,7 @@ void __cpuinit cpu_init(void)
  	switch_to_new_gdt(cpu);
  	loadsegment(fs, 0);
  
@@ -13717,7 +13942,7 @@ index c0f7d68..aa418f9 100644
  
  	memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
  	syscall_init();
-@@ -1225,7 +1177,6 @@ void __cpuinit cpu_init(void)
+@@ -1216,7 +1168,6 @@ void __cpuinit cpu_init(void)
  	wrmsrl(MSR_KERNEL_GS_BASE, 0);
  	barrier();
  
@@ -13725,7 +13950,7 @@ index c0f7d68..aa418f9 100644
  	if (cpu != 0)
  		enable_x2apic();
  
-@@ -1281,7 +1232,7 @@ void __cpuinit cpu_init(void)
+@@ -1272,7 +1223,7 @@ void __cpuinit cpu_init(void)
  {
  	int cpu = smp_processor_id();
  	struct task_struct *curr = current;
@@ -16999,18 +17224,10 @@ index 9c3bd4a..e1d9b35 100644
 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
 +#endif
 diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
-index 739d859..aab2a58 100644
+index f239f30..aab2a58 100644
 --- a/arch/x86/kernel/i387.c
 +++ b/arch/x86/kernel/i387.c
-@@ -154,6 +154,7 @@ int init_fpu(struct task_struct *tsk)
- 	if (tsk_used_math(tsk)) {
- 		if (HAVE_HWFP && tsk == current)
- 			unlazy_fpu(tsk);
-+		tsk->thread.fpu.last_cpu = ~0;
- 		return 0;
- 	}
- 
-@@ -188,6 +189,9 @@ int xfpregs_active(struct task_struct *target, const struct user_regset *regset)
+@@ -189,6 +189,9 @@ int xfpregs_active(struct task_struct *target, const struct user_regset *regset)
  
  int xfpregs_get(struct task_struct *target, const struct user_regset *regset,
  		unsigned int pos, unsigned int count,
@@ -17020,7 +17237,7 @@ index 739d859..aab2a58 100644
  		void *kbuf, void __user *ubuf)
  {
  	int ret;
-@@ -207,6 +211,9 @@ int xfpregs_get(struct task_struct *target, const struct user_regset *regset,
+@@ -208,6 +211,9 @@ int xfpregs_get(struct task_struct *target, const struct user_regset *regset,
  
  int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
  		unsigned int pos, unsigned int count,
@@ -17030,7 +17247,7 @@ index 739d859..aab2a58 100644
  		const void *kbuf, const void __user *ubuf)
  {
  	int ret;
-@@ -240,6 +247,9 @@ int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
+@@ -241,6 +247,9 @@ int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
  
  int xstateregs_get(struct task_struct *target, const struct user_regset *regset,
  		unsigned int pos, unsigned int count,
@@ -17040,7 +17257,7 @@ index 739d859..aab2a58 100644
  		void *kbuf, void __user *ubuf)
  {
  	int ret;
-@@ -269,6 +279,9 @@ int xstateregs_get(struct task_struct *target, const struct user_regset *regset,
+@@ -270,6 +279,9 @@ int xstateregs_get(struct task_struct *target, const struct user_regset *regset,
  
  int xstateregs_set(struct task_struct *target, const struct user_regset *regset,
  		  unsigned int pos, unsigned int count,
@@ -17050,7 +17267,7 @@ index 739d859..aab2a58 100644
  		  const void *kbuf, const void __user *ubuf)
  {
  	int ret;
-@@ -439,6 +452,9 @@ static void convert_to_fxsr(struct task_struct *tsk,
+@@ -440,6 +452,9 @@ static void convert_to_fxsr(struct task_struct *tsk,
  
  int fpregs_get(struct task_struct *target, const struct user_regset *regset,
  	       unsigned int pos, unsigned int count,
@@ -17060,7 +17277,7 @@ index 739d859..aab2a58 100644
  	       void *kbuf, void __user *ubuf)
  {
  	struct user_i387_ia32_struct env;
-@@ -471,6 +487,9 @@ int fpregs_get(struct task_struct *target, const struct user_regset *regset,
+@@ -472,6 +487,9 @@ int fpregs_get(struct task_struct *target, const struct user_regset *regset,
  
  int fpregs_set(struct task_struct *target, const struct user_regset *regset,
  	       unsigned int pos, unsigned int count,
@@ -17070,7 +17287,7 @@ index 739d859..aab2a58 100644
  	       const void *kbuf, const void __user *ubuf)
  {
  	struct user_i387_ia32_struct env;
-@@ -619,6 +638,8 @@ static inline int restore_i387_fsave(struct _fpstate_ia32 __user *buf)
+@@ -620,6 +638,8 @@ static inline int restore_i387_fsave(struct _fpstate_ia32 __user *buf)
  }
  
  static int restore_i387_fxsave(struct _fpstate_ia32 __user *buf,
@@ -24723,7 +24940,7 @@ index 8663f6c..829ae76 100644
  	printk(KERN_INFO "Write protecting the kernel text: %luk\n",
  		size >> 10);
 diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
-index 436a030..b8596b9 100644
+index 436a030..2b60088 100644
 --- a/arch/x86/mm/init_64.c
 +++ b/arch/x86/mm/init_64.c
 @@ -75,7 +75,7 @@ early_param("gbpages", parse_direct_gbpages_on);
@@ -24777,6 +24994,24 @@ index 436a030..b8596b9 100644
  		}
  		spin_unlock(&pgd_lock);
  	}
+@@ -162,7 +176,7 @@ static pud_t *fill_pud(pgd_t *pgd, unsigned long vaddr)
+ {
+ 	if (pgd_none(*pgd)) {
+ 		pud_t *pud = (pud_t *)spp_getpage();
+-		pgd_populate(&init_mm, pgd, pud);
++		pgd_populate_kernel(&init_mm, pgd, pud);
+ 		if (pud != pud_offset(pgd, 0))
+ 			printk(KERN_ERR "PAGETABLE BUG #00! %p <-> %p\n",
+ 			       pud, pud_offset(pgd, 0));
+@@ -174,7 +188,7 @@ static pmd_t *fill_pmd(pud_t *pud, unsigned long vaddr)
+ {
+ 	if (pud_none(*pud)) {
+ 		pmd_t *pmd = (pmd_t *) spp_getpage();
+-		pud_populate(&init_mm, pud, pmd);
++		pud_populate_kernel(&init_mm, pud, pmd);
+ 		if (pmd != pmd_offset(pud, 0))
+ 			printk(KERN_ERR "PAGETABLE BUG #01! %p <-> %p\n",
+ 			       pmd, pmd_offset(pud, 0));
 @@ -203,7 +217,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte)
  	pmd = fill_pmd(pud, vaddr);
  	pte = fill_pte(pmd, vaddr);
@@ -24822,6 +25057,15 @@ index 436a030..b8596b9 100644
  	adr = (void *)(((unsigned long)adr) | left);
  
  	return adr;
+@@ -592,7 +606,7 @@ kernel_physical_mapping_init(unsigned long start,
+ 		unmap_low_page(pud);
+ 
+ 		spin_lock(&init_mm.page_table_lock);
+-		pgd_populate(&init_mm, pgd, __va(pud_phys));
++		pgd_populate_kernel(&init_mm, pgd, __va(pud_phys));
+ 		spin_unlock(&init_mm.page_table_lock);
+ 		pgd_changed = true;
+ 	}
 @@ -684,6 +698,12 @@ void __init mem_init(void)
  
  	pci_iommu_alloc();
@@ -26719,10 +26963,10 @@ index 95c1cf6..4bfa5be 100644
  	.alloc_pud = xen_alloc_pmd_init,
  	.release_pud = xen_release_pmd_init,
 diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
-index 501d4e0..e877605 100644
+index f2ce60a..14e08dc 100644
 --- a/arch/x86/xen/smp.c
 +++ b/arch/x86/xen/smp.c
-@@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_cpu(void)
+@@ -209,11 +209,6 @@ static void __init xen_smp_prepare_boot_cpu(void)
  {
  	BUG_ON(smp_processor_id() != 0);
  	native_smp_prepare_boot_cpu();
@@ -26734,7 +26978,7 @@ index 501d4e0..e877605 100644
  	xen_filter_cpu_maps();
  	xen_setup_vcpu_info_placement();
  }
-@@ -275,12 +270,12 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
+@@ -290,12 +285,12 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
  	gdt = get_cpu_gdt_table(cpu);
  
  	ctxt->flags = VGCF_IN_KERNEL;
@@ -26750,7 +26994,7 @@ index 501d4e0..e877605 100644
  #else
  	ctxt->gs_base_kernel = per_cpu_offset(cpu);
  #endif
-@@ -331,13 +326,12 @@ static int __cpuinit xen_cpu_up(unsigned int cpu)
+@@ -346,13 +341,12 @@ static int __cpuinit xen_cpu_up(unsigned int cpu)
  	int rc;
  
  	per_cpu(current_task, cpu) = idle;
@@ -30276,7 +30520,7 @@ index 9689ca3..294f9c1 100644
  	return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
  }
 diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-index 65e1f00..a30ef00 100644
+index e159e33..cdcc663 100644
 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
 +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
 @@ -189,7 +189,7 @@ i915_gem_object_set_to_gpu_domain(struct drm_i915_gem_object *obj,
@@ -33609,7 +33853,7 @@ index 1898389..a3aa617 100644
  
  			rdev_dec_pending(rdev, mddev);
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 360f2b9..08b5382 100644
+index d1162e5..c7cd902 100644
 --- a/drivers/md/raid5.c
 +++ b/drivers/md/raid5.c
 @@ -1687,18 +1687,18 @@ static void raid5_end_read_request(struct bio * bi, int error)
@@ -34772,6 +35016,93 @@ index 52da7b2..4ddfe1c 100644
  	{ 				/* Sometime a Level-One switch card. */
  	  "Winbond W89c840",	CanHaveMII | HasBrokenTx | FDXOnNoMII},
  	{ "Winbond W89c840",	CanHaveMII | HasBrokenTx},
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index b2dc2c8..2e09edb 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -1259,55 +1259,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
+ {
+ 	int phy_addr;
+ 	struct netdev_private *np = netdev_priv(dev);
+-	struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru;
+-
+-	struct netdev_desc *desc;
+-	int i;
++	struct mii_ioctl_data *miidata = if_mii(rq);
+ 
+ 	phy_addr = np->phy_addr;
+ 	switch (cmd) {
+-	case SIOCDEVPRIVATE:
++	case SIOCGMIIPHY:
++		miidata->phy_id = phy_addr;
+ 		break;
+-
+-	case SIOCDEVPRIVATE + 1:
+-		miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num);
++	case SIOCGMIIREG:
++		miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num);
+ 		break;
+-	case SIOCDEVPRIVATE + 2:
+-		mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value);
++	case SIOCSMIIREG:
++		if (!capable(CAP_NET_ADMIN))
++			return -EPERM;
++		mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in);
+ 		break;
+-	case SIOCDEVPRIVATE + 3:
+-		break;
+-	case SIOCDEVPRIVATE + 4:
+-		break;
+-	case SIOCDEVPRIVATE + 5:
+-		netif_stop_queue (dev);
+-		break;
+-	case SIOCDEVPRIVATE + 6:
+-		netif_wake_queue (dev);
+-		break;
+-	case SIOCDEVPRIVATE + 7:
+-		printk
+-		    ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n",
+-		     netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx,
+-		     np->old_rx);
+-		break;
+-	case SIOCDEVPRIVATE + 8:
+-		printk("TX ring:\n");
+-		for (i = 0; i < TX_RING_SIZE; i++) {
+-			desc = &np->tx_ring[i];
+-			printk
+-			    ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x",
+-			     i,
+-			     (u32) (np->tx_ring_dma + i * sizeof (*desc)),
+-			     (u32)le64_to_cpu(desc->next_desc),
+-			     (u32)le64_to_cpu(desc->status),
+-			     (u32)(le64_to_cpu(desc->fraginfo) >> 32),
+-			     (u32)le64_to_cpu(desc->fraginfo));
+-			printk ("\n");
+-		}
+-		printk ("\n");
+-		break;
+-
+ 	default:
+ 		return -EOPNOTSUPP;
+ 	}
+diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h
+index ba0adca..30c2da3 100644
+--- a/drivers/net/ethernet/dlink/dl2k.h
++++ b/drivers/net/ethernet/dlink/dl2k.h
+@@ -365,13 +365,6 @@ struct ioctl_data {
+ 	char *data;
+ };
+ 
+-struct mii_data {
+-	__u16 reserved;
+-	__u16 reg_num;
+-	__u16 in_value;
+-	__u16 out_value;
+-};
+-
+ /* The Rx and Tx buffer descriptors. */
+ struct netdev_desc {
+ 	__le64 next_desc;
 diff --git a/drivers/net/ethernet/dlink/sundance.c b/drivers/net/ethernet/dlink/sundance.c
 index 28a3a9b..d96cb63 100644
 --- a/drivers/net/ethernet/dlink/sundance.c
@@ -41944,7 +42275,7 @@ index 95053ad..2cc93ca 100644
  			goto out_sig;
  		if (offset > inode->i_sb->s_maxbytes)
 diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
-index 9c098db..c755da5 100644
+index f624cd0..3d9a559 100644
 --- a/fs/autofs4/waitq.c
 +++ b/fs/autofs4/waitq.c
 @@ -61,7 +61,7 @@ static int autofs4_write(struct autofs_sb_info *sbi,
@@ -42050,7 +42381,7 @@ index 1ff9405..f1e376a 100644
  				fd_offset + ex.a_text);
  		up_write(&current->mm->mmap_sem);
 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index 07d096c..851a18b 100644
+index 07d096c..25762af 100644
 --- a/fs/binfmt_elf.c
 +++ b/fs/binfmt_elf.c
 @@ -32,6 +32,7 @@
@@ -42684,7 +43015,7 @@ index 07d096c..851a18b 100644
  			/* set_brk can never work. Avoid overflows. */
  			send_sig(SIGKILL, current, 0);
  			retval = -EINVAL;
-@@ -881,11 +1339,36 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -881,11 +1339,40 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  		goto out_free_dentry;
  	}
  	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
@@ -42707,8 +43038,12 @@ index 07d096c..851a18b 100644
 +		down_write(&current->mm->mmap_sem);
 +		retval = -ENOMEM;
 +		if (!find_vma_intersection(current->mm, start, start + size + PAGE_SIZE)) {
++			unsigned long prot = PROT_NONE;
++
 +			current->mm->brk_gap = PAGE_ALIGN(size) >> PAGE_SHIFT;
-+			start = do_mmap(NULL, start, size, PROT_NONE, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, 0);
++//			if (current->personality & ADDR_NO_RANDOMIZE)
++//				prot = PROT_READ;
++			start = do_mmap(NULL, start, size, prot, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, 0);
 +			retval = IS_ERR_VALUE(start) ? start : 0;
 +		}
 +		up_write(&current->mm->mmap_sem);
@@ -42724,7 +43059,7 @@ index 07d096c..851a18b 100644
  	if (elf_interpreter) {
  		unsigned long uninitialized_var(interp_map_addr);
  
-@@ -1098,7 +1581,7 @@ out:
+@@ -1098,7 +1585,7 @@ out:
   * Decide what to dump of a segment, part, all or none.
   */
  static unsigned long vma_dump_size(struct vm_area_struct *vma,
@@ -42733,7 +43068,7 @@ index 07d096c..851a18b 100644
  {
  #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
  
-@@ -1132,7 +1615,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+@@ -1132,7 +1619,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
  	if (vma->vm_file == NULL)
  		return 0;
  
@@ -42742,7 +43077,7 @@ index 07d096c..851a18b 100644
  		goto whole;
  
  	/*
-@@ -1354,9 +1837,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
+@@ -1354,9 +1841,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
  {
  	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
  	int i = 0;
@@ -42754,7 +43089,7 @@ index 07d096c..851a18b 100644
  	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
  }
  
-@@ -1862,14 +2345,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+@@ -1862,14 +2349,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
  }
  
  static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
@@ -42771,7 +43106,7 @@ index 07d096c..851a18b 100644
  	return size;
  }
  
-@@ -1963,7 +2446,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1963,7 +2450,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
  
@@ -42780,7 +43115,7 @@ index 07d096c..851a18b 100644
  	offset += elf_core_extra_data_size();
  	e_shoff = offset;
  
-@@ -1977,10 +2460,12 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1977,10 +2464,12 @@ static int elf_core_dump(struct coredump_params *cprm)
  	offset = dataoff;
  
  	size += sizeof(*elf);
@@ -42793,7 +43128,7 @@ index 07d096c..851a18b 100644
  	if (size > cprm->limit
  	    || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
  		goto end_coredump;
-@@ -1994,7 +2479,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1994,7 +2483,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_offset = offset;
  		phdr.p_vaddr = vma->vm_start;
  		phdr.p_paddr = 0;
@@ -42802,7 +43137,7 @@ index 07d096c..851a18b 100644
  		phdr.p_memsz = vma->vm_end - vma->vm_start;
  		offset += phdr.p_filesz;
  		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -2005,6 +2490,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2005,6 +2494,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_align = ELF_EXEC_PAGESIZE;
  
  		size += sizeof(phdr);
@@ -42810,7 +43145,7 @@ index 07d096c..851a18b 100644
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, &phdr, sizeof(phdr)))
  			goto end_coredump;
-@@ -2029,7 +2515,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2029,7 +2519,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		unsigned long addr;
  		unsigned long end;
  
@@ -42819,7 +43154,7 @@ index 07d096c..851a18b 100644
  
  		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
  			struct page *page;
-@@ -2038,6 +2524,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2038,6 +2528,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  			page = get_dump_page(addr);
  			if (page) {
  				void *kaddr = kmap(page);
@@ -42827,7 +43162,7 @@ index 07d096c..851a18b 100644
  				stop = ((size += PAGE_SIZE) > cprm->limit) ||
  					!dump_write(cprm->file, kaddr,
  						    PAGE_SIZE);
-@@ -2055,6 +2542,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2055,6 +2546,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	if (e_phnum == PN_XNUM) {
  		size += sizeof(*shdr4extnum);
@@ -42835,7 +43170,7 @@ index 07d096c..851a18b 100644
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, shdr4extnum,
  				   sizeof(*shdr4extnum)))
-@@ -2075,6 +2563,97 @@ out:
+@@ -2075,6 +2567,97 @@ out:
  
  #endif		/* CONFIG_ELF_CORE */
  
@@ -43948,7 +44283,7 @@ index b2a34a1..162fa69 100644
  	return rc;
  }
 diff --git a/fs/exec.c b/fs/exec.c
-index 153dee1..ab4ebe9 100644
+index ae42277..32c9035 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -55,6 +55,13 @@
@@ -44204,7 +44539,7 @@ index 153dee1..ab4ebe9 100644
  	set_fs(old_fs);
  	return result;
  }
-@@ -1252,7 +1284,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
+@@ -1255,7 +1287,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
  	}
  	rcu_read_unlock();
  
@@ -44213,7 +44548,7 @@ index 153dee1..ab4ebe9 100644
  		bprm->unsafe |= LSM_UNSAFE_SHARE;
  	} else {
  		res = -EAGAIN;
-@@ -1447,6 +1479,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+@@ -1450,6 +1482,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
  
  EXPORT_SYMBOL(search_binary_handler);
  
@@ -44242,7 +44577,7 @@ index 153dee1..ab4ebe9 100644
  /*
   * sys_execve() executes a new program.
   */
-@@ -1455,6 +1509,11 @@ static int do_execve_common(const char *filename,
+@@ -1458,6 +1512,11 @@ static int do_execve_common(const char *filename,
  				struct user_arg_ptr envp,
  				struct pt_regs *regs)
  {
@@ -44254,7 +44589,7 @@ index 153dee1..ab4ebe9 100644
  	struct linux_binprm *bprm;
  	struct file *file;
  	struct files_struct *displaced;
-@@ -1462,6 +1521,8 @@ static int do_execve_common(const char *filename,
+@@ -1465,6 +1524,8 @@ static int do_execve_common(const char *filename,
  	int retval;
  	const struct cred *cred = current_cred();
  
@@ -44263,7 +44598,7 @@ index 153dee1..ab4ebe9 100644
  	/*
  	 * We move the actual failure in case of RLIMIT_NPROC excess from
  	 * set*uid() to execve() because too many poorly written programs
-@@ -1502,12 +1563,27 @@ static int do_execve_common(const char *filename,
+@@ -1505,12 +1566,27 @@ static int do_execve_common(const char *filename,
  	if (IS_ERR(file))
  		goto out_unmark;
  
@@ -44291,7 +44626,7 @@ index 153dee1..ab4ebe9 100644
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1524,24 +1600,65 @@ static int do_execve_common(const char *filename,
+@@ -1527,24 +1603,65 @@ static int do_execve_common(const char *filename,
  	if (retval < 0)
  		goto out;
  
@@ -44361,7 +44696,7 @@ index 153dee1..ab4ebe9 100644
  	current->fs->in_exec = 0;
  	current->in_execve = 0;
  	acct_update_integrals(current);
-@@ -1550,6 +1667,14 @@ static int do_execve_common(const char *filename,
+@@ -1553,6 +1670,14 @@ static int do_execve_common(const char *filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -44376,7 +44711,7 @@ index 153dee1..ab4ebe9 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1623,7 +1748,7 @@ static int expand_corename(struct core_name *cn)
+@@ -1626,7 +1751,7 @@ static int expand_corename(struct core_name *cn)
  {
  	char *old_corename = cn->corename;
  
@@ -44385,7 +44720,7 @@ index 153dee1..ab4ebe9 100644
  	cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
  
  	if (!cn->corename) {
-@@ -1720,7 +1845,7 @@ static int format_corename(struct core_name *cn, long signr)
+@@ -1723,7 +1848,7 @@ static int format_corename(struct core_name *cn, long signr)
  	int pid_in_pattern = 0;
  	int err = 0;
  
@@ -44394,7 +44729,7 @@ index 153dee1..ab4ebe9 100644
  	cn->corename = kmalloc(cn->size, GFP_KERNEL);
  	cn->used = 0;
  
-@@ -1817,6 +1942,228 @@ out:
+@@ -1820,6 +1945,228 @@ out:
  	return ispipe;
  }
  
@@ -44623,7 +44958,7 @@ index 153dee1..ab4ebe9 100644
  static int zap_process(struct task_struct *start, int exit_code)
  {
  	struct task_struct *t;
-@@ -2014,17 +2361,17 @@ static void wait_for_dump_helpers(struct file *file)
+@@ -2017,17 +2364,17 @@ static void wait_for_dump_helpers(struct file *file)
  	pipe = file->f_path.dentry->d_inode->i_pipe;
  
  	pipe_lock(pipe);
@@ -44646,7 +44981,7 @@ index 153dee1..ab4ebe9 100644
  	pipe_unlock(pipe);
  
  }
-@@ -2085,7 +2432,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2088,7 +2435,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	int retval = 0;
  	int flag = 0;
  	int ispipe;
@@ -44655,7 +44990,7 @@ index 153dee1..ab4ebe9 100644
  	struct coredump_params cprm = {
  		.signr = signr,
  		.regs = regs,
-@@ -2100,6 +2447,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2103,6 +2450,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  
  	audit_core_dumps(signr);
  
@@ -44665,7 +45000,7 @@ index 153dee1..ab4ebe9 100644
  	binfmt = mm->binfmt;
  	if (!binfmt || !binfmt->core_dump)
  		goto fail;
-@@ -2167,7 +2517,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2170,7 +2520,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  		}
  		cprm.limit = RLIM_INFINITY;
  
@@ -44674,7 +45009,7 @@ index 153dee1..ab4ebe9 100644
  		if (core_pipe_limit && (core_pipe_limit < dump_count)) {
  			printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
  			       task_tgid_vnr(current), current->comm);
-@@ -2194,6 +2544,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2197,6 +2547,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	} else {
  		struct inode *inode;
  
@@ -44683,7 +45018,7 @@ index 153dee1..ab4ebe9 100644
  		if (cprm.limit < binfmt->min_coredump)
  			goto fail_unlock;
  
-@@ -2237,7 +2589,7 @@ close_fail:
+@@ -2240,7 +2592,7 @@ close_fail:
  		filp_close(cprm.file, NULL);
  fail_dropcount:
  	if (ispipe)
@@ -44692,7 +45027,7 @@ index 153dee1..ab4ebe9 100644
  fail_unlock:
  	kfree(cn.corename);
  fail_corename:
-@@ -2256,7 +2608,7 @@ fail:
+@@ -2259,7 +2611,7 @@ fail:
   */
  int dump_write(struct file *file, const void *addr, int nr)
  {
@@ -47587,10 +47922,10 @@ index 77becc0..aad7bd9 100644
  	if (user != (uid_t) -1) {
  		newattrs.ia_valid |= ATTR_UID;
 diff --git a/fs/pipe.c b/fs/pipe.c
-index a932ced..6495412 100644
+index 82e651b..8a68573 100644
 --- a/fs/pipe.c
 +++ b/fs/pipe.c
-@@ -420,9 +420,9 @@ redo:
+@@ -437,9 +437,9 @@ redo:
  		}
  		if (bufs)	/* More to do? */
  			continue;
@@ -47602,7 +47937,7 @@ index a932ced..6495412 100644
  			/* syscall merging: Usually we must not sleep
  			 * if O_NONBLOCK is set, or if we got some data.
  			 * But if a writer sleeps in kernel space, then
-@@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+@@ -503,7 +503,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
  	mutex_lock(&inode->i_mutex);
  	pipe = inode->i_pipe;
  
@@ -47611,7 +47946,7 @@ index a932ced..6495412 100644
  		send_sig(SIGPIPE, current, 0);
  		ret = -EPIPE;
  		goto out;
-@@ -530,7 +530,7 @@ redo1:
+@@ -552,7 +552,7 @@ redo1:
  	for (;;) {
  		int bufs;
  
@@ -47620,7 +47955,7 @@ index a932ced..6495412 100644
  			send_sig(SIGPIPE, current, 0);
  			if (!ret)
  				ret = -EPIPE;
-@@ -616,9 +616,9 @@ redo2:
+@@ -643,9 +643,9 @@ redo2:
  			kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
  			do_wakeup = 0;
  		}
@@ -47632,7 +47967,7 @@ index a932ced..6495412 100644
  	}
  out:
  	mutex_unlock(&inode->i_mutex);
-@@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table *wait)
+@@ -712,7 +712,7 @@ pipe_poll(struct file *filp, poll_table *wait)
  	mask = 0;
  	if (filp->f_mode & FMODE_READ) {
  		mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
@@ -47641,7 +47976,7 @@ index a932ced..6495412 100644
  			mask |= POLLHUP;
  	}
  
-@@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table *wait)
+@@ -722,7 +722,7 @@ pipe_poll(struct file *filp, poll_table *wait)
  		 * Most Unices do not set POLLERR for FIFOs but on Linux they
  		 * behave exactly like pipes for poll().
  		 */
@@ -47650,7 +47985,7 @@ index a932ced..6495412 100644
  			mask |= POLLERR;
  	}
  
-@@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int decr, int decw)
+@@ -736,10 +736,10 @@ pipe_release(struct inode *inode, int decr, int decw)
  
  	mutex_lock(&inode->i_mutex);
  	pipe = inode->i_pipe;
@@ -47664,7 +47999,7 @@ index a932ced..6495412 100644
  		free_pipe_info(inode);
  	} else {
  		wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
-@@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
+@@ -829,7 +829,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
  
  	if (inode->i_pipe) {
  		ret = 0;
@@ -47673,7 +48008,7 @@ index a932ced..6495412 100644
  	}
  
  	mutex_unlock(&inode->i_mutex);
-@@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
+@@ -846,7 +846,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
  
  	if (inode->i_pipe) {
  		ret = 0;
@@ -47682,7 +48017,7 @@ index a932ced..6495412 100644
  	}
  
  	mutex_unlock(&inode->i_mutex);
-@@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
+@@ -864,9 +864,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
  	if (inode->i_pipe) {
  		ret = 0;
  		if (filp->f_mode & FMODE_READ)
@@ -47694,7 +48029,7 @@ index a932ced..6495412 100644
  	}
  
  	mutex_unlock(&inode->i_mutex);
-@@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode)
+@@ -958,7 +958,7 @@ void free_pipe_info(struct inode *inode)
  	inode->i_pipe = NULL;
  }
  
@@ -47703,7 +48038,7 @@ index a932ced..6495412 100644
  
  /*
   * pipefs_dname() is called from d_path().
-@@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(void)
+@@ -988,7 +988,8 @@ static struct inode * get_pipe_inode(void)
  		goto fail_iput;
  	inode->i_pipe = pipe;
  
@@ -60629,10 +60964,10 @@ index e13117c..e9fc938 100644
  #define DMA_BIT_MASK(n)	(((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
  
 diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 37c3007..92ab679 100644
+index 7cce0ea..c2085e4 100644
 --- a/include/linux/efi.h
 +++ b/include/linux/efi.h
-@@ -580,7 +580,7 @@ struct efivar_operations {
+@@ -591,7 +591,7 @@ struct efivar_operations {
  	efi_get_variable_t *get_variable;
  	efi_get_next_variable_t *get_next_variable;
  	efi_set_variable_t *set_variable;
@@ -62318,7 +62653,7 @@ index 9970337..9444122 100644
  int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
  void abx500_remove_ops(struct device *dev);
 diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 17b27cd..467ba2f 100644
+index 17b27cd..baea141 100644
 --- a/include/linux/mm.h
 +++ b/include/linux/mm.h
 @@ -115,7 +115,14 @@ extern unsigned int kobjsize(const void *objp);
@@ -62387,7 +62722,63 @@ index 17b27cd..467ba2f 100644
  int vma_wants_writenotify(struct vm_area_struct *vma);
  
  extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
-@@ -1409,6 +1397,7 @@ out:
+@@ -1152,8 +1140,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
+ {
+ 	return 0;
+ }
++
++static inline int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd,
++						unsigned long address)
++{
++	return 0;
++}
+ #else
+ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
++int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
+ #endif
+ 
+ #ifdef __PAGETABLE_PMD_FOLDED
+@@ -1162,8 +1157,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud,
+ {
+ 	return 0;
+ }
++
++static inline int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud,
++						unsigned long address)
++{
++	return 0;
++}
+ #else
+ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address);
++int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address);
+ #endif
+ 
+ int __pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -1181,11 +1183,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a
+ 		NULL: pud_offset(pgd, address);
+ }
+ 
++static inline pud_t *pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
++{
++	return (unlikely(pgd_none(*pgd)) && __pud_alloc_kernel(mm, pgd, address))?
++		NULL: pud_offset(pgd, address);
++}
++
+ static inline pmd_t *pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+ {
+ 	return (unlikely(pud_none(*pud)) && __pmd_alloc(mm, pud, address))?
+ 		NULL: pmd_offset(pud, address);
+ }
++
++static inline pmd_t *pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address)
++{
++	return (unlikely(pud_none(*pud)) && __pmd_alloc_kernel(mm, pud, address))?
++		NULL: pmd_offset(pud, address);
++}
+ #endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */
+ 
+ #if USE_SPLIT_PTLOCKS
+@@ -1409,6 +1423,7 @@ out:
  }
  
  extern int do_munmap(struct mm_struct *, unsigned long, size_t);
@@ -62395,7 +62786,7 @@ index 17b27cd..467ba2f 100644
  
  extern unsigned long do_brk(unsigned long, unsigned long);
  
-@@ -1466,6 +1455,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
+@@ -1466,6 +1481,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
  extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
  					     struct vm_area_struct **pprev);
  
@@ -62406,7 +62797,7 @@ index 17b27cd..467ba2f 100644
  /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
     NULL if none.  Assume start_addr < end_addr. */
  static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -1494,15 +1487,6 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
+@@ -1494,15 +1513,6 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
  	return vma;
  }
  
@@ -62422,7 +62813,7 @@ index 17b27cd..467ba2f 100644
  struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
  int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
  			unsigned long pfn, unsigned long size, pgprot_t);
-@@ -1606,7 +1590,7 @@ extern int unpoison_memory(unsigned long pfn);
+@@ -1606,7 +1616,7 @@ extern int unpoison_memory(unsigned long pfn);
  extern int sysctl_memory_failure_early_kill;
  extern int sysctl_memory_failure_recovery;
  extern void shake_page(struct page *p, int access);
@@ -62431,7 +62822,7 @@ index 17b27cd..467ba2f 100644
  extern int soft_offline_page(struct page *page, int flags);
  
  extern void dump_page(struct page *page);
-@@ -1637,5 +1621,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; }
+@@ -1637,5 +1647,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; }
  static inline bool page_is_guard(struct page *page) { return false; }
  #endif /* CONFIG_DEBUG_PAGEALLOC */
  
@@ -62848,10 +63239,10 @@ index 8fc7dd1a..c19d89e 100644
  
  /*
 diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
-index 77257c9..51d473a 100644
+index 0072a53..c5dcca5 100644
 --- a/include/linux/pipe_fs_i.h
 +++ b/include/linux/pipe_fs_i.h
-@@ -46,9 +46,9 @@ struct pipe_buffer {
+@@ -47,9 +47,9 @@ struct pipe_buffer {
  struct pipe_inode_info {
  	wait_queue_head_t wait;
  	unsigned int nrbufs, curbuf, buffers;
@@ -66001,7 +66392,7 @@ index 1b5c081..c375f83 100644
  
  	/*
 diff --git a/kernel/exit.c b/kernel/exit.c
-index 4b4042f..5bdd8d5 100644
+index 46c8b14..d868958 100644
 --- a/kernel/exit.c
 +++ b/kernel/exit.c
 @@ -58,6 +58,10 @@
@@ -66053,7 +66444,7 @@ index 4b4042f..5bdd8d5 100644
  	/*
  	 * If we were started as result of loading a module, close all of the
  	 * user space pages.  We don't need them, and if we didn't close them
-@@ -892,6 +911,8 @@ void do_exit(long code)
+@@ -873,6 +892,8 @@ void do_exit(long code)
  	struct task_struct *tsk = current;
  	int group_dead;
  
@@ -66062,7 +66453,7 @@ index 4b4042f..5bdd8d5 100644
  	profile_task_exit(tsk);
  
  	WARN_ON(blk_needs_flush_plug(tsk));
-@@ -908,7 +929,6 @@ void do_exit(long code)
+@@ -889,7 +910,6 @@ void do_exit(long code)
  	 * mm_release()->clear_child_tid() from writing to a user-controlled
  	 * kernel address.
  	 */
@@ -66070,7 +66461,7 @@ index 4b4042f..5bdd8d5 100644
  
  	ptrace_event(PTRACE_EVENT_EXIT, code);
  
-@@ -969,6 +989,9 @@ void do_exit(long code)
+@@ -950,6 +970,9 @@ void do_exit(long code)
  	tsk->exit_code = code;
  	taskstats_exit(tsk, group_dead);
  
@@ -66080,7 +66471,7 @@ index 4b4042f..5bdd8d5 100644
  	exit_mm(tsk);
  
  	if (group_dead)
-@@ -1085,7 +1108,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
+@@ -1066,7 +1089,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
   * Take down every thread in the group.  This is called by fatal signals
   * as well as by sys_exit_group (below).
   */
@@ -68682,10 +69073,10 @@ index e8a1f83..363d17d 100644
  #ifdef CONFIG_RT_GROUP_SCHED
  	/*
 diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index b342f57..00324a0 100644
+index 478a04c..6970d99 100644
 --- a/kernel/sched/core.c
 +++ b/kernel/sched/core.c
-@@ -3143,6 +3143,19 @@ pick_next_task(struct rq *rq)
+@@ -3142,6 +3142,19 @@ pick_next_task(struct rq *rq)
  	BUG(); /* the idle class will always have a runnable task */
  }
  
@@ -68705,7 +69096,7 @@ index b342f57..00324a0 100644
  /*
   * __schedule() is the main scheduler function.
   */
-@@ -3162,6 +3175,8 @@ need_resched:
+@@ -3161,6 +3174,8 @@ need_resched:
  
  	schedule_debug(prev);
  
@@ -68714,7 +69105,7 @@ index b342f57..00324a0 100644
  	if (sched_feat(HRTICK))
  		hrtick_clear(rq);
  
-@@ -3852,6 +3867,8 @@ int can_nice(const struct task_struct *p, const int nice)
+@@ -3851,6 +3866,8 @@ int can_nice(const struct task_struct *p, const int nice)
  	/* convert nice value [19,-20] to rlimit style value [1,40] */
  	int nice_rlim = 20 - nice;
  
@@ -68723,7 +69114,7 @@ index b342f57..00324a0 100644
  	return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
  		capable(CAP_SYS_NICE));
  }
-@@ -3885,7 +3902,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+@@ -3884,7 +3901,8 @@ SYSCALL_DEFINE1(nice, int, increment)
  	if (nice > 19)
  		nice = 19;
  
@@ -68733,7 +69124,7 @@ index b342f57..00324a0 100644
  		return -EPERM;
  
  	retval = security_task_setnice(current, nice);
-@@ -4042,6 +4060,7 @@ recheck:
+@@ -4041,6 +4059,7 @@ recheck:
  			unsigned long rlim_rtprio =
  					task_rlimit(p, RLIMIT_RTPRIO);
  
@@ -68755,7 +69146,7 @@ index aca16b8..8e3acc4 100644
  	int this_cpu = smp_processor_id();
  	struct rq *this_rq = cpu_rq(this_cpu);
 diff --git a/kernel/signal.c b/kernel/signal.c
-index c73c428..7040057 100644
+index b09cf3b..b291c66 100644
 --- a/kernel/signal.c
 +++ b/kernel/signal.c
 @@ -46,12 +46,12 @@ static struct kmem_cache *sigqueue_cachep;
@@ -68864,7 +69255,7 @@ index c73c428..7040057 100644
  
  	return ret;
  }
-@@ -2820,7 +2843,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
+@@ -2829,7 +2852,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
  	int error = -ESRCH;
  
  	rcu_read_lock();
@@ -69852,7 +70243,7 @@ index fd3c8aa..5f324a6 100644
  	}
  	entry	= ring_buffer_event_data(event);
 diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
-index 0d6ff35..67e0ed7 100644
+index d9c07f0..c1eeceb 100644
 --- a/kernel/trace/trace_output.c
 +++ b/kernel/trace/trace_output.c
 @@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s, struct path *path)
@@ -70591,7 +70982,7 @@ index 56080ea..115071e 100644
  	/* keep elevated page count for bad page */
  	return ret;
 diff --git a/mm/memory.c b/mm/memory.c
-index 10b4dda..764ee07 100644
+index 10b4dda..b1f60ad 100644
 --- a/mm/memory.c
 +++ b/mm/memory.c
 @@ -457,8 +457,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -71148,7 +71539,62 @@ index 10b4dda..764ee07 100644
  		return VM_FAULT_OOM;
  	/* if an huge pmd materialized from under us just retry later */
  	if (unlikely(pmd_trans_huge(*pmd)))
-@@ -3618,7 +3856,7 @@ static int __init gate_vma_init(void)
+@@ -3551,6 +3789,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+ 	spin_unlock(&mm->page_table_lock);
+ 	return 0;
+ }
++
++int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
++{
++	pud_t *new = pud_alloc_one(mm, address);
++	if (!new)
++		return -ENOMEM;
++
++	smp_wmb(); /* See comment in __pte_alloc */
++
++	spin_lock(&mm->page_table_lock);
++	if (pgd_present(*pgd))		/* Another has populated it */
++		pud_free(mm, new);
++	else
++		pgd_populate_kernel(mm, pgd, new);
++	spin_unlock(&mm->page_table_lock);
++	return 0;
++}
+ #endif /* __PAGETABLE_PUD_FOLDED */
+ 
+ #ifndef __PAGETABLE_PMD_FOLDED
+@@ -3581,6 +3836,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+ 	spin_unlock(&mm->page_table_lock);
+ 	return 0;
+ }
++
++int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address)
++{
++	pmd_t *new = pmd_alloc_one(mm, address);
++	if (!new)
++		return -ENOMEM;
++
++	smp_wmb(); /* See comment in __pte_alloc */
++
++	spin_lock(&mm->page_table_lock);
++#ifndef __ARCH_HAS_4LEVEL_HACK
++	if (pud_present(*pud))		/* Another has populated it */
++		pmd_free(mm, new);
++	else
++		pud_populate_kernel(mm, pud, new);
++#else
++	if (pgd_present(*pud))		/* Another has populated it */
++		pmd_free(mm, new);
++	else
++		pgd_populate_kernel(mm, pud, new);
++#endif /* __ARCH_HAS_4LEVEL_HACK */
++	spin_unlock(&mm->page_table_lock);
++	return 0;
++}
+ #endif /* __PAGETABLE_PMD_FOLDED */
+ 
+ int make_pages_present(unsigned long addr, unsigned long end)
+@@ -3618,7 +3897,7 @@ static int __init gate_vma_init(void)
  	gate_vma.vm_start = FIXADDR_USER_START;
  	gate_vma.vm_end = FIXADDR_USER_END;
  	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -73987,6 +74433,28 @@ index 0342a5d..8180ae9 100644
  
  static int __init slab_sysfs_init(void)
  {
+diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
+index 1b7e22a..3fcd4f3 100644
+--- a/mm/sparse-vmemmap.c
++++ b/mm/sparse-vmemmap.c
+@@ -128,7 +128,7 @@ pud_t * __meminit vmemmap_pud_populate(pgd_t *pgd, unsigned long addr, int node)
+ 		void *p = vmemmap_alloc_block(PAGE_SIZE, node);
+ 		if (!p)
+ 			return NULL;
+-		pud_populate(&init_mm, pud, p);
++		pud_populate_kernel(&init_mm, pud, p);
+ 	}
+ 	return pud;
+ }
+@@ -140,7 +140,7 @@ pgd_t * __meminit vmemmap_pgd_populate(unsigned long addr, int node)
+ 		void *p = vmemmap_alloc_block(PAGE_SIZE, node);
+ 		if (!p)
+ 			return NULL;
+-		pgd_populate(&init_mm, pgd, p);
++		pgd_populate_kernel(&init_mm, pgd, p);
+ 	}
+ 	return pgd;
+ }
 diff --git a/mm/swap.c b/mm/swap.c
 index 14380e9..e244704 100644
 --- a/mm/swap.c
@@ -74077,7 +74545,7 @@ index 136ac4f..f917fa9 100644
  	mm->unmap_area = arch_unmap_area;
  }
 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index 86ce9a5..bc498f3 100644
+index 86ce9a5..e0bd080 100644
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
 @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
@@ -74146,6 +74614,24 @@ index 86ce9a5..bc498f3 100644
  }
  
  static int vmap_pmd_range(pud_t *pud, unsigned long addr,
+@@ -119,7 +144,7 @@ static int vmap_pmd_range(pud_t *pud, unsigned long addr,
+ 	pmd_t *pmd;
+ 	unsigned long next;
+ 
+-	pmd = pmd_alloc(&init_mm, pud, addr);
++	pmd = pmd_alloc_kernel(&init_mm, pud, addr);
+ 	if (!pmd)
+ 		return -ENOMEM;
+ 	do {
+@@ -136,7 +161,7 @@ static int vmap_pud_range(pgd_t *pgd, unsigned long addr,
+ 	pud_t *pud;
+ 	unsigned long next;
+ 
+-	pud = pud_alloc(&init_mm, pgd, addr);
++	pud = pud_alloc_kernel(&init_mm, pgd, addr);
+ 	if (!pud)
+ 		return -ENOMEM;
+ 	do {
 @@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void *x)
  	 * and fall back on vmalloc() if that fails. Others
  	 * just put it in the vmalloc space.
@@ -84456,10 +84942,10 @@ index 0000000..9ec45ae
 +};
 diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
 new file mode 100644
-index 0000000..255439f
+index 0000000..4ec0934
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin.c
-@@ -0,0 +1,1110 @@
+@@ -0,0 +1,1150 @@
 +/*
 + * Copyright 2011, 2012 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -84514,12 +85000,13 @@ index 0000000..255439f
 +
 +#define __unused __attribute__((__unused__))
 +#define NAME(node) IDENTIFIER_POINTER(DECL_NAME(node))
++#define NAME_LEN(node) IDENTIFIER_LENGTH(DECL_NAME(node))
 +#define BEFORE_STMT true
 +#define AFTER_STMT false
 +#define CREATE_NEW_VAR NULL_TREE
 +
 +int plugin_is_GPL_compatible;
-+void debug_gimple_stmt (gimple gs);
++void debug_gimple_stmt(gimple gs);
 +
 +static tree expand(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var);
 +static tree signed_size_overflow_type;
@@ -84527,9 +85014,10 @@ index 0000000..255439f
 +static tree report_size_overflow_decl;
 +static tree const_char_ptr_type_node;
 +static unsigned int handle_function(void);
++static bool file_match = true;
 +
 +static struct plugin_info size_overflow_plugin_info = {
-+	.version	= "20120409beta",
++	.version	= "20120502beta",
 +	.help		= "no-size_overflow\tturn off size overflow checking\n",
 +};
 +
@@ -84658,7 +85146,9 @@ index 0000000..255439f
 +		return;
 +
 +	hash = get_function_hash(func);
-+	if (hash->name && !strcmp(hash->name, NAME(func)) && !strcmp(hash->file, xloc.file))
++	if (hash->name && !strcmp(hash->name, NAME(func)))
++		return;
++	if (file_match && hash->file && !strcmp(hash->file, xloc.file))
 +		return;
 +
 +	gcc_assert(TREE_CODE(arg) != COMPONENT_REF);
@@ -84771,6 +85261,25 @@ index 0000000..255439f
 +
 +	stmt = build_cast_stmt(signed_size_overflow_type, rhs1, CREATE_NEW_VAR, gimple_location(oldstmt));
 +	gsi = gsi_for_stmt(oldstmt);
++	if (lookup_stmt_eh_lp(oldstmt) != 0) {
++		basic_block next_bb, cur_bb;
++		edge e;
++
++		gcc_assert(before == false);
++		gcc_assert(stmt_can_throw_internal(oldstmt));
++		gcc_assert(gimple_code(oldstmt) == GIMPLE_CALL);
++		gcc_assert(!gsi_end_p(gsi));
++
++		cur_bb = gimple_bb(oldstmt);
++		next_bb = cur_bb->next_bb;
++		e = find_edge(cur_bb, next_bb);
++		gcc_assert(e != NULL);
++		gcc_assert(e->flags & EDGE_FALLTHRU);
++
++		gsi = gsi_after_labels(next_bb);
++		gcc_assert(!gsi_end_p(gsi));
++		before = true;
++	}
 +	if (before)
 +		gsi_insert_before(&gsi, stmt, GSI_NEW_STMT);
 +	else
@@ -84901,7 +85410,7 @@ index 0000000..255439f
 +		newstmt = gimple_build_assign(new_var, new_rhs);
 +		break;
 +	case GIMPLE_ASSIGN:
-+		newstmt = gimple_copy(def_newstmt);
++		newstmt = gimple_build_assign(new_var, gimple_get_lhs(def_newstmt));
 +		break;
 +	default:
 +		/* unknown gimple_code (handle_build_new_phi_arg) */
@@ -84910,6 +85419,7 @@ index 0000000..255439f
 +
 +	gimple_set_lhs(newstmt, make_ssa_name(new_var, newstmt));
 +	gsi_insert(&gsi, newstmt, GSI_NEW_STMT);
++	update_stmt(newstmt);
 +	return newstmt;
 +}
 +
@@ -84924,7 +85434,6 @@ index 0000000..255439f
 +		return NULL_TREE;
 +
 +	newstmt = handle_new_phi_arg(arg, new_var, new_rhs);
-+	update_stmt(newstmt);
 +	return gimple_get_lhs(newstmt);
 +}
 +
@@ -84981,6 +85490,7 @@ index 0000000..255439f
 +		return handle_unary_rhs(visited, potentionally_overflowed, var);
 +
 +	case ARRAY_REF:
++	case BIT_FIELD_REF:
 +	case ADDR_EXPR:
 +	case COMPONENT_REF:
 +	case COND_EXPR:
@@ -85012,9 +85522,19 @@ index 0000000..255439f
 +
 +static tree create_string_param(tree string)
 +{
-+	tree array_ref = build4(ARRAY_REF, TREE_TYPE(string), string, integer_zero_node, NULL, NULL);
++	tree i_type, a_type;
++	int length = TREE_STRING_LENGTH(string);
 +
-+	return build1(ADDR_EXPR, ptr_type_node, array_ref);
++	gcc_assert(length > 0);
++
++	i_type = build_index_type(build_int_cst(NULL_TREE, length - 1));
++	a_type = build_array_type(char_type_node, i_type);
++
++	TREE_TYPE(string) = a_type;
++	TREE_CONSTANT(string) = 1;
++	TREE_READONLY(string) = 1;
++
++	return build1(ADDR_EXPR, ptr_type_node, string);
 +}
 +
 +static void insert_cond_result(basic_block bb_true, gimple stmt, tree arg)
@@ -85035,12 +85555,10 @@ index 0000000..255439f
 +
 +	loc_line = build_int_cstu(unsigned_type_node, xloc.line);
 +
-+	loc_file = build_string(strlen(xloc.file), xloc.file);
-+	TREE_TYPE(loc_file) = char_array_type_node;
++	loc_file = build_string(strlen(xloc.file) + 1, xloc.file);
 +	loc_file = create_string_param(loc_file);
 +
-+	current_func = build_string(IDENTIFIER_LENGTH(DECL_NAME(current_function_decl)), NAME(current_function_decl));
-+	TREE_TYPE(current_func) = char_array_type_node;
++	current_func = build_string(NAME_LEN(current_function_decl) + 1, NAME(current_function_decl));
 +	current_func = create_string_param(current_func);
 +
 +	// void report_size_overflow(const char *file, unsigned int line, const char *func)
@@ -85441,9 +85959,13 @@ index 0000000..255439f
 +	xloc = expand_location(DECL_SOURCE_LOCATION(fndecl));
 +
 +	fndecl = get_original_function_decl(fndecl);
-+	if (!hash->name || !hash->file)
++	if (!hash->name)
 +		return;
-+	if (strcmp(hash->name, NAME(fndecl)) || strcmp(hash->file, xloc.file))
++	if (file_match && !hash->file)
++		return;
++	if (strcmp(hash->name, NAME(fndecl)))
++		return;
++	if (file_match && strcmp(hash->file, xloc.file))
 +		return;
 +
 +#define search_param(argnum)							\
@@ -85526,6 +86048,7 @@ index 0000000..255439f
 +					  NULL_TREE);
 +	report_size_overflow_decl = build_fn_decl("report_size_overflow", fntype);
 +
++	DECL_ASSEMBLER_NAME(report_size_overflow_decl);
 +	TREE_PUBLIC(report_size_overflow_decl) = 1;
 +	DECL_EXTERNAL(report_size_overflow_decl) = 1;
 +	DECL_ARTIFICIAL(report_size_overflow_decl) = 1;
@@ -85554,9 +86077,12 @@ index 0000000..255439f
 +	}
 +
 +	for (i = 0; i < argc; ++i) {
-+		if (!(strcmp(argv[i].key, "no-size_overflow"))) {
++		if (!strcmp(argv[i].key, "no-size-overflow")) {
 +			enable = false;
 +			continue;
++		} else if (!(strcmp(argv[i].key, "no-file-match"))) {
++			file_match = false;
++			continue;
 +		}
 +		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
 +	}