Grsec/PaX: 2.9.1-{2.6.32.60,3.2.37,3.7.3}-20130118151820130118

38 files changed, 6036 insertions, 4871 deletions

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index c0dac22..bb6d062 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -34,7 +34,7 @@ Patch:	1059_linux-2.6.32.60.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.59
 
-Patch:	4420_grsecurity-2.9.1-2.6.32.60-201301032033.patch
+Patch:	4420_grsecurity-2.9.1-2.6.32.60-201301181517.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201301032033.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201301181517.patch
index 4ef624e..1eea97a 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201301032033.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201301181517.patch
@@ -77003,7 +77003,7 @@ index ff57421..f65f88a 100644
  
  out_free_fd:
 diff --git a/fs/exec.c b/fs/exec.c
-index 86fafc6..ddb5122 100644
+index 86fafc6..9154c823 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -56,12 +56,33 @@
@@ -77105,7 +77105,18 @@ index 86fafc6..ddb5122 100644
  	return 0;
  err:
  	up_write(&mm->mmap_sem);
-@@ -510,7 +545,7 @@ int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
+@@ -400,8 +435,9 @@ static int count(char __user * __user * argv, int max)
+ 			if (!p)
+ 				break;
+ 			argv++;
+-			if (i++ >= max)
++			if (i >= max)
+ 				return -E2BIG;
++			++i;
+ 
+ 			if (fatal_signal_pending(current))
+ 				return -ERESTARTNOHAND;
+@@ -510,7 +546,7 @@ int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
  	int r;
  	mm_segment_t oldfs = get_fs();
  	set_fs(KERNEL_DS);
@@ -77114,7 +77125,7 @@ index 86fafc6..ddb5122 100644
  	set_fs(oldfs);
  	return r;
  }
-@@ -540,7 +575,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -540,7 +576,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  	unsigned long new_end = old_end - shift;
  	struct mmu_gather *tlb;
  
@@ -77124,7 +77135,7 @@ index 86fafc6..ddb5122 100644
  
  	/*
  	 * ensure there are no vmas between where we want to go
-@@ -549,6 +585,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -549,6 +586,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  	if (vma != find_vma(mm, new_start))
  		return -EFAULT;
  
@@ -77135,7 +77146,7 @@ index 86fafc6..ddb5122 100644
  	/*
  	 * cover the whole range: [new_start, old_end)
  	 */
-@@ -630,10 +670,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -630,10 +671,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
  	stack_top = arch_align_stack(stack_top);
  	stack_top = PAGE_ALIGN(stack_top);
  
@@ -77146,7 +77157,7 @@ index 86fafc6..ddb5122 100644
  	stack_shift = vma->vm_end - stack_top;
  
  	bprm->p -= stack_shift;
-@@ -645,6 +681,14 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -645,6 +682,14 @@ int setup_arg_pages(struct linux_binprm *bprm,
  	bprm->exec -= stack_shift;
  
  	down_write(&mm->mmap_sem);
@@ -77161,7 +77172,7 @@ index 86fafc6..ddb5122 100644
  	vm_flags = VM_STACK_FLAGS;
  
  	/*
-@@ -658,19 +702,24 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -658,19 +703,24 @@ int setup_arg_pages(struct linux_binprm *bprm,
  		vm_flags &= ~VM_EXEC;
  	vm_flags |= mm->def_flags;
  
@@ -77193,7 +77204,7 @@ index 86fafc6..ddb5122 100644
  	stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
  	stack_size = vma->vm_end - vma->vm_start;
  	/*
-@@ -721,6 +770,8 @@ struct file *open_exec(const char *name)
+@@ -721,6 +771,8 @@ struct file *open_exec(const char *name)
  
  	fsnotify_open(file->f_path.dentry);
  
@@ -77202,7 +77213,7 @@ index 86fafc6..ddb5122 100644
  	err = deny_write_access(file);
  	if (err)
  		goto exit;
-@@ -744,7 +795,7 @@ int kernel_read(struct file *file, loff_t offset,
+@@ -744,7 +796,7 @@ int kernel_read(struct file *file, loff_t offset,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -77211,7 +77222,7 @@ index 86fafc6..ddb5122 100644
  	set_fs(old_fs);
  	return result;
  }
-@@ -985,6 +1036,21 @@ void set_task_comm(struct task_struct *tsk, char *buf)
+@@ -985,6 +1037,21 @@ void set_task_comm(struct task_struct *tsk, char *buf)
  	perf_event_comm(tsk);
  }
  
@@ -77233,7 +77244,7 @@ index 86fafc6..ddb5122 100644
  int flush_old_exec(struct linux_binprm * bprm)
  {
  	int retval;
-@@ -999,6 +1065,7 @@ int flush_old_exec(struct linux_binprm * bprm)
+@@ -999,6 +1066,7 @@ int flush_old_exec(struct linux_binprm * bprm)
  
  	set_mm_exe_file(bprm->mm, bprm->file);
  
@@ -77241,7 +77252,7 @@ index 86fafc6..ddb5122 100644
  	/*
  	 * Release all of the old mmap stuff
  	 */
-@@ -1023,10 +1090,6 @@ EXPORT_SYMBOL(flush_old_exec);
+@@ -1023,10 +1091,6 @@ EXPORT_SYMBOL(flush_old_exec);
  
  void setup_new_exec(struct linux_binprm * bprm)
  {
@@ -77252,7 +77263,7 @@ index 86fafc6..ddb5122 100644
  	arch_pick_mmap_layout(current->mm);
  
  	/* This is the point of no return */
-@@ -1037,18 +1100,7 @@ void setup_new_exec(struct linux_binprm * bprm)
+@@ -1037,18 +1101,7 @@ void setup_new_exec(struct linux_binprm * bprm)
  	else
  		set_dumpable(current->mm, suid_dumpable);
  
@@ -77272,7 +77283,7 @@ index 86fafc6..ddb5122 100644
  
  	/* Set the new mm task size. We have to do that late because it may
  	 * depend on TIF_32BIT which is only updated in flush_thread() on
-@@ -1090,14 +1142,14 @@ EXPORT_SYMBOL(setup_new_exec);
+@@ -1090,14 +1143,14 @@ EXPORT_SYMBOL(setup_new_exec);
   */
  int prepare_bprm_creds(struct linux_binprm *bprm)
  {
@@ -77289,7 +77300,7 @@ index 86fafc6..ddb5122 100644
  	return -ENOMEM;
  }
  
-@@ -1105,7 +1157,7 @@ void free_bprm(struct linux_binprm *bprm)
+@@ -1105,7 +1158,7 @@ void free_bprm(struct linux_binprm *bprm)
  {
  	free_arg_pages(bprm);
  	if (bprm->cred) {
@@ -77298,7 +77309,7 @@ index 86fafc6..ddb5122 100644
  		abort_creds(bprm->cred);
  	}
  	kfree(bprm);
-@@ -1126,13 +1178,13 @@ void install_exec_creds(struct linux_binprm *bprm)
+@@ -1126,13 +1179,13 @@ void install_exec_creds(struct linux_binprm *bprm)
  	 * credentials; any time after this it may be unlocked.
  	 */
  	security_bprm_committed_creds(bprm);
@@ -77314,7 +77325,7 @@ index 86fafc6..ddb5122 100644
   *   PTRACE_ATTACH
   */
  int check_unsafe_exec(struct linux_binprm *bprm)
-@@ -1152,7 +1204,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
+@@ -1152,7 +1205,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
  	}
  	rcu_read_unlock();
  
@@ -77323,7 +77334,7 @@ index 86fafc6..ddb5122 100644
  		bprm->unsafe |= LSM_UNSAFE_SHARE;
  	} else {
  		res = -EAGAIN;
-@@ -1339,6 +1391,21 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+@@ -1339,6 +1392,21 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
  
  EXPORT_SYMBOL(search_binary_handler);
  
@@ -77345,7 +77356,7 @@ index 86fafc6..ddb5122 100644
  /*
   * sys_execve() executes a new program.
   */
-@@ -1347,11 +1414,35 @@ int do_execve(char * filename,
+@@ -1347,11 +1415,35 @@ int do_execve(char * filename,
  	char __user *__user *envp,
  	struct pt_regs * regs)
  {
@@ -77381,7 +77392,7 @@ index 86fafc6..ddb5122 100644
  
  	retval = unshare_files(&displaced);
  	if (retval)
-@@ -1377,12 +1468,27 @@ int do_execve(char * filename,
+@@ -1377,12 +1469,27 @@ int do_execve(char * filename,
  	if (IS_ERR(file))
  		goto out_unmark;
  
@@ -77409,7 +77420,7 @@ index 86fafc6..ddb5122 100644
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1399,25 +1505,66 @@ int do_execve(char * filename,
+@@ -1399,25 +1506,66 @@ int do_execve(char * filename,
  	if (retval < 0)
  		goto out;
  
@@ -77480,7 +77491,7 @@ index 86fafc6..ddb5122 100644
  	current->fs->in_exec = 0;
  	current->in_execve = 0;
  	acct_update_integrals(current);
-@@ -1426,6 +1573,14 @@ int do_execve(char * filename,
+@@ -1426,6 +1574,14 @@ int do_execve(char * filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -77495,7 +77506,7 @@ index 86fafc6..ddb5122 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1591,6 +1746,251 @@ out:
+@@ -1591,6 +1747,251 @@ out:
  	return ispipe;
  }
  
@@ -77747,7 +77758,7 @@ index 86fafc6..ddb5122 100644
  static int zap_process(struct task_struct *start)
  {
  	struct task_struct *t;
-@@ -1793,17 +2193,17 @@ static void wait_for_dump_helpers(struct file *file)
+@@ -1793,17 +2194,17 @@ static void wait_for_dump_helpers(struct file *file)
  	pipe = file->f_path.dentry->d_inode->i_pipe;
  
  	pipe_lock(pipe);
@@ -77770,7 +77781,7 @@ index 86fafc6..ddb5122 100644
  	pipe_unlock(pipe);
  
  }
-@@ -1826,10 +2226,13 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -1826,10 +2227,13 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	char **helper_argv = NULL;
  	int helper_argc = 0;
  	int dump_count = 0;
@@ -77785,7 +77796,7 @@ index 86fafc6..ddb5122 100644
  	binfmt = mm->binfmt;
  	if (!binfmt || !binfmt->core_dump)
  		goto fail;
-@@ -1874,6 +2277,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -1874,6 +2278,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	 */
  	clear_thread_flag(TIF_SIGPENDING);
  
@@ -77794,7 +77805,7 @@ index 86fafc6..ddb5122 100644
  	/*
  	 * lock_kernel() because format_corename() is controlled by sysctl, which
  	 * uses lock_kernel()
-@@ -1908,7 +2313,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -1908,7 +2314,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  			goto fail_unlock;
  		}
  
@@ -77803,7 +77814,7 @@ index 86fafc6..ddb5122 100644
  		if (core_pipe_limit && (core_pipe_limit < dump_count)) {
  			printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
  			       task_tgid_vnr(current), current->comm);
-@@ -1972,7 +2377,7 @@ close_fail:
+@@ -1972,7 +2378,7 @@ close_fail:
  	filp_close(file, NULL);
  fail_dropcount:
  	if (dump_count)
@@ -78236,7 +78247,7 @@ index a24c58e..53f91ee 100644
  
  	if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
 diff --git a/fs/fs_struct.c b/fs/fs_struct.c
-index eee0590..34791ce 100644
+index eee0590..0a5b2ee 100644
 --- a/fs/fs_struct.c
 +++ b/fs/fs_struct.c
 @@ -4,6 +4,7 @@
@@ -78269,14 +78280,7 @@ index eee0590..34791ce 100644
  				count++;
  			}
  			if (fs->pwd.dentry == old_root->dentry
-@@ -84,12 +93,15 @@ void exit_fs(struct task_struct *tsk)
- {
- 	struct fs_struct *fs = tsk->fs;
- 
-+	gr_put_exec_file(tsk);
-+	
- 	if (fs) {
- 		int kill;
+@@ -89,7 +98,8 @@ void exit_fs(struct task_struct *tsk)
  		task_lock(tsk);
  		write_lock(&fs->lock);
  		tsk->fs = NULL;
@@ -78286,7 +78290,7 @@ index eee0590..34791ce 100644
  		write_unlock(&fs->lock);
  		task_unlock(tsk);
  		if (kill)
-@@ -102,7 +114,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
+@@ -102,7 +112,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
  	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
  	/* We don't need to lock fs - think why ;-) */
  	if (fs) {
@@ -78295,7 +78299,7 @@ index eee0590..34791ce 100644
  		fs->in_exec = 0;
  		rwlock_init(&fs->lock);
  		fs->umask = old->umask;
-@@ -127,8 +139,9 @@ int unshare_fs_struct(void)
+@@ -127,8 +137,9 @@ int unshare_fs_struct(void)
  
  	task_lock(current);
  	write_lock(&fs->lock);
@@ -78306,7 +78310,7 @@ index eee0590..34791ce 100644
  	write_unlock(&fs->lock);
  	task_unlock(current);
  
-@@ -141,13 +154,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
+@@ -141,13 +152,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
  
  int current_umask(void)
  {
@@ -78322,15 +78326,7 @@ index eee0590..34791ce 100644
  	.lock		= __RW_LOCK_UNLOCKED(init_fs.lock),
  	.umask		= 0022,
  };
-@@ -156,18 +169,21 @@ void daemonize_fs_struct(void)
- {
- 	struct fs_struct *fs = current->fs;
- 
-+	gr_put_exec_file(current);
-+
- 	if (fs) {
- 		int kill;
- 
+@@ -162,12 +173,13 @@ void daemonize_fs_struct(void)
  		task_lock(current);
  
  		write_lock(&init_fs.lock);
@@ -84038,10 +84034,10 @@ index e89734e..5e84d8d 100644
  			return 0;
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..7efd211
+index 0000000..7cf22bd
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,946 @@
+@@ -0,0 +1,964 @@
 +#
 +# grecurity configuration
 +#
@@ -84848,6 +84844,24 @@ index 0000000..7efd211
 +	  prevents a socket from lasting more than 45 seconds in LAST_ACK
 +	  state.
 +
++config GRKERNSEC_NO_SIMULT_CONNECT
++	bool "Disable TCP Simultaneous Connect"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on NET
++	help
++	  If you say Y here, a feature by Willy Tarreau will be enabled that
++	  removes a weakness in Linux's strict implementation of TCP that
++	  allows two clients to connect to each other without either entering
++	  a listening state.  The weakness allows an attacker to easily prevent
++	  a client from connecting to a known server provided the source port
++	  for the connection is guessed correctly.
++
++	  As the weakness could be used to prevent an antivirus or IPS from
++	  fetching updates, or prevent an SSL gateway from fetching a CRL,
++	  it should be eliminated by enabling this option.  Though Linux is
++	  one of few operating systems supporting simultaneous connect, it
++	  has no legitimate use in practice and is rarely supported by firewalls.
++	
 +config GRKERNSEC_SOCKET
 +	bool "Socket restrictions"
 +	depends on NET
@@ -89455,10 +89469,10 @@ index 0000000..955ddfb
 +
 diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
 new file mode 100644
-index 0000000..5804e36
+index 0000000..5a3ac97
 --- /dev/null
 +++ b/grsecurity/gracl_fs.c
-@@ -0,0 +1,437 @@
+@@ -0,0 +1,431 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/types.h>
@@ -89866,7 +89880,6 @@ index 0000000..5804e36
 +{
 +	u16 id;
 +	char *rolename;
-+	struct file *exec_file;
 +
 +	if (unlikely(current->acl_sp_role && gr_acl_is_enabled() && 
 +		     !(current->role->roletype & GR_ROLE_PERSIST))) {
@@ -89876,13 +89889,8 @@ index 0000000..5804e36
 +		gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
 +	}
 +
-+	write_lock(&grsec_exec_file_lock);
-+	exec_file = current->exec_file;
-+	current->exec_file = NULL;
-+	write_unlock(&grsec_exec_file_lock);
-+
-+	if (exec_file)
-+		fput(exec_file);
++	gr_put_exec_file(current);
++	return;
 +}
 +
 +int
@@ -102179,7 +102187,7 @@ index 9c06d10..5b211dc 100644
  	if (ret < 0)
  		return ret;
 diff --git a/kernel/exit.c b/kernel/exit.c
-index a2a1659..55ff5d7 100644
+index a2a1659..df8479c 100644
 --- a/kernel/exit.c
 +++ b/kernel/exit.c
 @@ -174,6 +174,10 @@ void release_task(struct task_struct * p)
@@ -102202,16 +102210,17 @@ index a2a1659..55ff5d7 100644
  	recalc_sigpending();
  	spin_unlock_irq(&current->sighand->siglock);
  	return 0;
-@@ -433,6 +437,8 @@ void daemonize(const char *name, ...)
+@@ -433,6 +437,9 @@ void daemonize(const char *name, ...)
  	vsnprintf(current->comm, sizeof(current->comm), name, args);
  	va_end(args);
  
++	gr_put_exec_file(current);
 +	gr_set_kernel_label(current);
 +
  	/*
  	 * If we were started as result of loading a module, close all of the
  	 * user space pages.  We don't need them, and if we didn't close them
-@@ -897,17 +903,17 @@ NORET_TYPE void do_exit(long code)
+@@ -897,17 +904,17 @@ NORET_TYPE void do_exit(long code)
  	struct task_struct *tsk = current;
  	int group_dead;
  
@@ -102236,7 +102245,7 @@ index a2a1659..55ff5d7 100644
  	 * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
  	 * continuing. Amongst other possible reasons, this is to prevent
  	 * mm_release()->clear_child_tid() from writing to a user-controlled
-@@ -915,6 +921,13 @@ NORET_TYPE void do_exit(long code)
+@@ -915,6 +922,13 @@ NORET_TYPE void do_exit(long code)
  	 */
  	set_fs(USER_DS);
  
@@ -102250,7 +102259,7 @@ index a2a1659..55ff5d7 100644
  	tracehook_report_exit(&code);
  
  	validate_creds_for_do_exit(tsk);
-@@ -973,6 +986,9 @@ NORET_TYPE void do_exit(long code)
+@@ -973,6 +987,9 @@ NORET_TYPE void do_exit(long code)
  	tsk->exit_code = code;
  	taskstats_exit(tsk, group_dead);
  
@@ -102260,7 +102269,7 @@ index a2a1659..55ff5d7 100644
  	exit_mm(tsk);
  
  	if (group_dead)
-@@ -1059,7 +1075,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
+@@ -1059,7 +1076,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
   * Take down every thread in the group.  This is called by fatal signals
   * as well as by sys_exit_group (below).
   */
@@ -102269,7 +102278,7 @@ index a2a1659..55ff5d7 100644
  do_group_exit(int exit_code)
  {
  	struct signal_struct *sig = current->signal;
-@@ -1188,7 +1204,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
+@@ -1188,7 +1205,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
  
  	if (unlikely(wo->wo_flags & WNOWAIT)) {
  		int exit_code = p->exit_code;
@@ -102279,7 +102288,7 @@ index a2a1659..55ff5d7 100644
  		get_task_struct(p);
  		read_unlock(&tasklist_lock);
 diff --git a/kernel/fork.c b/kernel/fork.c
-index c28f804..96ea6cb 100644
+index c28f804..3a04506 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -240,21 +240,26 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -102427,17 +102436,19 @@ index c28f804..96ea6cb 100644
  
  	retval = copy_creds(p, clone_flags);
  	if (retval < 0)
-@@ -1236,6 +1280,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- 	/* Need tasklist lock for parent etc handling! */
- 	write_lock_irq(&tasklist_lock);
+@@ -1263,6 +1307,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ 		goto bad_fork_free_pid;
+ 	}
  
-+	/* synchronizes with gr_set_acls() */
++	/* synchronizes with gr_set_acls()
++	   we need to call this past the point of no return for fork()
++	*/
 +	gr_copy_label(p);
 +
- 	/* CLONE_PARENT re-uses the old parent */
- 	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
- 		p->real_parent = current->real_parent;
-@@ -1337,6 +1384,8 @@ bad_fork_cleanup_count:
+ 	if (clone_flags & CLONE_THREAD) {
+ 		atomic_inc(&current->signal->count);
+ 		atomic_inc(&current->signal->live);
+@@ -1337,6 +1386,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -102446,7 +102457,7 @@ index c28f804..96ea6cb 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1430,6 +1479,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1430,6 +1481,8 @@ long do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -102455,7 +102466,7 @@ index c28f804..96ea6cb 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1562,7 +1613,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1562,7 +1615,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -102464,7 +102475,7 @@ index c28f804..96ea6cb 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -1685,7 +1736,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1685,7 +1738,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			write_lock(&fs->lock);
  			current->fs = new_fs;
@@ -113226,7 +113237,7 @@ index 1eba160b..c35d91f 100644
  	}
  }
 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index db755c4..fbca78e 100644
+index db755c4..07d671b 100644
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
 @@ -82,6 +82,9 @@ int sysctl_tcp_dsack __read_mostly = 1;
@@ -113300,7 +113311,18 @@ index db755c4..fbca78e 100644
  {
  	struct tcp_sock *tp = tcp_sk(sk);
  
-@@ -5100,7 +5127,16 @@ static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
+@@ -5093,38 +5120,48 @@ static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
+ 		 * an acknowledgment should be sent in reply (unless the RST
+ 		 * bit is set, if so drop the segment and return)".
+ 		 */
+-		if (!th->rst)
++		if (!th->rst) {
++			if (th->syn)
++				goto syn_challenge;
+ 			tcp_send_dupack(sk, skb);
++		}
+ 		goto discard;
+ 	}
  
  	/* Step 2: check RST bit */
  	if (th->rst) {
@@ -113318,8 +113340,11 @@ index db755c4..fbca78e 100644
  		goto discard;
  	}
  
-@@ -5111,20 +5147,22 @@ static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
- 
+-	/* ts_recent update must be made after we are sure that the packet
+-	 * is in window.
+-	 */
+-	tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
+-
  	/* step 3: check security and precedence [ignored] */
  
 -	/* step 4: Check for a SYN in window. */
@@ -113328,6 +113353,7 @@ index db755c4..fbca78e 100644
 +	 * RFC 5691 4.2 : Send a challenge ack
 +	 */
 +	if (th->syn) {
++syn_challenge:
  		if (syn_inerr)
  			TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
 -		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPABORTONSYN);
@@ -113348,7 +113374,7 @@ index db755c4..fbca78e 100644
  }
  
  /*
-@@ -5154,7 +5192,6 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
+@@ -5154,7 +5191,6 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
  			struct tcphdr *th, unsigned len)
  {
  	struct tcp_sock *tp = tcp_sk(sk);
@@ -113356,7 +113382,7 @@ index db755c4..fbca78e 100644
  
  	/*
  	 *	Header prediction.
-@@ -5330,16 +5367,18 @@ slow_path:
+@@ -5330,18 +5366,25 @@ slow_path:
  	if (len < (th->doff << 2) || tcp_checksum_complete_user(sk, skb))
  		goto csum_error;
  
@@ -113378,8 +113404,31 @@ index db755c4..fbca78e 100644
 +	if (tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
  		goto discard;
  
++	/* ts_recent update must be made after we are sure that the packet
++	 * is in window.
++	 */
++	tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
++
  	tcp_rcv_rtt_measure_ts(sk, skb);
-@@ -5618,7 +5657,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ 
+ 	/* Process urgent data. */
+@@ -5542,6 +5585,7 @@ discard:
+ 	    tcp_paws_reject(&tp->rx_opt, 0))
+ 		goto discard_and_undo;
+ 
++#ifndef CONFIG_GRKERNSEC_NO_SIMULT_CONNECT
+ 	if (th->syn) {
+ 		/* We see SYN without ACK. It is attempt of
+ 		 * simultaneous connect with crossed SYNs.
+@@ -5590,6 +5634,7 @@ discard:
+ 		goto discard;
+ #endif
+ 	}
++#endif
+ 	/* "fifth, if neither of the SYN or RST bits is set then
+ 	 * drop the segment and return."
+ 	 */
+@@ -5618,7 +5663,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  	struct tcp_sock *tp = tcp_sk(sk);
  	struct inet_connection_sock *icsk = inet_csk(sk);
  	int queued = 0;
@@ -113387,7 +113436,7 @@ index db755c4..fbca78e 100644
  
  	tp->rx_opt.saw_tstamp = 0;
  
-@@ -5634,7 +5672,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5634,7 +5678,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  			goto discard;
  
  		if (th->syn) {
@@ -113396,7 +113445,7 @@ index db755c4..fbca78e 100644
  				goto discard;
  			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
  				return 1;
-@@ -5673,12 +5711,14 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5673,12 +5717,14 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  		return 0;
  	}
  
@@ -113415,13 +113464,18 @@ index db755c4..fbca78e 100644
  		int acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH) > 0;
  
  		switch (sk->sk_state) {
-@@ -5789,8 +5829,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5789,8 +5835,12 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  			}
  			break;
  		}
 -	} else
 -		goto discard;
 +	}
++
++	/* ts_recent update must be made after we are sure that the packet
++	 * is in window.
++	 */
++	tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
  
  	/* step 6: check the URG bit */
  	tcp_urg(sk, skb, th);
diff --git a/2.6.32/4450_grsec-kconfig-default-gids.patch b/2.6.32/4450_grsec-kconfig-default-gids.patch
index 71d438f..7d4f60c 100644
--- a/2.6.32/4450_grsec-kconfig-default-gids.patch
+++ b/2.6.32/4450_grsec-kconfig-default-gids.patch
@@ -43,7 +43,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Setting this GID determines what group TPE restrictions will be
  	  *disabled* for.  If the sysctl option is enabled, a sysctl option
-@@ -825,7 +825,7 @@
+@@ -843,7 +843,7 @@
  config GRKERNSEC_SOCKET_ALL_GID
  	int "GID to deny all sockets for"
  	depends on GRKERNSEC_SOCKET_ALL
@@ -52,7 +52,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Here you can choose the GID to disable socket access for. Remember to
  	  add the users you want socket access disabled for to the GID
-@@ -846,7 +846,7 @@
+@@ -864,7 +864,7 @@
  config GRKERNSEC_SOCKET_CLIENT_GID
  	int "GID to deny client sockets for"
  	depends on GRKERNSEC_SOCKET_CLIENT
@@ -61,7 +61,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Here you can choose the GID to disable client socket access for.
  	  Remember to add the users you want client socket access disabled for to
-@@ -864,7 +864,7 @@
+@@ -882,7 +882,7 @@
  config GRKERNSEC_SOCKET_SERVER_GID
  	int "GID to deny server sockets for"
  	depends on GRKERNSEC_SOCKET_SERVER
diff --git a/2.6.32/4465_selinux-avc_audit-log-curr_ip.patch b/2.6.32/4465_selinux-avc_audit-log-curr_ip.patch
index 5af1cce..43ed69a 100644
--- a/2.6.32/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/2.6.32/4465_selinux-avc_audit-log-curr_ip.patch
@@ -28,7 +28,7 @@ Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
 diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
 --- a/grsecurity/Kconfig	2011-04-17 18:47:02.000000000 -0400
 +++ b/grsecurity/Kconfig	2011-04-17 18:51:15.000000000 -0400
-@@ -923,6 +923,27 @@
+@@ -941,6 +941,27 @@
  menu "Logging Options"
  depends on GRKERNSEC
  
diff --git a/3.2.36/0000_README b/3.2.37/0000_README
index 6266b76..e9758d7 100644
--- a/3.2.36/0000_README
+++ b/3.2.37/0000_README
@@ -62,7 +62,11 @@ Patch:	1035_linux-3.2.36.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.36
 
-Patch:	4420_grsecurity-2.9.1-3.2.36-201301032034.patch
+Patch:	1036_linux-3.2.37.patch 
+From:	http://www.kernel.org
+Desc:	Linux 3.2.37
+
+Patch:	4420_grsecurity-2.9.1-3.2.37-201301181518.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.36/1021_linux-3.2.22.patch b/3.2.37/1021_linux-3.2.22.patch
index e6ad93a..e6ad93a 100644
--- a/3.2.36/1021_linux-3.2.22.patch
+++ b/3.2.37/1021_linux-3.2.22.patch
diff --git a/3.2.36/1022_linux-3.2.23.patch b/3.2.37/1022_linux-3.2.23.patch
index 3d796d0..3d796d0 100644
--- a/3.2.36/1022_linux-3.2.23.patch
+++ b/3.2.37/1022_linux-3.2.23.patch
diff --git a/3.2.36/1023_linux-3.2.24.patch b/3.2.37/1023_linux-3.2.24.patch
index 4692eb4..4692eb4 100644
--- a/3.2.36/1023_linux-3.2.24.patch
+++ b/3.2.37/1023_linux-3.2.24.patch
diff --git a/3.2.36/1024_linux-3.2.25.patch b/3.2.37/1024_linux-3.2.25.patch
index e95c213..e95c213 100644
--- a/3.2.36/1024_linux-3.2.25.patch
+++ b/3.2.37/1024_linux-3.2.25.patch
diff --git a/3.2.36/1025_linux-3.2.26.patch b/3.2.37/1025_linux-3.2.26.patch
index 44065b9..44065b9 100644
--- a/3.2.36/1025_linux-3.2.26.patch
+++ b/3.2.37/1025_linux-3.2.26.patch
diff --git a/3.2.36/1026_linux-3.2.27.patch b/3.2.37/1026_linux-3.2.27.patch
index 5878eb4..5878eb4 100644
--- a/3.2.36/1026_linux-3.2.27.patch
+++ b/3.2.37/1026_linux-3.2.27.patch
diff --git a/3.2.36/1027_linux-3.2.28.patch b/3.2.37/1027_linux-3.2.28.patch
index 4dbba4b..4dbba4b 100644
--- a/3.2.36/1027_linux-3.2.28.patch
+++ b/3.2.37/1027_linux-3.2.28.patch
diff --git a/3.2.36/1028_linux-3.2.29.patch b/3.2.37/1028_linux-3.2.29.patch
index 3c65179..3c65179 100644
--- a/3.2.36/1028_linux-3.2.29.patch
+++ b/3.2.37/1028_linux-3.2.29.patch
diff --git a/3.2.36/1029_linux-3.2.30.patch b/3.2.37/1029_linux-3.2.30.patch
index 86aea4b..86aea4b 100644
--- a/3.2.36/1029_linux-3.2.30.patch
+++ b/3.2.37/1029_linux-3.2.30.patch
diff --git a/3.2.36/1030_linux-3.2.31.patch b/3.2.37/1030_linux-3.2.31.patch
index c6accf5..c6accf5 100644
--- a/3.2.36/1030_linux-3.2.31.patch
+++ b/3.2.37/1030_linux-3.2.31.patch
diff --git a/3.2.36/1031_linux-3.2.32.patch b/3.2.37/1031_linux-3.2.32.patch
index 247fc0b..247fc0b 100644
--- a/3.2.36/1031_linux-3.2.32.patch
+++ b/3.2.37/1031_linux-3.2.32.patch
diff --git a/3.2.36/1032_linux-3.2.33.patch b/3.2.37/1032_linux-3.2.33.patch
index c32fb75..c32fb75 100644
--- a/3.2.36/1032_linux-3.2.33.patch
+++ b/3.2.37/1032_linux-3.2.33.patch
diff --git a/3.2.36/1033_linux-3.2.34.patch b/3.2.37/1033_linux-3.2.34.patch
index d647b38..d647b38 100644
--- a/3.2.36/1033_linux-3.2.34.patch
+++ b/3.2.37/1033_linux-3.2.34.patch
diff --git a/3.2.36/1034_linux-3.2.35.patch b/3.2.37/1034_linux-3.2.35.patch
index 76a9c19..76a9c19 100644
--- a/3.2.36/1034_linux-3.2.35.patch
+++ b/3.2.37/1034_linux-3.2.35.patch
diff --git a/3.2.36/1035_linux-3.2.36.patch b/3.2.37/1035_linux-3.2.36.patch
index 5d192a3..5d192a3 100644
--- a/3.2.36/1035_linux-3.2.36.patch
+++ b/3.2.37/1035_linux-3.2.36.patch
diff --git a/3.2.37/1036_linux-3.2.37.patch b/3.2.37/1036_linux-3.2.37.patch
new file mode 100644
index 0000000..ad13251
--- /dev/null
+++ b/3.2.37/1036_linux-3.2.37.patch
@@ -0,0 +1,1689 @@
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index a4399f5..3b979c6 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -524,6 +524,11 @@ tcp_thin_dupack - BOOLEAN
+ 	Documentation/networking/tcp-thin.txt
+ 	Default: 0
+ 
++tcp_challenge_ack_limit - INTEGER
++	Limits number of Challenge ACK sent per second, as recommended
++	in RFC 5961 (Improving TCP's Robustness to Blind In-Window Attacks)
++	Default: 100
++
+ UDP variables:
+ 
+ udp_mem - vector of 3 INTEGERs: min, pressure, max
+diff --git a/Makefile b/Makefile
+index 2052c29..21c77e2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 36
++SUBLEVEL = 37
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index ec8affe..e74f86e 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -859,13 +859,8 @@ void update_vsyscall(struct timespec *wall_time, struct timespec *wtm,
+ 
+ void update_vsyscall_tz(void)
+ {
+-	/* Make userspace gettimeofday spin until we're done. */
+-	++vdso_data->tb_update_count;
+-	smp_mb();
+ 	vdso_data->tz_minuteswest = sys_tz.tz_minuteswest;
+ 	vdso_data->tz_dsttime = sys_tz.tz_dsttime;
+-	smp_mb();
+-	++vdso_data->tb_update_count;
+ }
+ 
+ static void __init clocksource_init(void)
+diff --git a/arch/powerpc/platforms/40x/ppc40x_simple.c b/arch/powerpc/platforms/40x/ppc40x_simple.c
+index e8dd5c5..d10c123 100644
+--- a/arch/powerpc/platforms/40x/ppc40x_simple.c
++++ b/arch/powerpc/platforms/40x/ppc40x_simple.c
+@@ -55,7 +55,8 @@ static const char *board[] __initdata = {
+ 	"amcc,haleakala",
+ 	"amcc,kilauea",
+ 	"amcc,makalu",
+-	"est,hotfoot"
++	"est,hotfoot",
++	NULL
+ };
+ 
+ static int __init ppc40x_probe(void)
+diff --git a/arch/sparc/include/asm/hugetlb.h b/arch/sparc/include/asm/hugetlb.h
+index 1770610..f368cef 100644
+--- a/arch/sparc/include/asm/hugetlb.h
++++ b/arch/sparc/include/asm/hugetlb.h
+@@ -58,14 +58,20 @@ static inline pte_t huge_pte_wrprotect(pte_t pte)
+ static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
+ 					   unsigned long addr, pte_t *ptep)
+ {
+-	ptep_set_wrprotect(mm, addr, ptep);
++	pte_t old_pte = *ptep;
++	set_huge_pte_at(mm, addr, ptep, pte_wrprotect(old_pte));
+ }
+ 
+ static inline int huge_ptep_set_access_flags(struct vm_area_struct *vma,
+ 					     unsigned long addr, pte_t *ptep,
+ 					     pte_t pte, int dirty)
+ {
+-	return ptep_set_access_flags(vma, addr, ptep, pte, dirty);
++	int changed = !pte_same(*ptep, pte);
++	if (changed) {
++		set_huge_pte_at(vma->vm_mm, addr, ptep, pte);
++		flush_tlb_page(vma, addr);
++	}
++	return changed;
+ }
+ 
+ static inline pte_t huge_ptep_get(pte_t *ptep)
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 8ab80ba..792b66f 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -789,8 +789,8 @@ acpi_bus_extract_wakeup_device_power_package(acpi_handle handle,
+ static void acpi_bus_set_run_wake_flags(struct acpi_device *device)
+ {
+ 	struct acpi_device_id button_device_ids[] = {
+-		{"PNP0C0D", 0},
+ 		{"PNP0C0C", 0},
++		{"PNP0C0D", 0},
+ 		{"PNP0C0E", 0},
+ 		{"", 0},
+ 	};
+@@ -802,6 +802,11 @@ static void acpi_bus_set_run_wake_flags(struct acpi_device *device)
+ 	/* Power button, Lid switch always enable wakeup */
+ 	if (!acpi_match_device_ids(device, button_device_ids)) {
+ 		device->wakeup.flags.run_wake = 1;
++		if (!acpi_match_device_ids(device, &button_device_ids[1])) {
++			/* Do not use Lid/sleep button for S5 wakeup */
++			if (device->wakeup.sleep_state == ACPI_STATE_S5)
++				device->wakeup.sleep_state = ACPI_STATE_S4;
++		}
+ 		device_set_wakeup_capable(&device->dev, true);
+ 		return;
+ 	}
+@@ -1152,7 +1157,7 @@ static void acpi_device_set_id(struct acpi_device *device)
+ 			acpi_add_id(device, ACPI_DOCK_HID);
+ 		else if (!acpi_ibm_smbus_match(device))
+ 			acpi_add_id(device, ACPI_SMBUS_IBM_HID);
+-		else if (!acpi_device_hid(device) &&
++		else if (list_empty(&device->pnp.ids) &&
+ 			 ACPI_IS_ROOT_DEVICE(device->parent)) {
+ 			acpi_add_id(device, ACPI_BUS_HID); /* \_SB, LNXSYBUS */
+ 			strcpy(device->pnp.device_name, ACPI_BUS_DEVICE_NAME);
+diff --git a/drivers/block/aoe/aoe.h b/drivers/block/aoe/aoe.h
+index db195ab..e49ddd0 100644
+--- a/drivers/block/aoe/aoe.h
++++ b/drivers/block/aoe/aoe.h
+@@ -1,5 +1,5 @@
+ /* Copyright (c) 2007 Coraid, Inc.  See COPYING for GPL terms. */
+-#define VERSION "47"
++#define VERSION "47q"
+ #define AOE_MAJOR 152
+ #define DEVICE_NAME "aoe"
+ 
+diff --git a/drivers/block/aoe/aoeblk.c b/drivers/block/aoe/aoeblk.c
+index 321de7b..7eca463 100644
+--- a/drivers/block/aoe/aoeblk.c
++++ b/drivers/block/aoe/aoeblk.c
+@@ -276,8 +276,6 @@ aoeblk_gdalloc(void *vp)
+ 		goto err_mempool;
+ 	blk_queue_make_request(d->blkq, aoeblk_make_request);
+ 	d->blkq->backing_dev_info.name = "aoe";
+-	if (bdi_init(&d->blkq->backing_dev_info))
+-		goto err_blkq;
+ 	spin_lock_irqsave(&d->lock, flags);
+ 	gd->major = AOE_MAJOR;
+ 	gd->first_minor = d->sysminor * AOE_PARTITIONS;
+@@ -298,9 +296,6 @@ aoeblk_gdalloc(void *vp)
+ 	aoedisk_add_sysfs(d);
+ 	return;
+ 
+-err_blkq:
+-	blk_cleanup_queue(d->blkq);
+-	d->blkq = NULL;
+ err_mempool:
+ 	mempool_destroy(d->bufpool);
+ err_disk:
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 791df46..012a9d2 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1305,6 +1305,7 @@ static inline void intel_unregister_dsm_handler(void) { return; }
+ #endif /* CONFIG_ACPI */
+ 
+ /* modesetting */
++extern void i915_redisable_vga(struct drm_device *dev);
+ extern void intel_modeset_init(struct drm_device *dev);
+ extern void intel_modeset_gem_init(struct drm_device *dev);
+ extern void intel_modeset_cleanup(struct drm_device *dev);
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 54acad3..fa9639b 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -8898,6 +8898,23 @@ static void i915_disable_vga(struct drm_device *dev)
+ 	POSTING_READ(vga_reg);
+ }
+ 
++void i915_redisable_vga(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++	u32 vga_reg;
++
++	if (HAS_PCH_SPLIT(dev))
++		vga_reg = CPU_VGACNTRL;
++	else
++		vga_reg = VGACNTRL;
++
++	if (I915_READ(vga_reg) != VGA_DISP_DISABLE) {
++		DRM_DEBUG_KMS("Something enabled VGA plane, disabling it\n");
++		I915_WRITE(vga_reg, VGA_DISP_DISABLE);
++		POSTING_READ(vga_reg);
++	}
++}
++
+ void intel_modeset_init(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index cf5ea3d..c6d0966 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -535,6 +535,7 @@ static int intel_lid_notify(struct notifier_block *nb, unsigned long val,
+ 
+ 	mutex_lock(&dev->mode_config.mutex);
+ 	drm_helper_resume_force_mode(dev);
++	i915_redisable_vga(dev);
+ 	mutex_unlock(&dev->mode_config.mutex);
+ 
+ 	return NOTIFY_OK;
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
+index d5af089..2bb29c9 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
+@@ -940,7 +940,7 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *mem)
+ 		if (dev_priv->gart_info.type == NOUVEAU_GART_AGP) {
+ 			mem->bus.offset = mem->start << PAGE_SHIFT;
+ 			mem->bus.base = dev_priv->gart_info.aper_base;
+-			mem->bus.is_iomem = true;
++			mem->bus.is_iomem = !dev->agp->cant_use_aperture;
+ 		}
+ #endif
+ 		break;
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index 81fc100..1b98338 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -1536,6 +1536,9 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
+ 			   of_machine_is_compatible("PowerBook6,7")) {
+ 			/* ibook */
+ 			rdev->mode_info.connector_table = CT_IBOOK;
++		} else if (of_machine_is_compatible("PowerMac3,5")) {
++			/* PowerMac G4 Silver radeon 7500 */
++			rdev->mode_info.connector_table = CT_MAC_G4_SILVER;
+ 		} else if (of_machine_is_compatible("PowerMac4,4")) {
+ 			/* emac */
+ 			rdev->mode_info.connector_table = CT_EMAC;
+@@ -1561,6 +1564,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
+ 			   (rdev->pdev->subsystem_device == 0x4150)) {
+ 			/* Mac G5 tower 9600 */
+ 			rdev->mode_info.connector_table = CT_MAC_G5_9600;
++		} else if ((rdev->pdev->device == 0x4c66) &&
++			   (rdev->pdev->subsystem_vendor == 0x1002) &&
++			   (rdev->pdev->subsystem_device == 0x4c66)) {
++			/* SAM440ep RV250 embedded board */
++			rdev->mode_info.connector_table = CT_SAM440EP;
+ 		} else
+ #endif /* CONFIG_PPC_PMAC */
+ #ifdef CONFIG_PPC64
+@@ -2134,6 +2142,115 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
+ 					    CONNECTOR_OBJECT_ID_SVIDEO,
+ 					    &hpd);
+ 		break;
++	case CT_SAM440EP:
++		DRM_INFO("Connector Table: %d (SAM440ep embedded board)\n",
++			 rdev->mode_info.connector_table);
++		/* LVDS */
++		ddc_i2c = combios_setup_i2c_bus(rdev, DDC_NONE_DETECTED, 0, 0);
++		hpd.hpd = RADEON_HPD_NONE;
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_LCD1_SUPPORT,
++								0),
++					  ATOM_DEVICE_LCD1_SUPPORT);
++		radeon_add_legacy_connector(dev, 0, ATOM_DEVICE_LCD1_SUPPORT,
++					    DRM_MODE_CONNECTOR_LVDS, &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_LVDS,
++					    &hpd);
++		/* DVI-I - secondary dac, int tmds */
++		ddc_i2c = combios_setup_i2c_bus(rdev, DDC_DVI, 0, 0);
++		hpd.hpd = RADEON_HPD_1; /* ??? */
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_DFP1_SUPPORT,
++								0),
++					  ATOM_DEVICE_DFP1_SUPPORT);
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_CRT2_SUPPORT,
++								2),
++					  ATOM_DEVICE_CRT2_SUPPORT);
++		radeon_add_legacy_connector(dev, 1,
++					    ATOM_DEVICE_DFP1_SUPPORT |
++					    ATOM_DEVICE_CRT2_SUPPORT,
++					    DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
++					    &hpd);
++		/* VGA - primary dac */
++		ddc_i2c = combios_setup_i2c_bus(rdev, DDC_VGA, 0, 0);
++		hpd.hpd = RADEON_HPD_NONE;
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_CRT1_SUPPORT,
++								1),
++					  ATOM_DEVICE_CRT1_SUPPORT);
++		radeon_add_legacy_connector(dev, 2,
++					    ATOM_DEVICE_CRT1_SUPPORT,
++					    DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_VGA,
++					    &hpd);
++		/* TV - TV DAC */
++		ddc_i2c.valid = false;
++		hpd.hpd = RADEON_HPD_NONE;
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_TV1_SUPPORT,
++								2),
++					  ATOM_DEVICE_TV1_SUPPORT);
++		radeon_add_legacy_connector(dev, 3, ATOM_DEVICE_TV1_SUPPORT,
++					    DRM_MODE_CONNECTOR_SVIDEO,
++					    &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_SVIDEO,
++					    &hpd);
++		break;
++	case CT_MAC_G4_SILVER:
++		DRM_INFO("Connector Table: %d (mac g4 silver)\n",
++			 rdev->mode_info.connector_table);
++		/* DVI-I - tv dac, int tmds */
++		ddc_i2c = combios_setup_i2c_bus(rdev, DDC_DVI, 0, 0);
++		hpd.hpd = RADEON_HPD_1; /* ??? */
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_DFP1_SUPPORT,
++								0),
++					  ATOM_DEVICE_DFP1_SUPPORT);
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_CRT2_SUPPORT,
++								2),
++					  ATOM_DEVICE_CRT2_SUPPORT);
++		radeon_add_legacy_connector(dev, 0,
++					    ATOM_DEVICE_DFP1_SUPPORT |
++					    ATOM_DEVICE_CRT2_SUPPORT,
++					    DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
++					    &hpd);
++		/* VGA - primary dac */
++		ddc_i2c = combios_setup_i2c_bus(rdev, DDC_VGA, 0, 0);
++		hpd.hpd = RADEON_HPD_NONE;
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_CRT1_SUPPORT,
++								1),
++					  ATOM_DEVICE_CRT1_SUPPORT);
++		radeon_add_legacy_connector(dev, 1, ATOM_DEVICE_CRT1_SUPPORT,
++					    DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_VGA,
++					    &hpd);
++		/* TV - TV DAC */
++		ddc_i2c.valid = false;
++		hpd.hpd = RADEON_HPD_NONE;
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								ATOM_DEVICE_TV1_SUPPORT,
++								2),
++					  ATOM_DEVICE_TV1_SUPPORT);
++		radeon_add_legacy_connector(dev, 2, ATOM_DEVICE_TV1_SUPPORT,
++					    DRM_MODE_CONNECTOR_SVIDEO,
++					    &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_SVIDEO,
++					    &hpd);
++		break;
+ 	default:
+ 		DRM_INFO("Connector table: %d (invalid)\n",
+ 			 rdev->mode_info.connector_table);
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index 87d494d..6fd53b6 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -689,7 +689,7 @@ radeon_vga_detect(struct drm_connector *connector, bool force)
+ 		ret = connector_status_disconnected;
+ 
+ 	if (radeon_connector->ddc_bus)
+-		dret = radeon_ddc_probe(radeon_connector);
++		dret = radeon_ddc_probe(radeon_connector, false);
+ 	if (dret) {
+ 		radeon_connector->detected_by_load = false;
+ 		if (radeon_connector->edid) {
+@@ -871,7 +871,7 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
+ 	bool dret = false;
+ 
+ 	if (radeon_connector->ddc_bus)
+-		dret = radeon_ddc_probe(radeon_connector);
++		dret = radeon_ddc_probe(radeon_connector, false);
+ 	if (dret) {
+ 		radeon_connector->detected_by_load = false;
+ 		if (radeon_connector->edid) {
+@@ -1299,7 +1299,8 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
+ 		if (encoder) {
+ 			/* setup ddc on the bridge */
+ 			radeon_atom_ext_encoder_setup_ddc(encoder);
+-			if (radeon_ddc_probe(radeon_connector)) /* try DDC */
++			/* bridge chips are always aux */
++			if (radeon_ddc_probe(radeon_connector, true)) /* try DDC */
+ 				ret = connector_status_connected;
+ 			else if (radeon_connector->dac_load_detect) { /* try load detection */
+ 				struct drm_encoder_helper_funcs *encoder_funcs = encoder->helper_private;
+@@ -1317,7 +1318,8 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
+ 				if (radeon_dp_getdpcd(radeon_connector))
+ 					ret = connector_status_connected;
+ 			} else {
+-				if (radeon_ddc_probe(radeon_connector))
++				/* try non-aux ddc (DP to DVI/HMDI/etc. adapter) */
++				if (radeon_ddc_probe(radeon_connector, false))
+ 					ret = connector_status_connected;
+ 			}
+ 		}
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index a22d6e6..aec8e0c 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -701,10 +701,15 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
+ 	if (radeon_connector->router.ddc_valid)
+ 		radeon_router_select_ddc_port(radeon_connector);
+ 
+-	if ((radeon_connector->base.connector_type == DRM_MODE_CONNECTOR_DisplayPort) ||
+-	    (radeon_connector->base.connector_type == DRM_MODE_CONNECTOR_eDP) ||
+-	    (radeon_connector_encoder_get_dp_bridge_encoder_id(&radeon_connector->base) !=
+-	     ENCODER_OBJECT_ID_NONE)) {
++	if (radeon_connector_encoder_get_dp_bridge_encoder_id(&radeon_connector->base) !=
++	    ENCODER_OBJECT_ID_NONE) {
++		struct radeon_connector_atom_dig *dig = radeon_connector->con_priv;
++
++		if (dig->dp_i2c_bus)
++			radeon_connector->edid = drm_get_edid(&radeon_connector->base,
++							      &dig->dp_i2c_bus->adapter);
++	} else if ((radeon_connector->base.connector_type == DRM_MODE_CONNECTOR_DisplayPort) ||
++		   (radeon_connector->base.connector_type == DRM_MODE_CONNECTOR_eDP)) {
+ 		struct radeon_connector_atom_dig *dig = radeon_connector->con_priv;
+ 
+ 		if ((dig->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT ||
+diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
+index 1441b00..cf20351 100644
+--- a/drivers/gpu/drm/radeon/radeon_i2c.c
++++ b/drivers/gpu/drm/radeon/radeon_i2c.c
+@@ -34,7 +34,7 @@
+  * radeon_ddc_probe
+  *
+  */
+-bool radeon_ddc_probe(struct radeon_connector *radeon_connector)
++bool radeon_ddc_probe(struct radeon_connector *radeon_connector, bool use_aux)
+ {
+ 	u8 out = 0x0;
+ 	u8 buf[8];
+@@ -58,7 +58,13 @@ bool radeon_ddc_probe(struct radeon_connector *radeon_connector)
+ 	if (radeon_connector->router.ddc_valid)
+ 		radeon_router_select_ddc_port(radeon_connector);
+ 
+-	ret = i2c_transfer(&radeon_connector->ddc_bus->adapter, msgs, 2);
++	if (use_aux) {
++		struct radeon_connector_atom_dig *dig = radeon_connector->con_priv;
++		ret = i2c_transfer(&dig->dp_i2c_bus->adapter, msgs, 2);
++	} else {
++		ret = i2c_transfer(&radeon_connector->ddc_bus->adapter, msgs, 2);
++	}
++
+ 	if (ret != 2)
+ 		/* Couldn't find an accessible DDC on this connector */
+ 		return false;
+diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
+index 8254d5a..bb42df4 100644
+--- a/drivers/gpu/drm/radeon/radeon_mode.h
++++ b/drivers/gpu/drm/radeon/radeon_mode.h
+@@ -210,6 +210,8 @@ enum radeon_connector_table {
+ 	CT_RN50_POWER,
+ 	CT_MAC_X800,
+ 	CT_MAC_G5_9600,
++	CT_SAM440EP,
++	CT_MAC_G4_SILVER
+ };
+ 
+ enum radeon_dvo_chip {
+@@ -521,7 +523,7 @@ extern void radeon_i2c_put_byte(struct radeon_i2c_chan *i2c,
+ 				u8 val);
+ extern void radeon_router_select_ddc_port(struct radeon_connector *radeon_connector);
+ extern void radeon_router_select_cd_port(struct radeon_connector *radeon_connector);
+-extern bool radeon_ddc_probe(struct radeon_connector *radeon_connector);
++extern bool radeon_ddc_probe(struct radeon_connector *radeon_connector, bool use_aux);
+ extern int radeon_ddc_get_modes(struct radeon_connector *radeon_connector);
+ 
+ extern struct drm_encoder *radeon_best_encoder(struct drm_connector *connector);
+diff --git a/drivers/hwmon/lm73.c b/drivers/hwmon/lm73.c
+index 9e64d96..376d9d9 100644
+--- a/drivers/hwmon/lm73.c
++++ b/drivers/hwmon/lm73.c
+@@ -49,6 +49,7 @@ static ssize_t set_temp(struct device *dev, struct device_attribute *da,
+ 	struct i2c_client *client = to_i2c_client(dev);
+ 	long temp;
+ 	short value;
++	s32 err;
+ 
+ 	int status = strict_strtol(buf, 10, &temp);
+ 	if (status < 0)
+@@ -57,8 +58,8 @@ static ssize_t set_temp(struct device *dev, struct device_attribute *da,
+ 	/* Write value */
+ 	value = (short) SENSORS_LIMIT(temp/250, (LM73_TEMP_MIN*4),
+ 		(LM73_TEMP_MAX*4)) << 5;
+-	i2c_smbus_write_word_swapped(client, attr->index, value);
+-	return count;
++	err = i2c_smbus_write_word_swapped(client, attr->index, value);
++	return (err < 0) ? err : count;
+ }
+ 
+ static ssize_t show_temp(struct device *dev, struct device_attribute *da,
+@@ -66,11 +67,16 @@ static ssize_t show_temp(struct device *dev, struct device_attribute *da,
+ {
+ 	struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
+ 	struct i2c_client *client = to_i2c_client(dev);
++	int temp;
++
++	s32 err = i2c_smbus_read_word_swapped(client, attr->index);
++	if (err < 0)
++		return err;
++
+ 	/* use integer division instead of equivalent right shift to
+ 	   guarantee arithmetic shift and preserve the sign */
+-	int temp = ((s16) (i2c_smbus_read_word_swapped(client,
+-		    attr->index))*250) / 32;
+-	return sprintf(buf, "%d\n", temp);
++	temp = (((s16) err) * 250) / 32;
++	return scnprintf(buf, PAGE_SIZE, "%d\n", temp);
+ }
+ 
+ 
+diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
+index 568b4f1..3ade373 100644
+--- a/drivers/infiniband/hw/nes/nes.h
++++ b/drivers/infiniband/hw/nes/nes.h
+@@ -524,6 +524,7 @@ void nes_iwarp_ce_handler(struct nes_device *, struct nes_hw_cq *);
+ int nes_destroy_cqp(struct nes_device *);
+ int nes_nic_cm_xmit(struct sk_buff *, struct net_device *);
+ void nes_recheck_link_status(struct work_struct *work);
++void nes_terminate_timeout(unsigned long context);
+ 
+ /* nes_nic.c */
+ struct net_device *nes_netdev_init(struct nes_device *, void __iomem *);
+diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
+index 7c0ff19..4cd1bf7 100644
+--- a/drivers/infiniband/hw/nes/nes_hw.c
++++ b/drivers/infiniband/hw/nes/nes_hw.c
+@@ -75,7 +75,6 @@ static void nes_process_iwarp_aeqe(struct nes_device *nesdev,
+ static void process_critical_error(struct nes_device *nesdev);
+ static void nes_process_mac_intr(struct nes_device *nesdev, u32 mac_number);
+ static unsigned int nes_reset_adapter_ne020(struct nes_device *nesdev, u8 *OneG_Mode);
+-static void nes_terminate_timeout(unsigned long context);
+ static void nes_terminate_start_timer(struct nes_qp *nesqp);
+ 
+ #ifdef CONFIG_INFINIBAND_NES_DEBUG
+@@ -3522,7 +3521,7 @@ static void nes_terminate_received(struct nes_device *nesdev,
+ }
+ 
+ /* Timeout routine in case terminate fails to complete */
+-static void nes_terminate_timeout(unsigned long context)
++void nes_terminate_timeout(unsigned long context)
+ {
+ 	struct nes_qp *nesqp = (struct nes_qp *)(unsigned long)context;
+ 
+@@ -3532,11 +3531,7 @@ static void nes_terminate_timeout(unsigned long context)
+ /* Set a timer in case hw cannot complete the terminate sequence */
+ static void nes_terminate_start_timer(struct nes_qp *nesqp)
+ {
+-	init_timer(&nesqp->terminate_timer);
+-	nesqp->terminate_timer.function = nes_terminate_timeout;
+-	nesqp->terminate_timer.expires = jiffies + HZ;
+-	nesqp->terminate_timer.data = (unsigned long)nesqp;
+-	add_timer(&nesqp->terminate_timer);
++	mod_timer(&nesqp->terminate_timer, (jiffies + HZ));
+ }
+ 
+ /**
+diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
+index 5095bc4..b0471b4 100644
+--- a/drivers/infiniband/hw/nes/nes_verbs.c
++++ b/drivers/infiniband/hw/nes/nes_verbs.c
+@@ -1404,6 +1404,9 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
+ 	}
+ 
+ 	nesqp->sig_all = (init_attr->sq_sig_type == IB_SIGNAL_ALL_WR);
++	init_timer(&nesqp->terminate_timer);
++	nesqp->terminate_timer.function = nes_terminate_timeout;
++	nesqp->terminate_timer.data = (unsigned long)nesqp;
+ 
+ 	/* update the QP table */
+ 	nesdev->nesadapter->qp_table[nesqp->hwqp.qp_id-NES_FIRST_QPN] = nesqp;
+@@ -1413,7 +1416,6 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
+ 	return &nesqp->ibqp;
+ }
+ 
+-
+ /**
+  * nes_clean_cq
+  */
+@@ -2559,6 +2561,11 @@ static struct ib_mr *nes_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+ 			return ibmr;
+ 		case IWNES_MEMREG_TYPE_QP:
+ 		case IWNES_MEMREG_TYPE_CQ:
++			if (!region->length) {
++				nes_debug(NES_DBG_MR, "Unable to register zero length region for CQ\n");
++				ib_umem_release(region);
++				return ERR_PTR(-EINVAL);
++			}
+ 			nespbl = kzalloc(sizeof(*nespbl), GFP_KERNEL);
+ 			if (!nespbl) {
+ 				nes_debug(NES_DBG_MR, "Unable to allocate PBL\n");
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+index e9d73e7..979d225 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+@@ -701,8 +701,8 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
+ 				2);
+ 	else if (AR_SREV_9485_11(ah))
+ 		INIT_INI_ARRAY(&ah->iniModesRxGain,
+-				ar9485Common_wo_xlna_rx_gain_1_1,
+-				ARRAY_SIZE(ar9485Common_wo_xlna_rx_gain_1_1),
++			       ar9485_common_rx_gain_1_1,
++			       ARRAY_SIZE(ar9485_common_rx_gain_1_1),
+ 				2);
+ 	else if (AR_SREV_9580(ah))
+ 		INIT_INI_ARRAY(&ah->iniModesRxGain,
+diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
+index 8a009bc..7ca84c3 100644
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -47,6 +47,7 @@ static struct usb_device_id p54u_table[] = {
+ 	{USB_DEVICE(0x0411, 0x0050)},	/* Buffalo WLI2-USB2-G54 */
+ 	{USB_DEVICE(0x045e, 0x00c2)},	/* Microsoft MN-710 */
+ 	{USB_DEVICE(0x0506, 0x0a11)},	/* 3COM 3CRWE254G72 */
++	{USB_DEVICE(0x0675, 0x0530)},	/* DrayTek Vigor 530 */
+ 	{USB_DEVICE(0x06b9, 0x0120)},	/* Thomson SpeedTouch 120g */
+ 	{USB_DEVICE(0x0707, 0xee06)},	/* SMC 2862W-G */
+ 	{USB_DEVICE(0x07aa, 0x001c)},	/* Corega CG-WLUSB2GT */
+@@ -82,6 +83,8 @@ static struct usb_device_id p54u_table[] = {
+ 	{USB_DEVICE(0x06a9, 0x000e)},	/* Westell 802.11g USB (A90-211WG-01) */
+ 	{USB_DEVICE(0x06b9, 0x0121)},	/* Thomson SpeedTouch 121g */
+ 	{USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
++	{USB_DEVICE(0x0803, 0x4310)},	/* Zoom 4410a */
++	{USB_DEVICE(0x083a, 0x4503)},	/* T-Com Sinus 154 data II */
+ 	{USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
+ 	{USB_DEVICE(0x083a, 0xc501)},	/* Zoom Wireless-G 4410 */
+ 	{USB_DEVICE(0x083a, 0xf503)},	/* Accton FD7050E ver 1010ec  */
+@@ -101,6 +104,7 @@ static struct usb_device_id p54u_table[] = {
+ 	{USB_DEVICE(0x13B1, 0x000C)},	/* Linksys WUSB54AG */
+ 	{USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
+ 	{USB_DEVICE(0x1435, 0x0427)},	/* Inventel UR054G */
++	/* {USB_DEVICE(0x15a9, 0x0002)}, * Also SparkLAN WL-682 with 3887 */
+ 	{USB_DEVICE(0x1668, 0x1050)},	/* Actiontec 802UIG-1 */
+ 	{USB_DEVICE(0x1740, 0x1000)},	/* Senao NUB-350 */
+ 	{USB_DEVICE(0x2001, 0x3704)},	/* DLink DWL-G122 rev A2 */
+diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
+index fb19447..67cbe5a 100644
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -4208,7 +4208,8 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ 	    IEEE80211_HW_SIGNAL_DBM |
+ 	    IEEE80211_HW_SUPPORTS_PS |
+ 	    IEEE80211_HW_PS_NULLFUNC_STACK |
+-	    IEEE80211_HW_AMPDU_AGGREGATION;
++	    IEEE80211_HW_AMPDU_AGGREGATION |
++	    IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL;
+ 	/*
+ 	 * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING for USB devices
+ 	 * unless we are capable of sending the buffered frames out after the
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 78fda9c..cab24f7 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2747,7 +2747,7 @@ static void ricoh_mmc_fixup_r5c832(struct pci_dev *dev)
+ 	if (PCI_FUNC(dev->devfn))
+ 		return;
+ 	/*
+-	 * RICOH 0xe823 SD/MMC card reader fails to recognize
++	 * RICOH 0xe822 and 0xe823 SD/MMC card readers fail to recognize
+ 	 * certain types of SD/MMC cards. Lowering the SD base
+ 	 * clock frequency from 200Mhz to 50Mhz fixes this issue.
+ 	 *
+@@ -2758,7 +2758,8 @@ static void ricoh_mmc_fixup_r5c832(struct pci_dev *dev)
+ 	 * 0xf9  - Key register for 0x150
+ 	 * 0xfc  - key register for 0xe1
+ 	 */
+-	if (dev->device == PCI_DEVICE_ID_RICOH_R5CE823) {
++	if (dev->device == PCI_DEVICE_ID_RICOH_R5CE822 ||
++	    dev->device == PCI_DEVICE_ID_RICOH_R5CE823) {
+ 		pci_write_config_byte(dev, 0xf9, 0xfc);
+ 		pci_write_config_byte(dev, 0x150, 0x10);
+ 		pci_write_config_byte(dev, 0xf9, 0x00);
+@@ -2785,6 +2786,8 @@ static void ricoh_mmc_fixup_r5c832(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE822, ricoh_mmc_fixup_r5c832);
++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE822, ricoh_mmc_fixup_r5c832);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832);
+ #endif /*CONFIG_MMC_RICOH_MMC*/
+diff --git a/drivers/rtc/rtc-vt8500.c b/drivers/rtc/rtc-vt8500.c
+index f93f412..f818dae 100644
+--- a/drivers/rtc/rtc-vt8500.c
++++ b/drivers/rtc/rtc-vt8500.c
+@@ -69,7 +69,7 @@
+ 				| ALARM_SEC_BIT)
+ 
+ #define VT8500_RTC_CR_ENABLE	(1 << 0)	/* Enable RTC */
+-#define VT8500_RTC_CR_24H	(1 << 1)	/* 24h time format */
++#define VT8500_RTC_CR_12H	(1 << 1)	/* 12h time format */
+ #define VT8500_RTC_CR_SM_ENABLE	(1 << 2)	/* Enable periodic irqs */
+ #define VT8500_RTC_CR_SM_SEC	(1 << 3)	/* 0: 1Hz/60, 1: 1Hz */
+ #define VT8500_RTC_CR_CALIB	(1 << 4)	/* Enable calibration */
+@@ -118,7 +118,7 @@ static int vt8500_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ 	tm->tm_min = bcd2bin((time & TIME_MIN_MASK) >> TIME_MIN_S);
+ 	tm->tm_hour = bcd2bin((time & TIME_HOUR_MASK) >> TIME_HOUR_S);
+ 	tm->tm_mday = bcd2bin(date & DATE_DAY_MASK);
+-	tm->tm_mon = bcd2bin((date & DATE_MONTH_MASK) >> DATE_MONTH_S);
++	tm->tm_mon = bcd2bin((date & DATE_MONTH_MASK) >> DATE_MONTH_S) - 1;
+ 	tm->tm_year = bcd2bin((date & DATE_YEAR_MASK) >> DATE_YEAR_S)
+ 			+ ((date >> DATE_CENTURY_S) & 1 ? 200 : 100);
+ 	tm->tm_wday = (time & TIME_DOW_MASK) >> TIME_DOW_S;
+@@ -137,8 +137,9 @@ static int vt8500_rtc_set_time(struct device *dev, struct rtc_time *tm)
+ 	}
+ 
+ 	writel((bin2bcd(tm->tm_year - 100) << DATE_YEAR_S)
+-		| (bin2bcd(tm->tm_mon) << DATE_MONTH_S)
+-		| (bin2bcd(tm->tm_mday)),
++		| (bin2bcd(tm->tm_mon + 1) << DATE_MONTH_S)
++		| (bin2bcd(tm->tm_mday))
++		| ((tm->tm_year >= 200) << DATE_CENTURY_S),
+ 		vt8500_rtc->regbase + VT8500_RTC_DS);
+ 	writel((bin2bcd(tm->tm_wday) << TIME_DOW_S)
+ 		| (bin2bcd(tm->tm_hour) << TIME_HOUR_S)
+@@ -248,7 +249,7 @@ static int __devinit vt8500_rtc_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	/* Enable RTC and set it to 24-hour mode */
+-	writel(VT8500_RTC_CR_ENABLE | VT8500_RTC_CR_24H,
++	writel(VT8500_RTC_CR_ENABLE,
+ 	       vt8500_rtc->regbase + VT8500_RTC_CR);
+ 
+ 	vt8500_rtc->rtc = rtc_device_register("vt8500-rtc", &pdev->dev,
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index a4884a5..c6ad694 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -1635,7 +1635,7 @@ int mvs_abort_task(struct sas_task *task)
+ 			mv_dprintk("mvs_abort_task() mvi=%p task=%p "
+ 				   "slot=%p slot_idx=x%x\n",
+ 				   mvi, task, slot, slot_idx);
+-			mvs_tmf_timedout((unsigned long)task);
++			task->task_state_flags |= SAS_TASK_STATE_ABORTED;
+ 			mvs_slot_task_free(mvi, task, slot, slot_idx);
+ 			rc = TMF_RESP_FUNC_COMPLETE;
+ 			goto out;
+diff --git a/drivers/video/mxsfb.c b/drivers/video/mxsfb.c
+index d837d63..03cb95a 100644
+--- a/drivers/video/mxsfb.c
++++ b/drivers/video/mxsfb.c
+@@ -366,7 +366,8 @@ static void mxsfb_disable_controller(struct fb_info *fb_info)
+ 		loop--;
+ 	}
+ 
+-	writel(VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4 + REG_CLR);
++	reg = readl(host->base + LCDC_VDCTRL4);
++	writel(reg & ~VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4);
+ 
+ 	clk_disable(host->clk);
+ 
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 99a27cf..4e5dfb7 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -485,6 +485,13 @@ send_nt_cancel(struct TCP_Server_Info *server, struct smb_hdr *in_buf,
+ 		mutex_unlock(&server->srv_mutex);
+ 		return rc;
+ 	}
++
++	/*
++	 * The response to this call was already factored into the sequence
++	 * number when the call went out, so we must adjust it back downward
++	 * after signing here.
++	 */
++	--server->sequence_number;
+ 	rc = smb_send(server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
+ 	mutex_unlock(&server->srv_mutex);
+ 
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index a6f3763..451b9b8 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1197,10 +1197,30 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, struct epoll_even
+ 	 * otherwise we might miss an event that happens between the
+ 	 * f_op->poll() call and the new event set registering.
+ 	 */
+-	epi->event.events = event->events;
++	epi->event.events = event->events; /* need barrier below */
+ 	epi->event.data = event->data; /* protected by mtx */
+ 
+ 	/*
++	 * The following barrier has two effects:
++	 *
++	 * 1) Flush epi changes above to other CPUs.  This ensures
++	 *    we do not miss events from ep_poll_callback if an
++	 *    event occurs immediately after we call f_op->poll().
++	 *    We need this because we did not take ep->lock while
++	 *    changing epi above (but ep_poll_callback does take
++	 *    ep->lock).
++	 *
++	 * 2) We also need to ensure we do not miss _past_ events
++	 *    when calling f_op->poll().  This barrier also
++	 *    pairs with the barrier in wq_has_sleeper (see
++	 *    comments for wq_has_sleeper).
++	 *
++	 * This barrier will now guarantee ep_poll_callback or f_op->poll
++	 * (or both) will notice the readiness of an item.
++	 */
++	smp_mb();
++
++	/*
+ 	 * Get current event bits. We can safely use the file* here because
+ 	 * its usage count has been increased by the caller of this function.
+ 	 */
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 191580a..fbb92e6 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -2093,13 +2093,14 @@ ext4_ext_in_cache(struct inode *inode, ext4_lblk_t block,
+  * removes index from the index block.
+  */
+ static int ext4_ext_rm_idx(handle_t *handle, struct inode *inode,
+-			struct ext4_ext_path *path)
++			struct ext4_ext_path *path, int depth)
+ {
+ 	int err;
+ 	ext4_fsblk_t leaf;
+ 
+ 	/* free index block */
+-	path--;
++	depth--;
++	path = path + depth;
+ 	leaf = ext4_idx_pblock(path->p_idx);
+ 	if (unlikely(path->p_hdr->eh_entries == 0)) {
+ 		EXT4_ERROR_INODE(inode, "path->p_hdr->eh_entries == 0");
+@@ -2124,6 +2125,19 @@ static int ext4_ext_rm_idx(handle_t *handle, struct inode *inode,
+ 
+ 	ext4_free_blocks(handle, inode, NULL, leaf, 1,
+ 			 EXT4_FREE_BLOCKS_METADATA | EXT4_FREE_BLOCKS_FORGET);
++
++	while (--depth >= 0) {
++		if (path->p_idx != EXT_FIRST_INDEX(path->p_hdr))
++			break;
++		path--;
++		err = ext4_ext_get_access(handle, inode, path);
++		if (err)
++			break;
++		path->p_idx->ei_block = (path+1)->p_idx->ei_block;
++		err = ext4_ext_dirty(handle, inode, path);
++		if (err)
++			break;
++	}
+ 	return err;
+ }
+ 
+@@ -2454,7 +2468,7 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
+ 	/* if this leaf is free, then we should
+ 	 * remove it from index block above */
+ 	if (err == 0 && eh->eh_entries == 0 && path[depth].p_bh != NULL)
+-		err = ext4_ext_rm_idx(handle, inode, path + depth);
++		err = ext4_ext_rm_idx(handle, inode, path, depth);
+ 
+ out:
+ 	return err;
+@@ -2587,7 +2601,7 @@ again:
+ 				/* index is empty, remove it;
+ 				 * handle must be already prepared by the
+ 				 * truncatei_leaf() */
+-				err = ext4_ext_rm_idx(handle, inode, path + i);
++				err = ext4_ext_rm_idx(handle, inode, path, i);
+ 			}
+ 			/* root level has p_bh == NULL, brelse() eats this */
+ 			brelse(path[i].p_bh);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index f8d5fce..24ac7a2 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1942,6 +1942,16 @@ set_qf_format:
+ 		}
+ 	}
+ #endif
++	if (test_opt(sb, DIOREAD_NOLOCK)) {
++		int blocksize =
++			BLOCK_SIZE << le32_to_cpu(sbi->s_es->s_log_block_size);
++
++		if (blocksize < PAGE_CACHE_SIZE) {
++			ext4_msg(sb, KERN_ERR, "can't mount with "
++				 "dioread_nolock if block size != PAGE_SIZE");
++			return 0;
++		}
++	}
+ 	return 1;
+ }
+ 
+@@ -3367,15 +3377,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ 			clear_opt(sb, DELALLOC);
+ 	}
+ 
+-	blocksize = BLOCK_SIZE << le32_to_cpu(es->s_log_block_size);
+-	if (test_opt(sb, DIOREAD_NOLOCK)) {
+-		if (blocksize < PAGE_SIZE) {
+-			ext4_msg(sb, KERN_ERR, "can't mount with "
+-				 "dioread_nolock if block size != PAGE_SIZE");
+-			goto failed_mount;
+-		}
+-	}
+-
+ 	sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
+ 		(test_opt(sb, POSIX_ACL) ? MS_POSIXACL : 0);
+ 
+@@ -3417,6 +3418,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ 	if (!ext4_feature_set_ok(sb, (sb->s_flags & MS_RDONLY)))
+ 		goto failed_mount;
+ 
++	blocksize = BLOCK_SIZE << le32_to_cpu(es->s_log_block_size);
+ 	if (blocksize < EXT4_MIN_BLOCK_SIZE ||
+ 	    blocksize > EXT4_MAX_BLOCK_SIZE) {
+ 		ext4_msg(sb, KERN_ERR,
+@@ -4652,7 +4654,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ 	}
+ 
+ 	ext4_setup_system_zone(sb);
+-	if (sbi->s_journal == NULL)
++	if (sbi->s_journal == NULL && !(old_sb_flags & MS_RDONLY))
+ 		ext4_commit_super(sb, 1);
+ 
+ #ifdef CONFIG_QUOTA
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 8267de5..d7dd774 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -179,7 +179,8 @@ repeat:
+ 		if (!new_transaction)
+ 			goto alloc_transaction;
+ 		write_lock(&journal->j_state_lock);
+-		if (!journal->j_running_transaction) {
++		if (!journal->j_running_transaction &&
++		    !journal->j_barrier_count) {
+ 			jbd2_get_transaction(journal, new_transaction);
+ 			new_transaction = NULL;
+ 		}
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 8150344..1943898 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1057,7 +1057,7 @@ static int nfs_get_option_str(substring_t args[], char **option)
+ {
+ 	kfree(*option);
+ 	*option = match_strdup(args);
+-	return !option;
++	return !*option;
+ }
+ 
+ static int nfs_get_option_ul(substring_t args[], unsigned long *option)
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 15df1a4..af37ce3 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -581,6 +581,7 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
+ 	struct udf_inode_info *iinfo = UDF_I(inode);
+ 	int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
+ 	int lastblock = 0;
++	bool isBeyondEOF;
+ 
+ 	prev_epos.offset = udf_file_entry_alloc_offset(inode);
+ 	prev_epos.block = iinfo->i_location;
+@@ -659,7 +660,7 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
+ 	/* Are we beyond EOF? */
+ 	if (etype == -1) {
+ 		int ret;
+-
++		isBeyondEOF = 1;
+ 		if (count) {
+ 			if (c)
+ 				laarr[0] = laarr[1];
+@@ -702,6 +703,7 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
+ 		endnum = c + 1;
+ 		lastblock = 1;
+ 	} else {
++		isBeyondEOF = 0;
+ 		endnum = startnum = ((count > 2) ? 2 : count);
+ 
+ 		/* if the current extent is in position 0,
+@@ -749,7 +751,8 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
+ 			*err = -ENOSPC;
+ 			return NULL;
+ 		}
+-		iinfo->i_lenExtents += inode->i_sb->s_blocksize;
++		if (isBeyondEOF)
++			iinfo->i_lenExtents += inode->i_sb->s_blocksize;
+ 	}
+ 
+ 	/* if the extent the requsted block is located in contains multiple
+diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
+index e58fa77..34e0274 100644
+--- a/include/asm-generic/tlb.h
++++ b/include/asm-generic/tlb.h
+@@ -78,6 +78,14 @@ struct mmu_gather_batch {
+ #define MAX_GATHER_BATCH	\
+ 	((PAGE_SIZE - sizeof(struct mmu_gather_batch)) / sizeof(void *))
+ 
++/*
++ * Limit the maximum number of mmu_gather batches to reduce a risk of soft
++ * lockups for non-preemptible kernels on huge machines when a lot of memory
++ * is zapped during unmapping.
++ * 10K pages freed at once should be safe even without a preemption point.
++ */
++#define MAX_GATHER_BATCH_COUNT	(10000UL/MAX_GATHER_BATCH)
++
+ /* struct mmu_gather is an opaque type used by the mm code for passing around
+  * any data needed by arch specific code for tlb_remove_page.
+  */
+@@ -94,6 +102,7 @@ struct mmu_gather {
+ 	struct mmu_gather_batch *active;
+ 	struct mmu_gather_batch	local;
+ 	struct page		*__pages[MMU_GATHER_BUNDLE];
++	unsigned int		batch_count;
+ };
+ 
+ #define HAVE_GENERIC_MMU_GATHER
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 59e4028..3fd17c2 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -50,6 +50,11 @@
+ # define inline		inline		__attribute__((always_inline))
+ # define __inline__	__inline__	__attribute__((always_inline))
+ # define __inline	__inline	__attribute__((always_inline))
++#else
++/* A lot of inline functions can cause havoc with function tracing */
++# define inline		inline		notrace
++# define __inline__	__inline__	notrace
++# define __inline	__inline	notrace
+ #endif
+ 
+ #define __deprecated			__attribute__((deprecated))
+diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
+index e90a673..8d9b903 100644
+--- a/include/linux/page-flags.h
++++ b/include/linux/page-flags.h
+@@ -360,7 +360,7 @@ static inline void ClearPageCompound(struct page *page)
+  * pages on the LRU and/or pagecache.
+  */
+ TESTPAGEFLAG(Compound, compound)
+-__PAGEFLAG(Head, compound)
++__SETPAGEFLAG(Head, compound)  __CLEARPAGEFLAG(Head, compound)
+ 
+ /*
+  * PG_reclaim is used in combination with PG_compound to mark the
+@@ -372,8 +372,14 @@ __PAGEFLAG(Head, compound)
+  * PG_compound & PG_reclaim	=> Tail page
+  * PG_compound & ~PG_reclaim	=> Head page
+  */
++#define PG_head_mask ((1L << PG_compound))
+ #define PG_head_tail_mask ((1L << PG_compound) | (1L << PG_reclaim))
+ 
++static inline int PageHead(struct page *page)
++{
++	return ((page->flags & PG_head_tail_mask) == PG_head_mask);
++}
++
+ static inline int PageTail(struct page *page)
+ {
+ 	return ((page->flags & PG_head_tail_mask) == PG_head_tail_mask);
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 5776609..3db3da1 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -1543,6 +1543,7 @@
+ #define PCI_DEVICE_ID_RICOH_RL5C476	0x0476
+ #define PCI_DEVICE_ID_RICOH_RL5C478	0x0478
+ #define PCI_DEVICE_ID_RICOH_R5C822	0x0822
++#define PCI_DEVICE_ID_RICOH_R5CE822	0xe822
+ #define PCI_DEVICE_ID_RICOH_R5CE823	0xe823
+ #define PCI_DEVICE_ID_RICOH_R5C832	0x0832
+ #define PCI_DEVICE_ID_RICOH_R5C843	0x0843
+diff --git a/include/linux/snmp.h b/include/linux/snmp.h
+index e16557a..64f5ca7 100644
+--- a/include/linux/snmp.h
++++ b/include/linux/snmp.h
+@@ -209,7 +209,6 @@ enum
+ 	LINUX_MIB_TCPDSACKOFOSENT,		/* TCPDSACKOfoSent */
+ 	LINUX_MIB_TCPDSACKRECV,			/* TCPDSACKRecv */
+ 	LINUX_MIB_TCPDSACKOFORECV,		/* TCPDSACKOfoRecv */
+-	LINUX_MIB_TCPABORTONSYN,		/* TCPAbortOnSyn */
+ 	LINUX_MIB_TCPABORTONDATA,		/* TCPAbortOnData */
+ 	LINUX_MIB_TCPABORTONCLOSE,		/* TCPAbortOnClose */
+ 	LINUX_MIB_TCPABORTONMEMORY,		/* TCPAbortOnMemory */
+@@ -233,6 +232,8 @@ enum
+ 	LINUX_MIB_TCPTIMEWAITOVERFLOW,		/* TCPTimeWaitOverflow */
+ 	LINUX_MIB_TCPREQQFULLDOCOOKIES,		/* TCPReqQFullDoCookies */
+ 	LINUX_MIB_TCPREQQFULLDROP,		/* TCPReqQFullDrop */
++	LINUX_MIB_TCPCHALLENGEACK,		/* TCPChallengeACK */
++	LINUX_MIB_TCPSYNCHALLENGE,		/* TCPSYNChallenge */
+ 	__LINUX_MIB_MAX
+ };
+ 
+diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
+index e6db62e..ca2755f 100644
+--- a/include/net/inet_connection_sock.h
++++ b/include/net/inet_connection_sock.h
+@@ -317,6 +317,7 @@ extern void inet_csk_reqsk_queue_prune(struct sock *parent,
+ 				       const unsigned long max_rto);
+ 
+ extern void inet_csk_destroy_sock(struct sock *sk);
++extern void inet_csk_prepare_forced_close(struct sock *sk);
+ 
+ /*
+  * LISTEN is a special case for poll..
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 72eddd1..1a6201a 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1128,6 +1128,10 @@ enum sta_notify_cmd {
+  * @IEEE80211_HW_TX_AMPDU_SETUP_IN_HW: The device handles TX A-MPDU session
+  *	setup strictly in HW. mac80211 should not attempt to do this in
+  *	software.
++ *
++ * @IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL: On this hardware TX BA session
++ *	should be tear down once BAR frame will not be acked.
++ *
+  */
+ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_HAS_RATE_CONTROL			= 1<<0,
+@@ -1154,6 +1158,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_SUPPORTS_PER_STA_GTK		= 1<<21,
+ 	IEEE80211_HW_AP_LINK_PS				= 1<<22,
+ 	IEEE80211_HW_TX_AMPDU_SETUP_IN_HW		= 1<<23,
++	IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL		= 1<<26,
+ };
+ 
+ /**
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index bb18c4d..0768715 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -251,6 +251,7 @@ extern int sysctl_tcp_max_ssthresh;
+ extern int sysctl_tcp_cookie_size;
+ extern int sysctl_tcp_thin_linear_timeouts;
+ extern int sysctl_tcp_thin_dupack;
++extern int sysctl_tcp_challenge_ack_limit;
+ 
+ extern atomic_long_t tcp_memory_allocated;
+ extern struct percpu_counter tcp_sockets_allocated;
+diff --git a/mm/memory.c b/mm/memory.c
+index 15e686a..4f2add1 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -205,10 +205,14 @@ static int tlb_next_batch(struct mmu_gather *tlb)
+ 		return 1;
+ 	}
+ 
++	if (tlb->batch_count == MAX_GATHER_BATCH_COUNT)
++		return 0;
++
+ 	batch = (void *)__get_free_pages(GFP_NOWAIT | __GFP_NOWARN, 0);
+ 	if (!batch)
+ 		return 0;
+ 
++	tlb->batch_count++;
+ 	batch->next = NULL;
+ 	batch->nr   = 0;
+ 	batch->max  = MAX_GATHER_BATCH;
+@@ -235,6 +239,7 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, bool fullmm)
+ 	tlb->local.nr   = 0;
+ 	tlb->local.max  = ARRAY_SIZE(tlb->__pages);
+ 	tlb->active     = &tlb->local;
++	tlb->batch_count = 0;
+ 
+ #ifdef CONFIG_HAVE_RCU_TABLE_FREE
+ 	tlb->batch = NULL;
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index c59d44b..4d1e637 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2334,8 +2334,7 @@ void numa_default_policy(void)
+  */
+ 
+ /*
+- * "local" is pseudo-policy:  MPOL_PREFERRED with MPOL_F_LOCAL flag
+- * Used only for mpol_parse_str() and mpol_to_str()
++ * "local" is implemented internally by MPOL_PREFERRED with MPOL_F_LOCAL flag.
+  */
+ #define MPOL_LOCAL MPOL_MAX
+ static const char * const policy_modes[] =
+@@ -2350,28 +2349,21 @@ static const char * const policy_modes[] =
+ 
+ #ifdef CONFIG_TMPFS
+ /**
+- * mpol_parse_str - parse string to mempolicy
++ * mpol_parse_str - parse string to mempolicy, for tmpfs mpol mount option.
+  * @str:  string containing mempolicy to parse
+  * @mpol:  pointer to struct mempolicy pointer, returned on success.
+- * @no_context:  flag whether to "contextualize" the mempolicy
++ * @unused:  redundant argument, to be removed later.
+  *
+  * Format of input:
+  *	<mode>[=<flags>][:<nodelist>]
+  *
+- * if @no_context is true, save the input nodemask in w.user_nodemask in
+- * the returned mempolicy.  This will be used to "clone" the mempolicy in
+- * a specific context [cpuset] at a later time.  Used to parse tmpfs mpol
+- * mount option.  Note that if 'static' or 'relative' mode flags were
+- * specified, the input nodemask will already have been saved.  Saving
+- * it again is redundant, but safe.
+- *
+  * On success, returns 0, else 1
+  */
+-int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
++int mpol_parse_str(char *str, struct mempolicy **mpol, int unused)
+ {
+ 	struct mempolicy *new = NULL;
+ 	unsigned short mode;
+-	unsigned short uninitialized_var(mode_flags);
++	unsigned short mode_flags;
+ 	nodemask_t nodes;
+ 	char *nodelist = strchr(str, ':');
+ 	char *flags = strchr(str, '=');
+@@ -2459,24 +2451,23 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
+ 	if (IS_ERR(new))
+ 		goto out;
+ 
+-	if (no_context) {
+-		/* save for contextualization */
+-		new->w.user_nodemask = nodes;
+-	} else {
+-		int ret;
+-		NODEMASK_SCRATCH(scratch);
+-		if (scratch) {
+-			task_lock(current);
+-			ret = mpol_set_nodemask(new, &nodes, scratch);
+-			task_unlock(current);
+-		} else
+-			ret = -ENOMEM;
+-		NODEMASK_SCRATCH_FREE(scratch);
+-		if (ret) {
+-			mpol_put(new);
+-			goto out;
+-		}
+-	}
++	/*
++	 * Save nodes for mpol_to_str() to show the tmpfs mount options
++	 * for /proc/mounts, /proc/pid/mounts and /proc/pid/mountinfo.
++	 */
++	if (mode != MPOL_PREFERRED)
++		new->v.nodes = nodes;
++	else if (nodelist)
++		new->v.preferred_node = first_node(nodes);
++	else
++		new->flags |= MPOL_F_LOCAL;
++
++	/*
++	 * Save nodes for contextualization: this will be used to "clone"
++	 * the mempolicy in a specific context [cpuset] at a later time.
++	 */
++	new->w.user_nodemask = nodes;
++
+ 	err = 0;
+ 
+ out:
+@@ -2496,13 +2487,13 @@ out:
+  * @buffer:  to contain formatted mempolicy string
+  * @maxlen:  length of @buffer
+  * @pol:  pointer to mempolicy to be formatted
+- * @no_context:  "context free" mempolicy - use nodemask in w.user_nodemask
++ * @unused:  redundant argument, to be removed later.
+  *
+  * Convert a mempolicy into a string.
+  * Returns the number of characters in buffer (if positive)
+  * or an error (negative)
+  */
+-int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
++int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int unused)
+ {
+ 	char *p = buffer;
+ 	int l;
+@@ -2528,7 +2519,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
+ 	case MPOL_PREFERRED:
+ 		nodes_clear(nodes);
+ 		if (flags & MPOL_F_LOCAL)
+-			mode = MPOL_LOCAL;	/* pseudo-policy */
++			mode = MPOL_LOCAL;
+ 		else
+ 			node_set(pol->v.preferred_node, nodes);
+ 		break;
+@@ -2536,10 +2527,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
+ 	case MPOL_BIND:
+ 		/* Fall through */
+ 	case MPOL_INTERLEAVE:
+-		if (no_context)
+-			nodes = pol->w.user_nodemask;
+-		else
+-			nodes = pol->v.nodes;
++		nodes = pol->v.nodes;
+ 		break;
+ 
+ 	default:
+diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
+index 3f4e541..72416c8 100644
+--- a/net/dccp/ipv4.c
++++ b/net/dccp/ipv4.c
+@@ -434,8 +434,8 @@ exit:
+ 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
+ 	return NULL;
+ put_and_exit:
+-	bh_unlock_sock(newsk);
+-	sock_put(newsk);
++	inet_csk_prepare_forced_close(newsk);
++	dccp_done(newsk);
+ 	goto exit;
+ }
+ 
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 17ee85c..592b78c 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -609,7 +609,8 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
+ 	newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
+ 
+ 	if (__inet_inherit_port(sk, newsk) < 0) {
+-		sock_put(newsk);
++		inet_csk_prepare_forced_close(newsk);
++		dccp_done(newsk);
+ 		goto out;
+ 	}
+ 	__inet6_hash(newsk, NULL);
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index c14d88a..907ef2c 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -647,6 +647,22 @@ void inet_csk_destroy_sock(struct sock *sk)
+ }
+ EXPORT_SYMBOL(inet_csk_destroy_sock);
+ 
++/* This function allows to force a closure of a socket after the call to
++ * tcp/dccp_create_openreq_child().
++ */
++void inet_csk_prepare_forced_close(struct sock *sk)
++{
++	/* sk_clone_lock locked the socket and set refcnt to 2 */
++	bh_unlock_sock(sk);
++	sock_put(sk);
++
++	/* The below has to be done to allow calling inet_csk_destroy_sock */
++	sock_set_flag(sk, SOCK_DEAD);
++	percpu_counter_inc(sk->sk_prot->orphan_count);
++	inet_sk(sk)->inet_num = 0;
++}
++EXPORT_SYMBOL(inet_csk_prepare_forced_close);
++
+ int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)
+ {
+ 	struct inet_sock *inet = inet_sk(sk);
+diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
+index 466ea8b..f7fdbe9 100644
+--- a/net/ipv4/proc.c
++++ b/net/ipv4/proc.c
+@@ -233,7 +233,6 @@ static const struct snmp_mib snmp4_net_list[] = {
+ 	SNMP_MIB_ITEM("TCPDSACKOfoSent", LINUX_MIB_TCPDSACKOFOSENT),
+ 	SNMP_MIB_ITEM("TCPDSACKRecv", LINUX_MIB_TCPDSACKRECV),
+ 	SNMP_MIB_ITEM("TCPDSACKOfoRecv", LINUX_MIB_TCPDSACKOFORECV),
+-	SNMP_MIB_ITEM("TCPAbortOnSyn", LINUX_MIB_TCPABORTONSYN),
+ 	SNMP_MIB_ITEM("TCPAbortOnData", LINUX_MIB_TCPABORTONDATA),
+ 	SNMP_MIB_ITEM("TCPAbortOnClose", LINUX_MIB_TCPABORTONCLOSE),
+ 	SNMP_MIB_ITEM("TCPAbortOnMemory", LINUX_MIB_TCPABORTONMEMORY),
+@@ -257,6 +256,8 @@ static const struct snmp_mib snmp4_net_list[] = {
+ 	SNMP_MIB_ITEM("TCPTimeWaitOverflow", LINUX_MIB_TCPTIMEWAITOVERFLOW),
+ 	SNMP_MIB_ITEM("TCPReqQFullDoCookies", LINUX_MIB_TCPREQQFULLDOCOOKIES),
+ 	SNMP_MIB_ITEM("TCPReqQFullDrop", LINUX_MIB_TCPREQQFULLDROP),
++	SNMP_MIB_ITEM("TCPChallengeACK", LINUX_MIB_TCPCHALLENGEACK),
++	SNMP_MIB_ITEM("TCPSYNChallenge", LINUX_MIB_TCPSYNCHALLENGE),
+ 	SNMP_MIB_SENTINEL
+ };
+ 
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index 69fd720..5485077 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -552,6 +552,13 @@ static struct ctl_table ipv4_table[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_dointvec
+ 	},
++	{
++		.procname	= "tcp_challenge_ack_limit",
++		.data		= &sysctl_tcp_challenge_ack_limit,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec
++	},
+ #ifdef CONFIG_NET_DMA
+ 	{
+ 		.procname	= "tcp_dma_copybreak",
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index a08a621..aab8f08 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -86,6 +86,9 @@ int sysctl_tcp_app_win __read_mostly = 31;
+ int sysctl_tcp_adv_win_scale __read_mostly = 1;
+ EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
+ 
++/* rfc5961 challenge ack rate limiting */
++int sysctl_tcp_challenge_ack_limit = 100;
++
+ int sysctl_tcp_stdurg __read_mostly;
+ int sysctl_tcp_rfc1337 __read_mostly;
+ int sysctl_tcp_max_orphans __read_mostly = NR_FILE;
+@@ -3700,6 +3703,24 @@ static int tcp_process_frto(struct sock *sk, int flag)
+ 	return 0;
+ }
+ 
++/* RFC 5961 7 [ACK Throttling] */
++static void tcp_send_challenge_ack(struct sock *sk)
++{
++	/* unprotected vars, we dont care of overwrites */
++	static u32 challenge_timestamp;
++	static unsigned int challenge_count;
++	u32 now = jiffies / HZ;
++
++	if (now != challenge_timestamp) {
++		challenge_timestamp = now;
++		challenge_count = 0;
++	}
++	if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
++		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
++		tcp_send_ack(sk);
++	}
++}
++
+ /* This routine deals with incoming acks, but not outgoing ones. */
+ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
+ {
+@@ -3718,8 +3739,14 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
+ 	/* If the ack is older than previous acks
+ 	 * then we can probably ignore it.
+ 	 */
+-	if (before(ack, prior_snd_una))
++	if (before(ack, prior_snd_una)) {
++		/* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */
++		if (before(ack, prior_snd_una - tp->max_window)) {
++			tcp_send_challenge_ack(sk);
++			return -1;
++		}
+ 		goto old_ack;
++	}
+ 
+ 	/* If the ack includes data we haven't sent yet, discard
+ 	 * this segment (RFC793 Section 3.9).
+@@ -5243,8 +5270,8 @@ out:
+ /* Does PAWS and seqno based validation of an incoming segment, flags will
+  * play significant role here.
+  */
+-static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
+-			      const struct tcphdr *th, int syn_inerr)
++static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
++				  const struct tcphdr *th, int syn_inerr)
+ {
+ 	const u8 *hash_location;
+ 	struct tcp_sock *tp = tcp_sk(sk);
+@@ -5269,38 +5296,48 @@ static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
+ 		 * an acknowledgment should be sent in reply (unless the RST
+ 		 * bit is set, if so drop the segment and return)".
+ 		 */
+-		if (!th->rst)
++		if (!th->rst) {
++			if (th->syn)
++				goto syn_challenge;
+ 			tcp_send_dupack(sk, skb);
++		}
+ 		goto discard;
+ 	}
+ 
+ 	/* Step 2: check RST bit */
+ 	if (th->rst) {
+-		tcp_reset(sk);
++		/* RFC 5961 3.2 :
++		 * If sequence number exactly matches RCV.NXT, then
++		 *     RESET the connection
++		 * else
++		 *     Send a challenge ACK
++		 */
++		if (TCP_SKB_CB(skb)->seq == tp->rcv_nxt)
++			tcp_reset(sk);
++		else
++			tcp_send_challenge_ack(sk);
+ 		goto discard;
+ 	}
+ 
+-	/* ts_recent update must be made after we are sure that the packet
+-	 * is in window.
+-	 */
+-	tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
+-
+ 	/* step 3: check security and precedence [ignored] */
+ 
+-	/* step 4: Check for a SYN in window. */
+-	if (th->syn && !before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
++	/* step 4: Check for a SYN
++	 * RFC 5691 4.2 : Send a challenge ack
++	 */
++	if (th->syn) {
++syn_challenge:
+ 		if (syn_inerr)
+ 			TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
+-		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPABORTONSYN);
+-		tcp_reset(sk);
+-		return -1;
++		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNCHALLENGE);
++		tcp_send_challenge_ack(sk);
++		goto discard;
+ 	}
+ 
+-	return 1;
++	return true;
+ 
+ discard:
+ 	__kfree_skb(skb);
+-	return 0;
++	return false;
+ }
+ 
+ /*
+@@ -5330,7 +5367,6 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
+ 			const struct tcphdr *th, unsigned int len)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+-	int res;
+ 
+ 	/*
+ 	 *	Header prediction.
+@@ -5510,14 +5546,18 @@ slow_path:
+ 	 *	Standard slow path.
+ 	 */
+ 
+-	res = tcp_validate_incoming(sk, skb, th, 1);
+-	if (res <= 0)
+-		return -res;
++	if (!tcp_validate_incoming(sk, skb, th, 1))
++		return 0;
+ 
+ step5:
+ 	if (th->ack && tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
+ 		goto discard;
+ 
++	/* ts_recent update must be made after we are sure that the packet
++	 * is in window.
++	 */
++	tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
++
+ 	tcp_rcv_rtt_measure_ts(sk, skb);
+ 
+ 	/* Process urgent data. */
+@@ -5822,7 +5862,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct inet_connection_sock *icsk = inet_csk(sk);
+ 	int queued = 0;
+-	int res;
+ 
+ 	tp->rx_opt.saw_tstamp = 0;
+ 
+@@ -5877,9 +5916,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ 		return 0;
+ 	}
+ 
+-	res = tcp_validate_incoming(sk, skb, th, 0);
+-	if (res <= 0)
+-		return -res;
++	if (!tcp_validate_incoming(sk, skb, th, 0))
++		return 0;
+ 
+ 	/* step 5: check the ACK field */
+ 	if (th->ack) {
+@@ -5990,6 +6028,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ 	} else
+ 		goto discard;
+ 
++	/* ts_recent update must be made after we are sure that the packet
++	 * is in window.
++	 */
++	tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
++
+ 	/* step 6: check the URG bit */
+ 	tcp_urg(sk, skb, th);
+ 
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 58c09a0..a97c9ad 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1520,9 +1520,8 @@ exit:
+ 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
+ 	return NULL;
+ put_and_exit:
+-	tcp_clear_xmit_timers(newsk);
+-	bh_unlock_sock(newsk);
+-	sock_put(newsk);
++	inet_csk_prepare_forced_close(newsk);
++	tcp_done(newsk);
+ 	goto exit;
+ }
+ EXPORT_SYMBOL(tcp_v4_syn_recv_sock);
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index ccab3c8..db10805 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1524,7 +1524,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
+ #endif
+ 
+ 	if (__inet_inherit_port(sk, newsk) < 0) {
+-		sock_put(newsk);
++		inet_csk_prepare_forced_close(newsk);
++		tcp_done(newsk);
+ 		goto out;
+ 	}
+ 	__inet6_hash(newsk, NULL);
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index 16518f3..67df50e 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -429,7 +429,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
+ 				       IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
+ 				      IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
+ 
+-				ieee80211_set_bar_pending(sta, tid, ssn);
++				if (local->hw.flags &
++				    IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL)
++					ieee80211_stop_tx_ba_session(&sta->sta, tid);
++				else
++					ieee80211_set_bar_pending(sta, tid, ssn);
+ 			}
+ 		}
+ 
+diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
+index 29b942c..f08b9166 100644
+--- a/net/sched/sch_htb.c
++++ b/net/sched/sch_htb.c
+@@ -876,7 +876,7 @@ ok:
+ 	q->now = psched_get_time();
+ 	start_at = jiffies;
+ 
+-	next_event = q->now + 5 * PSCHED_TICKS_PER_SEC;
++	next_event = q->now + 5LLU * PSCHED_TICKS_PER_SEC;
+ 
+ 	for (level = 0; level < TC_HTB_MAXDEPTH; level++) {
+ 		/* common case optimization - skip event handler quickly */
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index c90b832..56c3f85 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -880,16 +880,35 @@ struct rpc_task *rpc_new_task(const struct rpc_task_setup *setup_data)
+ 	return task;
+ }
+ 
++/*
++ * rpc_free_task - release rpc task and perform cleanups
++ *
++ * Note that we free up the rpc_task _after_ rpc_release_calldata()
++ * in order to work around a workqueue dependency issue.
++ *
++ * Tejun Heo states:
++ * "Workqueue currently considers two work items to be the same if they're
++ * on the same address and won't execute them concurrently - ie. it
++ * makes a work item which is queued again while being executed wait
++ * for the previous execution to complete.
++ *
++ * If a work function frees the work item, and then waits for an event
++ * which should be performed by another work item and *that* work item
++ * recycles the freed work item, it can create a false dependency loop.
++ * There really is no reliable way to detect this short of verifying
++ * every memory free."
++ *
++ */
+ static void rpc_free_task(struct rpc_task *task)
+ {
+-	const struct rpc_call_ops *tk_ops = task->tk_ops;
+-	void *calldata = task->tk_calldata;
++	unsigned short tk_flags = task->tk_flags;
++
++	rpc_release_calldata(task->tk_ops, task->tk_calldata);
+ 
+-	if (task->tk_flags & RPC_TASK_DYNAMIC) {
++	if (tk_flags & RPC_TASK_DYNAMIC) {
+ 		dprintk("RPC: %5u freeing task\n", task->tk_pid);
+ 		mempool_free(task, rpc_task_mempool);
+ 	}
+-	rpc_release_calldata(tk_ops, calldata);
+ }
+ 
+ static void rpc_async_release(struct work_struct *work)
diff --git a/3.2.36/4420_grsecurity-2.9.1-3.2.36-201301032034.patch b/3.2.37/4420_grsecurity-2.9.1-3.2.37-201301181518.patch
index 1e1956d..0666a7e 100644
--- a/3.2.36/4420_grsecurity-2.9.1-3.2.36-201301032034.patch
+++ b/3.2.37/4420_grsecurity-2.9.1-3.2.37-201301181518.patch
@@ -221,22 +221,6 @@ index 81c287f..8c5ad74 100644
  	pcbit=		[HW,ISDN]
  
  	pcd.		[PARIDE]
-diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
-index a4399f5..3b979c6 100644
---- a/Documentation/networking/ip-sysctl.txt
-+++ b/Documentation/networking/ip-sysctl.txt
-@@ -524,6 +524,11 @@ tcp_thin_dupack - BOOLEAN
- 	Documentation/networking/tcp-thin.txt
- 	Default: 0
- 
-+tcp_challenge_ack_limit - INTEGER
-+	Limits number of Challenge ACK sent per second, as recommended
-+	in RFC 5961 (Improving TCP's Robustness to Blind In-Window Attacks)
-+	Default: 100
-+
- UDP variables:
- 
- udp_mem - vector of 3 INTEGERs: min, pressure, max
 diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
 index 88fd7f5..b318a78 100644
 --- a/Documentation/sysctl/fs.txt
@@ -271,7 +255,7 @@ index 88fd7f5..b318a78 100644
  ==============================================================
  
 diff --git a/Makefile b/Makefile
-index 2052c29..5ef6c21 100644
+index 21c77e2..30aaeef 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -1510,18 +1494,6 @@ index ca94653..6ac0d56 100644
  
  #ifdef MULTI_USER
  extern struct cpu_user_fns cpu_user;
-diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
-index 3e08fd3..3f14f89 100644
---- a/arch/arm/include/asm/pgalloc.h
-+++ b/arch/arm/include/asm/pgalloc.h
-@@ -31,6 +31,7 @@
- #define pmd_alloc_one(mm,addr)		({ BUG(); ((pmd_t *)2); })
- #define pmd_free(mm, pmd)		do { } while (0)
- #define pgd_populate(mm,pmd,pte)	BUG()
-+#define pgd_populate_kernel(mm,pmd,pte)	BUG()
- 
- extern pgd_t *pgd_alloc(struct mm_struct *mm);
- extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
 diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
 index 984014b..a6d914f 100644
 --- a/arch/arm/include/asm/system.h
@@ -1682,6 +1654,21 @@ index b2a27b6..520889c 100644
  	bne	__sys_trace
  
  	cmp	scno, #NR_syscalls		@ check upper syscall limit
+diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
+index 08c82fd..647a3c7 100644
+--- a/arch/arm/kernel/head.S
++++ b/arch/arm/kernel/head.S
+@@ -46,7 +46,9 @@
+ 	.equ	swapper_pg_dir, KERNEL_RAM_VADDR - PG_DIR_SIZE
+ 
+ 	.macro	pgtbl, rd, phys
+-	add	\rd, \phys, #TEXT_OFFSET - PG_DIR_SIZE
++	mov	\rd, #TEXT_OFFSET
++	sub	\rd, #PG_DIR_SIZE
++	add	\rd, \rd, \phys
+ 	.endm
+ 
+ #ifdef CONFIG_XIP_KERNEL
 diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
 index e68d251..b70de67 100644
 --- a/arch/arm/kernel/process.c
@@ -1757,27 +1744,6 @@ index 90fa8b3..a3a2212 100644
  	if (!test_thread_flag(TIF_SYSCALL_TRACE))
  		return scno;
  	if (!(current->ptrace & PT_PTRACED))
-diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
-index 8fc2c8f..064c150 100644
---- a/arch/arm/kernel/setup.c
-+++ b/arch/arm/kernel/setup.c
-@@ -108,13 +108,13 @@ struct processor processor __read_mostly;
- struct cpu_tlb_fns cpu_tlb __read_mostly;
- #endif
- #ifdef MULTI_USER
--struct cpu_user_fns cpu_user __read_mostly;
-+struct cpu_user_fns cpu_user __read_only;
- #endif
- #ifdef MULTI_CACHE
--struct cpu_cache_fns cpu_cache __read_mostly;
-+struct cpu_cache_fns cpu_cache __read_only;
- #endif
- #ifdef CONFIG_OUTER_CACHE
--struct outer_cache_fns outer_cache __read_mostly;
-+struct outer_cache_fns outer_cache __read_only;
- EXPORT_SYMBOL(outer_cache);
- #endif
- 
 diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
 index 7ac5dfd..cbbbd34 100644
 --- a/arch/arm/kernel/traps.c
@@ -1950,6 +1916,19 @@ index e9d5f4a..f099699 100644
  	.late_init = n8x0_menelaus_late_init,
  };
  
+diff --git a/arch/arm/mach-omap2/smartreflex.h b/arch/arm/mach-omap2/smartreflex.h
+index 5f35b9e..6d09f99 100644
+--- a/arch/arm/mach-omap2/smartreflex.h
++++ b/arch/arm/mach-omap2/smartreflex.h
+@@ -183,7 +183,7 @@ struct omap_sr_class_data {
+ 	int (*notify)(struct voltagedomain *voltdm, u32 status);
+ 	u8 notify_flags;
+ 	u8 class_type;
+-};
++} __do_const;
+ 
+ /**
+  * struct omap_sr_nvalue_table	- Smartreflex n-target value info
 diff --git a/arch/arm/mach-ux500/mbox-db5500.c b/arch/arm/mach-ux500/mbox-db5500.c
 index 2b2d51c..0127490 100644
 --- a/arch/arm/mach-ux500/mbox-db5500.c
@@ -1964,58 +1943,10 @@ index 2b2d51c..0127490 100644
  static int mbox_show(struct seq_file *s, void *data)
  {
 diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
-index 4b0bc37..39d4e26 100644
+index 4b0bc37..e405631 100644
 --- a/arch/arm/mm/fault.c
 +++ b/arch/arm/mm/fault.c
-@@ -183,6 +183,13 @@ __do_user_fault(struct task_struct *tsk, unsigned long addr,
- 	}
- #endif
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (fsr & FSR_LNX_PF) {
-+		pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
-+		do_group_exit(SIGKILL);
-+	}
-+#endif
-+
- 	tsk->thread.address = addr;
- 	tsk->thread.error_code = fsr;
- 	tsk->thread.trap_no = 14;
-@@ -386,6 +393,33 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
- }
- #endif					/* CONFIG_MMU */
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+	long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 20; i++) {
-+		unsigned char c;
-+		if (get_user(c, (__force unsigned char __user *)pc+i))
-+			printk(KERN_CONT "?? ");
-+		else
-+			printk(KERN_CONT "%02x ", c);
-+	}
-+	printk("\n");
-+
-+	printk(KERN_ERR "PAX: bytes at SP-4: ");
-+	for (i = -1; i < 20; i++) {
-+		unsigned long c;
-+		if (get_user(c, (__force unsigned long __user *)sp+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08lx ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * First Level Translation Fault Handler
-  *
-@@ -630,6 +664,20 @@ do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
+@@ -630,6 +630,20 @@ do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
  	const struct fsr_info *inf = ifsr_info + fsr_fs(ifsr);
  	struct siginfo info;
  
@@ -2515,27 +2446,76 @@ index b77768d..e0795eb 100644
  
  static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
 diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
-index 449c8c0..432a3d2 100644
+index 449c8c0..50cdf87 100644
 --- a/arch/ia64/include/asm/uaccess.h
 +++ b/arch/ia64/include/asm/uaccess.h
-@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+@@ -42,6 +42,8 @@
+ #include <asm/pgtable.h>
+ #include <asm/io.h>
+ 
++extern void check_object_size(const void *ptr, unsigned long n, bool to);
++
+ /*
+  * For historical reasons, the following macros are grossly misnamed:
+  */
+@@ -240,12 +242,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
+ static inline unsigned long
+ __copy_to_user (void __user *to, const void *from, unsigned long count)
+ {
++	if (count > INT_MAX)
++		return count;
++
++	if (!__builtin_constant_p(count))
++		check_object_size(from, count, true);
++
+ 	return __copy_user(to, (__force void __user *) from, count);
+ }
+ 
+ static inline unsigned long
+ __copy_from_user (void *to, const void __user *from, unsigned long count)
+ {
++	if (count > INT_MAX)
++		return count;
++
++	if (!__builtin_constant_p(count))
++		check_object_size(to, count, false);
++
+ 	return __copy_user((__force void __user *) to, from, count);
+ }
+ 
+@@ -255,10 +269,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+ ({											\
+ 	void __user *__cu_to = (to);							\
  	const void *__cu_from = (from);							\
- 	long __cu_len = (n);								\
+-	long __cu_len = (n);								\
++	unsigned long __cu_len = (n);							\
  											\
 -	if (__access_ok(__cu_to, __cu_len, get_fs()))					\
-+	if (__cu_len > 0  && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs()))			\
++	if (__cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) {		\
++		if (!__builtin_constant_p(n))						\
++			check_object_size(__cu_from, __cu_len, true);			\
  		__cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);	\
++	}										\
  	__cu_len;									\
  })
-@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
- 	long __cu_len = (n);								\
+ 
+@@ -266,11 +283,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+ ({											\
+ 	void *__cu_to = (to);								\
+ 	const void __user *__cu_from = (from);						\
+-	long __cu_len = (n);								\
++	unsigned long __cu_len = (n);							\
  											\
  	__chk_user_ptr(__cu_from);							\
 -	if (__access_ok(__cu_from, __cu_len, get_fs()))					\
-+	if (__cu_len > 0 && __cu_len <= INT_MAX  && __access_ok(__cu_from, __cu_len, get_fs()))			\
++	if (__cu_len <= INT_MAX  && __access_ok(__cu_from, __cu_len, get_fs())) {	\
++		if (!__builtin_constant_p(n))						\
++			check_object_size(__cu_to, __cu_len, false);			\
  		__cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);	\
++	}										\
  	__cu_len;									\
  })
+ 
 diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
 index 24603be..948052d 100644
 --- a/arch/ia64/kernel/module.c
@@ -10842,9 +10822,18 @@ index a850b4d..1d8dfb7 100644
  
  /*
 diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
-index d8e8eef..99f81ae 100644
+index d8e8eef..15b1179 100644
 --- a/arch/x86/include/asm/io.h
 +++ b/arch/x86/include/asm/io.h
+@@ -184,7 +184,7 @@ static inline void __iomem *ioremap(resource_size_t offset, unsigned long size)
+ 	return ioremap_nocache(offset, size);
+ }
+ 
+-extern void iounmap(volatile void __iomem *addr);
++extern void iounmap(const volatile void __iomem *addr);
+ 
+ extern void set_iounmap_nonlazy(void);
+ 
 @@ -194,6 +194,17 @@ extern void set_iounmap_nonlazy(void);
  
  #include <linux/vmalloc.h>
@@ -11466,51 +11455,9 @@ index a7d2db9..edb023e 100644
  
  #endif /* __ASSEMBLY__ */
 diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
-index 8e8b9a4..f07d725 100644
+index 8e8b9a4..35918cc 100644
 --- a/arch/x86/include/asm/paravirt_types.h
 +++ b/arch/x86/include/asm/paravirt_types.h
-@@ -84,20 +84,20 @@ struct pv_init_ops {
- 	 */
- 	unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
- 			  unsigned long addr, unsigned len);
--};
-+} __no_const;
- 
- 
- struct pv_lazy_ops {
- 	/* Set deferred update mode, used for batching operations. */
- 	void (*enter)(void);
- 	void (*leave)(void);
--};
-+} __no_const;
- 
- struct pv_time_ops {
- 	unsigned long long (*sched_clock)(void);
- 	unsigned long long (*steal_clock)(int cpu);
- 	unsigned long (*get_tsc_khz)(void);
--};
-+} __no_const;
- 
- struct pv_cpu_ops {
- 	/* hooks for various privileged instructions */
-@@ -193,7 +193,7 @@ struct pv_cpu_ops {
- 
- 	void (*start_context_switch)(struct task_struct *prev);
- 	void (*end_context_switch)(struct task_struct *next);
--};
-+} __no_const;
- 
- struct pv_irq_ops {
- 	/*
-@@ -224,7 +224,7 @@ struct pv_apic_ops {
- 				 unsigned long start_eip,
- 				 unsigned long start_esp);
- #endif
--};
-+} __no_const;
- 
- struct pv_mmu_ops {
- 	unsigned long (*read_cr2)(void);
 @@ -313,6 +313,7 @@ struct pv_mmu_ops {
  	struct paravirt_callee_save make_pud;
  
@@ -11532,15 +11479,6 @@ index 8e8b9a4..f07d725 100644
  };
  
  struct arch_spinlock;
-@@ -334,7 +341,7 @@ struct pv_lock_ops {
- 	void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags);
- 	int (*spin_trylock)(struct arch_spinlock *lock);
- 	void (*spin_unlock)(struct arch_spinlock *lock);
--};
-+} __no_const;
- 
- /* This contains all the paravirt structures: we get a convenient
-  * number for each function using the offset which we use to indicate
 diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
 index b4389a4..7024269 100644
 --- a/arch/x86/include/asm/pgalloc.h
@@ -12254,7 +12192,7 @@ index 3b96fd4..8790004 100644
  }
  #endif
 diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
-index 92f29706..d0a1a53 100644
+index 92f29706..f4f21fd 100644
 --- a/arch/x86/include/asm/reboot.h
 +++ b/arch/x86/include/asm/reboot.h
 @@ -6,19 +6,19 @@
@@ -12270,9 +12208,8 @@ index 92f29706..d0a1a53 100644
  	void (*shutdown)(void);
  	void (*crash_shutdown)(struct pt_regs *);
 -	void (*emergency_restart)(void);
--};
 +	void (* __noreturn emergency_restart)(void);
-+} __no_const;
+ };
  
  extern struct machine_ops machine_ops;
  
@@ -12474,7 +12411,7 @@ index 5e64171..f58957e 100644
  #define __USER_DS	(GDT_ENTRY_DEFAULT_USER_DS*8+3)
  #define __USER_CS	(GDT_ENTRY_DEFAULT_USER_CS*8+3)
 diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
-index 73b11bc..d4a3b63 100644
+index 73b11bc..4803d4b 100644
 --- a/arch/x86/include/asm/smp.h
 +++ b/arch/x86/include/asm/smp.h
 @@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
@@ -12486,15 +12423,6 @@ index 73b11bc..d4a3b63 100644
  
  static inline struct cpumask *cpu_sibling_mask(int cpu)
  {
-@@ -77,7 +77,7 @@ struct smp_ops {
- 
- 	void (*send_call_func_ipi)(const struct cpumask *mask);
- 	void (*send_call_func_single_ipi)(int cpu);
--};
-+} __no_const;
- 
- /* Globals due to paravirt */
- extern void set_cpu_sibling_map(int cpu);
 @@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitdata;
  extern int safe_smp_processor_id(void);
  
@@ -13737,127 +13665,6 @@ index bb05228..d763d5b 100644
  })
  #endif
  
-diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
-index 1971e65..1e3559b 100644
---- a/arch/x86/include/asm/x86_init.h
-+++ b/arch/x86/include/asm/x86_init.h
-@@ -28,7 +28,7 @@ struct x86_init_mpparse {
- 	void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
- 	void (*find_smp_config)(void);
- 	void (*get_smp_config)(unsigned int early);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_resources - platform specific resource related ops
-@@ -42,7 +42,7 @@ struct x86_init_resources {
- 	void (*probe_roms)(void);
- 	void (*reserve_resources)(void);
- 	char *(*memory_setup)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_irqs - platform specific interrupt setup
-@@ -55,7 +55,7 @@ struct x86_init_irqs {
- 	void (*pre_vector_init)(void);
- 	void (*intr_init)(void);
- 	void (*trap_init)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_oem - oem platform specific customizing functions
-@@ -65,7 +65,7 @@ struct x86_init_irqs {
- struct x86_init_oem {
- 	void (*arch_setup)(void);
- 	void (*banner)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_mapping - platform specific initial kernel pagetable setup
-@@ -76,7 +76,7 @@ struct x86_init_oem {
-  */
- struct x86_init_mapping {
- 	void (*pagetable_reserve)(u64 start, u64 end);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_paging - platform specific paging functions
-@@ -86,7 +86,7 @@ struct x86_init_mapping {
- struct x86_init_paging {
- 	void (*pagetable_setup_start)(pgd_t *base);
- 	void (*pagetable_setup_done)(pgd_t *base);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_timers - platform specific timer setup
-@@ -101,7 +101,7 @@ struct x86_init_timers {
- 	void (*tsc_pre_init)(void);
- 	void (*timer_init)(void);
- 	void (*wallclock_init)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_iommu - platform specific iommu setup
-@@ -109,7 +109,7 @@ struct x86_init_timers {
-  */
- struct x86_init_iommu {
- 	int (*iommu_init)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_pci - platform specific pci init functions
-@@ -123,7 +123,7 @@ struct x86_init_pci {
- 	int (*init)(void);
- 	void (*init_irq)(void);
- 	void (*fixup_irqs)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_ops - functions for platform specific setup
-@@ -139,7 +139,7 @@ struct x86_init_ops {
- 	struct x86_init_timers		timers;
- 	struct x86_init_iommu		iommu;
- 	struct x86_init_pci		pci;
--};
-+} __no_const;
- 
- /**
-  * struct x86_cpuinit_ops - platform specific cpu hotplug setups
-@@ -147,7 +147,7 @@ struct x86_init_ops {
-  */
- struct x86_cpuinit_ops {
- 	void (*setup_percpu_clockev)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_platform_ops - platform specific runtime functions
-@@ -169,7 +169,7 @@ struct x86_platform_ops {
- 	void (*nmi_init)(void);
- 	unsigned char (*get_nmi_reason)(void);
- 	int (*i8042_detect)(void);
--};
-+} __no_const;
- 
- struct pci_dev;
- 
-@@ -177,7 +177,7 @@ struct x86_msi_ops {
- 	int (*setup_msi_irqs)(struct pci_dev *dev, int nvec, int type);
- 	void (*teardown_msi_irq)(unsigned int irq);
- 	void (*teardown_msi_irqs)(struct pci_dev *dev);
--};
-+} __no_const;
- 
- extern struct x86_init_ops x86_init;
- extern struct x86_cpuinit_ops x86_cpuinit;
 diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
 index c6ce245..aab6adb 100644
 --- a/arch/x86/include/asm/xsave.h
@@ -13898,6 +13705,19 @@ index c6ce245..aab6adb 100644
  			     "2:\n"
  			     ".section .fixup,\"ax\"\n"
  			     "3:  movl $-1,%[err]\n"
+diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
+index 479d03c..ee1bb25 100644
+--- a/arch/x86/kernel/acpi/boot.c
++++ b/arch/x86/kernel/acpi/boot.c
+@@ -1569,7 +1569,7 @@ int __init acpi_boot_init(void)
+ 	acpi_table_parse(ACPI_SIG_HPET, acpi_parse_hpet);
+ 
+ 	if (!acpi_noirq)
+-		x86_init.pci.init = pci_acpi_init;
++		*(void **)&x86_init.pci.init = pci_acpi_init;
+ 
+ 	return 0;
+ }
 diff --git a/arch/x86/kernel/acpi/realmode/Makefile b/arch/x86/kernel/acpi/realmode/Makefile
 index 6a564ac..3f3a3d7 100644
 --- a/arch/x86/kernel/acpi/realmode/Makefile
@@ -14108,6 +13928,32 @@ index bda833c..a9bdd97 100644
  	return addr;
  }
  
+diff --git a/arch/x86/kernel/amd_gart_64.c b/arch/x86/kernel/amd_gart_64.c
+index b1e7c7f..eb07876 100644
+--- a/arch/x86/kernel/amd_gart_64.c
++++ b/arch/x86/kernel/amd_gart_64.c
+@@ -850,7 +850,7 @@ int __init gart_iommu_init(void)
+ 
+ 	flush_gart();
+ 	dma_ops = &gart_dma_ops;
+-	x86_platform.iommu_shutdown = gart_iommu_shutdown;
++	*(void **)&x86_platform.iommu_shutdown = gart_iommu_shutdown;
+ 	swiotlb = 0;
+ 
+ 	return 0;
+diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
+index 3d2661c..58f1983 100644
+--- a/arch/x86/kernel/aperture_64.c
++++ b/arch/x86/kernel/aperture_64.c
+@@ -396,7 +396,7 @@ int __init gart_iommu_hole_init(void)
+ 
+ 			iommu_detected = 1;
+ 			gart_iommu_aperture = 1;
+-			x86_init.iommu.iommu_init = gart_iommu_init;
++			*(void **)&x86_init.iommu.iommu_init = gart_iommu_init;
+ 
+ 			ctl = read_pci_config(bus, slot, 3,
+ 					      AMD64_GARTAPERTURECTL);
 diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
 index c4e3581..7e2f9d0 100644
 --- a/arch/x86/kernel/apic/apic.c
@@ -14170,6 +14016,48 @@ index 6d939d7..0697fcc 100644
  
  		eoi_ioapic_irq(irq, cfg);
  	}
+diff --git a/arch/x86/kernel/apic/numaq_32.c b/arch/x86/kernel/apic/numaq_32.c
+index c4a61ca..8339ba6 100644
+--- a/arch/x86/kernel/apic/numaq_32.c
++++ b/arch/x86/kernel/apic/numaq_32.c
+@@ -257,14 +257,14 @@ static __init void early_check_numaq(void)
+ 		early_get_smp_config();
+ 
+ 	if (found_numaq) {
+-		x86_init.mpparse.mpc_record = numaq_mpc_record;
+-		x86_init.mpparse.setup_ioapic_ids = x86_init_noop;
+-		x86_init.mpparse.mpc_apic_id = mpc_apic_id;
+-		x86_init.mpparse.smp_read_mpc_oem = smp_read_mpc_oem;
+-		x86_init.mpparse.mpc_oem_pci_bus = mpc_oem_pci_bus;
+-		x86_init.mpparse.mpc_oem_bus_info = mpc_oem_bus_info;
+-		x86_init.timers.tsc_pre_init = numaq_tsc_init;
+-		x86_init.pci.init = pci_numaq_init;
++		*(void **)&x86_init.mpparse.mpc_record = numaq_mpc_record;
++		*(void **)&x86_init.mpparse.setup_ioapic_ids = x86_init_noop;
++		*(void **)&x86_init.mpparse.mpc_apic_id = mpc_apic_id;
++		*(void **)&x86_init.mpparse.smp_read_mpc_oem = smp_read_mpc_oem;
++		*(void **)&x86_init.mpparse.mpc_oem_pci_bus = mpc_oem_pci_bus;
++		*(void **)&x86_init.mpparse.mpc_oem_bus_info = mpc_oem_bus_info;
++		*(void **)&x86_init.timers.tsc_pre_init = numaq_tsc_init;
++		*(void **)&x86_init.pci.init = pci_numaq_init;
+ 	}
+ }
+ 
+diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
+index 79b05b8..0fc42b0 100644
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -139,8 +139,8 @@ static int __init uv_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
+ 			is_uv1 ? UV1_HUB_REVISION_BASE : UV2_HUB_REVISION_BASE;
+ 		pnodeid = early_get_pnodeid();
+ 		early_get_apic_pnode_shift();
+-		x86_platform.is_untracked_pat_range =  uv_is_untracked_pat_range;
+-		x86_platform.nmi_init = uv_nmi_init;
++		*(void **)&x86_platform.is_untracked_pat_range =  uv_is_untracked_pat_range;
++		*(void **)&x86_platform.nmi_init = uv_nmi_init;
+ 		if (!strcmp(oem_table_id, "UVL"))
+ 			uv_system_type = UV_LEGACY_APIC;
+ 		else if (!strcmp(oem_table_id, "UVX"))
 diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
 index a46bd38..6b906d7 100644
 --- a/arch/x86/kernel/apm_32.c
@@ -14486,8 +14374,99 @@ index 3e6ff6c..54b4992 100644
  	load_idt(&idt_descr);
  }
  #endif
+diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
+index 0e89635..279dd37 100644
+--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
+@@ -984,6 +984,22 @@ static struct attribute *default_attrs[] = {
+ };
+ 
+ #ifdef CONFIG_AMD_NB
++static struct attribute *default_attrs_amd_nb[] = {
++	&type.attr,
++	&level.attr,
++	&coherency_line_size.attr,
++	&physical_line_partition.attr,
++	&ways_of_associativity.attr,
++	&number_of_sets.attr,
++	&size.attr,
++	&shared_cpu_map.attr,
++	&shared_cpu_list.attr,
++	NULL,
++	NULL,
++	NULL,
++	NULL
++};
++
+ static struct attribute ** __cpuinit amd_l3_attrs(void)
+ {
+ 	static struct attribute **attrs;
+@@ -994,18 +1010,7 @@ static struct attribute ** __cpuinit amd_l3_attrs(void)
+ 
+ 	n = sizeof (default_attrs) / sizeof (struct attribute *);
+ 
+-	if (amd_nb_has_feature(AMD_NB_L3_INDEX_DISABLE))
+-		n += 2;
+-
+-	if (amd_nb_has_feature(AMD_NB_L3_PARTITIONING))
+-		n += 1;
+-
+-	attrs = kzalloc(n * sizeof (struct attribute *), GFP_KERNEL);
+-	if (attrs == NULL)
+-		return attrs = default_attrs;
+-
+-	for (n = 0; default_attrs[n]; n++)
+-		attrs[n] = default_attrs[n];
++	attrs = default_attrs_amd_nb;
+ 
+ 	if (amd_nb_has_feature(AMD_NB_L3_INDEX_DISABLE)) {
+ 		attrs[n++] = &cache_disable_0.attr;
+@@ -1056,6 +1061,13 @@ static struct kobj_type ktype_cache = {
+ 	.default_attrs	= default_attrs,
+ };
+ 
++#ifdef CONFIG_AMD_NB
++static struct kobj_type ktype_cache_amd_nb = {
++	.sysfs_ops	= &sysfs_ops,
++	.default_attrs	= default_attrs_amd_nb,
++};
++#endif
++
+ static struct kobj_type ktype_percpu_entry = {
+ 	.sysfs_ops	= &sysfs_ops,
+ };
+@@ -1121,20 +1133,26 @@ static int __cpuinit cache_add_dev(struct sys_device * sys_dev)
+ 		return retval;
+ 	}
+ 
++#ifdef CONFIG_AMD_NB
++	amd_l3_attrs();
++#endif
++
+ 	for (i = 0; i < num_cache_leaves; i++) {
++		struct kobj_type *ktype;
++
+ 		this_object = INDEX_KOBJECT_PTR(cpu, i);
+ 		this_object->cpu = cpu;
+ 		this_object->index = i;
+ 
+ 		this_leaf = CPUID4_INFO_IDX(cpu, i);
+ 
+-		ktype_cache.default_attrs = default_attrs;
++		ktype = &ktype_cache;
+ #ifdef CONFIG_AMD_NB
+ 		if (this_leaf->base.nb)
+-			ktype_cache.default_attrs = amd_l3_attrs();
++			ktype = &ktype_cache_amd_nb;
+ #endif
+ 		retval = kobject_init_and_add(&(this_object->kobj),
+-					      &ktype_cache,
++					      ktype,
+ 					      per_cpu(ici_cache_kobject, cpu),
+ 					      "index%1lu", i);
+ 		if (unlikely(retval)) {
 diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
-index 3b67877..2eab721 100644
+index 3b67877..6e11450 100644
 --- a/arch/x86/kernel/cpu/mcheck/mce.c
 +++ b/arch/x86/kernel/cpu/mcheck/mce.c
 @@ -42,6 +42,7 @@
@@ -14602,6 +14581,15 @@ index 3b67877..2eab721 100644
  	mce_chrdev_open_exclu = 0;
  
  	spin_unlock(&mce_chrdev_state_lock);
+@@ -2099,7 +2102,7 @@ mce_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
+ 	return NOTIFY_OK;
+ }
+ 
+-static struct notifier_block mce_cpu_notifier __cpuinitdata = {
++static struct notifier_block mce_cpu_notifier __cpuinitconst = {
+ 	.notifier_call = mce_cpu_callback,
+ };
+ 
 @@ -2177,7 +2180,7 @@ struct dentry *mce_get_debugfs_dir(void)
  static void mce_reset(void)
  {
@@ -14694,6 +14682,19 @@ index 2bda212..78cc605 100644
  	}
  }
  
+diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
+index d22d0c4..088eb6f 100644
+--- a/arch/x86/kernel/cpu/vmware.c
++++ b/arch/x86/kernel/cpu/vmware.c
+@@ -79,7 +79,7 @@ static void __init vmware_platform_setup(void)
+ 	VMWARE_PORT(GETHZ, eax, ebx, ecx, edx);
+ 
+ 	if (ebx != UINT_MAX)
+-		x86_platform.calibrate_tsc = vmware_get_tsc_khz;
++		*(void **)&x86_platform.calibrate_tsc = vmware_get_tsc_khz;
+ 	else
+ 		printk(KERN_WARNING
+ 		       "Failed to get TSC freq from the hypervisor\n");
 diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
 index 13ad899..f642b9a 100644
 --- a/arch/x86/kernel/crash.c
@@ -16989,10 +16990,10 @@ index c9a281f..3658fbe 100644
  		return -EFAULT;
  
 diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
-index 3bb0850..55a56f4 100644
+index 3bb0850..a5f08e5 100644
 --- a/arch/x86/kernel/head32.c
 +++ b/arch/x86/kernel/head32.c
-@@ -19,6 +19,7 @@
+@@ -19,12 +19,13 @@
  #include <asm/io_apic.h>
  #include <asm/bios_ebda.h>
  #include <asm/tlbflush.h>
@@ -17000,6 +17001,14 @@ index 3bb0850..55a56f4 100644
  
  static void __init i386_default_early_setup(void)
  {
+ 	/* Initialize 32bit specific setup functions */
+-	x86_init.resources.reserve_resources = i386_reserve_resources;
+-	x86_init.mpparse.setup_ioapic_ids = setup_ioapic_ids_from_mpc;
++	*(void **)&x86_init.resources.reserve_resources = i386_reserve_resources;
++	*(void **)&x86_init.mpparse.setup_ioapic_ids = setup_ioapic_ids_from_mpc;
+ 
+ 	reserve_ebda_region();
+ }
 @@ -33,7 +34,7 @@ void __init i386_start_kernel(void)
  {
  	memblock_init();
@@ -18335,9 +18344,18 @@ index 7da647d..c828808 100644
  			reset_current_kprobe();
  		preempt_enable_no_resched();
 diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
-index a9c2116..a52d4fc 100644
+index a9c2116..c15abd7 100644
 --- a/arch/x86/kernel/kvm.c
 +++ b/arch/x86/kernel/kvm.c
+@@ -422,7 +422,7 @@ static void __init paravirt_ops_setup(void)
+ 	pv_info.paravirt_enabled = 1;
+ 
+ 	if (kvm_para_has_feature(KVM_FEATURE_NOP_IO_DELAY))
+-		pv_cpu_ops.io_delay = kvm_io_delay;
++		*(void **)&pv_cpu_ops.io_delay = kvm_io_delay;
+ 
+ 	if (kvm_para_has_feature(KVM_FEATURE_MMU_OP)) {
+ 		pv_mmu_ops.set_pte = kvm_set_pte;
 @@ -437,6 +437,7 @@ static void __init paravirt_ops_setup(void)
  		pv_mmu_ops.set_pud = kvm_set_pud;
  #if PAGETABLE_LEVELS == 4
@@ -18346,6 +18364,54 @@ index a9c2116..a52d4fc 100644
  #endif
  #endif
  		pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
+@@ -601,15 +602,15 @@ void __init kvm_guest_init(void)
+ 	for (i = 0; i < KVM_TASK_SLEEP_HASHSIZE; i++)
+ 		spin_lock_init(&async_pf_sleepers[i].lock);
+ 	if (kvm_para_has_feature(KVM_FEATURE_ASYNC_PF))
+-		x86_init.irqs.trap_init = kvm_apf_trap_init;
++		*(void **)&x86_init.irqs.trap_init = kvm_apf_trap_init;
+ 
+ 	if (kvm_para_has_feature(KVM_FEATURE_STEAL_TIME)) {
+ 		has_steal_clock = 1;
+-		pv_time_ops.steal_clock = kvm_steal_clock;
++		*(void **)&pv_time_ops.steal_clock = kvm_steal_clock;
+ 	}
+ 
+ #ifdef CONFIG_SMP
+-	smp_ops.smp_prepare_boot_cpu = kvm_smp_prepare_boot_cpu;
++	*(void **)&smp_ops.smp_prepare_boot_cpu = kvm_smp_prepare_boot_cpu;
+ 	register_cpu_notifier(&kvm_cpu_notifier);
+ #else
+ 	kvm_guest_cpu_init();
+diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
+index 44842d7..4ac78f74 100644
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -189,17 +189,17 @@ void __init kvmclock_init(void)
+ 
+ 	if (kvm_register_clock("boot clock"))
+ 		return;
+-	pv_time_ops.sched_clock = kvm_clock_read;
+-	x86_platform.calibrate_tsc = kvm_get_tsc_khz;
+-	x86_platform.get_wallclock = kvm_get_wallclock;
+-	x86_platform.set_wallclock = kvm_set_wallclock;
++	*(void **)&pv_time_ops.sched_clock = kvm_clock_read;
++	*(void **)&x86_platform.calibrate_tsc = kvm_get_tsc_khz;
++	*(void **)&x86_platform.get_wallclock = kvm_get_wallclock;
++	*(void **)&x86_platform.set_wallclock = kvm_set_wallclock;
+ #ifdef CONFIG_X86_LOCAL_APIC
+-	x86_cpuinit.setup_percpu_clockev =
++	*(void **)&x86_cpuinit.setup_percpu_clockev =
+ 		kvm_setup_secondary_clock;
+ #endif
+-	machine_ops.shutdown  = kvm_shutdown;
++	*(void **)&machine_ops.shutdown  = kvm_shutdown;
+ #ifdef CONFIG_KEXEC
+-	machine_ops.crash_shutdown  = kvm_crash_shutdown;
++	*(void **)&machine_ops.crash_shutdown  = kvm_crash_shutdown;
+ #endif
+ 	kvm_get_preset_lpj();
+ 	clocksource_register_hz(&kvm_clock, NSEC_PER_SEC);
 diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
 index ea69726..604d066 100644
 --- a/arch/x86/kernel/ldt.c
@@ -18641,7 +18707,7 @@ index 676b8c7..870ba04 100644
  	.spin_is_locked = __ticket_spin_is_locked,
  	.spin_is_contended = __ticket_spin_is_contended,
 diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
-index d90272e..6bb013b 100644
+index d90272e..81820dd 100644
 --- a/arch/x86/kernel/paravirt.c
 +++ b/arch/x86/kernel/paravirt.c
 @@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
@@ -18695,18 +18761,7 @@ index d90272e..6bb013b 100644
  	.name = "bare hardware",
  	.paravirt_enabled = 0,
  	.kernel_rpl = 0,
-@@ -313,16 +320,16 @@ struct pv_info pv_info = {
- #endif
- };
- 
--struct pv_init_ops pv_init_ops = {
-+struct pv_init_ops pv_init_ops __read_only = {
- 	.patch = native_patch,
- };
- 
--struct pv_time_ops pv_time_ops = {
-+struct pv_time_ops pv_time_ops __read_only = {
- 	.sched_clock = native_sched_clock,
+@@ -322,7 +329,7 @@ struct pv_time_ops pv_time_ops = {
  	.steal_clock = native_steal_clock,
  };
  
@@ -18715,23 +18770,7 @@ index d90272e..6bb013b 100644
  	.save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
  	.restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
  	.irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
-@@ -334,7 +341,7 @@ struct pv_irq_ops pv_irq_ops = {
- #endif
- };
- 
--struct pv_cpu_ops pv_cpu_ops = {
-+struct pv_cpu_ops pv_cpu_ops __read_only = {
- 	.cpuid = native_cpuid,
- 	.get_debugreg = native_get_debugreg,
- 	.set_debugreg = native_set_debugreg,
-@@ -395,21 +402,26 @@ struct pv_cpu_ops pv_cpu_ops = {
- 	.end_context_switch = paravirt_nop,
- };
- 
--struct pv_apic_ops pv_apic_ops = {
-+struct pv_apic_ops pv_apic_ops __read_only = {
- #ifdef CONFIG_X86_LOCAL_APIC
- 	.startup_ipi_hook = paravirt_nop,
+@@ -401,15 +408,20 @@ struct pv_apic_ops pv_apic_ops = {
  #endif
  };
  
@@ -18775,6 +18814,19 @@ index d90272e..6bb013b 100644
  };
  
  EXPORT_SYMBOL_GPL(pv_time_ops);
+diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
+index 726494b..304df20 100644
+--- a/arch/x86/kernel/pci-calgary_64.c
++++ b/arch/x86/kernel/pci-calgary_64.c
+@@ -1463,7 +1463,7 @@ int __init detect_calgary(void)
+ 		printk(KERN_INFO "PCI-DMA: Calgary TCE table spec is %d\n",
+ 		       specified_table_size);
+ 
+-		x86_init.iommu.iommu_init = calgary_iommu_init;
++		*(void **)&x86_init.iommu.iommu_init = calgary_iommu_init;
+ 	}
+ 	return calgary_found;
+ 
 diff --git a/arch/x86/kernel/pci-iommu_table.c b/arch/x86/kernel/pci-iommu_table.c
 index 35ccf75..7a15747 100644
 --- a/arch/x86/kernel/pci-iommu_table.c
@@ -19095,7 +19147,7 @@ index 6a364a6..b147d11 100644
  		ip = *(u64 *)(fp+8);
  		if (!in_sched_functions(ip))
 diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
-index 2dc4121..3c2bbcd 100644
+index 2dc4121..89febda 100644
 --- a/arch/x86/kernel/ptrace.c
 +++ b/arch/x86/kernel/ptrace.c
 @@ -181,14 +181,13 @@ unsigned long kernel_stack_pointer(struct pt_regs *regs)
@@ -19143,6 +19195,41 @@ index 2dc4121..3c2bbcd 100644
  		break;
  #endif
  
+@@ -1229,7 +1228,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
+ 
+ #ifdef CONFIG_X86_64
+ 
+-static struct user_regset x86_64_regsets[] __read_mostly = {
++static struct user_regset x86_64_regsets[] = {
+ 	[REGSET_GENERAL] = {
+ 		.core_note_type = NT_PRSTATUS,
+ 		.n = sizeof(struct user_regs_struct) / sizeof(long),
+@@ -1273,7 +1272,7 @@ static const struct user_regset_view user_x86_64_view = {
+ #endif	/* CONFIG_X86_64 */
+ 
+ #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
+-static struct user_regset x86_32_regsets[] __read_mostly = {
++static struct user_regset x86_32_regsets[] = {
+ 	[REGSET_GENERAL] = {
+ 		.core_note_type = NT_PRSTATUS,
+ 		.n = sizeof(struct user_regs_struct32) / sizeof(u32),
+@@ -1326,13 +1325,13 @@ static const struct user_regset_view user_x86_32_view = {
+  */
+ u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS];
+ 
+-void update_regset_xstate_info(unsigned int size, u64 xstate_mask)
++void __init update_regset_xstate_info(unsigned int size, u64 xstate_mask)
+ {
+ #ifdef CONFIG_X86_64
+-	x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64);
++	*(unsigned int *)&x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64);
+ #endif
+ #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
+-	x86_32_regsets[REGSET_XSTATE].n = size / sizeof(u64);
++	*(unsigned int *)&x86_32_regsets[REGSET_XSTATE].n = size / sizeof(u64);
+ #endif
+ 	xstate_fx_sw_bytes[USER_XSTATE_XCR0_WORD] = xstate_mask;
+ }
 @@ -1361,7 +1360,7 @@ static void fill_sigtrap_info(struct task_struct *tsk,
  	memset(info, 0, sizeof(*info));
  	info->si_signo = SIGTRAP;
@@ -20701,6 +20788,19 @@ index 0f703f1..3b426f3 100644
  	   "kernel image bigger than KERNEL_IMAGE_SIZE");
  
  #ifdef CONFIG_SMP
+diff --git a/arch/x86/kernel/vsmp_64.c b/arch/x86/kernel/vsmp_64.c
+index a1d804b..1ab845e 100644
+--- a/arch/x86/kernel/vsmp_64.c
++++ b/arch/x86/kernel/vsmp_64.c
+@@ -98,7 +98,7 @@ static void __init set_vsmp_pv_ops(void)
+ 		pv_irq_ops.irq_enable  = PV_CALLEE_SAVE(vsmp_irq_enable);
+ 		pv_irq_ops.save_fl  = PV_CALLEE_SAVE(vsmp_save_fl);
+ 		pv_irq_ops.restore_fl  = PV_CALLEE_SAVE(vsmp_restore_fl);
+-		pv_init_ops.patch = vsmp_patch;
++		*(void **)&pv_init_ops.patch = vsmp_patch;
+ 
+ 		ctl &= ~(1 << 4);
+ 		writel(ctl, address + 4);
 diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
 index e4d4a22..47ee71f 100644
 --- a/arch/x86/kernel/vsyscall_64.c
@@ -21115,7 +21215,7 @@ index f4063fd..3c40814 100644
  	int r;
  	struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
 diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
-index cf4603b..de5b225 100644
+index cf4603b..21234b6 100644
 --- a/arch/x86/lguest/boot.c
 +++ b/arch/x86/lguest/boot.c
 @@ -1111,12 +1111,12 @@ static u32 lguest_apic_safe_wait_icr_idle(void)
@@ -21149,6 +21249,81 @@ index cf4603b..de5b225 100644
  }
  
  /*G:050
+@@ -1287,28 +1288,28 @@ __init void lguest_init(void)
+ 	pv_irq_ops.safe_halt = lguest_safe_halt;
+ 
+ 	/* Setup operations */
+-	pv_init_ops.patch = lguest_patch;
++	*(void **)&pv_init_ops.patch = lguest_patch;
+ 
+ 	/* Intercepts of various CPU instructions */
+-	pv_cpu_ops.load_gdt = lguest_load_gdt;
+-	pv_cpu_ops.cpuid = lguest_cpuid;
+-	pv_cpu_ops.load_idt = lguest_load_idt;
+-	pv_cpu_ops.iret = lguest_iret;
+-	pv_cpu_ops.load_sp0 = lguest_load_sp0;
+-	pv_cpu_ops.load_tr_desc = lguest_load_tr_desc;
+-	pv_cpu_ops.set_ldt = lguest_set_ldt;
+-	pv_cpu_ops.load_tls = lguest_load_tls;
+-	pv_cpu_ops.set_debugreg = lguest_set_debugreg;
+-	pv_cpu_ops.clts = lguest_clts;
+-	pv_cpu_ops.read_cr0 = lguest_read_cr0;
+-	pv_cpu_ops.write_cr0 = lguest_write_cr0;
+-	pv_cpu_ops.read_cr4 = lguest_read_cr4;
+-	pv_cpu_ops.write_cr4 = lguest_write_cr4;
+-	pv_cpu_ops.write_gdt_entry = lguest_write_gdt_entry;
+-	pv_cpu_ops.write_idt_entry = lguest_write_idt_entry;
+-	pv_cpu_ops.wbinvd = lguest_wbinvd;
+-	pv_cpu_ops.start_context_switch = paravirt_start_context_switch;
+-	pv_cpu_ops.end_context_switch = lguest_end_context_switch;
++	*(void **)&pv_cpu_ops.load_gdt = lguest_load_gdt;
++	*(void **)&pv_cpu_ops.cpuid = lguest_cpuid;
++	*(void **)&pv_cpu_ops.load_idt = lguest_load_idt;
++	*(void **)&pv_cpu_ops.iret = lguest_iret;
++	*(void **)&pv_cpu_ops.load_sp0 = lguest_load_sp0;
++	*(void **)&pv_cpu_ops.load_tr_desc = lguest_load_tr_desc;
++	*(void **)&pv_cpu_ops.set_ldt = lguest_set_ldt;
++	*(void **)&pv_cpu_ops.load_tls = lguest_load_tls;
++	*(void **)&pv_cpu_ops.set_debugreg = lguest_set_debugreg;
++	*(void **)&pv_cpu_ops.clts = lguest_clts;
++	*(void **)&pv_cpu_ops.read_cr0 = lguest_read_cr0;
++	*(void **)&pv_cpu_ops.write_cr0 = lguest_write_cr0;
++	*(void **)&pv_cpu_ops.read_cr4 = lguest_read_cr4;
++	*(void **)&pv_cpu_ops.write_cr4 = lguest_write_cr4;
++	*(void **)&pv_cpu_ops.write_gdt_entry = lguest_write_gdt_entry;
++	*(void **)&pv_cpu_ops.write_idt_entry = lguest_write_idt_entry;
++	*(void **)&pv_cpu_ops.wbinvd = lguest_wbinvd;
++	*(void **)&pv_cpu_ops.start_context_switch = paravirt_start_context_switch;
++	*(void **)&pv_cpu_ops.end_context_switch = lguest_end_context_switch;
+ 
+ 	/* Pagetable management */
+ 	pv_mmu_ops.write_cr3 = lguest_write_cr3;
+@@ -1336,11 +1337,11 @@ __init void lguest_init(void)
+ 	set_lguest_basic_apic_ops();
+ #endif
+ 
+-	x86_init.resources.memory_setup = lguest_memory_setup;
+-	x86_init.irqs.intr_init = lguest_init_IRQ;
+-	x86_init.timers.timer_init = lguest_time_init;
+-	x86_platform.calibrate_tsc = lguest_tsc_khz;
+-	x86_platform.get_wallclock =  lguest_get_wallclock;
++	*(void **)&x86_init.resources.memory_setup = lguest_memory_setup;
++	*(void **)&x86_init.irqs.intr_init = lguest_init_IRQ;
++	*(void **)&x86_init.timers.timer_init = lguest_time_init;
++	*(void **)&x86_platform.calibrate_tsc = lguest_tsc_khz;
++	*(void **)&x86_platform.get_wallclock =  lguest_get_wallclock;
+ 
+ 	/*
+ 	 * Now is a good time to look at the implementations of these functions
+@@ -1429,7 +1430,7 @@ __init void lguest_init(void)
+ 	 * routine.
+ 	 */
+ 	pm_power_off = lguest_power_off;
+-	machine_ops.restart = lguest_restart;
++	*(void **)&machine_ops.restart = lguest_restart;
+ 
+ 	/*
+ 	 * Now we're set up, call i386_start_kernel() in head32.c and we proceed
 diff --git a/arch/x86/lib/atomic64_32.c b/arch/x86/lib/atomic64_32.c
 index 042f682..c92afb6 100644
 --- a/arch/x86/lib/atomic64_32.c
@@ -25749,7 +25924,7 @@ index 7b179b4..6bd1777 100644
  
  	return (void *)vaddr;
 diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
-index be1ef57..55f0160 100644
+index be1ef57..2f2369b 100644
 --- a/arch/x86/mm/ioremap.c
 +++ b/arch/x86/mm/ioremap.c
 @@ -97,7 +97,7 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
@@ -25761,6 +25936,15 @@ index be1ef57..55f0160 100644
  			return NULL;
  		WARN_ON_ONCE(is_ram);
  	}
+@@ -256,7 +256,7 @@ EXPORT_SYMBOL(ioremap_prot);
+  *
+  * Caller must ensure there is only one unmapping for the same pointer.
+  */
+-void iounmap(volatile void __iomem *addr)
++void iounmap(const volatile void __iomem *addr)
+ {
+ 	struct vm_struct *p, *o;
+ 
 @@ -315,6 +315,9 @@ void *xlate_dev_mem_ptr(unsigned long phys)
  
  	/* If page is RAM, we can use __va. Otherwise ioremap and unmap. */
@@ -25892,7 +26076,7 @@ index 845df68..1d8d29f 100644
  		mm->unmap_area = arch_unmap_area_topdown;
  	}
 diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
-index de54b9b..799051e 100644
+index de54b9b..935281f 100644
 --- a/arch/x86/mm/mmio-mod.c
 +++ b/arch/x86/mm/mmio-mod.c
 @@ -194,7 +194,7 @@ static void pre(struct kmmio_probe *p, struct pt_regs *regs,
@@ -25922,6 +26106,24 @@ index de54b9b..799051e 100644
  	};
  	map.map_id = trace->id;
  
+@@ -290,7 +290,7 @@ void mmiotrace_ioremap(resource_size_t offset, unsigned long size,
+ 	ioremap_trace_core(offset, size, addr);
+ }
+ 
+-static void iounmap_trace_core(volatile void __iomem *addr)
++static void iounmap_trace_core(const volatile void __iomem *addr)
+ {
+ 	struct mmiotrace_map map = {
+ 		.phys = 0,
+@@ -328,7 +328,7 @@ not_enabled:
+ 	}
+ }
+ 
+-void mmiotrace_iounmap(volatile void __iomem *addr)
++void mmiotrace_iounmap(const volatile void __iomem *addr)
+ {
+ 	might_sleep();
+ 	if (is_enabled()) /* recheck and proper locking in *_core() */
 diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
 index b008656..773eac2 100644
 --- a/arch/x86/mm/pageattr-test.c
@@ -26868,6 +27070,19 @@ index bff89df..377758a 100644
  		unsigned long stack = kernel_stack_pointer(regs);
  		if (depth)
  			dump_trace(NULL, regs, (unsigned long *)stack, 0,
+diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
+index 0ed97d8..ac1ec9d 100644
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -436,7 +436,7 @@ int __init pci_acpi_init(void)
+ 	acpi_irq_penalty_init();
+ 	pcibios_enable_irq = acpi_pci_irq_enable;
+ 	pcibios_disable_irq = acpi_pci_irq_disable;
+-	x86_init.pci.init_irq = x86_init_noop;
++	*(void **)&x86_init.pci.init_irq = x86_init_noop;
+ 
+ 	if (pci_routeirq) {
+ 		/*
 diff --git a/arch/x86/pci/mrst.c b/arch/x86/pci/mrst.c
 index cb29191..036766d 100644
 --- a/arch/x86/pci/mrst.c
@@ -27191,6 +27406,60 @@ index db0e9a5..0372c14 100644
  	return !(ret & 0xff00);
  }
  EXPORT_SYMBOL(pcibios_set_irq_routing);
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index 4c262f6..01f170b 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -369,9 +369,9 @@ int __init pci_xen_init(void)
+ #endif
+ 
+ #ifdef CONFIG_PCI_MSI
+-	x86_msi.setup_msi_irqs = xen_setup_msi_irqs;
+-	x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
+-	x86_msi.teardown_msi_irqs = xen_teardown_msi_irqs;
++	*(void **)&x86_msi.setup_msi_irqs = xen_setup_msi_irqs;
++	*(void **)&x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
++	*(void **)&x86_msi.teardown_msi_irqs = xen_teardown_msi_irqs;
+ #endif
+ 	return 0;
+ }
+@@ -390,8 +390,8 @@ int __init pci_xen_hvm_init(void)
+ #endif
+ 
+ #ifdef CONFIG_PCI_MSI
+-	x86_msi.setup_msi_irqs = xen_hvm_setup_msi_irqs;
+-	x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
++	*(void **)&x86_msi.setup_msi_irqs = xen_hvm_setup_msi_irqs;
++	*(void **)&x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
+ #endif
+ 	return 0;
+ }
+@@ -448,8 +448,8 @@ int __init pci_xen_initial_domain(void)
+ 	int irq;
+ 
+ #ifdef CONFIG_PCI_MSI
+-	x86_msi.setup_msi_irqs = xen_initdom_setup_msi_irqs;
+-	x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
++	*(void **)&x86_msi.setup_msi_irqs = xen_initdom_setup_msi_irqs;
++	*(void **)&x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
+ #endif
+ 	xen_setup_acpi_sci();
+ 	__acpi_register_gsi = acpi_register_gsi_xen;
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 4d320b2..e9cf650 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -572,8 +572,8 @@ void __init efi_init(void)
+ 		do_add_efi_memmap();
+ 
+ #ifdef CONFIG_X86_32
+-	x86_platform.get_wallclock = efi_get_time;
+-	x86_platform.set_wallclock = efi_set_rtc_mmss;
++	*(void **)&x86_platform.get_wallclock = efi_get_time;
++	*(void **)&x86_platform.set_wallclock = efi_set_rtc_mmss;
+ #endif
+ 
+ #if EFI_DEBUG
 diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
 index 40e4469..1ab536e 100644
 --- a/arch/x86/platform/efi/efi_32.c
@@ -27430,7 +27699,7 @@ index 4c07cca..2c8427d 100644
  	ret
  ENDPROC(efi_call6)
 diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
-index ad4ec1c..686479e 100644
+index ad4ec1c..50d15e3 100644
 --- a/arch/x86/platform/mrst/mrst.c
 +++ b/arch/x86/platform/mrst/mrst.c
 @@ -76,18 +76,20 @@ struct sfi_rtc_table_entry sfi_mrtc_array[SFI_MRTC_MAX];
@@ -27456,6 +27725,105 @@ index ad4ec1c..686479e 100644
  }
  
  /* parse all the mtimer info to a static mtimer array */
+@@ -242,14 +244,14 @@ static void __init mrst_time_init(void)
+ 	case MRST_TIMER_APBT_ONLY:
+ 		break;
+ 	case MRST_TIMER_LAPIC_APBT:
+-		x86_init.timers.setup_percpu_clockev = setup_boot_APIC_clock;
+-		x86_cpuinit.setup_percpu_clockev = setup_secondary_APIC_clock;
++		*(void **)&x86_init.timers.setup_percpu_clockev = setup_boot_APIC_clock;
++		*(void **)&x86_cpuinit.setup_percpu_clockev = setup_secondary_APIC_clock;
+ 		break;
+ 	default:
+ 		if (!boot_cpu_has(X86_FEATURE_ARAT))
+ 			break;
+-		x86_init.timers.setup_percpu_clockev = setup_boot_APIC_clock;
+-		x86_cpuinit.setup_percpu_clockev = setup_secondary_APIC_clock;
++		*(void **)&x86_init.timers.setup_percpu_clockev = setup_boot_APIC_clock;
++		*(void **)&x86_cpuinit.setup_percpu_clockev = setup_secondary_APIC_clock;
+ 		return;
+ 	}
+ 	/* we need at least one APB timer */
+@@ -296,35 +298,35 @@ static unsigned char mrst_get_nmi_reason(void)
+  */
+ void __init x86_mrst_early_setup(void)
+ {
+-	x86_init.resources.probe_roms = x86_init_noop;
+-	x86_init.resources.reserve_resources = x86_init_noop;
++	*(void **)&x86_init.resources.probe_roms = x86_init_noop;
++	*(void **)&x86_init.resources.reserve_resources = x86_init_noop;
+ 
+-	x86_init.timers.timer_init = mrst_time_init;
+-	x86_init.timers.setup_percpu_clockev = x86_init_noop;
++	*(void **)&x86_init.timers.timer_init = mrst_time_init;
++	*(void **)&x86_init.timers.setup_percpu_clockev = x86_init_noop;
+ 
+-	x86_init.irqs.pre_vector_init = x86_init_noop;
++	*(void **)&x86_init.irqs.pre_vector_init = x86_init_noop;
+ 
+-	x86_init.oem.arch_setup = mrst_arch_setup;
++	*(void **)&x86_init.oem.arch_setup = mrst_arch_setup;
+ 
+-	x86_cpuinit.setup_percpu_clockev = apbt_setup_secondary_clock;
++	*(void **)&x86_cpuinit.setup_percpu_clockev = apbt_setup_secondary_clock;
+ 
+-	x86_platform.calibrate_tsc = mrst_calibrate_tsc;
+-	x86_platform.i8042_detect = mrst_i8042_detect;
+-	x86_init.timers.wallclock_init = mrst_rtc_init;
+-	x86_platform.get_nmi_reason = mrst_get_nmi_reason;
++	*(void **)&x86_platform.calibrate_tsc = mrst_calibrate_tsc;
++	*(void **)&x86_platform.i8042_detect = mrst_i8042_detect;
++	*(void **)&x86_init.timers.wallclock_init = mrst_rtc_init;
++	*(void **)&x86_platform.get_nmi_reason = mrst_get_nmi_reason;
+ 
+-	x86_init.pci.init = pci_mrst_init;
+-	x86_init.pci.fixup_irqs = x86_init_noop;
++	*(void **)&x86_init.pci.init = pci_mrst_init;
++	*(void **)&x86_init.pci.fixup_irqs = x86_init_noop;
+ 
+ 	legacy_pic = &null_legacy_pic;
+ 
+ 	/* Moorestown specific power_off/restart method */
+ 	pm_power_off = mrst_power_off;
+-	machine_ops.emergency_restart  = mrst_reboot;
++	*(void **)&machine_ops.emergency_restart  = mrst_reboot;
+ 
+ 	/* Avoid searching for BIOS MP tables */
+-	x86_init.mpparse.find_smp_config = x86_init_noop;
+-	x86_init.mpparse.get_smp_config = x86_init_uint_noop;
++	*(void **)&x86_init.mpparse.find_smp_config = x86_init_noop;
++	*(void **)&x86_init.mpparse.get_smp_config = x86_init_uint_noop;
+ 	set_bit(MP_BUS_ISA, mp_bus_not_pci);
+ }
+ 
+diff --git a/arch/x86/platform/mrst/vrtc.c b/arch/x86/platform/mrst/vrtc.c
+index 225bd0f..22e8086 100644
+--- a/arch/x86/platform/mrst/vrtc.c
++++ b/arch/x86/platform/mrst/vrtc.c
+@@ -120,8 +120,8 @@ void __init mrst_rtc_init(void)
+ 
+ 	vrtc_virt_base = (void __iomem *)set_fixmap_offset_nocache(FIX_LNW_VRTC,
+ 								vrtc_paddr);
+-	x86_platform.get_wallclock = vrtc_get_time;
+-	x86_platform.set_wallclock = vrtc_set_mmss;
++	*(void **)&x86_platform.get_wallclock = vrtc_get_time;
++	*(void **)&x86_platform.set_wallclock = vrtc_set_mmss;
+ }
+ 
+ /*
+diff --git a/arch/x86/platform/olpc/olpc_dt.c b/arch/x86/platform/olpc/olpc_dt.c
+index d6ee929..3637cb5 100644
+--- a/arch/x86/platform/olpc/olpc_dt.c
++++ b/arch/x86/platform/olpc/olpc_dt.c
+@@ -156,7 +156,7 @@ void * __init prom_early_alloc(unsigned long size)
+ 	return res;
+ }
+ 
+-static struct of_pdt_ops prom_olpc_ops __initdata = {
++static struct of_pdt_ops prom_olpc_ops __initconst = {
+ 	.nextprop = olpc_dt_nextprop,
+ 	.getproplen = olpc_dt_getproplen,
+ 	.getproperty = olpc_dt_getproperty,
 diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
 index f10c0af..78a3d87 100644
 --- a/arch/x86/power/cpu.c
@@ -27852,7 +28220,7 @@ index 153407c..611cba9 100644
 -}
 -__setup("vdso=", vdso_setup);
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 69b9ef6..cbe5f3a 100644
+index 69b9ef6..8b8429e 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -86,8 +86,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -27913,6 +28281,45 @@ index 69b9ef6..cbe5f3a 100644
  {
  	xen_reboot(SHUTDOWN_poweroff);
  }
+@@ -1125,14 +1123,14 @@ static const struct machine_ops xen_machine_ops __initconst = {
+  */
+ static void __init xen_setup_stackprotector(void)
+ {
+-	pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry_boot;
+-	pv_cpu_ops.load_gdt = xen_load_gdt_boot;
++	*(void **)&pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry_boot;
++	*(void **)&pv_cpu_ops.load_gdt = xen_load_gdt_boot;
+ 
+ 	setup_stack_canary_segment(0);
+ 	switch_to_new_gdt(0);
+ 
+-	pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
+-	pv_cpu_ops.load_gdt = xen_load_gdt;
++	*(void **)&pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
++	*(void **)&pv_cpu_ops.load_gdt = xen_load_gdt;
+ }
+ 
+ /* First C function to be called on Xen boot */
+@@ -1151,13 +1149,13 @@ asmlinkage void __init xen_start_kernel(void)
+ 
+ 	/* Install Xen paravirt ops */
+ 	pv_info = xen_info;
+-	pv_init_ops = xen_init_ops;
+-	pv_cpu_ops = xen_cpu_ops;
+-	pv_apic_ops = xen_apic_ops;
++	memcpy((void *)&pv_init_ops, &xen_init_ops, sizeof pv_init_ops);
++	memcpy((void *)&pv_cpu_ops, &xen_cpu_ops, sizeof pv_cpu_ops);
++	memcpy((void *)&pv_apic_ops, &xen_apic_ops, sizeof pv_apic_ops);
+ 
+-	x86_init.resources.memory_setup = xen_memory_setup;
+-	x86_init.oem.arch_setup = xen_arch_setup;
+-	x86_init.oem.banner = xen_banner;
++	*(void **)&x86_init.resources.memory_setup = xen_memory_setup;
++	*(void **)&x86_init.oem.arch_setup = xen_arch_setup;
++	*(void **)&x86_init.oem.banner = xen_banner;
+ 
+ 	xen_init_time_ops();
+ 
 @@ -1181,7 +1179,17 @@ asmlinkage void __init xen_start_kernel(void)
  	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
  
@@ -27932,22 +28339,64 @@ index 69b9ef6..cbe5f3a 100644
  
  	xen_setup_features();
  
-@@ -1212,13 +1220,6 @@ asmlinkage void __init xen_start_kernel(void)
- 
- 	machine_ops = xen_machine_ops;
+@@ -1210,14 +1218,7 @@ asmlinkage void __init xen_start_kernel(void)
+ 		pv_mmu_ops.ptep_modify_prot_commit = xen_ptep_modify_prot_commit;
+ 	}
  
+-	machine_ops = xen_machine_ops;
+-
 -	/*
 -	 * The only reliable way to retain the initial address of the
 -	 * percpu gdt_page is to remember it here, so we can go and
 -	 * mark it RW later, when the initial percpu area is freed.
 -	 */
 -	xen_initial_gdt = &per_cpu(gdt_page, 0);
--
++	memcpy((void *)&machine_ops, &xen_machine_ops, sizeof machine_ops);
+ 
  	xen_smp_init();
  
- #ifdef CONFIG_ACPI_NUMA
+@@ -1293,7 +1294,7 @@ asmlinkage void __init xen_start_kernel(void)
+ 		add_preferred_console("tty", 0, NULL);
+ 		add_preferred_console("hvc", 0, NULL);
+ 		if (pci_xen)
+-			x86_init.pci.arch_init = pci_xen_init;
++			*(void **)&x86_init.pci.arch_init = pci_xen_init;
+ 	} else {
+ 		const struct dom0_vga_console_info *info =
+ 			(void *)((char *)xen_start_info +
+@@ -1307,8 +1308,8 @@ asmlinkage void __init xen_start_kernel(void)
+ 		pci_request_acs();
+ 
+ 		/* Avoid searching for BIOS MP tables */
+-		x86_init.mpparse.find_smp_config = x86_init_noop;
+-		x86_init.mpparse.get_smp_config = x86_init_uint_noop;
++		*(void **)&x86_init.mpparse.find_smp_config = x86_init_noop;
++		*(void **)&x86_init.mpparse.get_smp_config = x86_init_uint_noop;
+ 	}
+ #ifdef CONFIG_PCI
+ 	/* PCI BIOS service won't work from a PV guest. */
+@@ -1420,7 +1421,7 @@ static void __init xen_hvm_guest_init(void)
+ 	xen_hvm_smp_init();
+ 	register_cpu_notifier(&xen_hvm_cpu_notifier);
+ 	xen_unplug_emulated_devices();
+-	x86_init.irqs.intr_init = xen_init_IRQ;
++	*(void **)&x86_init.irqs.intr_init = xen_init_IRQ;
+ 	xen_hvm_init_time_ops();
+ 	xen_hvm_init_mmu_ops();
+ }
+diff --git a/arch/x86/xen/irq.c b/arch/x86/xen/irq.c
+index 8bbb465..dcc060a 100644
+--- a/arch/x86/xen/irq.c
++++ b/arch/x86/xen/irq.c
+@@ -129,5 +129,5 @@ static const struct pv_irq_ops xen_irq_ops __initconst = {
+ void __init xen_init_irq_ops(void)
+ {
+ 	pv_irq_ops = xen_irq_ops;
+-	x86_init.irqs.intr_init = xen_init_IRQ;
++	*(void **)&x86_init.irqs.intr_init = xen_init_IRQ;
+ }
 diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index 2b8b0de..0787f8a 100644
+index 2b8b0de..34eb69e 100644
 --- a/arch/x86/xen/mmu.c
 +++ b/arch/x86/xen/mmu.c
 @@ -1757,6 +1757,9 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
@@ -27988,8 +28437,21 @@ index 2b8b0de..0787f8a 100644
  
  	.alloc_pud = xen_alloc_pmd_init,
  	.release_pud = xen_release_pmd_init,
+@@ -2086,9 +2095,9 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
+ 
+ void __init xen_init_mmu_ops(void)
+ {
+-	x86_init.mapping.pagetable_reserve = xen_mapping_pagetable_reserve;
+-	x86_init.paging.pagetable_setup_start = xen_pagetable_setup_start;
+-	x86_init.paging.pagetable_setup_done = xen_pagetable_setup_done;
++	*(void **)&x86_init.mapping.pagetable_reserve = xen_mapping_pagetable_reserve;
++	*(void **)&x86_init.paging.pagetable_setup_start = xen_pagetable_setup_start;
++	*(void **)&x86_init.paging.pagetable_setup_done = xen_pagetable_setup_done;
+ 	pv_mmu_ops = xen_mmu_ops;
+ 
+ 	memset(dummy_mapping, 0xff, PAGE_SIZE);
 diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
-index 9a23fff..9dfee11ca 100644
+index 9a23fff..ddaa2fa 100644
 --- a/arch/x86/xen/smp.c
 +++ b/arch/x86/xen/smp.c
 @@ -209,11 +209,6 @@ static void __init xen_smp_prepare_boot_cpu(void)
@@ -28036,6 +28498,101 @@ index 9a23fff..9dfee11ca 100644
  #endif
  	xen_setup_runstate_info(cpu);
  	xen_setup_timer(cpu);
+@@ -536,7 +530,7 @@ static const struct smp_ops xen_smp_ops __initconst = {
+ 
+ void __init xen_smp_init(void)
+ {
+-	smp_ops = xen_smp_ops;
++	memcpy((void *)&smp_ops, &xen_smp_ops, sizeof smp_ops);
+ 	xen_fill_possible_map();
+ 	xen_init_spinlocks();
+ }
+@@ -570,10 +564,10 @@ void __init xen_hvm_smp_init(void)
+ {
+ 	if (!xen_have_vector_callback)
+ 		return;
+-	smp_ops.smp_prepare_cpus = xen_hvm_smp_prepare_cpus;
+-	smp_ops.smp_send_reschedule = xen_smp_send_reschedule;
+-	smp_ops.cpu_up = xen_hvm_cpu_up;
+-	smp_ops.cpu_die = xen_hvm_cpu_die;
+-	smp_ops.send_call_func_ipi = xen_smp_send_call_function_ipi;
+-	smp_ops.send_call_func_single_ipi = xen_smp_send_call_function_single_ipi;
++	*(void **)&smp_ops.smp_prepare_cpus = xen_hvm_smp_prepare_cpus;
++	*(void **)&smp_ops.smp_send_reschedule = xen_smp_send_reschedule;
++	*(void **)&smp_ops.cpu_up = xen_hvm_cpu_up;
++	*(void **)&smp_ops.cpu_die = xen_hvm_cpu_die;
++	*(void **)&smp_ops.send_call_func_ipi = xen_smp_send_call_function_ipi;
++	*(void **)&smp_ops.send_call_func_single_ipi = xen_smp_send_call_function_single_ipi;
+ }
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index d69cc6c..8afa11d 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -390,12 +390,12 @@ void __init xen_init_spinlocks(void)
+ {
+ 	BUILD_BUG_ON(sizeof(struct xen_spinlock) > sizeof(arch_spinlock_t));
+ 
+-	pv_lock_ops.spin_is_locked = xen_spin_is_locked;
+-	pv_lock_ops.spin_is_contended = xen_spin_is_contended;
+-	pv_lock_ops.spin_lock = xen_spin_lock;
+-	pv_lock_ops.spin_lock_flags = xen_spin_lock_flags;
+-	pv_lock_ops.spin_trylock = xen_spin_trylock;
+-	pv_lock_ops.spin_unlock = xen_spin_unlock;
++	*(void **)&pv_lock_ops.spin_is_locked = xen_spin_is_locked;
++	*(void **)&pv_lock_ops.spin_is_contended = xen_spin_is_contended;
++	*(void **)&pv_lock_ops.spin_lock = xen_spin_lock;
++	*(void **)&pv_lock_ops.spin_lock_flags = xen_spin_lock_flags;
++	*(void **)&pv_lock_ops.spin_trylock = xen_spin_trylock;
++	*(void **)&pv_lock_ops.spin_unlock = xen_spin_unlock;
+ }
+ 
+ #ifdef CONFIG_XEN_DEBUG_FS
+diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
+index 0296a95..3c51a2d 100644
+--- a/arch/x86/xen/time.c
++++ b/arch/x86/xen/time.c
+@@ -481,15 +481,15 @@ static void __init xen_time_init(void)
+ 
+ void __init xen_init_time_ops(void)
+ {
+-	pv_time_ops = xen_time_ops;
++	memcpy((void *)&pv_time_ops, &xen_time_ops, sizeof pv_time_ops);
+ 
+-	x86_init.timers.timer_init = xen_time_init;
+-	x86_init.timers.setup_percpu_clockev = x86_init_noop;
+-	x86_cpuinit.setup_percpu_clockev = x86_init_noop;
++	*(void **)&x86_init.timers.timer_init = xen_time_init;
++	*(void **)&x86_init.timers.setup_percpu_clockev = x86_init_noop;
++	*(void **)&x86_cpuinit.setup_percpu_clockev = x86_init_noop;
+ 
+-	x86_platform.calibrate_tsc = xen_tsc_khz;
+-	x86_platform.get_wallclock = xen_get_wallclock;
+-	x86_platform.set_wallclock = xen_set_wallclock;
++	*(void **)&x86_platform.calibrate_tsc = xen_tsc_khz;
++	*(void **)&x86_platform.get_wallclock = xen_get_wallclock;
++	*(void **)&x86_platform.set_wallclock = xen_set_wallclock;
+ }
+ 
+ #ifdef CONFIG_XEN_PVHVM
+@@ -514,12 +514,12 @@ void __init xen_hvm_init_time_ops(void)
+ 		return;
+ 	}
+ 
+-	pv_time_ops = xen_time_ops;
+-	x86_init.timers.setup_percpu_clockev = xen_time_init;
+-	x86_cpuinit.setup_percpu_clockev = xen_hvm_setup_cpu_clockevents;
++	memcpy((void *)&pv_time_ops, &xen_time_ops, sizeof pv_time_ops);
++	*(void **)&x86_init.timers.setup_percpu_clockev = xen_time_init;
++	*(void **)&x86_cpuinit.setup_percpu_clockev = xen_hvm_setup_cpu_clockevents;
+ 
+-	x86_platform.calibrate_tsc = xen_tsc_khz;
+-	x86_platform.get_wallclock = xen_get_wallclock;
+-	x86_platform.set_wallclock = xen_set_wallclock;
++	*(void **)&x86_platform.calibrate_tsc = xen_tsc_khz;
++	*(void **)&x86_platform.get_wallclock = xen_get_wallclock;
++	*(void **)&x86_platform.set_wallclock = xen_set_wallclock;
+ }
+ #endif
 diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
 index b040b0e..8cc4fe0 100644
 --- a/arch/x86/xen/xen-asm_32.S
@@ -30110,6 +30667,52 @@ index 1e888c9..05cf1b0 100644
  	set_fs(old_fs);
  	if (likely(bw == len))
  		return 0;
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index 2678b6f..374ae19 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -419,7 +419,6 @@ int register_cdrom(struct cdrom_device_info *cdi)
+ 	ENSURE(reset, CDC_RESET);
+ 	ENSURE(generic_packet, CDC_GENERIC_PACKET);
+ 	cdi->mc_flags = 0;
+-	cdo->n_minors = 0;
+         cdi->options = CDO_USE_FFLAGS;
+ 	
+ 	if (autoclose==1 && CDROM_CAN(CDC_CLOSE_TRAY))
+@@ -439,8 +438,11 @@ int register_cdrom(struct cdrom_device_info *cdi)
+ 	else
+ 		cdi->cdda_method = CDDA_OLD;
+ 
+-	if (!cdo->generic_packet)
+-		cdo->generic_packet = cdrom_dummy_generic_packet;
++	if (!cdo->generic_packet) {
++		pax_open_kernel();
++		*(void **)&cdo->generic_packet = cdrom_dummy_generic_packet;
++		pax_close_kernel();
++	}
+ 
+ 	cdinfo(CD_REG_UNREG, "drive \"/dev/%s\" registered\n", cdi->name);
+ 	mutex_lock(&cdrom_mutex);
+@@ -461,7 +463,6 @@ void unregister_cdrom(struct cdrom_device_info *cdi)
+ 	if (cdi->exit)
+ 		cdi->exit(cdi);
+ 
+-	cdi->ops->n_minors--;
+ 	cdinfo(CD_REG_UNREG, "drive \"/dev/%s\" unregistered\n", cdi->name);
+ }
+ 
+diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
+index 3ceaf00..e3c3d38 100644
+--- a/drivers/cdrom/gdrom.c
++++ b/drivers/cdrom/gdrom.c
+@@ -491,7 +491,6 @@ static struct cdrom_device_ops gdrom_ops = {
+ 	.audio_ioctl		= gdrom_audio_ioctl,
+ 	.capability		= CDC_MULTI_SESSION | CDC_MEDIA_CHANGED |
+ 				  CDC_RESET | CDC_DRIVE_STATUS | CDC_CD_R,
+-	.n_minors		= 1,
+ };
+ 
+ static int gdrom_bdops_open(struct block_device *bdev, fmode_t mode)
 diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
 index 4364303..9adf4ee 100644
 --- a/drivers/char/Kconfig
@@ -30446,7 +31049,7 @@ index da3cfee..a5a6606 100644
  
  	*ppos = i;
 diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 8ae9235..0cbaf55 100644
+index 8ae9235..c7aab59 100644
 --- a/drivers/char/random.c
 +++ b/drivers/char/random.c
 @@ -269,8 +269,13 @@
@@ -30500,25 +31103,7 @@ index 8ae9235..0cbaf55 100644
  	smp_wmb();
  
  	if (out)
-@@ -821,6 +834,17 @@ void add_disk_randomness(struct gendisk *disk)
- }
- #endif
- 
-+#ifdef CONFIG_PAX_LATENT_ENTROPY
-+u64 latent_entropy;
-+
-+__init void transfer_latent_entropy(void)
-+{
-+	mix_pool_bytes(&input_pool, &latent_entropy, sizeof(latent_entropy), NULL);
-+	mix_pool_bytes(&nonblocking_pool, &latent_entropy, sizeof(latent_entropy), NULL);
-+//	printk(KERN_INFO "PAX: transferring latent entropy: %16llx\n", latent_entropy);
-+}
-+#endif
-+
- /*********************************************************************
-  *
-  * Entropy extraction routines
-@@ -979,6 +1003,10 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+@@ -979,6 +992,10 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
  	ssize_t ret = 0, i;
  	__u8 tmp[EXTRACT_SIZE];
  
@@ -30529,7 +31114,7 @@ index 8ae9235..0cbaf55 100644
  	xfer_secondary_pool(r, nbytes);
  	nbytes = account(r, nbytes, min, reserved);
  
-@@ -988,6 +1016,17 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+@@ -988,6 +1005,17 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
  		if (fips_enabled) {
  			unsigned long flags;
  
@@ -30547,7 +31132,7 @@ index 8ae9235..0cbaf55 100644
  			spin_lock_irqsave(&r->lock, flags);
  			if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
  				panic("Hardware RNG duplicated output!\n");
-@@ -1028,7 +1067,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
+@@ -1028,7 +1056,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
  
  		extract_buf(r, tmp);
  		i = min_t(int, nbytes, EXTRACT_SIZE);
@@ -30556,7 +31141,7 @@ index 8ae9235..0cbaf55 100644
  			ret = -EFAULT;
  			break;
  		}
-@@ -1105,6 +1144,7 @@ static void init_std_data(struct entropy_store *r)
+@@ -1105,6 +1133,7 @@ static void init_std_data(struct entropy_store *r)
  
  	r->entropy_count = 0;
  	r->entropy_total = 0;
@@ -30564,7 +31149,7 @@ index 8ae9235..0cbaf55 100644
  	mix_pool_bytes(r, &now, sizeof(now), NULL);
  	for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof(rv)) {
  		if (!arch_get_random_long(&rv))
-@@ -1379,7 +1419,7 @@ EXPORT_SYMBOL(generate_random_uuid);
+@@ -1379,7 +1408,7 @@ EXPORT_SYMBOL(generate_random_uuid);
  #include <linux/sysctl.h>
  
  static int min_read_thresh = 8, min_write_thresh;
@@ -31120,6 +31705,23 @@ index b298158..7ed8432 100644
  
  	iounmap(buf);
  	return 0;
+diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
+index 3e60e8d..2a9e727 100644
+--- a/drivers/firmware/efivars.c
++++ b/drivers/firmware/efivars.c
+@@ -1232,9 +1232,9 @@ efivars_init(void)
+ 		return -ENOMEM;
+ 	}
+ 
+-	ops.get_variable = efi.get_variable;
+-	ops.set_variable = efi.set_variable;
+-	ops.get_next_variable = efi.get_next_variable;
++	*(void **)&ops.get_variable = efi.get_variable;
++	*(void **)&ops.set_variable = efi.set_variable;
++	*(void **)&ops.get_next_variable = efi.get_next_variable;
+ 	error = register_efivars(&__efivars, &ops, efi_kobj);
+ 	if (error)
+ 		goto err_put;
 diff --git a/drivers/gpio/gpio-vr41xx.c b/drivers/gpio/gpio-vr41xx.c
 index 98723cb..10ca85b 100644
 --- a/drivers/gpio/gpio-vr41xx.c
@@ -31560,18 +32162,9 @@ index ca67338..0003ba7 100644
  	return can_switch;
  }
 diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 791df46..88fc1f9 100644
+index 012a9d2..3b2267c 100644
 --- a/drivers/gpu/drm/i915/i915_drv.h
 +++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -229,7 +229,7 @@ struct drm_i915_display_funcs {
- 	/* render clock increase/decrease */
- 	/* display clock increase/decrease */
- 	/* pll clock increase/decrease */
--};
-+} __no_const;
- 
- struct intel_device_info {
- 	u8 gen;
 @@ -319,7 +319,7 @@ typedef struct drm_i915_private {
  	int current_page;
  	int page_flipping;
@@ -31674,7 +32267,7 @@ index 93e74fb..4a1182d 100644
  	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
  	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 54acad3..39160c0 100644
+index fa9639b..2180f44 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
 @@ -2214,7 +2214,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
@@ -31729,6 +32322,26 @@ index 54acad3..39160c0 100644
  	drm_gem_object_unreference(&work->old_fb_obj->base);
  	drm_gem_object_unreference(&obj->base);
  	mutex_unlock(&dev->struct_mutex);
+@@ -7472,11 +7477,15 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
+ 	if (HAS_PCH_SPLIT(dev)) {
+ 		if (pipe == 2 && IS_IVYBRIDGE(dev))
+ 			intel_crtc->no_pll = true;
+-		intel_helper_funcs.prepare = ironlake_crtc_prepare;
+-		intel_helper_funcs.commit = ironlake_crtc_commit;
++		pax_open_kernel();
++		*(void **)&intel_helper_funcs.prepare = ironlake_crtc_prepare;
++		*(void **)&intel_helper_funcs.commit = ironlake_crtc_commit;
++		pax_close_kernel();
+ 	} else {
+-		intel_helper_funcs.prepare = i9xx_crtc_prepare;
+-		intel_helper_funcs.commit = i9xx_crtc_commit;
++		pax_open_kernel();
++		*(void **)&intel_helper_funcs.prepare = i9xx_crtc_prepare;
++		*(void **)&intel_helper_funcs.commit = i9xx_crtc_commit;
++		pax_close_kernel();
+ 	}
+ 
+ 	drm_crtc_helper_add(&intel_crtc->base, &intel_helper_funcs);
 diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
 index 54558a0..2d97005 100644
 --- a/drivers/gpu/drm/mga/mga_drv.h
@@ -31997,6 +32610,21 @@ index a9e33ce..09edd4b 100644
  }
  
  #endif
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index 0977849..3355dc2 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -3064,7 +3064,9 @@ static int evergreen_startup(struct radeon_device *rdev)
+ 	r = evergreen_blit_init(rdev);
+ 	if (r) {
+ 		r600_blit_fini(rdev);
+-		rdev->asic->copy = NULL;
++		pax_open_kernel();
++		*(void **)&rdev->asic->copy = NULL;
++		pax_close_kernel();
+ 		dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
+ 	}
+ 
 diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
 index 5a82b6b..9e69c73 100644
 --- a/drivers/gpu/drm/radeon/mkregtable.c
@@ -32018,6 +32646,70 @@ index 5a82b6b..9e69c73 100644
  
  	if (regcomp
  	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index 636255b..4b2411d 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1379,7 +1379,9 @@ static int cayman_startup(struct radeon_device *rdev)
+ 	r = evergreen_blit_init(rdev);
+ 	if (r) {
+ 		r600_blit_fini(rdev);
+-		rdev->asic->copy = NULL;
++		pax_open_kernel();
++		*(void **)&rdev->asic->copy = NULL;
++		pax_close_kernel();
+ 		dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
+ 	}
+ 
+diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
+index fad7cd1..56ef262 100644
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -592,8 +592,10 @@ int r100_pci_gart_init(struct radeon_device *rdev)
+ 	if (r)
+ 		return r;
+ 	rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
+-	rdev->asic->gart_tlb_flush = &r100_pci_gart_tlb_flush;
+-	rdev->asic->gart_set_page = &r100_pci_gart_set_page;
++	pax_open_kernel();
++	*(void **)&rdev->asic->gart_tlb_flush = &r100_pci_gart_tlb_flush;
++	*(void **)&rdev->asic->gart_set_page = &r100_pci_gart_set_page;
++	pax_close_kernel();
+ 	return radeon_gart_table_ram_alloc(rdev);
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
+index c93bc64..5a58f5b 100644
+--- a/drivers/gpu/drm/radeon/r300.c
++++ b/drivers/gpu/drm/radeon/r300.c
+@@ -105,8 +105,10 @@ int rv370_pcie_gart_init(struct radeon_device *rdev)
+ 	if (r)
+ 		DRM_ERROR("Failed to register debugfs file for PCIE gart !\n");
+ 	rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
+-	rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
+-	rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
++	pax_open_kernel();
++	*(void **)&rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
++	*(void **)&rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
++	pax_close_kernel();
+ 	return radeon_gart_table_vram_alloc(rdev);
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index bdfa82a..96e91ee 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -2439,7 +2439,9 @@ int r600_startup(struct radeon_device *rdev)
+ 	r = r600_blit_init(rdev);
+ 	if (r) {
+ 		r600_blit_fini(rdev);
+-		rdev->asic->copy = NULL;
++		pax_open_kernel();
++		*(void **)&rdev->asic->copy = NULL;
++		pax_close_kernel();
+ 		dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
+ 	}
+ 
 diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
 index cb1acff..8861bc5 100644
 --- a/drivers/gpu/drm/radeon/r600_cs.c
@@ -32031,7 +32723,7 @@ index cb1acff..8861bc5 100644
  	case V_038000_SQ_TEX_DIM_1D:
  	case V_038000_SQ_TEX_DIM_2D:
 diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
-index 28e69e9..d5836543 100644
+index 28e69e9..c4a82cc 100644
 --- a/drivers/gpu/drm/radeon/radeon.h
 +++ b/drivers/gpu/drm/radeon/radeon.h
 @@ -177,7 +177,7 @@ extern int sumo_get_temp(struct radeon_device *rdev);
@@ -32043,24 +32735,62 @@ index 28e69e9..d5836543 100644
  	uint32_t			last_seq;
  	unsigned long			last_jiffies;
  	unsigned long			last_timeout;
-@@ -515,7 +515,7 @@ struct r600_blit_cp_primitives {
- 			     int x2, int y2);
- 	void (*draw_auto)(struct radeon_device *rdev);
- 	void (*set_default_state)(struct radeon_device *rdev);
--};
-+} __no_const;
+diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
+index a2e1eae..8e4a0ec 100644
+--- a/drivers/gpu/drm/radeon/radeon_asic.c
++++ b/drivers/gpu/drm/radeon/radeon_asic.c
+@@ -114,13 +114,17 @@ void radeon_agp_disable(struct radeon_device *rdev)
+ 			rdev->family == CHIP_R423) {
+ 		DRM_INFO("Forcing AGP to PCIE mode\n");
+ 		rdev->flags |= RADEON_IS_PCIE;
+-		rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
+-		rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
++		pax_open_kernel();
++		*(void **)&rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
++		*(void **)&rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
++		pax_close_kernel();
+ 	} else {
+ 		DRM_INFO("Forcing AGP to PCI mode\n");
+ 		rdev->flags |= RADEON_IS_PCI;
+-		rdev->asic->gart_tlb_flush = &r100_pci_gart_tlb_flush;
+-		rdev->asic->gart_set_page = &r100_pci_gart_set_page;
++		pax_open_kernel();
++		*(void **)&rdev->asic->gart_tlb_flush = &r100_pci_gart_tlb_flush;
++		*(void **)&rdev->asic->gart_set_page = &r100_pci_gart_set_page;
++		pax_close_kernel();
+ 	}
+ 	rdev->mc.gtt_size = radeon_gart_size * 1024 * 1024;
+ }
+@@ -974,10 +978,12 @@ int radeon_asic_init(struct radeon_device *rdev)
+ 		rdev->asic = &r420_asic;
+ 		/* handle macs */
+ 		if (rdev->bios == NULL) {
+-			rdev->asic->get_engine_clock = &radeon_legacy_get_engine_clock;
+-			rdev->asic->set_engine_clock = &radeon_legacy_set_engine_clock;
+-			rdev->asic->get_memory_clock = &radeon_legacy_get_memory_clock;
+-			rdev->asic->set_memory_clock = NULL;
++			pax_open_kernel();
++			*(void **)&rdev->asic->get_engine_clock = &radeon_legacy_get_engine_clock;
++			*(void **)&rdev->asic->set_engine_clock = &radeon_legacy_set_engine_clock;
++			*(void **)&rdev->asic->get_memory_clock = &radeon_legacy_get_memory_clock;
++			*(void **)&rdev->asic->set_memory_clock = NULL;
++			pax_close_kernel();
+ 		}
+ 		break;
+ 	case CHIP_RS400:
+@@ -1057,8 +1063,10 @@ int radeon_asic_init(struct radeon_device *rdev)
+ 	}
  
- struct r600_blit {
- 	struct mutex		mutex;
-@@ -939,7 +939,7 @@ struct radeon_asic {
- 	void (*pre_page_flip)(struct radeon_device *rdev, int crtc);
- 	u32 (*page_flip)(struct radeon_device *rdev, int crtc, u64 crtc_base);
- 	void (*post_page_flip)(struct radeon_device *rdev, int crtc);
--};
-+} __no_const;
+ 	if (rdev->flags & RADEON_IS_IGP) {
+-		rdev->asic->get_memory_clock = NULL;
+-		rdev->asic->set_memory_clock = NULL;
++		pax_open_kernel();
++		*(void **)&rdev->asic->get_memory_clock = NULL;
++		*(void **)&rdev->asic->set_memory_clock = NULL;
++		pax_close_kernel();
+ 	}
  
- /*
-  * Asic structures
+ 	return 0;
 diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
 index c5762e3..987ff1d 100644
 --- a/drivers/gpu/drm/radeon/radeon_device.c
@@ -32202,6 +32932,21 @@ index a9049ed..501f284 100644
  	} else {
  		if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
  			rdev->pm.k8_bandwidth.full)
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index cc79449..611b32a 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -1082,7 +1082,9 @@ static int rv770_startup(struct radeon_device *rdev)
+ 	r = r600_blit_init(rdev);
+ 	if (r) {
+ 		r600_blit_fini(rdev);
+-		rdev->asic->copy = NULL;
++		pax_open_kernel();
++		*(void **)&rdev->asic->copy = NULL;
++		pax_close_kernel();
+ 		dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
+ 	}
+ 
 diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
 index 9e4313e..46fad36 100644
 --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -32586,19 +33331,6 @@ index 29015eb..af2d8e9 100644
  
  /* Wrapper access functions for multiplexed SMBus */
  static DEFINE_MUTEX(nforce2_lock);
-diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
-index d7a4833..7fae376 100644
---- a/drivers/i2c/i2c-mux.c
-+++ b/drivers/i2c/i2c-mux.c
-@@ -28,7 +28,7 @@
- /* multiplexer per channel data */
- struct i2c_mux_priv {
- 	struct i2c_adapter adap;
--	struct i2c_algorithm algo;
-+	i2c_algorithm_no_const algo;
- 
- 	struct i2c_adapter *parent;
- 	void *mux_dev;	/* the mux chip/device */
 diff --git a/drivers/ide/aec62xx.c b/drivers/ide/aec62xx.c
 index 57d00ca..0145194 100644
 --- a/drivers/ide/aec62xx.c
@@ -33453,7 +34185,7 @@ index 5965b3d..16817fb 100644
  	/* Free the control structures */
  
 diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
-index 568b4f1..5ea3eff 100644
+index 3ade373..f3b68b7 100644
 --- a/drivers/infiniband/hw/nes/nes.h
 +++ b/drivers/infiniband/hw/nes/nes.h
 @@ -178,17 +178,17 @@ extern unsigned int nes_debug_level;
@@ -33809,7 +34541,7 @@ index c00d2f3..8834298 100644
  
  /**
 diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
-index 5095bc4..41e8fff 100644
+index b0471b4..9ba4e9f 100644
 --- a/drivers/infiniband/hw/nes/nes_verbs.c
 +++ b/drivers/infiniband/hw/nes/nes_verbs.c
 @@ -46,9 +46,9 @@
@@ -33834,7 +34566,7 @@ index 5095bc4..41e8fff 100644
  	switch (init_attr->qp_type) {
  		case IB_QPT_RC:
  			if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
-@@ -1460,7 +1460,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
+@@ -1462,7 +1462,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
  	struct iw_cm_event cm_event;
  	int ret = 0;
  
@@ -33967,6 +34699,41 @@ index ba70058..571d25d 100644
  	serio->dev.bus = &serio_bus;
  	serio->dev.release = serio_release_port;
  	serio->dev.groups = serio_device_attr_groups;
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index ef2d493..bf04ef6 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -1468,7 +1468,7 @@ static int __init amd_iommu_init(void)
+ 
+ 	register_syscore_ops(&amd_iommu_syscore_ops);
+ 
+-	x86_platform.iommu_shutdown = disable_iommus;
++	*(void **)&x86_platform.iommu_shutdown = disable_iommus;
+ 
+ 	if (iommu_pass_through)
+ 		goto out;
+@@ -1538,7 +1538,7 @@ int __init amd_iommu_detect(void)
+ 	if (acpi_table_parse("IVRS", early_amd_iommu_detect) == 0) {
+ 		iommu_detected = 1;
+ 		amd_iommu_detected = 1;
+-		x86_init.iommu.iommu_init = amd_iommu_init;
++		*(void **)&x86_init.iommu.iommu_init = amd_iommu_init;
+ 
+ 		/* Make sure ACS will be enabled */
+ 		pci_request_acs();
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 97b2e21..7cfe357 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -568,7 +568,7 @@ int __init detect_intel_iommu(void)
+ 
+ #ifdef CONFIG_X86
+ 		if (ret)
+-			x86_init.iommu.iommu_init = intel_iommu_init;
++			*(void **)&x86_init.iommu.iommu_init = intel_iommu_init;
+ #endif
+ 	}
+ 	early_acpi_os_unmap_memory(dmar_tbl, dmar_tbl_size);
 diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
 index e44933d..9ba484a 100644
 --- a/drivers/isdn/capi/capi.c
@@ -34155,32 +34922,6 @@ index 2a57da59..e7a12ed 100644
  				return -EFAULT;
  		} else {
  			memcpy(buf, dp, left);
-diff --git a/drivers/isdn/hardware/eicon/divasync.h b/drivers/isdn/hardware/eicon/divasync.h
-index 85784a7..a19ca98 100644
---- a/drivers/isdn/hardware/eicon/divasync.h
-+++ b/drivers/isdn/hardware/eicon/divasync.h
-@@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
- } diva_didd_add_adapter_t;
- typedef struct _diva_didd_remove_adapter {
-  IDI_CALL p_request;
--} diva_didd_remove_adapter_t;
-+} __no_const diva_didd_remove_adapter_t;
- typedef struct _diva_didd_read_adapter_array {
-  void   * buffer;
-  dword length;
-diff --git a/drivers/isdn/hardware/eicon/xdi_adapter.h b/drivers/isdn/hardware/eicon/xdi_adapter.h
-index a3bd163..8956575 100644
---- a/drivers/isdn/hardware/eicon/xdi_adapter.h
-+++ b/drivers/isdn/hardware/eicon/xdi_adapter.h
-@@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
- typedef struct _diva_os_idi_adapter_interface {
- 	diva_init_card_proc_t cleanup_adapter_proc;
- 	diva_cmd_card_proc_t cmd_proc;
--} diva_os_idi_adapter_interface_t;
-+} __no_const diva_os_idi_adapter_interface_t;
- 
- typedef struct _diva_os_xdi_adapter {
- 	struct list_head link;
 diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
 index 2339d73..802ab87a 100644
 --- a/drivers/isdn/i4l/isdn_net.c
@@ -34768,32 +35509,6 @@ index fc90c11..c8cd9a9 100644
  
  	struct count_array old_counts;
  	struct count_array counts;
-diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
-index 3d0ed53..35dc592 100644
---- a/drivers/md/persistent-data/dm-space-map-disk.c
-+++ b/drivers/md/persistent-data/dm-space-map-disk.c
-@@ -23,7 +23,7 @@
-  * Space map interface.
-  */
- struct sm_disk {
--	struct dm_space_map sm;
-+	dm_space_map_no_const sm;
- 
- 	struct ll_disk ll;
- 	struct ll_disk old_ll;
-diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
-index e89ae5e..062e4c2 100644
---- a/drivers/md/persistent-data/dm-space-map-metadata.c
-+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
-@@ -43,7 +43,7 @@ struct block_op {
- };
- 
- struct sm_metadata {
--	struct dm_space_map sm;
-+	dm_space_map_no_const sm;
- 
- 	struct ll_disk ll;
- 	struct ll_disk old_ll;
 diff --git a/drivers/md/persistent-data/dm-space-map.h b/drivers/md/persistent-data/dm-space-map.h
 index 1cbfc6b..56e1dbb 100644
 --- a/drivers/md/persistent-data/dm-space-map.h
@@ -34941,19 +35656,6 @@ index ba9a643..e474ab5 100644
  	DDB_ID(DDVID, 0x0002, DDVID, 0x0001, ddb_octopus),
  	DDB_ID(DDVID, 0x0003, DDVID, 0x0001, ddb_octopus),
  	DDB_ID(DDVID, 0x0003, DDVID, 0x0002, ddb_octopus_le),
-diff --git a/drivers/media/dvb/dvb-core/dvb_demux.h b/drivers/media/dvb/dvb-core/dvb_demux.h
-index a7d876f..8c21b61 100644
---- a/drivers/media/dvb/dvb-core/dvb_demux.h
-+++ b/drivers/media/dvb/dvb-core/dvb_demux.h
-@@ -73,7 +73,7 @@ struct dvb_demux_feed {
- 	union {
- 		dmx_ts_cb ts;
- 		dmx_section_cb sec;
--	} cb;
-+	} __no_const cb;
- 
- 	struct dvb_demux *demux;
- 	void *priv;
 diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
 index d5cda35..017af46 100644
 --- a/drivers/media/dvb/dvb-core/dvbdev.c
@@ -35067,19 +35769,6 @@ index 61287fc..8b08712 100644
  {
  	struct redrat3_dev *rr3 = rcdev->priv;
  	struct device *dev = rr3->dev;
-diff --git a/drivers/media/video/au0828/au0828.h b/drivers/media/video/au0828/au0828.h
-index 9cde353..8c6a1c3 100644
---- a/drivers/media/video/au0828/au0828.h
-+++ b/drivers/media/video/au0828/au0828.h
-@@ -191,7 +191,7 @@ struct au0828_dev {
- 
- 	/* I2C */
- 	struct i2c_adapter		i2c_adap;
--	struct i2c_algorithm		i2c_algo;
-+	i2c_algorithm_no_const		i2c_algo;
- 	struct i2c_client		i2c_client;
- 	u32 				i2c_rc;
- 
 diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c
 index 68d1240..46b32eb 100644
 --- a/drivers/media/video/cx88/cx88-alsa.c
@@ -35129,19 +35818,6 @@ index ee0d0b3..63f6b78 100644
  	spin_lock_init(&vout->vbq_lock);
  
  	videobuf_queue_dma_contig_init(q, &video_vbq_ops, q->dev,
-diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
-index 305e6aa..0143317 100644
---- a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
-+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
-@@ -196,7 +196,7 @@ struct pvr2_hdw {
- 
- 	/* I2C stuff */
- 	struct i2c_adapter i2c_adap;
--	struct i2c_algorithm i2c_algo;
-+	i2c_algorithm_no_const i2c_algo;
- 	pvr2_i2c_func i2c_func[PVR2_I2C_FUNC_CNT];
- 	int i2c_cx25840_hack_state;
- 	int i2c_linked;
 diff --git a/drivers/media/video/saa7164/saa7164-encoder.c b/drivers/media/video/saa7164/saa7164-encoder.c
 index 2fd38a0..ddec3c4 100644
 --- a/drivers/media/video/saa7164/saa7164-encoder.c
@@ -35169,7 +35845,7 @@ index e2e0341..b80056c 100644
  {
  	struct saa7164_vbi_fh *fh = file->private_data;
 diff --git a/drivers/media/video/timblogiw.c b/drivers/media/video/timblogiw.c
-index a0895bf..b7ebb1b 100644
+index a0895bf..b451f5b 100644
 --- a/drivers/media/video/timblogiw.c
 +++ b/drivers/media/video/timblogiw.c
 @@ -745,7 +745,7 @@ static int timblogiw_mmap(struct file *file, struct vm_area_struct *vma)
@@ -35177,7 +35853,7 @@ index a0895bf..b7ebb1b 100644
  /* Platform device functions */
  
 -static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
-+static __devinitconst v4l2_ioctl_ops_no_const timblogiw_ioctl_ops = {
++static struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
  	.vidioc_querycap		= timblogiw_querycap,
  	.vidioc_enum_fmt_vid_cap	= timblogiw_enum_fmt,
  	.vidioc_g_fmt_vid_cap		= timblogiw_g_fmt,
@@ -35186,7 +35862,7 @@ index a0895bf..b7ebb1b 100644
  };
  
 -static __devinitconst struct v4l2_file_operations timblogiw_fops = {
-+static __devinitconst v4l2_file_operations_no_const timblogiw_fops = {
++static struct v4l2_file_operations timblogiw_fops = {
  	.owner		= THIS_MODULE,
  	.open		= timblogiw_open,
  	.release	= timblogiw_close,
@@ -35406,19 +36082,6 @@ index a8c08f3..155fe3d 100644
  	INIT_LIST_HEAD(&c->context_list);
  #endif
  
-diff --git a/drivers/mfd/abx500-core.c b/drivers/mfd/abx500-core.c
-index 7ce65f4..e66e9bc 100644
---- a/drivers/mfd/abx500-core.c
-+++ b/drivers/mfd/abx500-core.c
-@@ -15,7 +15,7 @@ static LIST_HEAD(abx500_list);
- 
- struct abx500_device_entry {
- 	struct list_head list;
--	struct abx500_ops ops;
-+	abx500_ops_no_const ops;
- 	struct device *dev;
- };
- 
 diff --git a/drivers/mfd/janz-cmodio.c b/drivers/mfd/janz-cmodio.c
 index 5c2a06a..8fa077c 100644
 --- a/drivers/mfd/janz-cmodio.c
@@ -35964,6 +36627,23 @@ index a03fde9..83254bc 100644
  
  	/* check to see if we are clearing active */
  	if (!strlen(ifname) || buf[0] == '\n') {
+diff --git a/drivers/net/ethernet/8390/ax88796.c b/drivers/net/ethernet/8390/ax88796.c
+index e9f8432..45308e6 100644
+--- a/drivers/net/ethernet/8390/ax88796.c
++++ b/drivers/net/ethernet/8390/ax88796.c
+@@ -872,9 +872,11 @@ static int ax_probe(struct platform_device *pdev)
+ 	if (ax->plat->reg_offsets)
+ 		ei_local->reg_offset = ax->plat->reg_offsets;
+ 	else {
++		resource_size_t _mem_size = mem_size;
++		do_div(_mem_size, 0x18);
+ 		ei_local->reg_offset = ax->reg_offsets;
+ 		for (ret = 0; ret < 0x18; ret++)
+-			ax->reg_offsets[ret] = (mem_size / 0x18) * ret;
++			ax->reg_offsets[ret] = _mem_size * ret;
+ 	}
+ 
+ 	if (!request_mem_region(mem->start, mem_size, pdev->name)) {
 diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
 index 1feae59..c2a61d2 100644
 --- a/drivers/net/ethernet/atheros/atlx/atl2.c
@@ -35977,19 +36657,58 @@ index 1feae59..c2a61d2 100644
      MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
      MODULE_PARM_DESC(X, desc);
  #else
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+index 283d663..4373534 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+@@ -1240,7 +1240,7 @@ static inline u8 bnx2x_get_path_func_num(struct bnx2x *bp)
+ static inline void bnx2x_init_bp_objs(struct bnx2x *bp)
+ {
+ 	/* RX_MODE controlling object */
+-	bnx2x_init_rx_mode_obj(bp, &bp->rx_mode_obj);
++	bnx2x_init_rx_mode_obj(bp);
+ 
+ 	/* multicast configuration controlling object */
+ 	bnx2x_init_mcast_obj(bp, &bp->mcast_obj, bp->fp->cl_id, bp->fp->cid,
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+index 1451769..0275580 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+@@ -2290,15 +2290,14 @@ int bnx2x_config_rx_mode(struct bnx2x *bp,
+ 	return rc;
+ }
+ 
+-void bnx2x_init_rx_mode_obj(struct bnx2x *bp,
+-			    struct bnx2x_rx_mode_obj *o)
++void bnx2x_init_rx_mode_obj(struct bnx2x *bp)
+ {
+ 	if (CHIP_IS_E1x(bp)) {
+-		o->wait_comp      = bnx2x_empty_rx_mode_wait;
+-		o->config_rx_mode = bnx2x_set_rx_mode_e1x;
++		bp->rx_mode_obj.wait_comp      = bnx2x_empty_rx_mode_wait;
++		bp->rx_mode_obj.config_rx_mode = bnx2x_set_rx_mode_e1x;
+ 	} else {
+-		o->wait_comp      = bnx2x_wait_rx_mode_comp_e2;
+-		o->config_rx_mode = bnx2x_set_rx_mode_e2;
++		bp->rx_mode_obj.wait_comp      = bnx2x_wait_rx_mode_comp_e2;
++		bp->rx_mode_obj.config_rx_mode = bnx2x_set_rx_mode_e2;
+ 	}
+ }
+ 
 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
-index 9a517c2..a50cfcb 100644
+index 9a517c2..6d245e1 100644
 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
-@@ -449,7 +449,7 @@ struct bnx2x_rx_mode_obj {
+@@ -1207,8 +1207,7 @@ int bnx2x_vlan_mac_move(struct bnx2x *bp,
  
- 	int (*wait_comp)(struct bnx2x *bp,
- 			 struct bnx2x_rx_mode_ramrod_params *p);
--};
-+} __no_const;
+ /********************* RX MODE ****************/
  
- /********************** Set multicast group ***********************************/
+-void bnx2x_init_rx_mode_obj(struct bnx2x *bp,
+-			    struct bnx2x_rx_mode_obj *o);
++void bnx2x_init_rx_mode_obj(struct bnx2x *bp);
  
+ /**
+  * Send and RX_MODE ramrod according to the provided parameters.
 diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
 index 94b4bd0..73c02de 100644
 --- a/drivers/net/ethernet/broadcom/tg3.h
@@ -36129,31 +36848,120 @@ index 61d2bdd..7f1154a 100644
  	{ "100/10M Ethernet PCI Adapter",	HAS_CHIP_XCVR },
  	{ "1000/100/10M Ethernet PCI Adapter",	HAS_MII_XCVR },
 diff --git a/drivers/net/ethernet/intel/e1000e/80003es2lan.c b/drivers/net/ethernet/intel/e1000e/80003es2lan.c
-index e1159e5..e18684d 100644
+index e1159e5..34efe3e 100644
 --- a/drivers/net/ethernet/intel/e1000e/80003es2lan.c
 +++ b/drivers/net/ethernet/intel/e1000e/80003es2lan.c
-@@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
+@@ -205,7 +205,6 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
  {
  	struct e1000_hw *hw = &adapter->hw;
  	struct e1000_mac_info *mac = &hw->mac;
 -	struct e1000_mac_operations *func = &mac->ops;
-+	e1000_mac_operations_no_const *func = &mac->ops;
  
  	/* Set media type */
  	switch (adapter->pdev->device) {
+@@ -233,16 +232,16 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
+ 	/* check for link */
+ 	switch (hw->phy.media_type) {
+ 	case e1000_media_type_copper:
+-		func->setup_physical_interface = e1000_setup_copper_link_80003es2lan;
+-		func->check_for_link = e1000e_check_for_copper_link;
++		mac->ops.setup_physical_interface = e1000_setup_copper_link_80003es2lan;
++		mac->ops.check_for_link = e1000e_check_for_copper_link;
+ 		break;
+ 	case e1000_media_type_fiber:
+-		func->setup_physical_interface = e1000e_setup_fiber_serdes_link;
+-		func->check_for_link = e1000e_check_for_fiber_link;
++		mac->ops.setup_physical_interface = e1000e_setup_fiber_serdes_link;
++		mac->ops.check_for_link = e1000e_check_for_fiber_link;
+ 		break;
+ 	case e1000_media_type_internal_serdes:
+-		func->setup_physical_interface = e1000e_setup_fiber_serdes_link;
+-		func->check_for_link = e1000e_check_for_serdes_link;
++		mac->ops.setup_physical_interface = e1000e_setup_fiber_serdes_link;
++		mac->ops.check_for_link = e1000e_check_for_serdes_link;
+ 		break;
+ 	default:
+ 		return -E1000_ERR_CONFIG;
 diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
-index 4f4d52a..2317bbc 100644
+index 4f4d52a..faf0fa4 100644
 --- a/drivers/net/ethernet/intel/e1000e/82571.c
 +++ b/drivers/net/ethernet/intel/e1000e/82571.c
-@@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
+@@ -239,7 +239,6 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
  {
  	struct e1000_hw *hw = &adapter->hw;
  	struct e1000_mac_info *mac = &hw->mac;
 -	struct e1000_mac_operations *func = &mac->ops;
-+	e1000_mac_operations_no_const *func = &mac->ops;
  	u32 swsm = 0;
  	u32 swsm2 = 0;
  	bool force_clear_smbi = false;
+@@ -272,22 +271,22 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
+ 	/* check for link */
+ 	switch (hw->phy.media_type) {
+ 	case e1000_media_type_copper:
+-		func->setup_physical_interface = e1000_setup_copper_link_82571;
+-		func->check_for_link = e1000e_check_for_copper_link;
+-		func->get_link_up_info = e1000e_get_speed_and_duplex_copper;
++		mac->ops.setup_physical_interface = e1000_setup_copper_link_82571;
++		mac->ops.check_for_link = e1000e_check_for_copper_link;
++		mac->ops.get_link_up_info = e1000e_get_speed_and_duplex_copper;
+ 		break;
+ 	case e1000_media_type_fiber:
+-		func->setup_physical_interface =
++		mac->ops.setup_physical_interface =
+ 			e1000_setup_fiber_serdes_link_82571;
+-		func->check_for_link = e1000e_check_for_fiber_link;
+-		func->get_link_up_info =
++		mac->ops.check_for_link = e1000e_check_for_fiber_link;
++		mac->ops.get_link_up_info =
+ 			e1000e_get_speed_and_duplex_fiber_serdes;
+ 		break;
+ 	case e1000_media_type_internal_serdes:
+-		func->setup_physical_interface =
++		mac->ops.setup_physical_interface =
+ 			e1000_setup_fiber_serdes_link_82571;
+-		func->check_for_link = e1000_check_for_serdes_link_82571;
+-		func->get_link_up_info =
++		mac->ops.check_for_link = e1000_check_for_serdes_link_82571;
++		mac->ops.get_link_up_info =
+ 			e1000e_get_speed_and_duplex_fiber_serdes;
+ 		break;
+ 	default:
+@@ -297,10 +296,10 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
+ 
+ 	switch (hw->mac.type) {
+ 	case e1000_82573:
+-		func->set_lan_id = e1000_set_lan_id_single_port;
+-		func->check_mng_mode = e1000e_check_mng_mode_generic;
+-		func->led_on = e1000e_led_on_generic;
+-		func->blink_led = e1000e_blink_led_generic;
++		mac->ops.set_lan_id = e1000_set_lan_id_single_port;
++		mac->ops.check_mng_mode = e1000e_check_mng_mode_generic;
++		mac->ops.led_on = e1000e_led_on_generic;
++		mac->ops.blink_led = e1000e_blink_led_generic;
+ 
+ 		/* FWSM register */
+ 		mac->has_fwsm = true;
+@@ -314,14 +313,14 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
+ 		break;
+ 	case e1000_82574:
+ 	case e1000_82583:
+-		func->set_lan_id = e1000_set_lan_id_single_port;
+-		func->check_mng_mode = e1000_check_mng_mode_82574;
+-		func->led_on = e1000_led_on_82574;
++		mac->ops.set_lan_id = e1000_set_lan_id_single_port;
++		mac->ops.check_mng_mode = e1000_check_mng_mode_82574;
++		mac->ops.led_on = e1000_led_on_82574;
+ 		break;
+ 	default:
+-		func->check_mng_mode = e1000e_check_mng_mode_generic;
+-		func->led_on = e1000e_led_on_generic;
+-		func->blink_led = e1000e_blink_led_generic;
++		mac->ops.check_mng_mode = e1000e_check_mng_mode_generic;
++		mac->ops.led_on = e1000e_led_on_generic;
++		mac->ops.blink_led = e1000e_blink_led_generic;
+ 
+ 		/* FWSM register */
+ 		mac->has_fwsm = true;
 diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
 index 8e362bb..679d9da 100644
 --- a/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -36167,228 +36975,6 @@ index 8e362bb..679d9da 100644
  	 (1 << 8)  | /* hthresh */                             \
  	 0x1f)       /* pthresh */
  
-diff --git a/drivers/net/ethernet/intel/e1000e/hw.h b/drivers/net/ethernet/intel/e1000e/hw.h
-index 2967039..ca8c40c 100644
---- a/drivers/net/ethernet/intel/e1000e/hw.h
-+++ b/drivers/net/ethernet/intel/e1000e/hw.h
-@@ -778,6 +778,7 @@ struct e1000_mac_operations {
- 	void (*write_vfta)(struct e1000_hw *, u32, u32);
- 	s32  (*read_mac_addr)(struct e1000_hw *);
- };
-+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
- 
- /*
-  * When to use various PHY register access functions:
-@@ -818,6 +819,7 @@ struct e1000_phy_operations {
- 	void (*power_up)(struct e1000_hw *);
- 	void (*power_down)(struct e1000_hw *);
- };
-+typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
- 
- /* Function pointers for the NVM. */
- struct e1000_nvm_operations {
-@@ -829,9 +831,10 @@ struct e1000_nvm_operations {
- 	s32  (*validate)(struct e1000_hw *);
- 	s32  (*write)(struct e1000_hw *, u16, u16, u16 *);
- };
-+typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
- 
- struct e1000_mac_info {
--	struct e1000_mac_operations ops;
-+	e1000_mac_operations_no_const ops;
- 	u8 addr[ETH_ALEN];
- 	u8 perm_addr[ETH_ALEN];
- 
-@@ -872,7 +875,7 @@ struct e1000_mac_info {
- };
- 
- struct e1000_phy_info {
--	struct e1000_phy_operations ops;
-+	e1000_phy_operations_no_const ops;
- 
- 	enum e1000_phy_type type;
- 
-@@ -906,7 +909,7 @@ struct e1000_phy_info {
- };
- 
- struct e1000_nvm_info {
--	struct e1000_nvm_operations ops;
-+	e1000_nvm_operations_no_const ops;
- 
- 	enum e1000_nvm_type type;
- 	enum e1000_nvm_override override;
-diff --git a/drivers/net/ethernet/intel/igb/e1000_hw.h b/drivers/net/ethernet/intel/igb/e1000_hw.h
-index 4519a13..f97fcd0 100644
---- a/drivers/net/ethernet/intel/igb/e1000_hw.h
-+++ b/drivers/net/ethernet/intel/igb/e1000_hw.h
-@@ -314,6 +314,7 @@ struct e1000_mac_operations {
- 	s32  (*read_mac_addr)(struct e1000_hw *);
- 	s32  (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *);
- };
-+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
- 
- struct e1000_phy_operations {
- 	s32  (*acquire)(struct e1000_hw *);
-@@ -330,6 +331,7 @@ struct e1000_phy_operations {
- 	s32  (*set_d3_lplu_state)(struct e1000_hw *, bool);
- 	s32  (*write_reg)(struct e1000_hw *, u32, u16);
- };
-+typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
- 
- struct e1000_nvm_operations {
- 	s32  (*acquire)(struct e1000_hw *);
-@@ -339,6 +341,7 @@ struct e1000_nvm_operations {
- 	s32  (*update)(struct e1000_hw *);
- 	s32  (*validate)(struct e1000_hw *);
- };
-+typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
- 
- struct e1000_info {
- 	s32 (*get_invariants)(struct e1000_hw *);
-@@ -350,7 +353,7 @@ struct e1000_info {
- extern const struct e1000_info e1000_82575_info;
- 
- struct e1000_mac_info {
--	struct e1000_mac_operations ops;
-+	e1000_mac_operations_no_const ops;
- 
- 	u8 addr[6];
- 	u8 perm_addr[6];
-@@ -388,7 +391,7 @@ struct e1000_mac_info {
- };
- 
- struct e1000_phy_info {
--	struct e1000_phy_operations ops;
-+	e1000_phy_operations_no_const ops;
- 
- 	enum e1000_phy_type type;
- 
-@@ -423,7 +426,7 @@ struct e1000_phy_info {
- };
- 
- struct e1000_nvm_info {
--	struct e1000_nvm_operations ops;
-+	e1000_nvm_operations_no_const ops;
- 	enum e1000_nvm_type type;
- 	enum e1000_nvm_override override;
- 
-@@ -468,6 +471,7 @@ struct e1000_mbx_operations {
- 	s32 (*check_for_ack)(struct e1000_hw *, u16);
- 	s32 (*check_for_rst)(struct e1000_hw *, u16);
- };
-+typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
- 
- struct e1000_mbx_stats {
- 	u32 msgs_tx;
-@@ -479,7 +483,7 @@ struct e1000_mbx_stats {
- };
- 
- struct e1000_mbx_info {
--	struct e1000_mbx_operations ops;
-+	e1000_mbx_operations_no_const ops;
- 	struct e1000_mbx_stats stats;
- 	u32 timeout;
- 	u32 usec_delay;
-diff --git a/drivers/net/ethernet/intel/igbvf/vf.h b/drivers/net/ethernet/intel/igbvf/vf.h
-index d7ed58f..64cde36 100644
---- a/drivers/net/ethernet/intel/igbvf/vf.h
-+++ b/drivers/net/ethernet/intel/igbvf/vf.h
-@@ -189,9 +189,10 @@ struct e1000_mac_operations {
- 	s32  (*read_mac_addr)(struct e1000_hw *);
- 	s32  (*set_vfta)(struct e1000_hw *, u16, bool);
- };
-+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
- 
- struct e1000_mac_info {
--	struct e1000_mac_operations ops;
-+	e1000_mac_operations_no_const ops;
- 	u8 addr[6];
- 	u8 perm_addr[6];
- 
-@@ -213,6 +214,7 @@ struct e1000_mbx_operations {
- 	s32 (*check_for_ack)(struct e1000_hw *);
- 	s32 (*check_for_rst)(struct e1000_hw *);
- };
-+typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
- 
- struct e1000_mbx_stats {
- 	u32 msgs_tx;
-@@ -224,7 +226,7 @@ struct e1000_mbx_stats {
- };
- 
- struct e1000_mbx_info {
--	struct e1000_mbx_operations ops;
-+	e1000_mbx_operations_no_const ops;
- 	struct e1000_mbx_stats stats;
- 	u32 timeout;
- 	u32 usec_delay;
-diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
-index f00d6d5..81dcf1d 100644
---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
-+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
-@@ -2710,6 +2710,7 @@ struct ixgbe_eeprom_operations {
- 	s32 (*update_checksum)(struct ixgbe_hw *);
- 	u16 (*calc_checksum)(struct ixgbe_hw *);
- };
-+typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
- 
- struct ixgbe_mac_operations {
- 	s32 (*init_hw)(struct ixgbe_hw *);
-@@ -2771,6 +2772,7 @@ struct ixgbe_mac_operations {
- 	/* Manageability interface */
- 	s32 (*set_fw_drv_ver)(struct ixgbe_hw *, u8, u8, u8, u8);
- };
-+typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
- 
- struct ixgbe_phy_operations {
- 	s32 (*identify)(struct ixgbe_hw *);
-@@ -2790,9 +2792,10 @@ struct ixgbe_phy_operations {
- 	s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
- 	s32 (*check_overtemp)(struct ixgbe_hw *);
- };
-+typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
- 
- struct ixgbe_eeprom_info {
--	struct ixgbe_eeprom_operations  ops;
-+	ixgbe_eeprom_operations_no_const ops;
- 	enum ixgbe_eeprom_type          type;
- 	u32                             semaphore_delay;
- 	u16                             word_size;
-@@ -2802,7 +2805,7 @@ struct ixgbe_eeprom_info {
- 
- #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED	0x01
- struct ixgbe_mac_info {
--	struct ixgbe_mac_operations     ops;
-+	ixgbe_mac_operations_no_const   ops;
- 	enum ixgbe_mac_type             type;
- 	u8                              addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
- 	u8                              perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
-@@ -2830,7 +2833,7 @@ struct ixgbe_mac_info {
- };
- 
- struct ixgbe_phy_info {
--	struct ixgbe_phy_operations     ops;
-+	ixgbe_phy_operations_no_const   ops;
- 	struct mdio_if_info		mdio;
- 	enum ixgbe_phy_type             type;
- 	u32                             id;
-@@ -2858,6 +2861,7 @@ struct ixgbe_mbx_operations {
- 	s32 (*check_for_ack)(struct ixgbe_hw *, u16);
- 	s32 (*check_for_rst)(struct ixgbe_hw *, u16);
- };
-+typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
- 
- struct ixgbe_mbx_stats {
- 	u32 msgs_tx;
-@@ -2869,7 +2873,7 @@ struct ixgbe_mbx_stats {
- };
- 
- struct ixgbe_mbx_info {
--	struct ixgbe_mbx_operations ops;
-+	ixgbe_mbx_operations_no_const ops;
- 	struct ixgbe_mbx_stats stats;
- 	u32 timeout;
- 	u32 usec_delay;
 diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
 index 4c8e199..f7f5587 100644
 --- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -36419,44 +37005,6 @@ index 4c8e199..f7f5587 100644
  
  	if (!q_vector->rxr_count)
  		return IRQ_HANDLED;
-diff --git a/drivers/net/ethernet/intel/ixgbevf/vf.h b/drivers/net/ethernet/intel/ixgbevf/vf.h
-index 10306b4..28df758 100644
---- a/drivers/net/ethernet/intel/ixgbevf/vf.h
-+++ b/drivers/net/ethernet/intel/ixgbevf/vf.h
-@@ -70,6 +70,7 @@ struct ixgbe_mac_operations {
- 	s32 (*clear_vfta)(struct ixgbe_hw *);
- 	s32 (*set_vfta)(struct ixgbe_hw *, u32, u32, bool);
- };
-+typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
- 
- enum ixgbe_mac_type {
- 	ixgbe_mac_unknown = 0,
-@@ -79,7 +80,7 @@ enum ixgbe_mac_type {
- };
- 
- struct ixgbe_mac_info {
--	struct ixgbe_mac_operations ops;
-+	ixgbe_mac_operations_no_const ops;
- 	u8 addr[6];
- 	u8 perm_addr[6];
- 
-@@ -103,6 +104,7 @@ struct ixgbe_mbx_operations {
- 	s32 (*check_for_ack)(struct ixgbe_hw *);
- 	s32 (*check_for_rst)(struct ixgbe_hw *);
- };
-+typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
- 
- struct ixgbe_mbx_stats {
- 	u32 msgs_tx;
-@@ -114,7 +116,7 @@ struct ixgbe_mbx_stats {
- };
- 
- struct ixgbe_mbx_info {
--	struct ixgbe_mbx_operations ops;
-+	ixgbe_mbx_operations_no_const ops;
- 	struct ixgbe_mbx_stats stats;
- 	u32 timeout;
- 	u32 udelay;
 diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
 index 94bbc85..78c12e6 100644
 --- a/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -36469,32 +37017,31 @@ index 94bbc85..78c12e6 100644
  
  #include <linux/mlx4/device.h>
  #include <linux/mlx4/doorbell.h>
-diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.h b/drivers/net/ethernet/neterion/vxge/vxge-config.h
-index 5046a64..71ca936 100644
---- a/drivers/net/ethernet/neterion/vxge/vxge-config.h
-+++ b/drivers/net/ethernet/neterion/vxge/vxge-config.h
-@@ -514,7 +514,7 @@ struct vxge_hw_uld_cbs {
- 	void (*link_down)(struct __vxge_hw_device *devh);
- 	void (*crit_err)(struct __vxge_hw_device *devh,
- 			enum vxge_hw_event type, u64 ext_data);
--};
-+} __no_const;
+diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
+index 98e2c10..79af7f8 100644
+--- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
++++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
+@@ -3461,7 +3461,10 @@ __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
+ 	struct __vxge_hw_fifo *fifo;
+ 	struct vxge_hw_fifo_config *config;
+ 	u32 txdl_size, txdl_per_memblock;
+-	struct vxge_hw_mempool_cbs fifo_mp_callback;
++	static struct vxge_hw_mempool_cbs fifo_mp_callback = {
++		.item_func_alloc = __vxge_hw_fifo_mempool_item_alloc,
++	};
++
+ 	struct __vxge_hw_virtualpath *vpath;
  
- /*
-  * struct __vxge_hw_blockpool_entry - Block private data structure
-diff --git a/drivers/net/ethernet/neterion/vxge/vxge-traffic.h b/drivers/net/ethernet/neterion/vxge/vxge-traffic.h
-index 4a518a3..936b334 100644
---- a/drivers/net/ethernet/neterion/vxge/vxge-traffic.h
-+++ b/drivers/net/ethernet/neterion/vxge/vxge-traffic.h
-@@ -2088,7 +2088,7 @@ struct vxge_hw_mempool_cbs {
- 			struct vxge_hw_mempool_dma	*dma_object,
- 			u32			index,
- 			u32			is_last);
--};
-+} __no_const;
+ 	if ((vp == NULL) || (attr == NULL)) {
+@@ -3544,8 +3547,6 @@ __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
+ 		goto exit;
+ 	}
  
- #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath)				\
- 		((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next)
+-	fifo_mp_callback.item_func_alloc = __vxge_hw_fifo_mempool_item_alloc;
+-
+ 	fifo->mempool =
+ 		__vxge_hw_mempool_create(vpath->hldev,
+ 			fifo->config->memblock_size,
 diff --git a/drivers/net/ethernet/octeon/octeon_mgmt.c b/drivers/net/ethernet/octeon/octeon_mgmt.c
 index 212f43b..fb31b51 100644
 --- a/drivers/net/ethernet/octeon/octeon_mgmt.c
@@ -36602,6 +37149,19 @@ index d4d2bc1..14b8672 100644
  };
  
  static int stmmac_init_fs(struct net_device *dev)
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index 26106c0..4046553 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -1067,7 +1067,7 @@ static int macvtap_device_event(struct notifier_block *unused,
+ 	return NOTIFY_DONE;
+ }
+ 
+-static struct notifier_block macvtap_notifier_block __read_mostly = {
++static struct notifier_block macvtap_notifier_block = {
+ 	.notifier_call	= macvtap_device_event,
+ };
+ 
 diff --git a/drivers/net/phy/mdio-bitbang.c b/drivers/net/phy/mdio-bitbang.c
 index 6539189..09875ce 100644
 --- a/drivers/net/phy/mdio-bitbang.c
@@ -36900,18 +37460,6 @@ index e662cbc..8d4a102 100644
  			return -EINVAL;
  	}
  
-diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
-index 4cc4a8b..a7dc55a 100644
---- a/drivers/net/wireless/ath/ath.h
-+++ b/drivers/net/wireless/ath/ath.h
-@@ -119,6 +119,7 @@ struct ath_ops {
- 	void (*write_flush) (void *);
- 	u32 (*rmw)(void *, u32 reg_offset, u32 set, u32 clr);
- };
-+typedef struct ath_ops __no_const ath_ops_no_const;
- 
- struct ath_common;
- struct ath_bus_ops;
 diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
 index b346d04..04436fa 100644
 --- a/drivers/net/wireless/ath/ath5k/base.c
@@ -37139,7 +37687,7 @@ index f5ae3c6..7936af3 100644
  
  static u16 ar9003_calc_ptr_chksum(struct ar9003_txc *ads)
 diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
-index a5c4ba8..a2cea02 100644
+index a5c4ba8..1aff36c 100644
 --- a/drivers/net/wireless/ath/ath9k/hw.h
 +++ b/drivers/net/wireless/ath/ath9k/hw.h
 @@ -606,7 +606,7 @@ struct ath_hw_private_ops {
@@ -37160,28 +37708,28 @@ index a5c4ba8..a2cea02 100644
  
  struct ath_nf_limits {
  	s16 max;
-@@ -656,7 +656,7 @@ enum ath_cal_list {
- #define AH_FASTCC       0x4
- 
- struct ath_hw {
--	struct ath_ops reg_ops;
-+	ath_ops_no_const reg_ops;
- 
- 	struct ieee80211_hw *hw;
- 	struct ath_common common;
-diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
-index bea8524..c677c06 100644
---- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
-@@ -547,7 +547,7 @@ struct phy_func_ptr {
- 	void (*carrsuppr)(struct brcms_phy *);
- 	s32 (*rxsigpwr)(struct brcms_phy *, s32);
- 	void (*detach)(struct brcms_phy *);
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+index 62dc461..5250f0b 100644
+--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
++++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+@@ -175,7 +175,7 @@ struct brcmf_cfg80211_event_loop {
+ 				     struct net_device *ndev,
+ 				     const struct brcmf_event_msg *e,
+ 				     void *data);
+-};
++} __no_const;
+ 
+ /* representing interface of cfg80211 plane */
+ struct brcmf_cfg80211_iface {
+@@ -239,7 +239,7 @@ struct brcmf_cfg80211_profile {
+ struct brcmf_cfg80211_iscan_eloop {
+ 	s32 (*handler[WL_SCAN_ERSULTS_LAST])
+ 		(struct brcmf_cfg80211_priv *cfg_priv);
 -};
 +} __no_const;
  
- struct brcms_phy {
- 	struct brcms_phy_pub pubpi_ro;
+ /* dongle iscan controller */
+ struct brcmf_cfg80211_iscan_ctrl {
 diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
 index b3d9f3f..9931f58 100644
 --- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
@@ -37392,19 +37940,6 @@ index 523ad55..f8c5dc5 100644
  	}
  
  	spin_lock_init(&hwsim_radio_lock);
-diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
-index 30f138b..c904585 100644
---- a/drivers/net/wireless/mwifiex/main.h
-+++ b/drivers/net/wireless/mwifiex/main.h
-@@ -543,7 +543,7 @@ struct mwifiex_if_ops {
- 	void (*cleanup_mpa_buf) (struct mwifiex_adapter *);
- 	int (*cmdrsp_complete) (struct mwifiex_adapter *, struct sk_buff *);
- 	int (*event_complete) (struct mwifiex_adapter *, struct sk_buff *);
--};
-+} __no_const;
- 
- struct mwifiex_adapter {
- 	u8 iface_type;
 diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
 index 0c13840..a5c3ed6 100644
 --- a/drivers/net/wireless/rndis_wlan.c
@@ -37418,19 +37953,32 @@ index 0c13840..a5c3ed6 100644
  		rts_threshold = 2347;
  
  	tmp = cpu_to_le32(rts_threshold);
-diff --git a/drivers/net/wireless/wl1251/wl1251.h b/drivers/net/wireless/wl1251/wl1251.h
-index a77f1bb..c608b2b 100644
---- a/drivers/net/wireless/wl1251/wl1251.h
-+++ b/drivers/net/wireless/wl1251/wl1251.h
-@@ -266,7 +266,7 @@ struct wl1251_if_operations {
- 	void (*reset)(struct wl1251 *wl);
- 	void (*enable_irq)(struct wl1251 *wl);
- 	void (*disable_irq)(struct wl1251 *wl);
--};
-+} __no_const;
+diff --git a/drivers/net/wireless/wl1251/sdio.c b/drivers/net/wireless/wl1251/sdio.c
+index e2750a1..797e179 100644
+--- a/drivers/net/wireless/wl1251/sdio.c
++++ b/drivers/net/wireless/wl1251/sdio.c
+@@ -269,13 +269,17 @@ static int wl1251_sdio_probe(struct sdio_func *func,
+ 
+ 		irq_set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
  
- struct wl1251 {
- 	struct ieee80211_hw *hw;
+-		wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
+-		wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
++		pax_open_kernel();
++		*(void **)&wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
++		*(void **)&wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
++		pax_close_kernel();
+ 
+ 		wl1251_info("using dedicated interrupt line");
+ 	} else {
+-		wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq;
+-		wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq;
++		pax_open_kernel();
++		*(void **)&wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq;
++		*(void **)&wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq;
++		pax_close_kernel();
+ 
+ 		wl1251_info("using SDIO interrupt");
+ 	}
 diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
 index f34b5b2..b5abb9f 100644
 --- a/drivers/oprofile/buffer_sync.c
@@ -37573,19 +38121,82 @@ index 3f56bc0..707d642 100644
  }
  #endif /* IEEE1284.3 support. */
  
-diff --git a/drivers/pci/hotplug/cpci_hotplug.h b/drivers/pci/hotplug/cpci_hotplug.h
-index 9fff878..ad0ad53 100644
---- a/drivers/pci/hotplug/cpci_hotplug.h
-+++ b/drivers/pci/hotplug/cpci_hotplug.h
-@@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
- 	int (*hardware_test) (struct slot* slot, u32 value);
- 	u8  (*get_power) (struct slot* slot);
- 	int (*set_power) (struct slot* slot, int value);
--};
-+} __no_const;
+diff --git a/drivers/pci/hotplug/cpcihp_generic.c b/drivers/pci/hotplug/cpcihp_generic.c
+index fb3f846..792d643 100644
+--- a/drivers/pci/hotplug/cpcihp_generic.c
++++ b/drivers/pci/hotplug/cpcihp_generic.c
+@@ -73,7 +73,6 @@ static u16 port;
+ static unsigned int enum_bit;
+ static u8 enum_mask;
+ 
+-static struct cpci_hp_controller_ops generic_hpc_ops;
+ static struct cpci_hp_controller generic_hpc;
  
- struct cpci_hp_controller {
- 	unsigned int irq;
+ static int __init validate_parameters(void)
+@@ -139,6 +138,10 @@ static int query_enum(void)
+ 	return ((value & enum_mask) == enum_mask);
+ }
+ 
++static struct cpci_hp_controller_ops generic_hpc_ops = {
++	.query_enum = query_enum,
++};
++
+ static int __init cpcihp_generic_init(void)
+ {
+ 	int status;
+@@ -169,7 +172,6 @@ static int __init cpcihp_generic_init(void)
+ 	pci_dev_put(dev);
+ 
+ 	memset(&generic_hpc, 0, sizeof (struct cpci_hp_controller));
+-	generic_hpc_ops.query_enum = query_enum;
+ 	generic_hpc.ops = &generic_hpc_ops;
+ 
+ 	status = cpci_hp_register_controller(&generic_hpc);
+diff --git a/drivers/pci/hotplug/cpcihp_zt5550.c b/drivers/pci/hotplug/cpcihp_zt5550.c
+index 41f6a8d..da73050 100644
+--- a/drivers/pci/hotplug/cpcihp_zt5550.c
++++ b/drivers/pci/hotplug/cpcihp_zt5550.c
+@@ -59,7 +59,6 @@
+ /* local variables */
+ static int debug;
+ static int poll;
+-static struct cpci_hp_controller_ops zt5550_hpc_ops;
+ static struct cpci_hp_controller zt5550_hpc;
+ 
+ /* Primary cPCI bus bridge device */
+@@ -205,6 +204,10 @@ static int zt5550_hc_disable_irq(void)
+ 	return 0;
+ }
+ 
++static struct cpci_hp_controller_ops zt5550_hpc_ops = {
++	.query_enum = zt5550_hc_query_enum,
++};
++
+ static int zt5550_hc_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ 	int status;
+@@ -216,16 +219,17 @@ static int zt5550_hc_init_one (struct pci_dev *pdev, const struct pci_device_id
+ 	dbg("returned from zt5550_hc_config");
+ 
+ 	memset(&zt5550_hpc, 0, sizeof (struct cpci_hp_controller));
+-	zt5550_hpc_ops.query_enum = zt5550_hc_query_enum;
+ 	zt5550_hpc.ops = &zt5550_hpc_ops;
+ 	if(!poll) {
+ 		zt5550_hpc.irq = hc_dev->irq;
+ 		zt5550_hpc.irq_flags = IRQF_SHARED;
+ 		zt5550_hpc.dev_id = hc_dev;
+ 
+-		zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
+-		zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
+-		zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
++		pax_open_kernel();
++		*(void **)&zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
++		*(void **)&zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
++		*(void **)&zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
++		pax_open_kernel();
+ 	} else {
+ 		info("using ENUM# polling mode");
+ 	}
 diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
 index 76ba8a1..20ca857 100644
 --- a/drivers/pci/hotplug/cpqphp_nvram.c
@@ -37869,19 +38480,6 @@ index b0ecacb..7c9da2e 100644
  		return 0;
  
  	/* check if the resource is reserved */
-diff --git a/drivers/power/bq27x00_battery.c b/drivers/power/bq27x00_battery.c
-index bb16f5b..c751eef 100644
---- a/drivers/power/bq27x00_battery.c
-+++ b/drivers/power/bq27x00_battery.c
-@@ -67,7 +67,7 @@
- struct bq27x00_device_info;
- struct bq27x00_access_methods {
- 	int (*read)(struct bq27x00_device_info *di, u8 reg, bool single);
--};
-+} __no_const;
- 
- enum bq27x00_chip { BQ27000, BQ27500 };
- 
 diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
 index 33f5d9a..d957d3f 100644
 --- a/drivers/regulator/max8660.c
@@ -37939,19 +38537,6 @@ index cace6d3..f623fda 100644
  		return rtc_set_time(rtc, &tm);
  
  	case RTC_PIE_ON:
-diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
-index ffb5878..e6d785c 100644
---- a/drivers/scsi/aacraid/aacraid.h
-+++ b/drivers/scsi/aacraid/aacraid.h
-@@ -492,7 +492,7 @@ struct adapter_ops
- 	int  (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
- 	/* Administrative operations */
- 	int  (*adapter_comm)(struct aac_dev * dev, int comm);
--};
-+} __no_const;
- 
- /*
-  *	Define which interrupt handler needs to be installed
 diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
 index 705e13e..91c873c 100644
 --- a/drivers/scsi/aacraid/linit.c
@@ -37991,49 +38576,19 @@ index a796de9..1ef20e1 100644
  typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
  
  struct bfa_faa_cbfn_s {
-diff --git a/drivers/scsi/bfa/bfa_fcpim.c b/drivers/scsi/bfa/bfa_fcpim.c
-index e07bd47..cd1bbbb 100644
---- a/drivers/scsi/bfa/bfa_fcpim.c
-+++ b/drivers/scsi/bfa/bfa_fcpim.c
-@@ -4121,7 +4121,7 @@ bfa_fcp_attach(struct bfa_s *bfa, void *bfad, struct bfa_iocfc_cfg_s *cfg,
- 
- 	bfa_iotag_attach(fcp);
- 
--	fcp->itn_arr = (struct bfa_itn_s *) bfa_mem_kva_curp(fcp);
-+	fcp->itn_arr = (bfa_itn_s_no_const *) bfa_mem_kva_curp(fcp);
- 	bfa_mem_kva_curp(fcp) = (u8 *)fcp->itn_arr +
- 			(fcp->num_itns * sizeof(struct bfa_itn_s));
- 	memset(fcp->itn_arr, 0,
-@@ -4179,7 +4179,7 @@ bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
- 		void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m))
- {
- 	struct bfa_fcp_mod_s *fcp = BFA_FCP_MOD(bfa);
--	struct bfa_itn_s *itn;
-+	bfa_itn_s_no_const *itn;
- 
- 	itn =  BFA_ITN_FROM_TAG(fcp, rport->rport_tag);
- 	itn->isr = isr;
 diff --git a/drivers/scsi/bfa/bfa_fcpim.h b/drivers/scsi/bfa/bfa_fcpim.h
-index 1080bcb..a3b39e3 100644
+index 1080bcb..4a8ddd9 100644
 --- a/drivers/scsi/bfa/bfa_fcpim.h
 +++ b/drivers/scsi/bfa/bfa_fcpim.h
-@@ -37,6 +37,7 @@ struct bfa_iotag_s {
+@@ -36,7 +36,7 @@ struct bfa_iotag_s {
+ 
  struct bfa_itn_s {
  	bfa_isr_func_t isr;
- };
-+typedef struct bfa_itn_s __no_const bfa_itn_s_no_const;
+-};
++} __no_const;
  
  void bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
  		void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m));
-@@ -149,7 +150,7 @@ struct bfa_fcp_mod_s {
- 	struct list_head	iotag_tio_free_q;	/* free IO resources */
- 	struct list_head	iotag_unused_q;	/* unused IO resources*/
- 	struct bfa_iotag_s	*iotag_arr;
--	struct bfa_itn_s	*itn_arr;
-+	bfa_itn_s_no_const	*itn_arr;
- 	int			num_ioim_reqs;
- 	int			num_fwtio_reqs;
- 	int			num_itns;
 diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
 index 546d46b..642fa5b 100644
 --- a/drivers/scsi/bfa/bfa_ioc.h
@@ -38218,19 +38773,6 @@ index c721509..8be5717 100644
  
  	/* queue and queue Info */
  	struct list_head reqQ;
-diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
-index f2df059..a3a9930 100644
---- a/drivers/scsi/ips.h
-+++ b/drivers/scsi/ips.h
-@@ -1027,7 +1027,7 @@ typedef struct {
-    int       (*intr)(struct ips_ha *);
-    void      (*enableint)(struct ips_ha *);
-    uint32_t (*statupd)(struct ips_ha *);
--} ips_hw_func_t;
-+} __no_const ips_hw_func_t;
- 
- typedef struct ips_ha {
-    uint8_t            ha_id[IPS_MAX_CHANNELS+1];
 diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
 index 9de9db2..1e09660 100644
 --- a/drivers/scsi/libfc/fc_exch.c
@@ -38664,19 +39206,23 @@ index ca496c7..9c791d5 100644
  
  	/* To indicate add/delete/modify during CCN */
  	u8 change_detected;
-diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
-index fcf052c..a8025a4 100644
---- a/drivers/scsi/qla2xxx/qla_def.h
-+++ b/drivers/scsi/qla2xxx/qla_def.h
-@@ -2244,7 +2244,7 @@ struct isp_operations {
- 	int (*get_flash_version) (struct scsi_qla_host *, void *);
- 	int (*start_scsi) (srb_t *);
- 	int (*abort_isp) (struct scsi_qla_host *);
--};
-+} __no_const;
- 
- /* MSI-X Support *************************************************************/
- 
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 82a5ca6..97ace97 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1429,8 +1429,10 @@ qla2x00_config_dma_addressing(struct qla_hw_data *ha)
+ 		    !pci_set_consistent_dma_mask(ha->pdev, DMA_BIT_MASK(64))) {
+ 			/* Ok, a 64bit DMA mask is applicable. */
+ 			ha->flags.enable_64bit_addressing = 1;
+-			ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
+-			ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
++			pax_open_kernel();
++			*(void **)&ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
++			*(void **)&ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
++			pax_close_kernel();
+ 			return;
+ 		}
+ 	}
 diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
 index fd5edc6..4906148 100644
 --- a/drivers/scsi/qla4xxx/ql4_def.h
@@ -39145,19 +39691,6 @@ index c7b5e8b..783d6cb 100644
  			return -EFAULT;
  
  	return 0;
-diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h
-index be21617..0954e45 100644
---- a/drivers/staging/usbip/usbip_common.h
-+++ b/drivers/staging/usbip/usbip_common.h
-@@ -289,7 +289,7 @@ struct usbip_device {
- 		void (*shutdown)(struct usbip_device *);
- 		void (*reset)(struct usbip_device *);
- 		void (*unusable)(struct usbip_device *);
--	} eh_ops;
-+	} __no_const eh_ops;
- };
- 
- #if 0
 diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
 index 88b3298..3783eee 100644
 --- a/drivers/staging/usbip/vhci.h
@@ -39275,19 +39808,6 @@ index 51b5adf..098e320 100644
  	pDevice->apdev->netdev_ops = &apdev_netdev_ops;
  
  	pDevice->apdev->type = ARPHRD_IEEE80211;
-diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
-index 7843dfd..3db105f 100644
---- a/drivers/staging/wlan-ng/hfa384x_usb.c
-+++ b/drivers/staging/wlan-ng/hfa384x_usb.c
-@@ -204,7 +204,7 @@ static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
- 
- struct usbctlx_completor {
- 	int (*complete) (struct usbctlx_completor *);
--};
-+} __no_const;
- 
- static int
- hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
 diff --git a/drivers/staging/zcache/tmem.c b/drivers/staging/zcache/tmem.c
 index 1ca66ea..76f1343 100644
 --- a/drivers/staging/zcache/tmem.c
@@ -39820,6 +40340,38 @@ index 2b42a01..32a2ed3 100644
  #ifdef CONFIG_KGDB_SERIAL_CONSOLE
  /* This is only available if kgdboc is a built in for early debugging */
  static int __init kgdboc_early_init(char *opt)
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index b31f1c3..1b6b8c4 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -440,11 +440,16 @@ static void s3c24xx_serial_shutdown(struct uart_port *port)
+ 	}
+ }
+ 
++static int s3c64xx_serial_startup(struct uart_port *port);
+ static int s3c24xx_serial_startup(struct uart_port *port)
+ {
+ 	struct s3c24xx_uart_port *ourport = to_ourport(port);
+ 	int ret;
+ 
++	/* Startup sequence is different for s3c64xx and higher SoC's */
++	if (s3c24xx_serial_has_interrupt_mask(port))
++		return s3c64xx_serial_startup(port);
++
+ 	dbg("s3c24xx_serial_startup: port=%p (%08lx,%p)\n",
+ 	    port->mapbase, port->membase);
+ 
+@@ -1149,10 +1154,6 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
+ 	port->dev	= &platdev->dev;
+ 	ourport->info	= info;
+ 
+-	/* Startup sequence is different for s3c64xx and higher SoC's */
+-	if (s3c24xx_serial_has_interrupt_mask(port))
+-		s3c24xx_serial_ops.startup = s3c64xx_serial_startup;
+-
+ 	/* copy the info in from provided structure */
+ 	ourport->port.fifosize = info->fifosize;
+ 
 diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
 index 43db715..82134aa 100644
 --- a/drivers/tty/sysrq.c
@@ -43525,29 +44077,6 @@ index 88714ae..16c2e11 100644
  
  
  static inline u32 get_pll_internal_frequency(u32 ref_freq,
-diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
-index e56c934..fc22f4b 100644
---- a/drivers/xen/xen-pciback/conf_space.h
-+++ b/drivers/xen/xen-pciback/conf_space.h
-@@ -44,15 +44,15 @@ struct config_field {
- 		struct {
- 			conf_dword_write write;
- 			conf_dword_read read;
--		} dw;
-+		} __no_const dw;
- 		struct {
- 			conf_word_write write;
- 			conf_word_read read;
--		} w;
-+		} __no_const w;
- 		struct {
- 			conf_byte_write write;
- 			conf_byte_read read;
--		} b;
-+		} __no_const b;
- 	} u;
- 	struct list_head list;
- };
 diff --git a/drivers/xen/xenfs/xenstored.c b/drivers/xen/xenfs/xenstored.c
 index fef20db..d28b1ab 100644
 --- a/drivers/xen/xenfs/xenstored.c
@@ -45687,10 +46216,10 @@ index 608c1c3..7d040a8 100644
  	return rc;
  }
 diff --git a/fs/eventpoll.c b/fs/eventpoll.c
-index a6f3763..f38ed00 100644
+index 451b9b8..12e5a03 100644
 --- a/fs/eventpoll.c
 +++ b/fs/eventpoll.c
-@@ -1540,8 +1540,8 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
+@@ -1560,8 +1560,8 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
  		error = PTR_ERR(file);
  		goto out_free_fd;
  	}
@@ -45701,7 +46230,7 @@ index a6f3763..f38ed00 100644
  
  out_free_fd:
 diff --git a/fs/exec.c b/fs/exec.c
-index c27fa0d..00ce2eb 100644
+index c27fa0d..02a6a78 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -55,12 +55,33 @@
@@ -45850,7 +46379,7 @@ index c27fa0d..00ce2eb 100644
  
  	return native;
  }
-@@ -443,7 +466,7 @@ static int count(struct user_arg_ptr argv, int max)
+@@ -443,11 +466,12 @@ static int count(struct user_arg_ptr argv, int max)
  			if (!p)
  				break;
  
@@ -45858,8 +46387,14 @@ index c27fa0d..00ce2eb 100644
 +			if (IS_ERR((const char __force_kernel *)p))
  				return -EFAULT;
  
- 			if (i++ >= max)
-@@ -477,7 +500,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
+-			if (i++ >= max)
++			if (i >= max)
+ 				return -E2BIG;
++			++i;
+ 
+ 			if (fatal_signal_pending(current))
+ 				return -ERESTARTNOHAND;
+@@ -477,7 +501,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
  
  		ret = -EFAULT;
  		str = get_user_arg_ptr(argv, argc);
@@ -45868,7 +46403,7 @@ index c27fa0d..00ce2eb 100644
  			goto out;
  
  		len = strnlen_user(str, MAX_ARG_STRLEN);
-@@ -559,7 +582,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
+@@ -559,7 +583,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
  	int r;
  	mm_segment_t oldfs = get_fs();
  	struct user_arg_ptr argv = {
@@ -45877,7 +46412,7 @@ index c27fa0d..00ce2eb 100644
  	};
  
  	set_fs(KERNEL_DS);
-@@ -594,7 +617,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -594,7 +618,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  	unsigned long new_end = old_end - shift;
  	struct mmu_gather tlb;
  
@@ -45887,7 +46422,7 @@ index c27fa0d..00ce2eb 100644
  
  	/*
  	 * ensure there are no vmas between where we want to go
-@@ -603,6 +627,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -603,6 +628,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  	if (vma != find_vma(mm, new_start))
  		return -EFAULT;
  
@@ -45898,7 +46433,7 @@ index c27fa0d..00ce2eb 100644
  	/*
  	 * cover the whole range: [new_start, old_end)
  	 */
-@@ -683,10 +711,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -683,10 +712,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
  	stack_top = arch_align_stack(stack_top);
  	stack_top = PAGE_ALIGN(stack_top);
  
@@ -45909,7 +46444,7 @@ index c27fa0d..00ce2eb 100644
  	stack_shift = vma->vm_end - stack_top;
  
  	bprm->p -= stack_shift;
-@@ -698,8 +722,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -698,8 +723,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
  	bprm->exec -= stack_shift;
  
  	down_write(&mm->mmap_sem);
@@ -45938,7 +46473,7 @@ index c27fa0d..00ce2eb 100644
  	/*
  	 * Adjust stack execute permissions; explicitly enable for
  	 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
-@@ -718,13 +762,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -718,13 +763,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
  		goto out_unlock;
  	BUG_ON(prev != vma);
  
@@ -45952,7 +46487,7 @@ index c27fa0d..00ce2eb 100644
  	/* mprotect_fixup is overkill to remove the temporary stack flags */
  	vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
  
-@@ -782,6 +819,8 @@ struct file *open_exec(const char *name)
+@@ -782,6 +820,8 @@ struct file *open_exec(const char *name)
  
  	fsnotify_open(file);
  
@@ -45961,7 +46496,7 @@ index c27fa0d..00ce2eb 100644
  	err = deny_write_access(file);
  	if (err)
  		goto exit;
-@@ -805,7 +844,7 @@ int kernel_read(struct file *file, loff_t offset,
+@@ -805,7 +845,7 @@ int kernel_read(struct file *file, loff_t offset,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -45970,7 +46505,7 @@ index c27fa0d..00ce2eb 100644
  	set_fs(old_fs);
  	return result;
  }
-@@ -1070,6 +1109,21 @@ void set_task_comm(struct task_struct *tsk, char *buf)
+@@ -1070,6 +1110,21 @@ void set_task_comm(struct task_struct *tsk, char *buf)
  	perf_event_comm(tsk);
  }
  
@@ -45992,7 +46527,7 @@ index c27fa0d..00ce2eb 100644
  int flush_old_exec(struct linux_binprm * bprm)
  {
  	int retval;
-@@ -1084,6 +1138,7 @@ int flush_old_exec(struct linux_binprm * bprm)
+@@ -1084,6 +1139,7 @@ int flush_old_exec(struct linux_binprm * bprm)
  
  	set_mm_exe_file(bprm->mm, bprm->file);
  
@@ -46000,7 +46535,7 @@ index c27fa0d..00ce2eb 100644
  	/*
  	 * Release all of the old mmap stuff
  	 */
-@@ -1116,10 +1171,6 @@ EXPORT_SYMBOL(would_dump);
+@@ -1116,10 +1172,6 @@ EXPORT_SYMBOL(would_dump);
  
  void setup_new_exec(struct linux_binprm * bprm)
  {
@@ -46011,7 +46546,7 @@ index c27fa0d..00ce2eb 100644
  	arch_pick_mmap_layout(current->mm);
  
  	/* This is the point of no return */
-@@ -1130,18 +1181,7 @@ void setup_new_exec(struct linux_binprm * bprm)
+@@ -1130,18 +1182,7 @@ void setup_new_exec(struct linux_binprm * bprm)
  	else
  		set_dumpable(current->mm, suid_dumpable);
  
@@ -46031,7 +46566,7 @@ index c27fa0d..00ce2eb 100644
  
  	/* Set the new mm task size. We have to do that late because it may
  	 * depend on TIF_32BIT which is only updated in flush_thread() on
-@@ -1266,7 +1306,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
+@@ -1266,7 +1307,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
  	}
  	rcu_read_unlock();
  
@@ -46040,7 +46575,7 @@ index c27fa0d..00ce2eb 100644
  		bprm->unsafe |= LSM_UNSAFE_SHARE;
  	} else {
  		res = -EAGAIN;
-@@ -1461,6 +1501,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+@@ -1461,6 +1502,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
  
  EXPORT_SYMBOL(search_binary_handler);
  
@@ -46069,7 +46604,7 @@ index c27fa0d..00ce2eb 100644
  /*
   * sys_execve() executes a new program.
   */
-@@ -1469,6 +1531,11 @@ static int do_execve_common(const char *filename,
+@@ -1469,6 +1532,11 @@ static int do_execve_common(const char *filename,
  				struct user_arg_ptr envp,
  				struct pt_regs *regs)
  {
@@ -46081,7 +46616,7 @@ index c27fa0d..00ce2eb 100644
  	struct linux_binprm *bprm;
  	struct file *file;
  	struct files_struct *displaced;
-@@ -1476,6 +1543,8 @@ static int do_execve_common(const char *filename,
+@@ -1476,6 +1544,8 @@ static int do_execve_common(const char *filename,
  	int retval;
  	const struct cred *cred = current_cred();
  
@@ -46090,7 +46625,7 @@ index c27fa0d..00ce2eb 100644
  	/*
  	 * We move the actual failure in case of RLIMIT_NPROC excess from
  	 * set*uid() to execve() because too many poorly written programs
-@@ -1516,12 +1585,27 @@ static int do_execve_common(const char *filename,
+@@ -1516,12 +1586,27 @@ static int do_execve_common(const char *filename,
  	if (IS_ERR(file))
  		goto out_unmark;
  
@@ -46118,7 +46653,7 @@ index c27fa0d..00ce2eb 100644
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1538,24 +1622,65 @@ static int do_execve_common(const char *filename,
+@@ -1538,24 +1623,65 @@ static int do_execve_common(const char *filename,
  	if (retval < 0)
  		goto out;
  
@@ -46188,7 +46723,7 @@ index c27fa0d..00ce2eb 100644
  	current->fs->in_exec = 0;
  	current->in_execve = 0;
  	acct_update_integrals(current);
-@@ -1564,6 +1689,14 @@ static int do_execve_common(const char *filename,
+@@ -1564,6 +1690,14 @@ static int do_execve_common(const char *filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -46203,7 +46738,7 @@ index c27fa0d..00ce2eb 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1637,7 +1770,7 @@ static int expand_corename(struct core_name *cn)
+@@ -1637,7 +1771,7 @@ static int expand_corename(struct core_name *cn)
  {
  	char *old_corename = cn->corename;
  
@@ -46212,7 +46747,7 @@ index c27fa0d..00ce2eb 100644
  	cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
  
  	if (!cn->corename) {
-@@ -1734,7 +1867,7 @@ static int format_corename(struct core_name *cn, long signr)
+@@ -1734,7 +1868,7 @@ static int format_corename(struct core_name *cn, long signr)
  	int pid_in_pattern = 0;
  	int err = 0;
  
@@ -46221,7 +46756,7 @@ index c27fa0d..00ce2eb 100644
  	cn->corename = kmalloc(cn->size, GFP_KERNEL);
  	cn->used = 0;
  
-@@ -1831,6 +1964,250 @@ out:
+@@ -1831,6 +1965,250 @@ out:
  	return ispipe;
  }
  
@@ -46435,7 +46970,7 @@ index c27fa0d..00ce2eb 100644
 +	if (!n)
 +		return;
 +
-+	type = check_heap_object(ptr, n, to);
++	type = check_heap_object(ptr, n);
 +	if (!type) {
 +		if (check_stack_object(ptr, n) != -1)
 +			return;
@@ -46472,7 +47007,7 @@ index c27fa0d..00ce2eb 100644
  static int zap_process(struct task_struct *start, int exit_code)
  {
  	struct task_struct *t;
-@@ -2004,17 +2381,17 @@ static void coredump_finish(struct mm_struct *mm)
+@@ -2004,17 +2382,17 @@ static void coredump_finish(struct mm_struct *mm)
  void set_dumpable(struct mm_struct *mm, int value)
  {
  	switch (value) {
@@ -46493,7 +47028,7 @@ index c27fa0d..00ce2eb 100644
  		set_bit(MMF_DUMP_SECURELY, &mm->flags);
  		smp_wmb();
  		set_bit(MMF_DUMPABLE, &mm->flags);
-@@ -2027,7 +2404,7 @@ static int __get_dumpable(unsigned long mm_flags)
+@@ -2027,7 +2405,7 @@ static int __get_dumpable(unsigned long mm_flags)
  	int ret;
  
  	ret = mm_flags & MMF_DUMPABLE_MASK;
@@ -46502,7 +47037,7 @@ index c27fa0d..00ce2eb 100644
  }
  
  int get_dumpable(struct mm_struct *mm)
-@@ -2042,17 +2419,17 @@ static void wait_for_dump_helpers(struct file *file)
+@@ -2042,17 +2420,17 @@ static void wait_for_dump_helpers(struct file *file)
  	pipe = file->f_path.dentry->d_inode->i_pipe;
  
  	pipe_lock(pipe);
@@ -46525,7 +47060,7 @@ index c27fa0d..00ce2eb 100644
  	pipe_unlock(pipe);
  
  }
-@@ -2113,7 +2490,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2113,7 +2491,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	int retval = 0;
  	int flag = 0;
  	int ispipe;
@@ -46535,7 +47070,7 @@ index c27fa0d..00ce2eb 100644
  	struct coredump_params cprm = {
  		.signr = signr,
  		.regs = regs,
-@@ -2128,6 +2506,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2128,6 +2507,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  
  	audit_core_dumps(signr);
  
@@ -46545,7 +47080,7 @@ index c27fa0d..00ce2eb 100644
  	binfmt = mm->binfmt;
  	if (!binfmt || !binfmt->core_dump)
  		goto fail;
-@@ -2138,14 +2519,16 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2138,14 +2520,16 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	if (!cred)
  		goto fail;
  	/*
@@ -46566,7 +47101,7 @@ index c27fa0d..00ce2eb 100644
  	}
  
  	retval = coredump_wait(exit_code, &core_state);
-@@ -2195,7 +2578,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2195,7 +2579,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  		}
  		cprm.limit = RLIM_INFINITY;
  
@@ -46575,7 +47110,7 @@ index c27fa0d..00ce2eb 100644
  		if (core_pipe_limit && (core_pipe_limit < dump_count)) {
  			printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
  			       task_tgid_vnr(current), current->comm);
-@@ -2222,9 +2605,19 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2222,9 +2606,19 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	} else {
  		struct inode *inode;
  
@@ -46595,7 +47130,7 @@ index c27fa0d..00ce2eb 100644
  		cprm.file = filp_open(cn.corename,
  				 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
  				 0600);
-@@ -2265,7 +2658,7 @@ close_fail:
+@@ -2265,7 +2659,7 @@ close_fail:
  		filp_close(cprm.file, NULL);
  fail_dropcount:
  	if (ispipe)
@@ -46604,7 +47139,7 @@ index c27fa0d..00ce2eb 100644
  fail_unlock:
  	kfree(cn.corename);
  fail_corename:
-@@ -2284,7 +2677,7 @@ fail:
+@@ -2284,7 +2678,7 @@ fail:
   */
  int dump_write(struct file *file, const void *addr, int nr)
  {
@@ -46810,10 +47345,10 @@ index 1d07c12..9965aec 100644
  
  	return 0;
 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index f8d5fce..c411c11 100644
+index 24ac7a2..c596196 100644
 --- a/fs/ext4/super.c
 +++ b/fs/ext4/super.c
-@@ -3163,7 +3163,6 @@ int ext4_calculate_overhead(struct super_block *sb)
+@@ -3173,7 +3173,6 @@ int ext4_calculate_overhead(struct super_block *sb)
  	ext4_fsblk_t overhead = 0;
  	char *buf = (char *) get_zeroed_page(GFP_KERNEL);
  
@@ -46975,7 +47510,7 @@ index 0845f84..7b4ebef 100644
  
  	if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
 diff --git a/fs/fs_struct.c b/fs/fs_struct.c
-index 78b519c..7c6fd17 100644
+index 78b519c..0386555 100644
 --- a/fs/fs_struct.c
 +++ b/fs/fs_struct.c
 @@ -4,6 +4,7 @@
@@ -47008,15 +47543,7 @@ index 78b519c..7c6fd17 100644
  				count++;
  			}
  			if (fs->pwd.dentry == old_root->dentry
-@@ -103,13 +112,16 @@ void exit_fs(struct task_struct *tsk)
- {
- 	struct fs_struct *fs = tsk->fs;
- 
-+	gr_put_exec_file(tsk);
-+	
- 	if (fs) {
- 		int kill;
- 		task_lock(tsk);
+@@ -109,7 +118,8 @@ void exit_fs(struct task_struct *tsk)
  		spin_lock(&fs->lock);
  		write_seqcount_begin(&fs->seq);
  		tsk->fs = NULL;
@@ -47026,7 +47553,7 @@ index 78b519c..7c6fd17 100644
  		write_seqcount_end(&fs->seq);
  		spin_unlock(&fs->lock);
  		task_unlock(tsk);
-@@ -123,7 +135,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
+@@ -123,7 +133,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
  	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
  	/* We don't need to lock fs - think why ;-) */
  	if (fs) {
@@ -47035,7 +47562,7 @@ index 78b519c..7c6fd17 100644
  		fs->in_exec = 0;
  		spin_lock_init(&fs->lock);
  		seqcount_init(&fs->seq);
-@@ -132,6 +144,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
+@@ -132,6 +142,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
  		spin_lock(&old->lock);
  		fs->root = old->root;
  		path_get_longterm(&fs->root);
@@ -47045,7 +47572,7 @@ index 78b519c..7c6fd17 100644
  		fs->pwd = old->pwd;
  		path_get_longterm(&fs->pwd);
  		spin_unlock(&old->lock);
-@@ -150,8 +165,9 @@ int unshare_fs_struct(void)
+@@ -150,8 +163,9 @@ int unshare_fs_struct(void)
  
  	task_lock(current);
  	spin_lock(&fs->lock);
@@ -47056,7 +47583,7 @@ index 78b519c..7c6fd17 100644
  	spin_unlock(&fs->lock);
  	task_unlock(current);
  
-@@ -164,13 +180,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
+@@ -164,13 +178,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
  
  int current_umask(void)
  {
@@ -47072,15 +47599,7 @@ index 78b519c..7c6fd17 100644
  	.lock		= __SPIN_LOCK_UNLOCKED(init_fs.lock),
  	.seq		= SEQCNT_ZERO,
  	.umask		= 0022,
-@@ -180,18 +196,21 @@ void daemonize_fs_struct(void)
- {
- 	struct fs_struct *fs = current->fs;
- 
-+	gr_put_exec_file(current);
-+
- 	if (fs) {
- 		int kill;
- 
+@@ -186,12 +200,13 @@ void daemonize_fs_struct(void)
  		task_lock(current);
  
  		spin_lock(&init_fs.lock);
@@ -49314,19 +49833,6 @@ index ca4913a..8d4cf9e 100644
  	get_fs_root(current->fs, &root);
  	error = lock_mount(&old);
  	if (error)
-diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
-index 1aaa0ee..c5cc5bd 100644
---- a/fs/nfs/blocklayout/blocklayout.c
-+++ b/fs/nfs/blocklayout/blocklayout.c
-@@ -92,7 +92,7 @@ static int is_writable(struct pnfs_block_extent *be, sector_t isect)
-  */
- struct parallel_io {
- 	struct kref refcnt;
--	struct rpc_call_ops call_ops;
-+	rpc_call_ops_no_const call_ops;
- 	void (*pnfs_callback) (void *data);
- 	void *data;
- };
 diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
 index 756f4df..8bd49ca 100644
 --- a/fs/nfs/dir.c
@@ -51448,7 +51954,7 @@ index d33418f..2a5345e 100644
  		return -EINVAL;
  
 diff --git a/fs/seq_file.c b/fs/seq_file.c
-index dba43c3..9ae2292 100644
+index dba43c3..7511af2 100644
 --- a/fs/seq_file.c
 +++ b/fs/seq_file.c
 @@ -9,6 +9,7 @@
@@ -51522,7 +52028,7 @@ index dba43c3..9ae2292 100644
  		void *data)
  {
 -	struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
-+	seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
++	seq_operations_no_const *op = kzalloc(sizeof(*op), GFP_KERNEL);
  	int res = -ENOMEM;
  
  	if (op) {
@@ -51959,10 +52465,10 @@ index 87323f1..dab9d00 100644
  	ip = issum ? mp->m_rsumip : mp->m_rbmip;
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..70183d8
+index 0000000..de63c25
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,964 @@
+@@ -0,0 +1,982 @@
 +#
 +# grecurity configuration
 +#
@@ -52787,6 +53293,24 @@ index 0000000..70183d8
 +	  prevents a socket from lasting more than 45 seconds in LAST_ACK
 +	  state.
 +
++config GRKERNSEC_NO_SIMULT_CONNECT
++	bool "Disable TCP Simultaneous Connect"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on NET
++	help
++	  If you say Y here, a feature by Willy Tarreau will be enabled that
++	  removes a weakness in Linux's strict implementation of TCP that
++	  allows two clients to connect to each other without either entering
++	  a listening state.  The weakness allows an attacker to easily prevent
++	  a client from connecting to a known server provided the source port
++	  for the connection is guessed correctly.
++
++	  As the weakness could be used to prevent an antivirus or IPS from
++	  fetching updates, or prevent an SSL gateway from fetching a CRL,
++	  it should be eliminated by enabling this option.  Though Linux is
++	  one of few operating systems supporting simultaneous connect, it
++	  has no legitimate use in practice and is rarely supported by firewalls.
++	
 +config GRKERNSEC_SOCKET
 +	bool "Socket restrictions"
 +	depends on NET
@@ -57409,10 +57933,10 @@ index 0000000..955ddfb
 +
 diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
 new file mode 100644
-index 0000000..d28e241
+index 0000000..b20f6e9
 --- /dev/null
 +++ b/grsecurity/gracl_fs.c
-@@ -0,0 +1,437 @@
+@@ -0,0 +1,431 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/types.h>
@@ -57820,7 +58344,6 @@ index 0000000..d28e241
 +{
 +	u16 id;
 +	char *rolename;
-+	struct file *exec_file;
 +
 +	if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
 +	    !(current->role->roletype & GR_ROLE_PERSIST))) {
@@ -57830,13 +58353,8 @@ index 0000000..d28e241
 +		gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
 +	}
 +
-+	write_lock(&grsec_exec_file_lock);
-+	exec_file = current->exec_file;
-+	current->exec_file = NULL;
-+	write_unlock(&grsec_exec_file_lock);
-+
-+	if (exec_file)
-+		fput(exec_file);
++	gr_put_exec_file(current);
++	return;
 +}
 +
 +int
@@ -61909,19 +62427,6 @@ index 0000000..9f7b1ac
 +
 +	return retval;
 +}
-diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
-index 6cd5b64..f620d2d 100644
---- a/include/acpi/acpi_bus.h
-+++ b/include/acpi/acpi_bus.h
-@@ -107,7 +107,7 @@ struct acpi_device_ops {
- 	acpi_op_bind bind;
- 	acpi_op_unbind unbind;
- 	acpi_op_notify notify;
--};
-+} __no_const;
- 
- #define ACPI_DRIVER_ALL_NOTIFY_EVENTS	0x1	/* system AND device events */
- 
 diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
 index 77ff547..181834f 100644
 --- a/include/asm-generic/4level-fixup.h
@@ -62545,6 +63050,19 @@ index b5e2e4c..6a5373e 100644
  
  /**
   * PERCPU_SECTION - define output section for percpu area, simple version
+diff --git a/include/crypto/algapi.h b/include/crypto/algapi.h
+index ecc721d..029cf5a 100644
+--- a/include/crypto/algapi.h
++++ b/include/crypto/algapi.h
+@@ -34,7 +34,7 @@ struct crypto_type {
+ 	unsigned int maskclear;
+ 	unsigned int maskset;
+ 	unsigned int tfmsize;
+-};
++} __do_const;
+ 
+ struct crypto_instance {
+ 	struct crypto_alg alg;
 diff --git a/include/drm/drmP.h b/include/drm/drmP.h
 index bf4b2dc..2d0762f 100644
 --- a/include/drm/drmP.h
@@ -62576,18 +63094,9 @@ index bf4b2dc..2d0762f 100644
  
  	struct list_head filelist;
 diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
-index 73b0712..0b7ef2f 100644
+index 73b0712..2e581af 100644
 --- a/include/drm/drm_crtc_helper.h
 +++ b/include/drm/drm_crtc_helper.h
-@@ -74,7 +74,7 @@ struct drm_crtc_helper_funcs {
- 
- 	/* disable crtc when not in use - more explicit than dpms off */
- 	void (*disable)(struct drm_crtc *crtc);
--};
-+} __no_const;
- 
- struct drm_encoder_helper_funcs {
- 	void (*dpms)(struct drm_encoder *encoder, int mode);
 @@ -95,7 +95,7 @@ struct drm_encoder_helper_funcs {
  					    struct drm_connector *connector);
  	/* disable encoder when not in use - more explicit than dpms off */
@@ -62801,6 +63310,18 @@ index a63d13d..f15d415 100644
  #endif /* __KERNEL__ */
  
  #endif /* !_LINUX_CAPABILITY_H */
+diff --git a/include/linux/cdrom.h b/include/linux/cdrom.h
+index 35eae4b..5673e99 100644
+--- a/include/linux/cdrom.h
++++ b/include/linux/cdrom.h
+@@ -985,7 +985,6 @@ struct cdrom_device_ops {
+ 
+ /* driver specifications */
+ 	const int capability;   /* capability flags */
+-	int n_minors;           /* number of active minor devices */
+ 	/* handle uniform packets for scsi type devices (scsi,atapi) */
+ 	int (*generic_packet) (struct cdrom_device_info *,
+ 			       struct packet_command *);
 diff --git a/include/linux/cleancache.h b/include/linux/cleancache.h
 index 04ffb2e..6799180 100644
 --- a/include/linux/cleancache.h
@@ -63097,19 +63618,6 @@ index 75f53f8..5c7972d 100644
  	struct dma_pinned_list *pinned_list, struct page *page,
  	unsigned int offset, size_t len);
  
-diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 1328d8c..2cd894c 100644
---- a/include/linux/efi.h
-+++ b/include/linux/efi.h
-@@ -457,7 +457,7 @@ struct efivar_operations {
- 	efi_get_variable_t *get_variable;
- 	efi_get_next_variable_t *get_next_variable;
- 	efi_set_variable_t *set_variable;
--};
-+} __no_const;
- 
- struct efivars {
- 	/*
 diff --git a/include/linux/elf.h b/include/linux/elf.h
 index 31f0508..5421c01 100644
 --- a/include/linux/elf.h
@@ -63208,19 +63716,6 @@ index 8eeb205..d59bfa2 100644
  	struct rcu_head		rcu;
  	struct sock_filter     	insns[0];
  };
-diff --git a/include/linux/firewire.h b/include/linux/firewire.h
-index 84ccf8e..2e9b14c 100644
---- a/include/linux/firewire.h
-+++ b/include/linux/firewire.h
-@@ -428,7 +428,7 @@ struct fw_iso_context {
- 	union {
- 		fw_iso_callback_t sc;
- 		fw_iso_mc_callback_t mc;
--	} callback;
-+	} __no_const callback;
- 	void *callback_data;
- };
- 
 diff --git a/include/linux/fs.h b/include/linux/fs.h
 index 29b6353..295eed1 100644
 --- a/include/linux/fs.h
@@ -63283,31 +63778,10 @@ index 2a53f10..0187fdf 100644
  }
  
  /*
-diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
-index 91d0e0a3..035666b 100644
---- a/include/linux/fsnotify_backend.h
-+++ b/include/linux/fsnotify_backend.h
-@@ -105,6 +105,7 @@ struct fsnotify_ops {
- 	void (*freeing_mark)(struct fsnotify_mark *mark, struct fsnotify_group *group);
- 	void (*free_event_priv)(struct fsnotify_event_private_data *priv);
- };
-+typedef struct fsnotify_ops __no_const fsnotify_ops_no_const;
- 
- /*
-  * A group is a "thing" that wants to receive notification about filesystem
 diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
-index c3da42d..c70e0df 100644
+index c3da42d..d98b224 100644
 --- a/include/linux/ftrace_event.h
 +++ b/include/linux/ftrace_event.h
-@@ -97,7 +97,7 @@ struct trace_event_functions {
- 	trace_print_func	raw;
- 	trace_print_func	hex;
- 	trace_print_func	binary;
--};
-+} __no_const;
- 
- struct trace_event {
- 	struct hlist_node		node;
 @@ -254,7 +254,7 @@ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
  extern int trace_add_event_call(struct ftrace_event_call *call);
  extern void trace_remove_event_call(struct ftrace_event_call *call);
@@ -64472,19 +64946,6 @@ index 0000000..e7ffaaf
 +			    const int protocol);
 +
 +#endif
-diff --git a/include/linux/hid.h b/include/linux/hid.h
-index 331e2ef..fcd0ee5 100644
---- a/include/linux/hid.h
-+++ b/include/linux/hid.h
-@@ -679,7 +679,7 @@ struct hid_ll_driver {
- 			unsigned int code, int value);
- 
- 	int (*parse)(struct hid_device *hdev);
--};
-+} __no_const;
- 
- #define	PM_HINT_FULLON	1<<5
- #define PM_HINT_NORMAL	1<<1
 diff --git a/include/linux/highmem.h b/include/linux/highmem.h
 index 52e9620..26c34b1 100644
 --- a/include/linux/highmem.h
@@ -64533,6 +64994,19 @@ index a6deef4..c56a7f2 100644
  	struct list_head context_list;	/* list of context id's
  					   and pointers */
  #endif
+diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
+index b5f927f..929b882 100644
+--- a/include/linux/if_pppox.h
++++ b/include/linux/if_pppox.h
+@@ -203,7 +203,7 @@ struct pppox_proto {
+ 	int		(*ioctl)(struct socket *sock, unsigned int cmd,
+ 				 unsigned long arg);
+ 	struct module	*owner;
+-};
++} __do_const;
+ 
+ extern int register_pppox_proto(int proto_num, const struct pppox_proto *pp);
+ extern void unregister_pppox_proto(int proto_num);
 diff --git a/include/linux/init.h b/include/linux/init.h
 index 9146f39..23fa1ea 100644
 --- a/include/linux/init.h
@@ -64627,19 +65101,6 @@ index cdde2b3..d782954 100644
  	.fs		= &init_fs,					\
  	.files		= &init_files,					\
  	.signal		= &init_signals,				\
-diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
-index e6ca56d..8583707 100644
---- a/include/linux/intel-iommu.h
-+++ b/include/linux/intel-iommu.h
-@@ -296,7 +296,7 @@ struct iommu_flush {
- 			      u8 fm, u64 type);
- 	void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
- 			    unsigned int size_order, u64 type);
--};
-+} __no_const;
- 
- enum {
- 	SR_DMAR_FECTL_REG,
 diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
 index a64b00e..464d8bc 100644
 --- a/include/linux/interrupt.h
@@ -64743,6 +65204,19 @@ index b16f653..eb908f4 100644
  #define request_module(mod...) __request_module(true, mod)
  #define request_module_nowait(mod...) __request_module(false, mod)
  #define try_then_request_module(x, mod...) \
+diff --git a/include/linux/kobject.h b/include/linux/kobject.h
+index 445f978..925605f 100644
+--- a/include/linux/kobject.h
++++ b/include/linux/kobject.h
+@@ -111,7 +111,7 @@ struct kobj_type {
+ 	struct attribute **default_attrs;
+ 	const struct kobj_ns_type_operations *(*child_ns_type)(struct kobject *kobj);
+ 	const void *(*namespace)(struct kobject *kobj);
+-};
++} __do_const;
+ 
+ struct kobj_uevent_env {
+ 	char *envp[UEVENT_NUM_ENVP];
 diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
 index 6136821..b3ba6ba 100644
 --- a/include/linux/kvm_host.h
@@ -64814,6 +65288,20 @@ index cafc09a..d7e7829 100644
  
  struct ata_port_info {
  	unsigned long		flags;
+diff --git a/include/linux/list.h b/include/linux/list.h
+index cc6d2aa..71febca 100644
+--- a/include/linux/list.h
++++ b/include/linux/list.h
+@@ -112,6 +112,9 @@ extern void __list_del_entry(struct list_head *entry);
+ extern void list_del(struct list_head *entry);
+ #endif
+ 
++extern void pax_list_add_tail(struct list_head *new, struct list_head *head);
++extern void pax_list_del(struct list_head *entry);
++
+ /**
+  * list_replace - replace old entry by new one
+  * @old : the element to be replaced
 diff --git a/include/linux/mca.h b/include/linux/mca.h
 index 3797270..7765ede 100644
 --- a/include/linux/mca.h
@@ -64827,31 +65315,6 @@ index 3797270..7765ede 100644
  
  struct mca_bus {
  	u64			default_dma_mask;
-diff --git a/include/linux/memory.h b/include/linux/memory.h
-index 6bea2c2..a27245a 100644
---- a/include/linux/memory.h
-+++ b/include/linux/memory.h
-@@ -144,7 +144,7 @@ struct memory_accessor {
- 			size_t count);
- 	ssize_t (*write)(struct memory_accessor *, const char *buf,
- 			 off_t offset, size_t count);
--};
-+} __no_const;
- 
- /*
-  * Kernel text modification mutex, used for code patching. Users of this lock
-diff --git a/include/linux/mfd/abx500.h b/include/linux/mfd/abx500.h
-index 9970337..9444122 100644
---- a/include/linux/mfd/abx500.h
-+++ b/include/linux/mfd/abx500.h
-@@ -188,6 +188,7 @@ struct abx500_ops {
- 	int (*event_registers_startup_state_get) (struct device *, u8 *);
- 	int (*startup_irq_enabled) (struct device *, unsigned int);
- };
-+typedef struct abx500_ops __no_const abx500_ops_no_const;
- 
- int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
- void abx500_remove_ops(struct device *dev);
 diff --git a/include/linux/mm.h b/include/linux/mm.h
 index 4baadd1..293e034 100644
 --- a/include/linux/mm.h
@@ -65081,6 +65544,28 @@ index 5b42f1b..9782147 100644
  };
  
  static inline void mm_init_cpumask(struct mm_struct *mm)
+diff --git a/include/linux/mmiotrace.h b/include/linux/mmiotrace.h
+index c5d5278..f0b68c8 100644
+--- a/include/linux/mmiotrace.h
++++ b/include/linux/mmiotrace.h
+@@ -46,7 +46,7 @@ extern int kmmio_handler(struct pt_regs *regs, unsigned long addr);
+ /* Called from ioremap.c */
+ extern void mmiotrace_ioremap(resource_size_t offset, unsigned long size,
+ 							void __iomem *addr);
+-extern void mmiotrace_iounmap(volatile void __iomem *addr);
++extern void mmiotrace_iounmap(const volatile void __iomem *addr);
+ 
+ /* For anyone to insert markers. Remember trailing newline. */
+ extern __printf(1, 2) int mmiotrace_printk(const char *fmt, ...);
+@@ -66,7 +66,7 @@ static inline void mmiotrace_ioremap(resource_size_t offset,
+ {
+ }
+ 
+-static inline void mmiotrace_iounmap(volatile void __iomem *addr)
++static inline void mmiotrace_iounmap(const volatile void __iomem *addr)
+ {
+ }
+ 
 diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
 index 1d1b1e1..2a13c78 100644
 --- a/include/linux/mmu_notifier.h
@@ -65137,10 +65622,10 @@ index 468819c..17b9db3 100644
  struct hid_device_id {
  	__u16 bus;
 diff --git a/include/linux/module.h b/include/linux/module.h
-index 3cb7839..511cb87 100644
+index 3cb7839..dcb1974 100644
 --- a/include/linux/module.h
 +++ b/include/linux/module.h
-@@ -17,6 +17,7 @@
+@@ -17,9 +17,11 @@
  #include <linux/moduleparam.h>
  #include <linux/tracepoint.h>
  #include <linux/export.h>
@@ -65148,7 +65633,11 @@ index 3cb7839..511cb87 100644
  
  #include <linux/percpu.h>
  #include <asm/module.h>
-@@ -261,19 +262,16 @@ struct module
++#include <asm/pgtable.h>
+ 
+ #include <trace/events/module.h>
+ 
+@@ -261,19 +263,16 @@ struct module
  	int (*init)(void);
  
  	/* If this is non-NULL, vfree after init() returns */
@@ -65172,7 +65661,7 @@ index 3cb7839..511cb87 100644
  
  	/* Arch-specific module values */
  	struct mod_arch_specific arch;
-@@ -329,6 +327,10 @@ struct module
+@@ -329,6 +328,10 @@ struct module
  #ifdef CONFIG_EVENT_TRACING
  	struct ftrace_event_call **trace_events;
  	unsigned int num_trace_events;
@@ -65183,7 +65672,7 @@ index 3cb7839..511cb87 100644
  #endif
  #ifdef CONFIG_FTRACE_MCOUNT_RECORD
  	unsigned int num_ftrace_callsites;
-@@ -379,16 +381,46 @@ bool is_module_address(unsigned long addr);
+@@ -379,16 +382,46 @@ bool is_module_address(unsigned long addr);
  bool is_module_percpu_address(unsigned long addr);
  bool is_module_text_address(unsigned long addr);
  
@@ -65334,6 +65823,32 @@ index 00ca32b..1f8accc 100644
  					     * Do not use this in drivers.
  					     */
  
+diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
+index 3540c6e..83adb6c 100644
+--- a/include/linux/netfilter/ipset/ip_set.h
++++ b/include/linux/netfilter/ipset/ip_set.h
+@@ -274,7 +274,7 @@ struct ip_set_type_variant {
+ 	/* Return true if "b" set is the same as "a"
+ 	 * according to the create set parameters */
+ 	bool (*same_set)(const struct ip_set *a, const struct ip_set *b);
+-};
++} __do_const;
+ 
+ /* The core set type structure */
+ struct ip_set_type {
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index 74d3386..e800dbf 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -65,7 +65,7 @@ struct nfnl_callback {
+ 		    const struct nlattr * const cda[]);
+ 	const struct nla_policy *policy;	/* netlink attribute policy */
+ 	const u_int16_t attr_count;		/* number of nlattr's */
+-};
++} __do_const;
+ 
+ struct nfnetlink_subsystem {
+ 	const char *name;
 diff --git a/include/linux/netfilter/xt_gradm.h b/include/linux/netfilter/xt_gradm.h
 new file mode 100644
 index 0000000..33f4af8
@@ -65349,19 +65864,20 @@ index 0000000..33f4af8
 +};
 +
 +#endif
-diff --git a/include/linux/of_pdt.h b/include/linux/of_pdt.h
-index c65a18a..0c05f3a 100644
---- a/include/linux/of_pdt.h
-+++ b/include/linux/of_pdt.h
-@@ -32,7 +32,7 @@ struct of_pdt_ops {
- 
- 	/* return 0 on success; fill in 'len' with number of bytes in path */
- 	int (*pkg2path)(phandle node, char *buf, const int buflen, int *len);
+diff --git a/include/linux/notifier.h b/include/linux/notifier.h
+index d65746e..62e72c2 100644
+--- a/include/linux/notifier.h
++++ b/include/linux/notifier.h
+@@ -51,7 +51,8 @@ struct notifier_block {
+ 	int (*notifier_call)(struct notifier_block *, unsigned long, void *);
+ 	struct notifier_block __rcu *next;
+ 	int priority;
 -};
-+} __no_const;
- 
- extern void *prom_early_alloc(unsigned long size);
++} __do_const;
++typedef struct notifier_block __no_const notifier_block_no_const;
  
+ struct atomic_notifier_head {
+ 	spinlock_t lock;
 diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
 index a4c5624..2dabfb7 100644
 --- a/include/linux/oprofile.h
@@ -65400,34 +65916,6 @@ index 4633b2f..988bc08 100644
  	atomic_t			reorder_objects;
  	atomic_t			refcnt;
  	unsigned int			max_seq_nr;
-diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
-index e90a673..8d9b903 100644
---- a/include/linux/page-flags.h
-+++ b/include/linux/page-flags.h
-@@ -360,7 +360,7 @@ static inline void ClearPageCompound(struct page *page)
-  * pages on the LRU and/or pagecache.
-  */
- TESTPAGEFLAG(Compound, compound)
--__PAGEFLAG(Head, compound)
-+__SETPAGEFLAG(Head, compound)  __CLEARPAGEFLAG(Head, compound)
- 
- /*
-  * PG_reclaim is used in combination with PG_compound to mark the
-@@ -372,8 +372,14 @@ __PAGEFLAG(Head, compound)
-  * PG_compound & PG_reclaim	=> Tail page
-  * PG_compound & ~PG_reclaim	=> Head page
-  */
-+#define PG_head_mask ((1L << PG_compound))
- #define PG_head_tail_mask ((1L << PG_compound) | (1L << PG_reclaim))
- 
-+static inline int PageHead(struct page *page)
-+{
-+	return ((page->flags & PG_head_tail_mask) == PG_head_mask);
-+}
-+
- static inline int PageTail(struct page *page)
- {
- 	return ((page->flags & PG_head_tail_mask) == PG_head_tail_mask);
 diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
 index b669be6..8335421 100644
 --- a/include/linux/perf_event.h
@@ -65511,19 +65999,6 @@ index 79159de..f1233a9 100644
  
  /********** include/linux/timer.h **********/
  /*
-diff --git a/include/linux/preempt.h b/include/linux/preempt.h
-index 58969b2..ead129b 100644
---- a/include/linux/preempt.h
-+++ b/include/linux/preempt.h
-@@ -123,7 +123,7 @@ struct preempt_ops {
- 	void (*sched_in)(struct preempt_notifier *notifier, int cpu);
- 	void (*sched_out)(struct preempt_notifier *notifier,
- 			  struct task_struct *next);
--};
-+} __no_const;
- 
- /**
-  * preempt_notifier - key for installing preemption notifiers
 diff --git a/include/linux/printk.h b/include/linux/printk.h
 index f0e22f7..82dd544 100644
 --- a/include/linux/printk.h
@@ -65546,7 +66021,7 @@ index f0e22f7..82dd544 100644
  void log_buf_kexec_setup(void);
  void __init setup_log_buf(int early);
 diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
-index 643b96c..ef55a9c 100644
+index 643b96c..afeaad5 100644
 --- a/include/linux/proc_fs.h
 +++ b/include/linux/proc_fs.h
 @@ -155,6 +155,19 @@ static inline struct proc_dir_entry *proc_create(const char *name, mode_t mode,
@@ -65569,15 +66044,6 @@ index 643b96c..ef55a9c 100644
  static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
  	mode_t mode, struct proc_dir_entry *base, 
  	read_proc_t *read_proc, void * data)
-@@ -258,7 +271,7 @@ union proc_op {
- 	int (*proc_show)(struct seq_file *m,
- 		struct pid_namespace *ns, struct pid *pid,
- 		struct task_struct *task);
--};
-+} __no_const;
- 
- struct ctl_table_header;
- struct ctl_table;
 diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
 index 800f113..12c82ec 100644
 --- a/include/linux/ptrace.h
@@ -65611,21 +66077,10 @@ index 800f113..12c82ec 100644
  }
  
 diff --git a/include/linux/random.h b/include/linux/random.h
-index 29e217a..b9d7532 100644
+index 29e217a..1dee1dd 100644
 --- a/include/linux/random.h
 +++ b/include/linux/random.h
-@@ -55,6 +55,10 @@ extern void add_input_randomness(unsigned int type, unsigned int code,
- 				 unsigned int value);
- extern void add_interrupt_randomness(int irq, int irq_flags);
- 
-+#ifdef CONFIG_PAX_LATENT_ENTROPY
-+extern void transfer_latent_entropy(void);
-+#endif
-+
- extern void get_random_bytes(void *buf, int nbytes);
- extern void get_random_bytes_arch(void *buf, int nbytes);
- void generate_random_uuid(unsigned char uuid_out[16]);
-@@ -71,12 +75,17 @@ void srandom32(u32 seed);
+@@ -71,12 +71,17 @@ void srandom32(u32 seed);
  
  u32 prandom32(struct rnd_state *);
  
@@ -65683,6 +66138,19 @@ index e0879a7..a12f962 100644
  #include <asm/emergency-restart.h>
  
  #endif
+diff --git a/include/linux/regset.h b/include/linux/regset.h
+index 686f373..a72ed78 100644
+--- a/include/linux/regset.h
++++ b/include/linux/regset.h
+@@ -160,7 +160,7 @@ struct user_regset {
+ 	unsigned int 			align;
+ 	unsigned int 			bias;
+ 	unsigned int 			core_note_type;
+-};
++} __do_const;
+ 
+ /**
+  * struct user_regset_view - available regsets
 diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
 index 96d465f..b084e05 100644
 --- a/include/linux/reiserfs_fs.h
@@ -65722,18 +66190,6 @@ index 14a86bc..17d0700 100644
  
  /*
   * CONFIG_RELAY kernel API, kernel/relay.c
-diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
-index c6c6084..5bf1212 100644
---- a/include/linux/rfkill.h
-+++ b/include/linux/rfkill.h
-@@ -147,6 +147,7 @@ struct rfkill_ops {
- 	void	(*query)(struct rfkill *rfkill, void *data);
- 	int	(*set_block)(void *data, bool blocked);
- };
-+typedef struct rfkill_ops __no_const rfkill_ops_no_const;
- 
- #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
- /**
 diff --git a/include/linux/rio.h b/include/linux/rio.h
 index 4d50611..c6858a2 100644
 --- a/include/linux/rio.h
@@ -66139,7 +66595,7 @@ index 53dc7e7..e353d6b 100644
  					       int size);
  extern int	       skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
 diff --git a/include/linux/slab.h b/include/linux/slab.h
-index 573c809..a6e62c9 100644
+index 573c809..6375905 100644
 --- a/include/linux/slab.h
 +++ b/include/linux/slab.h
 @@ -11,12 +11,20 @@
@@ -66191,7 +66647,7 @@ index 573c809..a6e62c9 100644
  void kfree(const void *);
  void kzfree(const void *);
  size_t ksize(const void *);
-+const char *check_heap_object(const void *ptr, unsigned long n, bool to);
++const char *check_heap_object(const void *ptr, unsigned long n);
 +bool is_usercopy_object(const void *ptr);
  
  /*
@@ -66392,27 +66848,6 @@ index a32bcfd..c3991fb 100644
  static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
  {
  	if (__builtin_constant_p(size) &&
-diff --git a/include/linux/snmp.h b/include/linux/snmp.h
-index e16557a..64f5ca7 100644
---- a/include/linux/snmp.h
-+++ b/include/linux/snmp.h
-@@ -209,7 +209,6 @@ enum
- 	LINUX_MIB_TCPDSACKOFOSENT,		/* TCPDSACKOfoSent */
- 	LINUX_MIB_TCPDSACKRECV,			/* TCPDSACKRecv */
- 	LINUX_MIB_TCPDSACKOFORECV,		/* TCPDSACKOfoRecv */
--	LINUX_MIB_TCPABORTONSYN,		/* TCPAbortOnSyn */
- 	LINUX_MIB_TCPABORTONDATA,		/* TCPAbortOnData */
- 	LINUX_MIB_TCPABORTONCLOSE,		/* TCPAbortOnClose */
- 	LINUX_MIB_TCPABORTONMEMORY,		/* TCPAbortOnMemory */
-@@ -233,6 +232,8 @@ enum
- 	LINUX_MIB_TCPTIMEWAITOVERFLOW,		/* TCPTimeWaitOverflow */
- 	LINUX_MIB_TCPREQQFULLDOCOOKIES,		/* TCPReqQFullDoCookies */
- 	LINUX_MIB_TCPREQQFULLDROP,		/* TCPReqQFullDrop */
-+	LINUX_MIB_TCPCHALLENGEACK,		/* TCPChallengeACK */
-+	LINUX_MIB_TCPSYNCHALLENGE,		/* TCPSYNChallenge */
- 	__LINUX_MIB_MAX
- };
- 
 diff --git a/include/linux/sonet.h b/include/linux/sonet.h
 index de8832d..0147b46 100644
 --- a/include/linux/sonet.h
@@ -66481,18 +66916,6 @@ index 3d8f9c4..69f1c0a 100644
  }
  
  #endif /* __KERNEL__ */
-diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
-index e775689..9e206d9 100644
---- a/include/linux/sunrpc/sched.h
-+++ b/include/linux/sunrpc/sched.h
-@@ -105,6 +105,7 @@ struct rpc_call_ops {
- 	void (*rpc_call_done)(struct rpc_task *, void *);
- 	void (*rpc_release)(void *);
- };
-+typedef struct rpc_call_ops __no_const rpc_call_ops_no_const;
- 
- struct rpc_task_setup {
- 	struct rpc_task *task;
 diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
 index c14fe86..393245e 100644
 --- a/include/linux/sunrpc/svc_rdma.h
@@ -66548,6 +66971,19 @@ index 703cfa33..0b8ca72ac 100644
  extern int proc_dointvec(struct ctl_table *, int,
  			 void __user *, size_t *, loff_t *);
  extern int proc_dointvec_minmax(struct ctl_table *, int,
+diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
+index 7faf933..eb6f5e3 100644
+--- a/include/linux/sysrq.h
++++ b/include/linux/sysrq.h
+@@ -36,7 +36,7 @@ struct sysrq_key_op {
+ 	char *help_msg;
+ 	char *action_msg;
+ 	int enable_mask;
+-};
++} __do_const;
+ 
+ #ifdef CONFIG_MAGIC_SYSRQ
+ 
 diff --git a/include/linux/tracehook.h b/include/linux/tracehook.h
 index a71a292..51bd91d 100644
 --- a/include/linux/tracehook.h
@@ -66586,6 +67022,19 @@ index a71a292..51bd91d 100644
  }
  
  /**
+diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
+index ecdaeb9..8d27e20 100644
+--- a/include/linux/tty_driver.h
++++ b/include/linux/tty_driver.h
+@@ -286,7 +286,7 @@ struct tty_operations {
+ 	void (*poll_put_char)(struct tty_driver *driver, int line, char ch);
+ #endif
+ 	const struct file_operations *proc_fops;
+-};
++} __do_const;
+ 
+ struct tty_driver {
+ 	int	magic;		/* magic number for this structure */
 diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
 index ff7dc08..893e1bd 100644
 --- a/include/linux/tty_ldisc.h
@@ -66715,7 +67164,7 @@ index 93629fc..0c97651 100644
  	unsigned long active_duration;
  
 diff --git a/include/linux/usb/renesas_usbhs.h b/include/linux/usb/renesas_usbhs.h
-index e5a40c3..20ab0f6 100644
+index e5a40c3..d75f068 100644
 --- a/include/linux/usb/renesas_usbhs.h
 +++ b/include/linux/usb/renesas_usbhs.h
 @@ -39,7 +39,7 @@ enum {
@@ -66727,15 +67176,6 @@ index e5a40c3..20ab0f6 100644
  
  /*
   * callback functions for platform
-@@ -89,7 +89,7 @@ struct renesas_usbhs_platform_callback {
- 	 * VBUS control is needed for Host
- 	 */
- 	int (*set_vbus)(struct platform_device *pdev, int enable);
--};
-+} __no_const;
- 
- /*
-  * parameters for renesas usbhs
 diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
 index 6f8fbcf..8259001 100644
 --- a/include/linux/vermagic.h
@@ -66916,21 +67356,8 @@ index e5d1220..ef6e406 100644
  #ifdef  __KERNEL__
  
  #include <linux/types.h>
-diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h
-index 4aeff96..b378cdc 100644
---- a/include/media/saa7146_vv.h
-+++ b/include/media/saa7146_vv.h
-@@ -163,7 +163,7 @@ struct saa7146_ext_vv
- 	int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
- 
- 	/* the extension can override this */
--	struct v4l2_ioctl_ops ops;
-+	v4l2_ioctl_ops_no_const ops;
- 	/* pointer to the saa7146 core ops */
- 	const struct v4l2_ioctl_ops *core_ops;
- 
 diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
-index c7c40f1..4f01585 100644
+index c7c40f1..5c31482 100644
 --- a/include/media/v4l2-dev.h
 +++ b/include/media/v4l2-dev.h
 @@ -56,7 +56,7 @@ int v4l2_prio_check(struct v4l2_prio_state *global, enum v4l2_priority local);
@@ -66942,40 +67369,18 @@ index c7c40f1..4f01585 100644
  	ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
  	ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
  	unsigned int (*poll) (struct file *, struct poll_table_struct *);
-@@ -68,6 +68,7 @@ struct v4l2_file_operations {
- 	int (*open) (struct file *);
- 	int (*release) (struct file *);
- };
-+typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const;
- 
- /*
-  * Newer version of video_device, handled by videodev2.c
 diff --git a/include/media/v4l2-ioctl.h b/include/media/v4l2-ioctl.h
-index 4d1c74a..65e1221 100644
+index 4d1c74a..8e58054 100644
 --- a/include/media/v4l2-ioctl.h
 +++ b/include/media/v4l2-ioctl.h
-@@ -274,7 +274,7 @@ struct v4l2_ioctl_ops {
- 	long (*vidioc_default)	       (struct file *file, void *fh,
+@@ -275,7 +275,6 @@ struct v4l2_ioctl_ops {
  					bool valid_prio, int cmd, void *arg);
  };
--
-+typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
  
+-
  /* v4l debugging and diagnostics */
  
-diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
-index 8d55251..dfe5b0a 100644
---- a/include/net/caif/caif_hsi.h
-+++ b/include/net/caif/caif_hsi.h
-@@ -98,7 +98,7 @@ struct cfhsi_drv {
- 	void (*rx_done_cb) (struct cfhsi_drv *drv);
- 	void (*wake_up_cb) (struct cfhsi_drv *drv);
- 	void (*wake_down_cb) (struct cfhsi_drv *drv);
--};
-+} __no_const;
- 
- /* Structure implemented by HSI device. */
- struct cfhsi_dev {
+ /* Debug bitmask flags to be used on V4L2 */
 diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
 index 9e5425b..8136ffc 100644
 --- a/include/net/caif/cfctrl.h
@@ -67012,6 +67417,19 @@ index 2a7eefd..3250f3b 100644
 +extern atomic_unchecked_t flow_cache_genid;
  
  #endif
+diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
+index ca2755f..85ec88c 100644
+--- a/include/net/inet_connection_sock.h
++++ b/include/net/inet_connection_sock.h
+@@ -61,7 +61,7 @@ struct inet_connection_sock_af_ops {
+ 	void	    (*addr2sockaddr)(struct sock *sk, struct sockaddr *);
+ 	int	    (*bind_conflict)(const struct sock *sk,
+ 				     const struct inet_bind_bucket *tb);
+-};
++} __do_const;
+ 
+ /** inet_connection_sock - INET connection oriented sock
+  *
 diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
 index e9ff3fc..9d3e5c7 100644
 --- a/include/net/inetpeer.h
@@ -67076,19 +67494,6 @@ index 416dcb0..dc75cc1 100644
  	atomic_t		weight;		/* server weight */
  
  	atomic_t		refcnt;		/* reference counter */
-diff --git a/include/net/irda/ircomm_core.h b/include/net/irda/ircomm_core.h
-index 69b610a..fe3962c 100644
---- a/include/net/irda/ircomm_core.h
-+++ b/include/net/irda/ircomm_core.h
-@@ -51,7 +51,7 @@ typedef struct {
- 	int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
- 	int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *, 
- 				  struct ircomm_info *);	
--} call_t;
-+} __no_const call_t;
- 
- struct ircomm_cb {
- 	irda_queue_t queue;
 diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
 index 59ba38bc..d515662 100644
 --- a/include/net/irda/ircomm_tty.h
@@ -67151,6 +67556,19 @@ index 8ba8ce2..99b7fff 100644
  		struct sk_buff *skb, int offset, struct iovec *to,
  		size_t len, struct dma_pinned_list *pinned_list);
  
+diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
+index 252fd10..aa1421f 100644
+--- a/include/net/netfilter/nf_queue.h
++++ b/include/net/netfilter/nf_queue.h
+@@ -22,7 +22,7 @@ struct nf_queue_handler {
+ 	int			(*outfn)(struct nf_queue_entry *entry,
+ 					 unsigned int queuenum);
+ 	char			*name;
+-};
++} __do_const;
+ 
+ extern int nf_register_queue_handler(u_int8_t pf,
+ 				     const struct nf_queue_handler *qh);
 diff --git a/include/net/netlink.h b/include/net/netlink.h
 index cb1f350..3279d2c 100644
 --- a/include/net/netlink.h
@@ -67179,6 +67597,28 @@ index d786b4f..4c3dd41 100644
  
  #ifdef CONFIG_IP_MROUTE
  #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
+diff --git a/include/net/protocol.h b/include/net/protocol.h
+index 6f7eb80..f9838be 100644
+--- a/include/net/protocol.h
++++ b/include/net/protocol.h
+@@ -44,7 +44,7 @@ struct net_protocol {
+ 	int			(*gro_complete)(struct sk_buff *skb);
+ 	unsigned int		no_policy:1,
+ 				netns_ok:1;
+-};
++} __do_const;
+ 
+ #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
+ struct inet6_protocol {
+@@ -63,7 +63,7 @@ struct inet6_protocol {
+ 	int	(*gro_complete)(struct sk_buff *skb);
+ 
+ 	unsigned int	flags;	/* INET6_PROTO_xxx */
+-};
++} __do_const;
+ 
+ #define INET6_PROTO_NOPOLICY	0x1
+ #define INET6_PROTO_FINAL	0x2
 diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
 index ad03988..0c5a964 100644
 --- a/include/net/sctp/sctp.h
@@ -67196,6 +67636,28 @@ index ad03988..0c5a964 100644
  #define SCTP_ENABLE_DEBUG
  #define SCTP_DISABLE_DEBUG
  #define SCTP_ASSERT(expr, str, func)
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index a15432da..6e7d872 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -624,7 +624,7 @@ struct sctp_af {
+ 	int		sockaddr_len;
+ 	sa_family_t	sa_family;
+ 	struct list_head list;
+-};
++} __do_const;
+ 
+ struct sctp_af *sctp_get_af_specific(sa_family_t);
+ int sctp_register_af(struct sctp_af *);
+@@ -644,7 +644,7 @@ struct sctp_pf {
+ 					  struct sctp_association *asoc);
+ 	void (*addr_v4map) (struct sctp_sock *, union sctp_addr *);
+ 	struct sctp_af *af;
+-};
++} __do_const;
+ 
+ 
+ /* Structure to track chunk fragments that have been acked, but peer
 diff --git a/include/net/sock.h b/include/net/sock.h
 index ddf523c..1f06685 100644
 --- a/include/net/sock.h
@@ -67228,18 +67690,10 @@ index ddf523c..1f06685 100644
  static inline struct page *sk_stream_alloc_page(struct sock *sk)
  {
 diff --git a/include/net/tcp.h b/include/net/tcp.h
-index bb18c4d..3a158c4 100644
+index 0768715..3fedeb4 100644
 --- a/include/net/tcp.h
 +++ b/include/net/tcp.h
-@@ -251,6 +251,7 @@ extern int sysctl_tcp_max_ssthresh;
- extern int sysctl_tcp_cookie_size;
- extern int sysctl_tcp_thin_linear_timeouts;
- extern int sysctl_tcp_thin_dupack;
-+extern int sysctl_tcp_challenge_ack_limit;
- 
- extern atomic_long_t tcp_memory_allocated;
- extern struct percpu_counter tcp_sockets_allocated;
-@@ -469,7 +470,7 @@ extern void tcp_retransmit_timer(struct sock *sk);
+@@ -470,7 +470,7 @@ extern void tcp_retransmit_timer(struct sock *sk);
  extern void tcp_xmit_retransmit_queue(struct sock *);
  extern void tcp_simple_retransmit(struct sock *);
  extern int tcp_trim_head(struct sock *, struct sk_buff *, u32);
@@ -67248,7 +67702,7 @@ index bb18c4d..3a158c4 100644
  
  extern void tcp_send_probe0(struct sock *);
  extern void tcp_send_partial(struct sock *);
-@@ -632,8 +633,8 @@ struct tcp_skb_cb {
+@@ -633,8 +633,8 @@ struct tcp_skb_cb {
  		struct inet6_skb_parm	h6;
  #endif
  	} header;	/* For incoming frames		*/
@@ -67259,7 +67713,7 @@ index bb18c4d..3a158c4 100644
  	__u32		when;		/* used to compute rtt's	*/
  	__u8		tcp_flags;	/* TCP header flags. (tcp[13])	*/
  	__u8		sacked;		/* State flags for SACK/FACK.	*/
-@@ -646,7 +647,7 @@ struct tcp_skb_cb {
+@@ -647,7 +647,7 @@ struct tcp_skb_cb {
  #define TCPCB_EVER_RETRANS	0x80	/* Ever retransmitted frame	*/
  #define TCPCB_RETRANS		(TCPCB_SACKED_RETRANS|TCPCB_EVER_RETRANS)
  
@@ -67268,32 +67722,19 @@ index bb18c4d..3a158c4 100644
  };
  
  #define TCP_SKB_CB(__skb)	((struct tcp_skb_cb *)&((__skb)->cb[0]))
-@@ -1409,7 +1410,7 @@ struct tcp_seq_afinfo {
- 	char				*name;
- 	sa_family_t			family;
- 	const struct file_operations	*seq_fops;
--	struct seq_operations		seq_ops;
-+	seq_operations_no_const		seq_ops;
- };
- 
- struct tcp_iter_state {
-diff --git a/include/net/udp.h b/include/net/udp.h
-index 3b285f4..0219639 100644
---- a/include/net/udp.h
-+++ b/include/net/udp.h
-@@ -237,7 +237,7 @@ struct udp_seq_afinfo {
- 	sa_family_t			family;
- 	struct udp_table		*udp_table;
- 	const struct file_operations	*seq_fops;
--	struct seq_operations		seq_ops;
-+	seq_operations_no_const		seq_ops;
- };
- 
- struct udp_iter_state {
 diff --git a/include/net/xfrm.h b/include/net/xfrm.h
-index 921f627..8221ddc 100644
+index 921f627..91461fe 100644
 --- a/include/net/xfrm.h
 +++ b/include/net/xfrm.h
+@@ -417,7 +417,7 @@ struct xfrm_mode {
+ 	struct module *owner;
+ 	unsigned int encap;
+ 	int flags;
+-};
++} __do_const;
+ 
+ /* Flags for xfrm_mode. */
+ enum {
 @@ -508,7 +508,7 @@ struct xfrm_policy {
  	struct timer_list	timer;
  
@@ -67367,74 +67808,19 @@ index 2a65167..91e01f8 100644
  
  
  /**
-diff --git a/include/sound/ak4xxx-adda.h b/include/sound/ak4xxx-adda.h
-index 030b87c..98a6954 100644
---- a/include/sound/ak4xxx-adda.h
-+++ b/include/sound/ak4xxx-adda.h
-@@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
- 	void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
- 		      unsigned char val);
- 	void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
--};
-+} __no_const;
- 
- #define AK4XXX_IMAGE_SIZE	(AK4XXX_MAX_CHIPS * 16)	/* 64 bytes */
- 
-diff --git a/include/sound/hwdep.h b/include/sound/hwdep.h
-index 8c05e47..2b5df97 100644
---- a/include/sound/hwdep.h
-+++ b/include/sound/hwdep.h
-@@ -49,7 +49,7 @@ struct snd_hwdep_ops {
- 			  struct snd_hwdep_dsp_status *status);
- 	int (*dsp_load)(struct snd_hwdep *hw,
- 			struct snd_hwdep_dsp_image *image);
--};
-+} __no_const;
- 
- struct snd_hwdep {
- 	struct snd_card *card;
-diff --git a/include/sound/info.h b/include/sound/info.h
-index 5492cc4..1a65278 100644
---- a/include/sound/info.h
-+++ b/include/sound/info.h
-@@ -44,7 +44,7 @@ struct snd_info_entry_text {
- 		     struct snd_info_buffer *buffer);
- 	void (*write)(struct snd_info_entry *entry,
- 		      struct snd_info_buffer *buffer);
--};
-+} __no_const;
- 
- struct snd_info_entry_ops {
- 	int (*open)(struct snd_info_entry *entry,
-diff --git a/include/sound/pcm.h b/include/sound/pcm.h
-index 0cf91b2..b70cae4 100644
---- a/include/sound/pcm.h
-+++ b/include/sound/pcm.h
-@@ -81,6 +81,7 @@ struct snd_pcm_ops {
- 	int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
- 	int (*ack)(struct snd_pcm_substream *substream);
- };
-+typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
- 
- /*
-  *
-diff --git a/include/sound/sb16_csp.h b/include/sound/sb16_csp.h
-index af1b49e..a5d55a5 100644
---- a/include/sound/sb16_csp.h
-+++ b/include/sound/sb16_csp.h
-@@ -146,7 +146,7 @@ struct snd_sb_csp_ops {
- 	int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
- 	int (*csp_stop) (struct snd_sb_csp * p);
- 	int (*csp_qsound_transfer) (struct snd_sb_csp * p);
--};
-+} __no_const;
- 
- /*
-  * CSP private data
 diff --git a/include/sound/soc.h b/include/sound/soc.h
-index 11cfb59..e3f93f4 100644
+index 11cfb59..808afef 100644
 --- a/include/sound/soc.h
 +++ b/include/sound/soc.h
+@@ -641,7 +641,7 @@ struct snd_soc_codec_driver {
+ 	/* probe ordering - for components with runtime dependencies */
+ 	int probe_order;
+ 	int remove_order;
+-};
++} __do_const;
+ 
+ /* SoC platform interface */
+ struct snd_soc_platform_driver {
 @@ -683,7 +683,7 @@ struct snd_soc_platform_driver {
  	/* platform IO - used for platform DAPM */
  	unsigned int (*read)(struct snd_soc_platform *, unsigned int);
@@ -67458,18 +67844,9 @@ index 444cd6b..3327cc5 100644
  	const struct firmware *dsp_microcode;
  	const struct firmware *controller_microcode;
 diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
-index 6ee550e..4793a65 100644
+index 6ee550e..ebec4cc 100644
 --- a/include/target/target_core_base.h
 +++ b/include/target/target_core_base.h
-@@ -347,7 +347,7 @@ struct t10_reservation_ops {
- 	int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32);
- 	int (*t10_pr_register)(struct se_cmd *);
- 	int (*t10_pr_clear)(struct se_cmd *);
--};
-+} __no_const;
- 
- struct t10_reservation {
- 	/* Reservation effects all target ports */
 @@ -466,8 +466,8 @@ struct se_cmd {
  	atomic_t		t_se_count;
  	atomic_t		t_task_cdbs_left;
@@ -67571,6 +67948,19 @@ index 1c09820..7f5ec79 100644
  
  	TP_ARGS(irq, action, ret),
  
+diff --git a/include/video/omapdss.h b/include/video/omapdss.h
+index 6582c45..66ade1b 100644
+--- a/include/video/omapdss.h
++++ b/include/video/omapdss.h
+@@ -305,7 +305,7 @@ struct omap_dss_board_info {
+ 	struct omap_dss_device *default_device;
+ 	int (*dsi_enable_pads)(int dsi_id, unsigned lane_mask);
+ 	void (*dsi_disable_pads)(int dsi_id, unsigned lane_mask);
+-};
++} __do_const;
+ 
+ /* Init with the board info */
+ extern int omap_display_init(struct omap_dss_board_info *board_data);
 diff --git a/include/video/udlfb.h b/include/video/udlfb.h
 index c41f308..6918de3 100644
 --- a/include/video/udlfb.h
@@ -67927,7 +68317,7 @@ index 2531811..040d4d4 100644
  	next_state = Reset;
  	return 0;
 diff --git a/init/main.c b/init/main.c
-index cb08fea2..a290416 100644
+index cb08fea2..b5f96d5 100644
 --- a/init/main.c
 +++ b/init/main.c
 @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { }
@@ -68029,7 +68419,15 @@ index cb08fea2..a290416 100644
  	}
  
  	return ret;
-@@ -711,8 +769,14 @@ static void __init do_initcalls(void)
+@@ -707,12 +765,22 @@ int __init_or_module do_one_initcall(initcall_t fn)
+ 
+ extern initcall_t __initcall_start[], __initcall_end[], __early_initcall_end[];
+ 
++#ifdef CONFIG_PAX_LATENT_ENTROPY
++u64 latent_entropy;
++#endif
++
+ static void __init do_initcalls(void)
  {
  	initcall_t *fn;
  
@@ -68038,14 +68436,14 @@ index cb08fea2..a290416 100644
  		do_one_initcall(*fn);
 +
 +#ifdef CONFIG_PAX_LATENT_ENTROPY
-+		transfer_latent_entropy();
++		add_device_randomness(&latent_entropy, sizeof(latent_entropy));
 +#endif
 +
 +	}
  }
  
  /*
-@@ -738,8 +802,14 @@ static void __init do_pre_smp_initcalls(void)
+@@ -738,8 +806,14 @@ static void __init do_pre_smp_initcalls(void)
  {
  	initcall_t *fn;
  
@@ -68054,14 +68452,14 @@ index cb08fea2..a290416 100644
  		do_one_initcall(*fn);
 +
 +#ifdef CONFIG_PAX_LATENT_ENTROPY
-+		transfer_latent_entropy();
++		add_device_randomness(&latent_entropy, sizeof(latent_entropy));
 +#endif
 +
 +	}
  }
  
  static void run_init_process(const char *init_filename)
-@@ -821,7 +891,7 @@ static int __init kernel_init(void * unused)
+@@ -821,7 +895,7 @@ static int __init kernel_init(void * unused)
  	do_basic_setup();
  
  	/* Open the /dev/console on the rootfs, this should never fail */
@@ -68070,7 +68468,7 @@ index cb08fea2..a290416 100644
  		printk(KERN_WARNING "Warning: unable to open an initial console.\n");
  
  	(void) sys_dup(0);
-@@ -834,11 +904,13 @@ static int __init kernel_init(void * unused)
+@@ -834,11 +908,13 @@ static int __init kernel_init(void * unused)
  	if (!ramdisk_execute_command)
  		ramdisk_execute_command = "/init";
  
@@ -68939,7 +69337,7 @@ index 7d1f05e..66d5a8e 100644
  
  	/*
 diff --git a/kernel/exit.c b/kernel/exit.c
-index 234e152..2e3e7e1 100644
+index 234e152..0ae0243 100644
 --- a/kernel/exit.c
 +++ b/kernel/exit.c
 @@ -168,6 +168,10 @@ void release_task(struct task_struct * p)
@@ -68962,16 +69360,17 @@ index 234e152..2e3e7e1 100644
  	recalc_sigpending();
  	spin_unlock_irq(&current->sighand->siglock);
  	return 0;
-@@ -416,6 +420,8 @@ void daemonize(const char *name, ...)
+@@ -416,6 +420,9 @@ void daemonize(const char *name, ...)
  	vsnprintf(current->comm, sizeof(current->comm), name, args);
  	va_end(args);
  
++	gr_put_exec_file(current);
 +	gr_set_kernel_label(current);
 +
  	/*
  	 * If we were started as result of loading a module, close all of the
  	 * user space pages.  We don't need them, and if we didn't close them
-@@ -874,6 +880,8 @@ NORET_TYPE void do_exit(long code)
+@@ -874,6 +881,8 @@ NORET_TYPE void do_exit(long code)
  	struct task_struct *tsk = current;
  	int group_dead;
  
@@ -68980,7 +69379,7 @@ index 234e152..2e3e7e1 100644
  	profile_task_exit(tsk);
  
  	WARN_ON(blk_needs_flush_plug(tsk));
-@@ -890,7 +898,6 @@ NORET_TYPE void do_exit(long code)
+@@ -890,7 +899,6 @@ NORET_TYPE void do_exit(long code)
  	 * mm_release()->clear_child_tid() from writing to a user-controlled
  	 * kernel address.
  	 */
@@ -68988,7 +69387,7 @@ index 234e152..2e3e7e1 100644
  
  	ptrace_event(PTRACE_EVENT_EXIT, code);
  
-@@ -952,6 +959,9 @@ NORET_TYPE void do_exit(long code)
+@@ -952,6 +960,9 @@ NORET_TYPE void do_exit(long code)
  	tsk->exit_code = code;
  	taskstats_exit(tsk, group_dead);
  
@@ -68998,7 +69397,7 @@ index 234e152..2e3e7e1 100644
  	exit_mm(tsk);
  
  	if (group_dead)
-@@ -1065,7 +1075,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
+@@ -1065,7 +1076,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
   * Take down every thread in the group.  This is called by fatal signals
   * as well as by sys_exit_group (below).
   */
@@ -69008,7 +69407,7 @@ index 234e152..2e3e7e1 100644
  {
  	struct signal_struct *sig = current->signal;
 diff --git a/kernel/fork.c b/kernel/fork.c
-index ce0c182..ce1dbee 100644
+index ce0c182..07a5f7a 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -270,19 +270,24 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -69306,17 +69705,19 @@ index ce0c182..ce1dbee 100644
  	if (atomic_read(&p->real_cred->user->processes) >=
  			task_rlimit(p, RLIMIT_NPROC)) {
  		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-@@ -1314,6 +1386,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- 	/* Need tasklist lock for parent etc handling! */
- 	write_lock_irq(&tasklist_lock);
+@@ -1341,6 +1413,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ 		goto bad_fork_free_pid;
+ 	}
  
-+	/* synchronizes with gr_set_acls() */
++	/* synchronizes with gr_set_acls()
++	   we need to call this past the point of no return for fork()
++	*/
 +	gr_copy_label(p);
 +
- 	/* CLONE_PARENT re-uses the old parent */
- 	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
- 		p->real_parent = current->real_parent;
-@@ -1421,6 +1496,8 @@ bad_fork_cleanup_count:
+ 	if (clone_flags & CLONE_THREAD) {
+ 		current->signal->nr_threads++;
+ 		atomic_inc(&current->signal->live);
+@@ -1421,6 +1498,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -69325,7 +69726,7 @@ index ce0c182..ce1dbee 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1521,6 +1598,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1521,6 +1600,8 @@ long do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -69334,7 +69735,7 @@ index ce0c182..ce1dbee 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1630,7 +1709,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1630,7 +1711,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -69343,7 +69744,7 @@ index ce0c182..ce1dbee 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -1719,7 +1798,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1719,7 +1800,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			spin_lock(&fs->lock);
  			current->fs = new_fs;
@@ -70709,6 +71110,62 @@ index 89096dd..f91ebc5 100644
  	mutex_set_owner(lock);
  
  	/* set it to 0 if there are no waiters left: */
+diff --git a/kernel/notifier.c b/kernel/notifier.c
+index 2d5cc4c..d9ea600 100644
+--- a/kernel/notifier.c
++++ b/kernel/notifier.c
+@@ -5,6 +5,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/vmalloc.h>
+ #include <linux/reboot.h>
++#include <linux/mm.h>
+ 
+ /*
+  *	Notifier list for kernel code which wants to be called
+@@ -24,10 +25,12 @@ static int notifier_chain_register(struct notifier_block **nl,
+ 	while ((*nl) != NULL) {
+ 		if (n->priority > (*nl)->priority)
+ 			break;
+-		nl = &((*nl)->next);
++		nl = (struct notifier_block **)&((*nl)->next);
+ 	}
+-	n->next = *nl;
++	pax_open_kernel();
++	*(const void **)&n->next = *nl;
+ 	rcu_assign_pointer(*nl, n);
++	pax_close_kernel();
+ 	return 0;
+ }
+ 
+@@ -39,10 +42,12 @@ static int notifier_chain_cond_register(struct notifier_block **nl,
+ 			return 0;
+ 		if (n->priority > (*nl)->priority)
+ 			break;
+-		nl = &((*nl)->next);
++		nl = (struct notifier_block **)&((*nl)->next);
+ 	}
+-	n->next = *nl;
++	pax_open_kernel();
++	*(const void **)&n->next = *nl;
+ 	rcu_assign_pointer(*nl, n);
++	pax_close_kernel();
+ 	return 0;
+ }
+ 
+@@ -51,10 +56,12 @@ static int notifier_chain_unregister(struct notifier_block **nl,
+ {
+ 	while ((*nl) != NULL) {
+ 		if ((*nl) == n) {
++			pax_open_kernel();
+ 			rcu_assign_pointer(*nl, n->next);
++			pax_close_kernel();
+ 			return 0;
+ 		}
+-		nl = &((*nl)->next);
++		nl = (struct notifier_block **)&((*nl)->next);
+ 	}
+ 	return -ENOENT;
+ }
 diff --git a/kernel/padata.c b/kernel/padata.c
 index b452599..5d68f4e 100644
 --- a/kernel/padata.c
@@ -72783,7 +73240,7 @@ index 0b537f2..40d6c20 100644
  		return -ENOMEM;
  	return 0;
 diff --git a/kernel/timer.c b/kernel/timer.c
-index c219db6..bb98998 100644
+index c219db6..815c225 100644
 --- a/kernel/timer.c
 +++ b/kernel/timer.c
 @@ -1306,7 +1306,7 @@ void update_process_times(int user_tick)
@@ -72795,6 +73252,15 @@ index c219db6..bb98998 100644
  {
  	struct tvec_base *base = __this_cpu_read(tvec_bases);
  
+@@ -1725,7 +1725,7 @@ static int __cpuinit timer_cpu_notify(struct notifier_block *self,
+ 	return NOTIFY_OK;
+ }
+ 
+-static struct notifier_block __cpuinitdata timers_nb = {
++static struct notifier_block __cpuinitconst timers_nb = {
+ 	.notifier_call	= timer_cpu_notify,
+ };
+ 
 diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
 index 16fc34a..efd8bb8 100644
 --- a/kernel/trace/blktrace.c
@@ -72827,7 +73293,7 @@ index 16fc34a..efd8bb8 100644
  	ret = -EIO;
  	bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 54dba59..fb6a82f 100644
+index 54dba59..5c6d44e 100644
 --- a/kernel/trace/ftrace.c
 +++ b/kernel/trace/ftrace.c
 @@ -1587,12 +1587,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
@@ -72859,6 +73325,34 @@ index 54dba59..fb6a82f 100644
  {
  	struct ftrace_func_probe *entry;
  	struct ftrace_page *pg;
+@@ -3968,8 +3973,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ 
+ static int ftrace_graph_active;
+-static struct notifier_block ftrace_suspend_notifier;
+-
+ int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
+ {
+ 	return 0;
+@@ -4113,6 +4116,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
+ 	return NOTIFY_DONE;
+ }
+ 
++static struct notifier_block ftrace_suspend_notifier = {
++	.notifier_call = ftrace_suspend_notifier_call
++};
++
+ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+ 			trace_func_graph_ent_t entryfunc)
+ {
+@@ -4126,7 +4133,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+ 		goto out;
+ 	}
+ 
+-	ftrace_suspend_notifier.notifier_call = ftrace_suspend_notifier_call;
+ 	register_pm_notifier(&ftrace_suspend_notifier);
+ 
+ 	ftrace_graph_active++;
 diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
 index 6fdc629..55739fe 100644
 --- a/kernel/trace/ring_buffer.c
@@ -73290,7 +73784,7 @@ index fd3c8aa..5f324a6 100644
  	}
  	entry	= ring_buffer_event_data(event);
 diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
-index 1dcf253..b31d45c 100644
+index 1dcf253..f84c561 100644
 --- a/kernel/trace/trace_output.c
 +++ b/kernel/trace/trace_output.c
 @@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s, struct path *path)
@@ -73302,6 +73796,24 @@ index 1dcf253..b31d45c 100644
  		if (p) {
  			s->len = p - s->buffer;
  			return 1;
+@@ -811,13 +811,13 @@ int register_ftrace_event(struct trace_event *event)
+ 	}
+ 
+ 	if (event->funcs->trace == NULL)
+-		event->funcs->trace = trace_nop_print;
++		*(void **)&event->funcs->trace = trace_nop_print;
+ 	if (event->funcs->raw == NULL)
+-		event->funcs->raw = trace_nop_print;
++		*(void **)&event->funcs->raw = trace_nop_print;
+ 	if (event->funcs->hex == NULL)
+-		event->funcs->hex = trace_nop_print;
++		*(void **)&event->funcs->hex = trace_nop_print;
+ 	if (event->funcs->binary == NULL)
+-		event->funcs->binary = trace_nop_print;
++		*(void **)&event->funcs->binary = trace_nop_print;
+ 
+ 	key = event->type & (EVENT_HASHSIZE - 1);
+ 
 diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
 index 77575b3..6e623d1 100644
 --- a/kernel/trace/trace_stack.c
@@ -73389,6 +73901,19 @@ index 82928f5..34320a0 100644
  	help
  	  This option lets you use the FireWire bus for remote debugging
  	  with help of the firewire-ohci driver. It enables unfiltered
+diff --git a/lib/Makefile b/lib/Makefile
+index a4da283..57fec5e 100644
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -45,7 +45,7 @@ obj-$(CONFIG_GENERIC_HWEIGHT) += hweight.o
+ 
+ obj-$(CONFIG_BTREE) += btree.o
+ obj-$(CONFIG_DEBUG_PREEMPT) += smp_processor_id.o
+-obj-$(CONFIG_DEBUG_LIST) += list_debug.o
++obj-y += list_debug.o
+ obj-$(CONFIG_DEBUG_OBJECTS) += debugobjects.o
+ 
+ ifneq ($(CONFIG_HAVE_DEC_LOCK),y)
 diff --git a/lib/bitmap.c b/lib/bitmap.c
 index 0d4a127..33a06c7 100644
 --- a/lib/bitmap.c
@@ -73442,6 +73967,21 @@ index 1955209..cbbb2ad 100644
  
  	file = NULL;
  	line = 0;
+diff --git a/lib/cpu-notifier-error-inject.c b/lib/cpu-notifier-error-inject.c
+index 4dc2032..7a2a1da 100644
+--- a/lib/cpu-notifier-error-inject.c
++++ b/lib/cpu-notifier-error-inject.c
+@@ -45,7 +45,9 @@ static struct notifier_block err_inject_cpu_notifier = {
+ 
+ static int err_inject_init(void)
+ {
+-	err_inject_cpu_notifier.priority = priority;
++	pax_open_kernel();
++	*(int *)&err_inject_cpu_notifier.priority = priority;
++	pax_close_kernel();
+ 
+ 	return register_hotcpu_notifier(&err_inject_cpu_notifier);
+ }
 diff --git a/lib/debugobjects.c b/lib/debugobjects.c
 index a78b7c6..2c73084 100644
 --- a/lib/debugobjects.c
@@ -73478,9 +74018,18 @@ index 7c0e953..f642b5c 100644
  EXPORT_SYMBOL(devm_ioport_unmap);
  
 diff --git a/lib/dma-debug.c b/lib/dma-debug.c
-index fea790a..ebb0e82 100644
+index fea790a..3bdd6b4 100644
 --- a/lib/dma-debug.c
 +++ b/lib/dma-debug.c
+@@ -760,7 +760,7 @@ static int dma_debug_device_change(struct notifier_block *nb, unsigned long acti
+ 
+ void dma_debug_add_bus(struct bus_type *bus)
+ {
+-	struct notifier_block *nb;
++	notifier_block_no_const *nb;
+ 
+ 	if (global_disable)
+ 		return;
 @@ -925,7 +925,7 @@ out:
  
  static void check_for_stack(struct device *dev, void *addr)
@@ -73576,12 +74125,29 @@ index 3efb882..8492f4c 100644
  
  	if (atomic_dec_and_test(&kref->refcount)) {
 diff --git a/lib/list_debug.c b/lib/list_debug.c
-index b8029a5..1fa8092 100644
+index b8029a5..111353c 100644
 --- a/lib/list_debug.c
 +++ b/lib/list_debug.c
-@@ -20,14 +20,18 @@ void __list_add(struct list_head *new,
- 			      struct list_head *prev,
- 			      struct list_head *next)
+@@ -8,7 +8,9 @@
+ 
+ #include <linux/module.h>
+ #include <linux/list.h>
++#include <linux/mm.h>
+ 
++#ifdef CONFIG_DEBUG_LIST
+ /*
+  * Insert a new entry between two known consecutive entries.
+  *
+@@ -16,18 +18,31 @@
+  * the prev/next entries already!
+  */
+ 
+-void __list_add(struct list_head *new,
+-			      struct list_head *prev,
+-			      struct list_head *next)
++static bool __list_add_debug(struct list_head *new,
++			     struct list_head *prev,
++			     struct list_head *next)
  {
 -	WARN(next->prev != prev,
 +	if (WARN(next->prev != prev,
@@ -73598,10 +74164,87 @@ index b8029a5..1fa8092 100644
 +	    WARN(new == prev || new == next,
 +		 "list_add double add: new=%p, prev=%p, next=%p.\n",
 +		new, prev, next))
++		return false;
++	return true;
++}
++
++void __list_add(struct list_head *new,
++		struct list_head *prev,
++		struct list_head *next)
++{
++	if (!__list_add_debug(new, prev, next))
 +		return;
  	next->prev = new;
  	new->next = next;
  	new->prev = prev;
+@@ -35,7 +50,7 @@ void __list_add(struct list_head *new,
+ }
+ EXPORT_SYMBOL(__list_add);
+ 
+-void __list_del_entry(struct list_head *entry)
++static bool __list_del_entry_debug(struct list_head *entry)
+ {
+ 	struct list_head *prev, *next;
+ 
+@@ -54,9 +69,16 @@ void __list_del_entry(struct list_head *entry)
+ 	    WARN(next->prev != entry,
+ 		"list_del corruption. next->prev should be %p, "
+ 		"but was %p\n", entry, next->prev))
++		return false;
++	return true;
++}
++
++void __list_del_entry(struct list_head *entry)
++{
++	if (!__list_del_entry_debug(entry))
+ 		return;
+ 
+-	__list_del(prev, next);
++	__list_del(entry->prev, entry->next);
+ }
+ EXPORT_SYMBOL(__list_del_entry);
+ 
+@@ -73,3 +95,40 @@ void list_del(struct list_head *entry)
+ 	entry->prev = LIST_POISON2;
+ }
+ EXPORT_SYMBOL(list_del);
++#endif
++
++void pax_list_add_tail(struct list_head *new, struct list_head *head)
++{
++	struct list_head *prev, *next;
++
++	prev = head->prev;
++	next = head;
++
++#ifdef CONFIG_DEBUG_LIST
++	if (!__list_add_debug(new, prev, next))
++		return;
++#endif
++
++	pax_open_kernel();
++	next->prev = new;
++	new->next = next;
++	new->prev = prev;
++	prev->next = new;
++	pax_close_kernel();
++}
++EXPORT_SYMBOL(pax_list_add_tail);
++
++void pax_list_del(struct list_head *entry)
++{
++#ifdef CONFIG_DEBUG_LIST
++	if (!__list_del_entry_debug(entry))
++		return;
++#endif
++
++	pax_open_kernel();
++	__list_del(entry->prev, entry->next);
++	entry->next = LIST_POISON1;
++	entry->prev = LIST_POISON2;
++	pax_close_kernel();
++}
++EXPORT_SYMBOL(pax_list_del);
 diff --git a/lib/radix-tree.c b/lib/radix-tree.c
 index d9df745..e73c2fe 100644
 --- a/lib/radix-tree.c
@@ -74174,10 +74817,10 @@ index 1b03878..de5405e 100644
  	/* keep elevated page count for bad page */
  	return ret;
 diff --git a/mm/memory.c b/mm/memory.c
-index 15e686a..ab78050 100644
+index 4f2add1..3a99036 100644
 --- a/mm/memory.c
 +++ b/mm/memory.c
-@@ -457,8 +457,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
+@@ -462,8 +462,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
  		return;
  
  	pmd = pmd_offset(pud, start);
@@ -74190,7 +74833,7 @@ index 15e686a..ab78050 100644
  }
  
  static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
-@@ -489,9 +493,12 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
+@@ -494,9 +498,12 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
  	if (end - 1 > ceiling - 1)
  		return;
  
@@ -74203,7 +74846,7 @@ index 15e686a..ab78050 100644
  }
  
  /*
-@@ -1577,12 +1584,6 @@ no_page_table:
+@@ -1582,12 +1589,6 @@ no_page_table:
  	return page;
  }
  
@@ -74216,7 +74859,7 @@ index 15e686a..ab78050 100644
  /**
   * __get_user_pages() - pin user pages in memory
   * @tsk:	task_struct of target task
-@@ -1655,10 +1656,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+@@ -1660,10 +1661,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
  			(VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
  	i = 0;
  
@@ -74229,7 +74872,7 @@ index 15e686a..ab78050 100644
  		if (!vma && in_gate_area(mm, start)) {
  			unsigned long pg = start & PAGE_MASK;
  			pgd_t *pgd;
-@@ -1706,7 +1707,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+@@ -1711,7 +1712,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
  			goto next_page;
  		}
  
@@ -74238,7 +74881,7 @@ index 15e686a..ab78050 100644
  		    (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
  		    !(vm_flags & vma->vm_flags))
  			return i ? : -EFAULT;
-@@ -1733,11 +1734,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+@@ -1738,11 +1739,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
  				int ret;
  				unsigned int fault_flags = 0;
  
@@ -74250,7 +74893,7 @@ index 15e686a..ab78050 100644
  				if (foll_flags & FOLL_WRITE)
  					fault_flags |= FAULT_FLAG_WRITE;
  				if (nonblocking)
-@@ -1811,7 +1807,7 @@ next_page:
+@@ -1816,7 +1812,7 @@ next_page:
  			start += PAGE_SIZE;
  			nr_pages--;
  		} while (nr_pages && start < vma->vm_end);
@@ -74259,7 +74902,7 @@ index 15e686a..ab78050 100644
  	return i;
  }
  EXPORT_SYMBOL(__get_user_pages);
-@@ -2018,6 +2014,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
+@@ -2023,6 +2019,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
  	page_add_file_rmap(page);
  	set_pte_at(mm, addr, pte, mk_pte(page, prot));
  
@@ -74270,7 +74913,7 @@ index 15e686a..ab78050 100644
  	retval = 0;
  	pte_unmap_unlock(pte, ptl);
  	return retval;
-@@ -2052,10 +2052,22 @@ out:
+@@ -2057,10 +2057,22 @@ out:
  int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
  			struct page *page)
  {
@@ -74293,7 +74936,7 @@ index 15e686a..ab78050 100644
  	vma->vm_flags |= VM_INSERTPAGE;
  	return insert_page(vma, addr, page, vma->vm_page_prot);
  }
-@@ -2141,6 +2153,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
+@@ -2146,6 +2158,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
  			unsigned long pfn)
  {
  	BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
@@ -74301,7 +74944,7 @@ index 15e686a..ab78050 100644
  
  	if (addr < vma->vm_start || addr >= vma->vm_end)
  		return -EFAULT;
-@@ -2348,7 +2361,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
+@@ -2353,7 +2366,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
  
  	BUG_ON(pud_huge(*pud));
  
@@ -74312,7 +74955,7 @@ index 15e686a..ab78050 100644
  	if (!pmd)
  		return -ENOMEM;
  	do {
-@@ -2368,7 +2383,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
+@@ -2373,7 +2388,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
  	unsigned long next;
  	int err;
  
@@ -74323,7 +74966,7 @@ index 15e686a..ab78050 100644
  	if (!pud)
  		return -ENOMEM;
  	do {
-@@ -2456,6 +2473,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
+@@ -2461,6 +2478,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
  		copy_user_highpage(dst, src, va, vma);
  }
  
@@ -74510,7 +75153,7 @@ index 15e686a..ab78050 100644
  /*
   * This routine handles present pages, when users try to write
   * to a shared page. It is done by copying the page to a new address
-@@ -2667,6 +2864,12 @@ gotten:
+@@ -2672,6 +2869,12 @@ gotten:
  	 */
  	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -74523,7 +75166,7 @@ index 15e686a..ab78050 100644
  		if (old_page) {
  			if (!PageAnon(old_page)) {
  				dec_mm_counter_fast(mm, MM_FILEPAGES);
-@@ -2718,6 +2921,10 @@ gotten:
+@@ -2723,6 +2926,10 @@ gotten:
  			page_remove_rmap(old_page);
  		}
  
@@ -74534,7 +75177,7 @@ index 15e686a..ab78050 100644
  		/* Free the old page.. */
  		new_page = old_page;
  		ret |= VM_FAULT_WRITE;
-@@ -2997,6 +3204,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3002,6 +3209,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	swap_free(entry);
  	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
  		try_to_free_swap(page);
@@ -74546,7 +75189,7 @@ index 15e686a..ab78050 100644
  	unlock_page(page);
  	if (swapcache) {
  		/*
-@@ -3020,6 +3232,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3025,6 +3237,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -74558,7 +75201,7 @@ index 15e686a..ab78050 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  out:
-@@ -3039,40 +3256,6 @@ out_release:
+@@ -3044,40 +3261,6 @@ out_release:
  }
  
  /*
@@ -74599,7 +75242,7 @@ index 15e686a..ab78050 100644
   * We enter with non-exclusive mmap_sem (to exclude vma changes,
   * but allow concurrent faults), and pte mapped but not yet locked.
   * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -3081,27 +3264,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3086,27 +3269,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  		unsigned long address, pte_t *page_table, pmd_t *pmd,
  		unsigned int flags)
  {
@@ -74632,7 +75275,7 @@ index 15e686a..ab78050 100644
  	if (unlikely(anon_vma_prepare(vma)))
  		goto oom;
  	page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -3120,6 +3299,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3125,6 +3304,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	if (!pte_none(*page_table))
  		goto release;
  
@@ -74644,7 +75287,7 @@ index 15e686a..ab78050 100644
  	inc_mm_counter_fast(mm, MM_ANONPAGES);
  	page_add_new_anon_rmap(page, vma, address);
  setpte:
-@@ -3127,6 +3311,12 @@ setpte:
+@@ -3132,6 +3316,12 @@ setpte:
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -74657,7 +75300,7 @@ index 15e686a..ab78050 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  	return 0;
-@@ -3270,6 +3460,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3275,6 +3465,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	 */
  	/* Only go through if we didn't race with anybody else... */
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -74670,7 +75313,7 @@ index 15e686a..ab78050 100644
  		flush_icache_page(vma, page);
  		entry = mk_pte(page, vma->vm_page_prot);
  		if (flags & FAULT_FLAG_WRITE)
-@@ -3289,6 +3485,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3294,6 +3490,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  
  		/* no need to invalidate: a not-present page won't be cached */
  		update_mmu_cache(vma, address, page_table);
@@ -74685,7 +75328,7 @@ index 15e686a..ab78050 100644
  	} else {
  		if (cow_page)
  			mem_cgroup_uncharge_page(cow_page);
-@@ -3442,6 +3646,12 @@ int handle_pte_fault(struct mm_struct *mm,
+@@ -3447,6 +3651,12 @@ int handle_pte_fault(struct mm_struct *mm,
  		if (flags & FAULT_FLAG_WRITE)
  			flush_tlb_fix_spurious_fault(vma, address);
  	}
@@ -74698,7 +75341,7 @@ index 15e686a..ab78050 100644
  unlock:
  	pte_unmap_unlock(pte, ptl);
  	return 0;
-@@ -3458,6 +3668,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3463,6 +3673,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	pmd_t *pmd;
  	pte_t *pte;
  
@@ -74709,7 +75352,7 @@ index 15e686a..ab78050 100644
  	__set_current_state(TASK_RUNNING);
  
  	count_vm_event(PGFAULT);
-@@ -3469,6 +3683,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3474,6 +3688,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	if (unlikely(is_vm_hugetlb_page(vma)))
  		return hugetlb_fault(mm, vma, address, flags);
  
@@ -74744,7 +75387,7 @@ index 15e686a..ab78050 100644
  retry:
  	pgd = pgd_offset(mm, address);
  	pud = pud_alloc(mm, pgd, address);
-@@ -3510,7 +3752,7 @@ retry:
+@@ -3515,7 +3757,7 @@ retry:
  	 * run pte_offset_map on the pmd, if an huge pmd could
  	 * materialize from under us from a different thread.
  	 */
@@ -74753,7 +75396,7 @@ index 15e686a..ab78050 100644
  		return VM_FAULT_OOM;
  	/* if an huge pmd materialized from under us just retry later */
  	if (unlikely(pmd_trans_huge(*pmd)))
-@@ -3547,6 +3789,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3552,6 +3794,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -74777,7 +75420,7 @@ index 15e686a..ab78050 100644
  #endif /* __PAGETABLE_PUD_FOLDED */
  
  #ifndef __PAGETABLE_PMD_FOLDED
-@@ -3577,6 +3836,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3582,6 +3841,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -74808,7 +75451,7 @@ index 15e686a..ab78050 100644
  #endif /* __PAGETABLE_PMD_FOLDED */
  
  int make_pages_present(unsigned long addr, unsigned long end)
-@@ -3614,7 +3897,7 @@ static int __init gate_vma_init(void)
+@@ -3619,7 +3902,7 @@ static int __init gate_vma_init(void)
  	gate_vma.vm_start = FIXADDR_USER_START;
  	gate_vma.vm_end = FIXADDR_USER_END;
  	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -74854,7 +75497,7 @@ index 9ad7d1e..09d87b7 100644
  
  	writeback_set_ratelimit();
 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index c59d44b..9e0a005 100644
+index 4d1e637..9e0a005 100644
 --- a/mm/mempolicy.c
 +++ b/mm/mempolicy.c
 @@ -655,6 +655,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
@@ -74928,128 +75571,6 @@ index c59d44b..9e0a005 100644
  		rcu_read_unlock();
  		err = -EPERM;
  		goto out;
-@@ -2334,8 +2366,7 @@ void numa_default_policy(void)
-  */
- 
- /*
-- * "local" is pseudo-policy:  MPOL_PREFERRED with MPOL_F_LOCAL flag
-- * Used only for mpol_parse_str() and mpol_to_str()
-+ * "local" is implemented internally by MPOL_PREFERRED with MPOL_F_LOCAL flag.
-  */
- #define MPOL_LOCAL MPOL_MAX
- static const char * const policy_modes[] =
-@@ -2350,28 +2381,21 @@ static const char * const policy_modes[] =
- 
- #ifdef CONFIG_TMPFS
- /**
-- * mpol_parse_str - parse string to mempolicy
-+ * mpol_parse_str - parse string to mempolicy, for tmpfs mpol mount option.
-  * @str:  string containing mempolicy to parse
-  * @mpol:  pointer to struct mempolicy pointer, returned on success.
-- * @no_context:  flag whether to "contextualize" the mempolicy
-+ * @unused:  redundant argument, to be removed later.
-  *
-  * Format of input:
-  *	<mode>[=<flags>][:<nodelist>]
-  *
-- * if @no_context is true, save the input nodemask in w.user_nodemask in
-- * the returned mempolicy.  This will be used to "clone" the mempolicy in
-- * a specific context [cpuset] at a later time.  Used to parse tmpfs mpol
-- * mount option.  Note that if 'static' or 'relative' mode flags were
-- * specified, the input nodemask will already have been saved.  Saving
-- * it again is redundant, but safe.
-- *
-  * On success, returns 0, else 1
-  */
--int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
-+int mpol_parse_str(char *str, struct mempolicy **mpol, int unused)
- {
- 	struct mempolicy *new = NULL;
- 	unsigned short mode;
--	unsigned short uninitialized_var(mode_flags);
-+	unsigned short mode_flags;
- 	nodemask_t nodes;
- 	char *nodelist = strchr(str, ':');
- 	char *flags = strchr(str, '=');
-@@ -2459,24 +2483,23 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
- 	if (IS_ERR(new))
- 		goto out;
- 
--	if (no_context) {
--		/* save for contextualization */
--		new->w.user_nodemask = nodes;
--	} else {
--		int ret;
--		NODEMASK_SCRATCH(scratch);
--		if (scratch) {
--			task_lock(current);
--			ret = mpol_set_nodemask(new, &nodes, scratch);
--			task_unlock(current);
--		} else
--			ret = -ENOMEM;
--		NODEMASK_SCRATCH_FREE(scratch);
--		if (ret) {
--			mpol_put(new);
--			goto out;
--		}
--	}
-+	/*
-+	 * Save nodes for mpol_to_str() to show the tmpfs mount options
-+	 * for /proc/mounts, /proc/pid/mounts and /proc/pid/mountinfo.
-+	 */
-+	if (mode != MPOL_PREFERRED)
-+		new->v.nodes = nodes;
-+	else if (nodelist)
-+		new->v.preferred_node = first_node(nodes);
-+	else
-+		new->flags |= MPOL_F_LOCAL;
-+
-+	/*
-+	 * Save nodes for contextualization: this will be used to "clone"
-+	 * the mempolicy in a specific context [cpuset] at a later time.
-+	 */
-+	new->w.user_nodemask = nodes;
-+
- 	err = 0;
- 
- out:
-@@ -2496,13 +2519,13 @@ out:
-  * @buffer:  to contain formatted mempolicy string
-  * @maxlen:  length of @buffer
-  * @pol:  pointer to mempolicy to be formatted
-- * @no_context:  "context free" mempolicy - use nodemask in w.user_nodemask
-+ * @unused:  redundant argument, to be removed later.
-  *
-  * Convert a mempolicy into a string.
-  * Returns the number of characters in buffer (if positive)
-  * or an error (negative)
-  */
--int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
-+int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int unused)
- {
- 	char *p = buffer;
- 	int l;
-@@ -2528,7 +2551,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
- 	case MPOL_PREFERRED:
- 		nodes_clear(nodes);
- 		if (flags & MPOL_F_LOCAL)
--			mode = MPOL_LOCAL;	/* pseudo-policy */
-+			mode = MPOL_LOCAL;
- 		else
- 			node_set(pol->v.preferred_node, nodes);
- 		break;
-@@ -2536,10 +2559,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
- 	case MPOL_BIND:
- 		/* Fall through */
- 	case MPOL_INTERLEAVE:
--		if (no_context)
--			nodes = pol->w.user_nodemask;
--		else
--			nodes = pol->v.nodes;
-+		nodes = pol->v.nodes;
- 		break;
- 
- 	default:
 diff --git a/mm/migrate.c b/mm/migrate.c
 index 180d97f..c75ef28 100644
 --- a/mm/migrate.c
@@ -77211,7 +77732,7 @@ index 12b9e80..5118865 100644
  		return -ENOMEM;
  
 diff --git a/mm/slab.c b/mm/slab.c
-index 4c3b671..6c47937 100644
+index 4c3b671..fb969ec 100644
 --- a/mm/slab.c
 +++ b/mm/slab.c
 @@ -151,7 +151,7 @@
@@ -77389,7 +77910,7 @@ index 4c3b671..6c47937 100644
 +}
 +
 +#ifdef CONFIG_PAX_USERCOPY
-+const char *check_heap_object(const void *ptr, unsigned long n, bool to)
++const char *check_heap_object(const void *ptr, unsigned long n)
 +{
 +	struct page *page;
 +	struct kmem_cache *cachep;
@@ -77427,7 +77948,7 @@ index 4c3b671..6c47937 100644
   * ksize - get the actual amount of memory allocated for a given object
   * @objp: Pointer to the object
 diff --git a/mm/slob.c b/mm/slob.c
-index 8105be4..33e52d7 100644
+index 8105be4..8d6cd07 100644
 --- a/mm/slob.c
 +++ b/mm/slob.c
 @@ -29,7 +29,7 @@
@@ -77608,7 +78129,7 @@ index 8105be4..33e52d7 100644
 +}
 +
 +#ifdef CONFIG_PAX_USERCOPY
-+const char *check_heap_object(const void *ptr, unsigned long n, bool to)
++const char *check_heap_object(const void *ptr, unsigned long n)
 +{
 +	struct slob_page *sp;
 +	const slob_t *free;
@@ -77780,7 +78301,7 @@ index 8105be4..33e52d7 100644
  EXPORT_SYMBOL(kmem_cache_free);
  
 diff --git a/mm/slub.c b/mm/slub.c
-index 5710788..c2b884e 100644
+index 5710788..dffead9 100644
 --- a/mm/slub.c
 +++ b/mm/slub.c
 @@ -208,7 +208,7 @@ struct track {
@@ -77891,7 +78412,7 @@ index 5710788..c2b884e 100644
 +}
 +
 +#ifdef CONFIG_PAX_USERCOPY
-+const char *check_heap_object(const void *ptr, unsigned long n, bool to)
++const char *check_heap_object(const void *ptr, unsigned long n)
 +{
 +	struct page *page;
 +	struct kmem_cache *s;
@@ -78450,9 +78971,18 @@ index 8fd603b..cf0d930 100644
  	return 0;
  }
 diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
-index 5471628..cef8398 100644
+index 5471628..3bd1bf5 100644
 --- a/net/8021q/vlan.c
 +++ b/net/8021q/vlan.c
+@@ -513,7 +513,7 @@ out:
+ 	return NOTIFY_DONE;
+ }
+ 
+-static struct notifier_block vlan_notifier_block __read_mostly = {
++static struct notifier_block vlan_notifier_block = {
+ 	.notifier_call = vlan_device_event,
+ };
+ 
 @@ -588,8 +588,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
  		err = -EPERM;
  		if (!capable(CAP_NET_ADMIN))
@@ -78529,19 +79059,6 @@ index dfc0719..47c5322 100644
  
  /*
   * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
-diff --git a/net/atm/mpc.h b/net/atm/mpc.h
-index 0919a88..a23d54e 100644
---- a/net/atm/mpc.h
-+++ b/net/atm/mpc.h
-@@ -33,7 +33,7 @@ struct mpoa_client {
- 	struct mpc_parameters parameters;  /* parameters for this client    */
- 
- 	const struct net_device_ops *old_ops;
--	struct net_device_ops new_ops;
-+	net_device_ops_no_const new_ops;
- };
- 
- 
 diff --git a/net/atm/proc.c b/net/atm/proc.c
 index 0d020de..011c7bb 100644
 --- a/net/atm/proc.c
@@ -79109,19 +79626,50 @@ index 8656909..a2ae45d 100644
  	}
  
  	/* Update statistics. */
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 0ce2ad0..cb92a90 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -818,7 +818,7 @@ static const struct net_proto_family can_family_ops = {
+ };
+ 
+ /* notifier block for netdevice event */
+-static struct notifier_block can_netdev_notifier __read_mostly = {
++static struct notifier_block can_netdev_notifier = {
+ 	.notifier_call = can_notifier,
+ };
+ 
 diff --git a/net/can/gw.c b/net/can/gw.c
-index 3d79b12..8de85fa 100644
+index 3d79b12..a9f0846 100644
 --- a/net/can/gw.c
 +++ b/net/can/gw.c
-@@ -96,7 +96,7 @@ struct cf_mod {
- 	struct {
- 		void (*xor)(struct can_frame *cf, struct cgw_csum_xor *xor);
- 		void (*crc8)(struct can_frame *cf, struct cgw_csum_crc8 *crc8);
--	} csumfunc;
-+	} __no_const csumfunc;
- };
+@@ -67,7 +67,6 @@ MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");
+ MODULE_ALIAS("can-gw");
+ 
+ HLIST_HEAD(cgw_list);
+-static struct notifier_block notifier;
+ 
+ static struct kmem_cache *cgw_cache __read_mostly;
+ 
+@@ -911,6 +910,10 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
+ 	return err;
+ }
+ 
++static struct notifier_block notifier = {
++	.notifier_call = cgw_notifier
++};
++
+ static __init int cgw_module_init(void)
+ {
+ 	printk(banner);
+@@ -922,7 +925,6 @@ static __init int cgw_module_init(void)
+ 		return -ENOMEM;
  
+ 	/* set notifier */
+-	notifier.notifier_call = cgw_notifier;
+ 	register_netdevice_notifier(&notifier);
  
+ 	if (__rtnl_register(PF_CAN, RTM_GETROUTE, NULL, cgw_dump_jobs, NULL)) {
 diff --git a/net/compat.c b/net/compat.c
 index 6def90e..ffd9b82 100644
 --- a/net/compat.c
@@ -79443,18 +79991,42 @@ index c40f27e..7f49254 100644
  
  	m->msg_iov = iov;
 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 5229c7f..6cb13fa 100644
+index 5229c7f..e1550a7 100644
 --- a/net/core/rtnetlink.c
 +++ b/net/core/rtnetlink.c
-@@ -57,7 +57,7 @@ struct rtnl_link {
- 	rtnl_doit_func		doit;
- 	rtnl_dumpit_func	dumpit;
- 	rtnl_calcit_func 	calcit;
--};
-+} __no_const;
+@@ -197,14 +197,16 @@ int __rtnl_register(int protocol, int msgtype,
+ 		rtnl_msg_handlers[protocol] = tab;
+ 	}
+ 
++	pax_open_kernel();
+ 	if (doit)
+-		tab[msgindex].doit = doit;
++		*(void **)&tab[msgindex].doit = doit;
  
- static DEFINE_MUTEX(rtnl_mutex);
+ 	if (dumpit)
+-		tab[msgindex].dumpit = dumpit;
++		*(void **)&tab[msgindex].dumpit = dumpit;
  
+ 	if (calcit)
+-		tab[msgindex].calcit = calcit;
++		*(void **)&tab[msgindex].calcit = calcit;
++	pax_close_kernel();
+ 
+ 	return 0;
+ }
+@@ -247,8 +249,10 @@ int rtnl_unregister(int protocol, int msgtype)
+ 	if (rtnl_msg_handlers[protocol] == NULL)
+ 		return -ENOENT;
+ 
+-	rtnl_msg_handlers[protocol][msgindex].doit = NULL;
+-	rtnl_msg_handlers[protocol][msgindex].dumpit = NULL;
++	pax_open_kernel();
++	*(void **)&rtnl_msg_handlers[protocol][msgindex].doit = NULL;
++	*(void **)&rtnl_msg_handlers[protocol][msgindex].dumpit = NULL;
++	pax_close_kernel();
+ 
+ 	return 0;
+ }
 diff --git a/net/core/scm.c b/net/core/scm.c
 index ff52ad0..aff1c0f 100644
 --- a/net/core/scm.c
@@ -79635,6 +80207,22 @@ index 39a2d29..f39c0fe 100644
  	---help---
  	  Econet is a fairly old and slow networking protocol mainly used by
  	  Acorn computers to access file and print servers. It uses native
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index e41c40f..26d7e03 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -827,9 +827,9 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+ 		if (!ifa) {
+ 			ret = -ENOBUFS;
+ 			ifa = inet_alloc_ifa();
++			if (!ifa)
++				break;
+ 			INIT_HLIST_NODE(&ifa->hash);
+-			if (!ifa)
+-				break;
+ 			if (colon)
+ 				memcpy(ifa->ifa_label, ifr.ifr_name, IFNAMSIZ);
+ 			else
 diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
 index 92fc5f6..b790d91 100644
 --- a/net/ipv4/fib_frontend.c
@@ -79978,27 +80566,6 @@ index 43d4c3b..1914409 100644
  }
  
  static int ping_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
-index 466ea8b..f7fdbe9 100644
---- a/net/ipv4/proc.c
-+++ b/net/ipv4/proc.c
-@@ -233,7 +233,6 @@ static const struct snmp_mib snmp4_net_list[] = {
- 	SNMP_MIB_ITEM("TCPDSACKOfoSent", LINUX_MIB_TCPDSACKOFOSENT),
- 	SNMP_MIB_ITEM("TCPDSACKRecv", LINUX_MIB_TCPDSACKRECV),
- 	SNMP_MIB_ITEM("TCPDSACKOfoRecv", LINUX_MIB_TCPDSACKOFORECV),
--	SNMP_MIB_ITEM("TCPAbortOnSyn", LINUX_MIB_TCPABORTONSYN),
- 	SNMP_MIB_ITEM("TCPAbortOnData", LINUX_MIB_TCPABORTONDATA),
- 	SNMP_MIB_ITEM("TCPAbortOnClose", LINUX_MIB_TCPABORTONCLOSE),
- 	SNMP_MIB_ITEM("TCPAbortOnMemory", LINUX_MIB_TCPABORTONMEMORY),
-@@ -257,6 +256,8 @@ static const struct snmp_mib snmp4_net_list[] = {
- 	SNMP_MIB_ITEM("TCPTimeWaitOverflow", LINUX_MIB_TCPTIMEWAITOVERFLOW),
- 	SNMP_MIB_ITEM("TCPReqQFullDoCookies", LINUX_MIB_TCPREQQFULLDOCOOKIES),
- 	SNMP_MIB_ITEM("TCPReqQFullDrop", LINUX_MIB_TCPREQQFULLDROP),
-+	SNMP_MIB_ITEM("TCPChallengeACK", LINUX_MIB_TCPCHALLENGEACK),
-+	SNMP_MIB_ITEM("TCPSYNChallenge", LINUX_MIB_TCPSYNCHALLENGE),
- 	SNMP_MIB_SENTINEL
- };
- 
 diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
 index e1d4f30..d7a97b3 100644
 --- a/net/ipv4/raw.c
@@ -80091,80 +80658,11 @@ index 94cdbc5..0cb0063 100644
  		if (peer->tcp_ts_stamp) {
  			ts = peer->tcp_ts;
  			tsage = get_seconds() - peer->tcp_ts_stamp;
-diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
-index 69fd720..5485077 100644
---- a/net/ipv4/sysctl_net_ipv4.c
-+++ b/net/ipv4/sysctl_net_ipv4.c
-@@ -552,6 +552,13 @@ static struct ctl_table ipv4_table[] = {
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec
- 	},
-+	{
-+		.procname	= "tcp_challenge_ack_limit",
-+		.data		= &sysctl_tcp_challenge_ack_limit,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0644,
-+		.proc_handler	= proc_dointvec
-+	},
- #ifdef CONFIG_NET_DMA
- 	{
- 		.procname	= "tcp_dma_copybreak",
 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index a08a621..92b6be7 100644
+index aab8f08..36092b1 100644
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
-@@ -86,6 +86,9 @@ int sysctl_tcp_app_win __read_mostly = 31;
- int sysctl_tcp_adv_win_scale __read_mostly = 1;
- EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
- 
-+/* rfc5961 challenge ack rate limiting */
-+int sysctl_tcp_challenge_ack_limit = 100;
-+
- int sysctl_tcp_stdurg __read_mostly;
- int sysctl_tcp_rfc1337 __read_mostly;
- int sysctl_tcp_max_orphans __read_mostly = NR_FILE;
-@@ -3700,6 +3703,24 @@ static int tcp_process_frto(struct sock *sk, int flag)
- 	return 0;
- }
- 
-+/* RFC 5961 7 [ACK Throttling] */
-+static void tcp_send_challenge_ack(struct sock *sk)
-+{
-+	/* unprotected vars, we dont care of overwrites */
-+	static u32 challenge_timestamp;
-+	static unsigned int challenge_count;
-+	u32 now = jiffies / HZ;
-+
-+	if (now != challenge_timestamp) {
-+		challenge_timestamp = now;
-+		challenge_count = 0;
-+	}
-+	if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
-+		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
-+		tcp_send_ack(sk);
-+	}
-+}
-+
- /* This routine deals with incoming acks, but not outgoing ones. */
- static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
- {
-@@ -3718,8 +3739,14 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
- 	/* If the ack is older than previous acks
- 	 * then we can probably ignore it.
- 	 */
--	if (before(ack, prior_snd_una))
-+	if (before(ack, prior_snd_una)) {
-+		/* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */
-+		if (before(ack, prior_snd_una - tp->max_window)) {
-+			tcp_send_challenge_ack(sk);
-+			return -1;
-+		}
- 		goto old_ack;
-+	}
- 
- 	/* If the ack includes data we haven't sent yet, discard
- 	 * this segment (RFC793 Section 3.9).
-@@ -4700,7 +4727,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
+@@ -4727,7 +4727,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
   * simplifies code)
   */
  static void
@@ -80173,74 +80671,7 @@ index a08a621..92b6be7 100644
  	     struct sk_buff *head, struct sk_buff *tail,
  	     u32 start, u32 end)
  {
-@@ -5243,8 +5270,8 @@ out:
- /* Does PAWS and seqno based validation of an incoming segment, flags will
-  * play significant role here.
-  */
--static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
--			      const struct tcphdr *th, int syn_inerr)
-+static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
-+				  const struct tcphdr *th, int syn_inerr)
- {
- 	const u8 *hash_location;
- 	struct tcp_sock *tp = tcp_sk(sk);
-@@ -5276,7 +5303,16 @@ static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
- 
- 	/* Step 2: check RST bit */
- 	if (th->rst) {
--		tcp_reset(sk);
-+		/* RFC 5961 3.2 :
-+		 * If sequence number exactly matches RCV.NXT, then
-+		 *     RESET the connection
-+		 * else
-+		 *     Send a challenge ACK
-+		 */
-+		if (TCP_SKB_CB(skb)->seq == tp->rcv_nxt)
-+			tcp_reset(sk);
-+		else
-+			tcp_send_challenge_ack(sk);
- 		goto discard;
- 	}
- 
-@@ -5287,20 +5323,22 @@ static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
- 
- 	/* step 3: check security and precedence [ignored] */
- 
--	/* step 4: Check for a SYN in window. */
--	if (th->syn && !before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
-+	/* step 4: Check for a SYN
-+	 * RFC 5691 4.2 : Send a challenge ack
-+	 */
-+	if (th->syn) {
- 		if (syn_inerr)
- 			TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
--		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPABORTONSYN);
--		tcp_reset(sk);
--		return -1;
-+		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNCHALLENGE);
-+		tcp_send_challenge_ack(sk);
-+		goto discard;
- 	}
- 
--	return 1;
-+	return true;
- 
- discard:
- 	__kfree_skb(skb);
--	return 0;
-+	return false;
- }
- 
- /*
-@@ -5330,7 +5368,6 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
- 			const struct tcphdr *th, unsigned int len)
- {
- 	struct tcp_sock *tp = tcp_sk(sk);
--	int res;
- 
- 	/*
- 	 *	Header prediction.
-@@ -5506,16 +5543,18 @@ slow_path:
+@@ -5542,6 +5542,9 @@ slow_path:
  	if (len < (th->doff << 2) || tcp_checksum_complete_user(sk, skb))
  		goto csum_error;
  
@@ -80250,28 +80681,32 @@ index a08a621..92b6be7 100644
  	/*
  	 *	Standard slow path.
  	 */
- 
--	res = tcp_validate_incoming(sk, skb, th, 1);
--	if (res <= 0)
--		return -res;
-+	if (!tcp_validate_incoming(sk, skb, th, 1))
-+		return 0;
+@@ -5550,7 +5553,7 @@ slow_path:
+ 		return 0;
  
  step5:
 -	if (th->ack && tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
 +	if (tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
  		goto discard;
  
- 	tcp_rcv_rtt_measure_ts(sk, skb);
-@@ -5822,7 +5861,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
- 	struct tcp_sock *tp = tcp_sk(sk);
- 	struct inet_connection_sock *icsk = inet_csk(sk);
- 	int queued = 0;
--	int res;
+ 	/* ts_recent update must be made after we are sure that the packet
+@@ -5786,6 +5789,7 @@ discard:
+ 	    tcp_paws_reject(&tp->rx_opt, 0))
+ 		goto discard_and_undo;
  
- 	tp->rx_opt.saw_tstamp = 0;
- 
-@@ -5838,7 +5876,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
++#ifndef CONFIG_GRKERNSEC_NO_SIMULT_CONNECT
+ 	if (th->syn) {
+ 		/* We see SYN without ACK. It is attempt of
+ 		 * simultaneous connect with crossed SYNs.
+@@ -5834,6 +5838,7 @@ discard:
+ 		goto discard;
+ #endif
+ 	}
++#endif
+ 	/* "fifth, if neither of the SYN or RST bits is set then
+ 	 * drop the segment and return."
+ 	 */
+@@ -5877,7 +5882,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  			goto discard;
  
  		if (th->syn) {
@@ -80280,18 +80715,15 @@ index a08a621..92b6be7 100644
  				goto discard;
  			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
  				return 1;
-@@ -5877,12 +5915,14 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5916,11 +5921,14 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  		return 0;
  	}
  
--	res = tcp_validate_incoming(sk, skb, th, 0);
--	if (res <= 0)
--		return -res;
 +	if (!th->ack)
 +		goto discard;
 +
-+	if (!tcp_validate_incoming(sk, skb, th, 0))
-+		return 0;
+ 	if (!tcp_validate_incoming(sk, skb, th, 0))
+ 		return 0;
  
  	/* step 5: check the ACK field */
 -	if (th->ack) {
@@ -80299,7 +80731,7 @@ index a08a621..92b6be7 100644
  		int acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH) > 0;
  
  		switch (sk->sk_state) {
-@@ -5987,8 +6027,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -6025,8 +6033,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  			}
  			break;
  		}
@@ -80307,10 +80739,10 @@ index a08a621..92b6be7 100644
 -		goto discard;
 +	}
  
- 	/* step 6: check the URG bit */
- 	tcp_urg(sk, skb, th);
+ 	/* ts_recent update must be made after we are sure that the packet
+ 	 * is in window.
 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index 58c09a0..b62df0b 100644
+index a97c9ad..6c2166f 100644
 --- a/net/ipv4/tcp_ipv4.c
 +++ b/net/ipv4/tcp_ipv4.c
 @@ -87,6 +87,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
@@ -80323,7 +80755,7 @@ index 58c09a0..b62df0b 100644
  
  #ifdef CONFIG_TCP_MD5SIG
  static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
-@@ -1637,6 +1640,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1636,6 +1639,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
  	return 0;
  
  reset:
@@ -80333,7 +80765,7 @@ index 58c09a0..b62df0b 100644
  	tcp_v4_send_reset(rsk, skb);
  discard:
  	kfree_skb(skb);
-@@ -1699,12 +1705,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
+@@ -1698,12 +1704,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
  	TCP_SKB_CB(skb)->sacked	 = 0;
  
  	sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -80356,7 +80788,7 @@ index 58c09a0..b62df0b 100644
  
  	if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
  		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
-@@ -1754,6 +1767,10 @@ no_tcp_socket:
+@@ -1753,6 +1766,10 @@ no_tcp_socket:
  bad_packet:
  		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
  	} else {
@@ -80367,7 +80799,7 @@ index 58c09a0..b62df0b 100644
  		tcp_v4_send_reset(NULL, skb);
  	}
  
-@@ -2414,7 +2431,11 @@ static void get_openreq4(const struct sock *sk, const struct request_sock *req,
+@@ -2413,7 +2430,11 @@ static void get_openreq4(const struct sock *sk, const struct request_sock *req,
  		0,  /* non standard timer */
  		0, /* open_requests have no inode */
  		atomic_read(&sk->sk_refcnt),
@@ -80379,7 +80811,7 @@ index 58c09a0..b62df0b 100644
  		len);
  }
  
-@@ -2464,7 +2485,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
+@@ -2463,7 +2484,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
  		sock_i_uid(sk),
  		icsk->icsk_probes_out,
  		sock_i_ino(sk),
@@ -80393,7 +80825,7 @@ index 58c09a0..b62df0b 100644
  		jiffies_to_clock_t(icsk->icsk_rto),
  		jiffies_to_clock_t(icsk->icsk_ack.ato),
  		(icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
-@@ -2492,7 +2518,13 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw,
+@@ -2491,7 +2517,13 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw,
  		" %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
  		i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
  		3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
@@ -80805,7 +81237,7 @@ index 6e6c2c4..942cebf 100644
  
  static int raw6_seq_show(struct seq_file *seq, void *v)
 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index ccab3c8..99f760b 100644
+index db10805..42998ba 100644
 --- a/net/ipv6/tcp_ipv6.c
 +++ b/net/ipv6/tcp_ipv6.c
 @@ -93,6 +93,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
@@ -80819,7 +81251,7 @@ index ccab3c8..99f760b 100644
  static void tcp_v6_hash(struct sock *sk)
  {
  	if (sk->sk_state != TCP_CLOSE) {
-@@ -1656,6 +1660,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1657,6 +1661,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
  	return 0;
  
  reset:
@@ -80829,7 +81261,7 @@ index ccab3c8..99f760b 100644
  	tcp_v6_send_reset(sk, skb);
  discard:
  	if (opt_skb)
-@@ -1735,12 +1742,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
+@@ -1736,12 +1743,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
  	TCP_SKB_CB(skb)->sacked = 0;
  
  	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -80852,7 +81284,7 @@ index ccab3c8..99f760b 100644
  
  	if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
  		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
-@@ -1788,6 +1803,10 @@ no_tcp_socket:
+@@ -1789,6 +1804,10 @@ no_tcp_socket:
  bad_packet:
  		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
  	} else {
@@ -80863,7 +81295,7 @@ index ccab3c8..99f760b 100644
  		tcp_v6_send_reset(NULL, skb);
  	}
  
-@@ -2048,7 +2067,13 @@ static void get_openreq6(struct seq_file *seq,
+@@ -2049,7 +2068,13 @@ static void get_openreq6(struct seq_file *seq,
  		   uid,
  		   0,  /* non standard timer */
  		   0, /* open_requests have no inode */
@@ -80878,7 +81310,7 @@ index ccab3c8..99f760b 100644
  }
  
  static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
-@@ -2098,7 +2123,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
+@@ -2099,7 +2124,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
  		   sock_i_uid(sp),
  		   icsk->icsk_probes_out,
  		   sock_i_ino(sp),
@@ -80892,7 +81324,7 @@ index ccab3c8..99f760b 100644
  		   jiffies_to_clock_t(icsk->icsk_rto),
  		   jiffies_to_clock_t(icsk->icsk_ack.ato),
  		   (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
-@@ -2133,7 +2163,13 @@ static void get_timewait6_sock(struct seq_file *seq,
+@@ -2134,7 +2164,13 @@ static void get_timewait6_sock(struct seq_file *seq,
  		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
  		   tw->tw_substate, 0, 0,
  		   3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
@@ -82269,6 +82701,19 @@ index 7635107..4670276 100644
  	_proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
  
  	ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 8104278..631330b 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -1034,7 +1034,7 @@ void sctp_v6_pf_init(void)
+ 
+ void sctp_v6_pf_exit(void)
+ {
+-	list_del(&sctp_af_inet6.list);
++	pax_list_del((struct list_head *)&sctp_af_inet6.list);
+ }
+ 
+ /* Initialize IPv6 support and register with socket layer.  */
 diff --git a/net/sctp/proc.c b/net/sctp/proc.c
 index 1e2eee8..ce3967e 100644
 --- a/net/sctp/proc.c
@@ -82283,6 +82728,32 @@ index 1e2eee8..ce3967e 100644
  			   assoc->state, hash,
  			   assoc->assoc_id,
  			   assoc->sndbuf_used,
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index 6f6ad86..f80bd85 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -862,8 +862,10 @@ int sctp_register_af(struct sctp_af *af)
+ 		return 0;
+ 	}
+ 
+-	INIT_LIST_HEAD(&af->list);
+-	list_add_tail(&af->list, &sctp_address_families);
++	pax_open_kernel();
++	INIT_LIST_HEAD((struct list_head *)&af->list);
++	pax_close_kernel();
++	pax_list_add_tail((struct list_head *)&af->list, &sctp_address_families);
+ 	return 1;
+ }
+ 
+@@ -1149,7 +1151,7 @@ static void sctp_v4_pf_init(void)
+ 
+ static void sctp_v4_pf_exit(void)
+ {
+-	list_del(&sctp_af_inet.list);
++	pax_list_del((struct list_head *)&sctp_af_inet.list);
+ }
+ 
+ static int sctp_v4_protosw_init(void)
 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
 index fa8333b..7382d42 100644
 --- a/net/sctp/socket.c
@@ -82572,7 +83043,7 @@ index 68879db..ed22cd4 100644
  	set_fs(KERNEL_DS);
  	if (level == SOL_SOCKET)
 diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
-index c90b832..69d57f6 100644
+index 56c3f85..434bb1f 100644
 --- a/net/sunrpc/sched.c
 +++ b/net/sunrpc/sched.c
 @@ -238,9 +238,9 @@ static int rpc_wait_bit_killable(void *word)
@@ -82817,6 +83288,39 @@ index e758139..d29ea47 100644
  		int mode = (table->mode >> 6) & 7;
  		return (mode << 6) | (mode << 3) | mode;
  	}
+diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
+index e728d4c..dffdddf 100644
+--- a/net/tipc/eth_media.c
++++ b/net/tipc/eth_media.c
+@@ -57,7 +57,6 @@ struct eth_bearer {
+ 
+ static struct eth_bearer eth_bearers[MAX_ETH_BEARERS];
+ static int eth_started;
+-static struct notifier_block notifier;
+ 
+ /**
+  * send_msg - send a TIPC message out over an Ethernet interface
+@@ -264,6 +263,11 @@ static char *eth_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size
+  * with OS for notifications about device state changes.
+  */
+ 
++static struct notifier_block notifier = {
++	.notifier_call = &recv_notification,
++	.priority = 0,
++};
++
+ int tipc_eth_media_start(void)
+ {
+ 	struct tipc_media_addr bcast_addr;
+@@ -284,8 +288,6 @@ int tipc_eth_media_start(void)
+ 	if (res)
+ 		return res;
+ 
+-	notifier.notifier_call = &recv_notification;
+-	notifier.priority = 0;
+ 	res = register_netdevice_notifier(&notifier);
+ 	if (!res)
+ 		eth_started = 1;
 diff --git a/net/tipc/link.c b/net/tipc/link.c
 index ae98a72..7bb6056 100644
 --- a/net/tipc/link.c
@@ -82924,19 +83428,6 @@ index 317bfe3..6786706 100644
  		mutex_unlock(&path.dentry->d_inode->i_mutex);
  		dput(path.dentry);
  		path.dentry = dentry;
-diff --git a/net/wireless/core.h b/net/wireless/core.h
-index 02c3be3..e022efa 100644
---- a/net/wireless/core.h
-+++ b/net/wireless/core.h
-@@ -27,7 +27,7 @@ struct cfg80211_registered_device {
- 	struct mutex mtx;
- 
- 	/* rfkill support */
--	struct rfkill_ops rfkill_ops;
-+	rfkill_ops_no_const rfkill_ops;
- 	struct rfkill *rfkill;
- 	struct work_struct rfkill_sync;
- 
 diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
 index 0af7f54..c916d2f 100644
 --- a/net/wireless/wext-core.c
@@ -83051,10 +83542,21 @@ index 113d20e..a8da249 100644
  	}
  
 diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
-index 9414b9c..d14ecb6 100644
+index 9414b9c..5139a22 100644
 --- a/net/xfrm/xfrm_state.c
 +++ b/net/xfrm/xfrm_state.c
-@@ -1985,8 +1985,10 @@ int __xfrm_init_state(struct xfrm_state *x, bool init_replay)
+@@ -278,7 +278,9 @@ int xfrm_register_mode(struct xfrm_mode *mode, int family)
+ 	if (!try_module_get(afinfo->owner))
+ 		goto out;
+ 
+-	mode->afinfo = afinfo;
++	pax_open_kernel();
++	*(void **)&mode->afinfo = afinfo;
++	pax_close_kernel();
+ 	modemap[mode->encap] = mode;
+ 	err = 0;
+ 
+@@ -1985,8 +1987,10 @@ int __xfrm_init_state(struct xfrm_state *x, bool init_replay)
  		goto error;
  
  	x->outer_mode = xfrm_get_mode(x->props.mode, family);
@@ -83503,7 +84005,7 @@ index 38f6617..e70b72b 100755
  
  exuberant()
 diff --git a/security/Kconfig b/security/Kconfig
-index 51bd5a0..4b1d4dd 100644
+index 51bd5a0..6a9a9a2 100644
 --- a/security/Kconfig
 +++ b/security/Kconfig
 @@ -4,6 +4,896 @@
@@ -84327,7 +84829,7 @@ index 51bd5a0..4b1d4dd 100644
 +config PAX_USERCOPY
 +	bool "Harden heap object copies between kernel and userland"
 +	default y if GRKERNSEC_CONFIG_AUTO
-+	depends on X86 || PPC || SPARC || ARM
++	depends on ARM || IA64 || PPC || SPARC || X86
 +	depends on GRKERNSEC && (SLAB || SLUB || SLOB)
 +	select PAX_USERCOPY_SLABS
 +	help
@@ -85174,19 +85676,6 @@ index cd094ec..eca1277 100644
  		break;
  	default:
  		return -EINVAL;
-diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c
-index c94578d..0794ac1 100644
---- a/sound/isa/cmi8330.c
-+++ b/sound/isa/cmi8330.c
-@@ -172,7 +172,7 @@ struct snd_cmi8330 {
- 
- 	struct snd_pcm *pcm;
- 	struct snd_cmi8330_stream {
--		struct snd_pcm_ops ops;
-+		snd_pcm_ops_no_const ops;
- 		snd_pcm_open_callback_t open;
- 		void *private_data; /* sb or wss */
- 	} streams[2];
 diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c
 index 733b014..56ce96f 100644
 --- a/sound/oss/sb_audio.c
@@ -85238,67 +85727,6 @@ index 09d4648..cf234c7 100644
  
                  list_add(&s->list, &cs4297a_devs);
  
-diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
-index 78b2223..9e57b8e 100644
---- a/sound/pci/hda/hda_codec.h
-+++ b/sound/pci/hda/hda_codec.h
-@@ -614,7 +614,7 @@ struct hda_bus_ops {
- 	/* notify power-up/down from codec to controller */
- 	void (*pm_notify)(struct hda_bus *bus);
- #endif
--};
-+} __no_const;
- 
- /* template to pass to the bus constructor */
- struct hda_bus_template {
-@@ -716,6 +716,7 @@ struct hda_codec_ops {
- #endif
- 	void (*reboot_notify)(struct hda_codec *codec);
- };
-+typedef struct hda_codec_ops __no_const hda_codec_ops_no_const;
- 
- /* record for amp information cache */
- struct hda_cache_head {
-@@ -746,7 +747,7 @@ struct hda_pcm_ops {
- 		       struct snd_pcm_substream *substream);
- 	int (*cleanup)(struct hda_pcm_stream *info, struct hda_codec *codec,
- 		       struct snd_pcm_substream *substream);
--};
-+} __no_const;
- 
- /* PCM information for each substream */
- struct hda_pcm_stream {
-@@ -804,7 +805,7 @@ struct hda_codec {
- 	const char *modelname;	/* model name for preset */
- 
- 	/* set by patch */
--	struct hda_codec_ops patch_ops;
-+	hda_codec_ops_no_const patch_ops;
- 
- 	/* PCM to create, set by patch_ops.build_pcms callback */
- 	unsigned int num_pcms;
-diff --git a/sound/pci/ice1712/ice1712.h b/sound/pci/ice1712/ice1712.h
-index 0da778a..bc38b84 100644
---- a/sound/pci/ice1712/ice1712.h
-+++ b/sound/pci/ice1712/ice1712.h
-@@ -269,7 +269,7 @@ struct snd_ak4xxx_private {
- 	unsigned int mask_flags;	/* total mask bits */
- 	struct snd_akm4xxx_ops {
- 		void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
--	} ops;
-+	} __no_const ops;
- };
- 
- struct snd_ice1712_spdif {
-@@ -285,7 +285,7 @@ struct snd_ice1712_spdif {
- 		int (*default_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
- 		void (*stream_get)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
- 		int (*stream_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
--	} ops;
-+	} __no_const ops;
- };
- 
- 
 diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
 index 03ee4e3..be86b46 100644
 --- a/sound/pci/ymfpci/ymfpci_main.c
@@ -85344,18 +85772,32 @@ index 03ee4e3..be86b46 100644
  	chip->pci = pci;
  	chip->irq = -1;
 diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
-index ee15337..e2187a6 100644
+index ee15337..ab0ec34 100644
 --- a/sound/soc/soc-pcm.c
 +++ b/sound/soc/soc-pcm.c
-@@ -583,7 +583,7 @@ static snd_pcm_uframes_t soc_pcm_pointer(struct snd_pcm_substream *substream)
- }
+@@ -627,13 +627,15 @@ int soc_new_pcm(struct snd_soc_pcm_runtime *rtd, int num)
+ 	rtd->pcm = pcm;
+ 	pcm->private_data = rtd;
+ 	if (platform->driver->ops) {
+-		soc_pcm_ops.mmap = platform->driver->ops->mmap;
+-		soc_pcm_ops.pointer = platform->driver->ops->pointer;
+-		soc_pcm_ops.ioctl = platform->driver->ops->ioctl;
+-		soc_pcm_ops.copy = platform->driver->ops->copy;
+-		soc_pcm_ops.silence = platform->driver->ops->silence;
+-		soc_pcm_ops.ack = platform->driver->ops->ack;
+-		soc_pcm_ops.page = platform->driver->ops->page;
++		pax_open_kernel();
++		*(void **)&soc_pcm_ops.mmap = platform->driver->ops->mmap;
++		*(void **)&soc_pcm_ops.pointer = platform->driver->ops->pointer;
++		*(void **)&soc_pcm_ops.ioctl = platform->driver->ops->ioctl;
++		*(void **)&soc_pcm_ops.copy = platform->driver->ops->copy;
++		*(void **)&soc_pcm_ops.silence = platform->driver->ops->silence;
++		*(void **)&soc_pcm_ops.ack = platform->driver->ops->ack;
++		*(void **)&soc_pcm_ops.page = platform->driver->ops->page;
++		pax_close_kernel();
+ 	}
  
- /* ASoC PCM operations */
--static struct snd_pcm_ops soc_pcm_ops = {
-+static snd_pcm_ops_no_const soc_pcm_ops = {
- 	.open		= soc_pcm_open,
- 	.close		= soc_pcm_close,
- 	.hw_params	= soc_pcm_hw_params,
+ 	if (playback)
 diff --git a/sound/usb/card.h b/sound/usb/card.h
 index 665e297..ed6b31c 100644
 --- a/sound/usb/card.h
@@ -85766,13 +86208,13 @@ index 0000000..846aeb0
 +}
 diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
 new file mode 100644
-index 0000000..92ed719
+index 0000000..1742271
 --- /dev/null
 +++ b/tools/gcc/constify_plugin.c
-@@ -0,0 +1,331 @@
+@@ -0,0 +1,349 @@
 +/*
 + * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
-+ * Copyright 2011 by PaX Team <pageexec@freemail.hu>
++ * Copyright 2011-2013 by PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2, or (at your option) v3
 + *
 + * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
@@ -85810,10 +86252,16 @@ index 0000000..92ed719
 +int plugin_is_GPL_compatible;
 +
 +static struct plugin_info const_plugin_info = {
-+	.version	= "201205300030",
++	.version	= "201301150230",
 +	.help		= "no-constify\tturn off constification\n",
 +};
 +
++static tree get_field_type(tree field)
++{
++	return strip_array_types(TREE_TYPE(field));
++}
++
++static bool walk_struct(tree node);
 +static void deconstify_tree(tree node);
 +
 +static void deconstify_type(tree type)
@@ -85821,14 +86269,17 @@ index 0000000..92ed719
 +	tree field;
 +
 +	for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
-+		tree type = TREE_TYPE(field);
++		tree fieldtype = get_field_type(field);
 +
-+		if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
++		if (TREE_CODE(fieldtype) != RECORD_TYPE && TREE_CODE(fieldtype) != UNION_TYPE)
 +			continue;
-+		if (!TYPE_READONLY(type))
++		if (!TYPE_READONLY(fieldtype))
++			continue;
++		if (!walk_struct(fieldtype))
 +			continue;
 +
 +		deconstify_tree(field);
++		TREE_READONLY(field) = 0;
 +	}
 +	TYPE_READONLY(type) = 0;
 +	C_TYPE_FIELDS_READONLY(type) = 0;
@@ -85838,8 +86289,14 @@ index 0000000..92ed719
 +{
 +	tree old_type, new_type, field;
 +
++//	TREE_READONLY(node) = 0;
 +	old_type = TREE_TYPE(node);
++	while (TREE_CODE(old_type) == ARRAY_TYPE && TREE_CODE(TREE_TYPE(old_type)) != ARRAY_TYPE) {
++		node = old_type;
++		old_type = TREE_TYPE(old_type);
++	}
 +
++	gcc_assert(TREE_CODE(old_type) == RECORD_TYPE || TREE_CODE(old_type) == UNION_TYPE);
 +	gcc_assert(TYPE_READONLY(old_type) && (TYPE_QUALS(old_type) & TYPE_QUAL_CONST));
 +
 +	new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
@@ -85849,7 +86306,6 @@ index 0000000..92ed719
 +
 +	deconstify_type(new_type);
 +
-+	TREE_READONLY(node) = 0;
 +	TREE_TYPE(node) = new_type;
 +}
 +
@@ -85959,7 +86415,7 @@ index 0000000..92ed719
 +
 +static bool is_fptr(tree field)
 +{
-+	tree ptr = TREE_TYPE(field);
++	tree ptr = get_field_type(field);
 +
 +	if (TREE_CODE(ptr) != POINTER_TYPE)
 +		return false;
@@ -85974,6 +86430,9 @@ index 0000000..92ed719
 +	if (TYPE_FIELDS(node) == NULL_TREE)
 +		return false;
 +
++	if (lookup_attribute("do_const", TYPE_ATTRIBUTES(node)))
++		return true;
++
 +	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node))) {
 +		gcc_assert(!TYPE_READONLY(node));
 +		deconstify_type(node);
@@ -85981,7 +86440,7 @@ index 0000000..92ed719
 +	}
 +
 +	for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
-+		tree type = TREE_TYPE(field);
++		tree type = get_field_type(field);
 +		enum tree_code code = TREE_CODE(type);
 +
 +		if (node == type)
@@ -86007,30 +86466,13 @@ index 0000000..92ed719
 +
 +	if (walk_struct(type))
 +		constify_type(type);
++	else
++		deconstify_type(type);
 +}
 +
-+static unsigned int check_local_variables(void);
-+
-+struct gimple_opt_pass pass_local_variable = {
-+	{
-+		.type			= GIMPLE_PASS,
-+		.name			= "check_local_variables",
-+		.gate			= NULL,
-+		.execute		= check_local_variables,
-+		.sub			= NULL,
-+		.next			= NULL,
-+		.static_pass_number	= 0,
-+		.tv_id			= TV_NONE,
-+		.properties_required	= 0,
-+		.properties_provided	= 0,
-+		.properties_destroyed	= 0,
-+		.todo_flags_start	= 0,
-+		.todo_flags_finish	= 0
-+	}
-+};
-+
 +static unsigned int check_local_variables(void)
 +{
++	unsigned int ret = 0;
 +	tree var;
 +	referenced_var_iterator rvi;
 +
@@ -86058,12 +86500,30 @@ index 0000000..92ed719
 +
 +		if (walk_struct(type)) {
 +			error_at(DECL_SOURCE_LOCATION(var), "constified variable %qE cannot be local", var);
-+			return 1;
++			ret = 1;
 +		}
 +	}
-+	return 0;
++	return ret;
 +}
 +
++struct gimple_opt_pass pass_local_variable = {
++	{
++		.type			= GIMPLE_PASS,
++		.name			= "check_local_variables",
++		.gate			= NULL,
++		.execute		= check_local_variables,
++		.sub			= NULL,
++		.next			= NULL,
++		.static_pass_number	= 0,
++		.tv_id			= TV_NONE,
++		.properties_required	= 0,
++		.properties_provided	= 0,
++		.properties_destroyed	= 0,
++		.todo_flags_start	= 0,
++		.todo_flags_finish	= 0
++	}
++};
++
 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
 +{
 +	const char * const plugin_name = plugin_info->base_name;
@@ -86074,9 +86534,9 @@ index 0000000..92ed719
 +
 +	struct register_pass_info local_variable_pass_info = {
 +		.pass				= &pass_local_variable.pass,
-+		.reference_pass_name		= "*referenced_vars",
++		.reference_pass_name		= "ssa",
 +		.ref_pass_instance_number	= 1,
-+		.pos_op				= PASS_POS_INSERT_AFTER
++		.pos_op				= PASS_POS_INSERT_BEFORE
 +	};
 +
 +	if (!plugin_default_version_check(version, &gcc_version)) {
@@ -90507,10 +90967,10 @@ index 0000000..a8203dd
 +atyfb_setup_generic_49151 atyfb_setup_generic 3 49151 NULL
 diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
 new file mode 100644
-index 0000000..6387ddc
+index 0000000..792ee60
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin.c
-@@ -0,0 +1,1918 @@
+@@ -0,0 +1,1930 @@
 +/*
 + * Copyright 2011, 2012 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -90563,6 +91023,8 @@ index 0000000..6387ddc
 +	MARKED_NO, MARKED_YES, MARKED_NOT_INTENTIONAL
 +};
 +
++static unsigned int call_count = 0;
++
 +#define __unused __attribute__((__unused__))
 +#define NAME(node) IDENTIFIER_POINTER(DECL_NAME(node))
 +#define NAME_LEN(node) IDENTIFIER_LENGTH(DECL_NAME(node))
@@ -90590,10 +91052,8 @@ index 0000000..6387ddc
 +static tree get_size_overflow_type(gimple stmt, const_tree node);
 +static tree dup_assign(struct pointer_set_t *visited, gimple oldstmt, const_tree node, tree rhs1, tree rhs2, tree __unused rhs3);
 +
-+static unsigned int call_count=0;
-+
 +static struct plugin_info size_overflow_plugin_info = {
-+	.version	= "20121212beta",
++	.version	= "20130109beta",
 +	.help		= "no-size-overflow\tturn off size overflow checking\n",
 +};
 +
@@ -90880,7 +91340,7 @@ index 0000000..6387ddc
 +		  (code == POINTER_TYPE && TREE_CODE(TREE_TYPE(type)) == INTEGER_TYPE));
 +}
 +
-+static int find_arg_number(const_tree arg, tree func)
++static unsigned int find_arg_number(const_tree arg, tree func)
 +{
 +	tree var;
 +	unsigned int argnum = 1;
@@ -91143,8 +91603,8 @@ index 0000000..6387ddc
 +	basic_block first_bb;
 +
 +	first_bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
-+	if (dom_info_available_p(CDI_DOMINATORS))
-+		set_immediate_dominator(CDI_DOMINATORS, first_bb, ENTRY_BLOCK_PTR);
++	gcc_assert(dom_info_available_p(CDI_DOMINATORS));
++	set_immediate_dominator(CDI_DOMINATORS, first_bb, ENTRY_BLOCK_PTR);
 +	return first_bb;
 +}
 +
@@ -91290,6 +91750,10 @@ index 0000000..6387ddc
 +	if (rhs_mode == SImode && lhs_mode == DImode && (TYPE_UNSIGNED(rhs_type) || !TYPE_UNSIGNED(lhs_type)))
 +		return false;
 +
++	// skip lhs check on signed SI -> HI cast or signed SI -> QI cast
++	if (rhs_mode == SImode && !TYPE_UNSIGNED(rhs_type) && (lhs_mode == HImode || lhs_mode == QImode))
++		return false;
++
 +	return true;
 +}
 +
@@ -91334,21 +91798,37 @@ index 0000000..6387ddc
 +	return true;
 +}
 +
++static tree create_cast_assign(struct pointer_set_t *visited, gimple stmt)
++{
++	tree rhs1 = gimple_assign_rhs1(stmt);
++	tree lhs = gimple_get_lhs(stmt);
++	const_tree rhs1_type = TREE_TYPE(rhs1);
++	const_tree lhs_type = TREE_TYPE(lhs);
++
++	if (TYPE_UNSIGNED(rhs1_type) == TYPE_UNSIGNED(lhs_type))
++		return create_assign(visited, stmt, lhs, AFTER_STMT);
++
++	return create_assign(visited, stmt, rhs1, AFTER_STMT);
++}
++
 +static tree handle_unary_rhs(struct pointer_set_t *visited, gimple stmt)
 +{
-+	gimple def_stmt;
 +	tree size_overflow_type, lhs = gimple_get_lhs(stmt);
-+	tree new_rhs1, rhs1 = gimple_assign_rhs1(stmt);
++	tree new_rhs1 = NULL_TREE;
++	tree rhs1 = gimple_assign_rhs1(stmt);
 +	const_tree rhs1_type = TREE_TYPE(rhs1);
 +	const_tree lhs_type = TREE_TYPE(lhs);
 +
-+	new_rhs1 = expand(visited, rhs1);
++	if (gimple_plf(stmt, MY_STMT))
++		return lhs;
 +
-+	if (new_rhs1 == NULL_TREE || TREE_CODE(rhs1_type) == POINTER_TYPE)
++	if (TREE_CODE(rhs1_type) == POINTER_TYPE)
 +		return create_assign(visited, stmt, lhs, AFTER_STMT);
 +
-+	if (gimple_plf(stmt, MY_STMT))
-+		return lhs;
++	new_rhs1 = expand(visited, rhs1);
++
++	if (new_rhs1 == NULL_TREE)
++		return create_cast_assign(visited, stmt);
 +
 +	if (gimple_plf(stmt, NO_CAST_CHECK))
 +		return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
@@ -91363,18 +91843,14 @@ index 0000000..6387ddc
 +	if (!gimple_assign_cast_p(stmt) || check_undefined_integer_operation(stmt))
 +		return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
 +
++	if (TYPE_UNSIGNED(rhs1_type) != TYPE_UNSIGNED(lhs_type))
++		return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++
 +	size_overflow_type = get_size_overflow_type(stmt, rhs1);
 +	new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
 +
 +	check_size_overflow(stmt, size_overflow_type, new_rhs1, rhs1, BEFORE_STMT);
 +
-+	rhs1 = gimple_assign_rhs1(stmt);
-+	rhs1_type = TREE_TYPE(rhs1);
-+	if (TYPE_UNSIGNED(rhs1_type) != TYPE_UNSIGNED(lhs_type)) {
-+		def_stmt = get_def_stmt(new_rhs1);
-+		rhs1 = gimple_assign_rhs1(def_stmt);
-+		return create_assign(visited, stmt, rhs1, AFTER_STMT);
-+	}
 +	change_rhs1(stmt, new_rhs1);
 +
 +	if (!check_mode_type(stmt))
@@ -91523,10 +91999,9 @@ index 0000000..6387ddc
 +	make_edge(cond_bb, join_bb, EDGE_FALSE_VALUE);
 +	make_edge(bb_true, join_bb, EDGE_FALLTHRU);
 +
-+	if (dom_info_available_p(CDI_DOMINATORS)) {
-+		set_immediate_dominator(CDI_DOMINATORS, bb_true, cond_bb);
-+		set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
-+	}
++	gcc_assert(dom_info_available_p(CDI_DOMINATORS));
++	set_immediate_dominator(CDI_DOMINATORS, bb_true, cond_bb);
++	set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
 +
 +	if (current_loops != NULL) {
 +		gcc_assert(cond_bb->loop_father == join_bb->loop_father);
@@ -91551,9 +92026,11 @@ index 0000000..6387ddc
 +	gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == BOOLEAN_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE);
 +
 +	type_max = cast_a_tree(size_overflow_type, TYPE_MAX_VALUE(rhs_type));
-+	type_min = cast_a_tree(size_overflow_type, TYPE_MIN_VALUE(rhs_type));
++	// typemax (-1) < typemin (0)
++	if (TREE_OVERFLOW(type_max))
++		return;
 +
-+	gcc_assert(!TREE_OVERFLOW(type_max));
++	type_min = cast_a_tree(size_overflow_type, TYPE_MIN_VALUE(rhs_type));
 +
 +	cast_rhs_type = TREE_TYPE(cast_rhs);
 +	type_max_type = TREE_TYPE(type_max);
@@ -91653,7 +92130,6 @@ index 0000000..6387ddc
 +
 +	rhs1 = gimple_assign_rhs1(def_stmt);
 +	rhs1_def_stmt = get_def_stmt(rhs1);
-+	gcc_assert(gimple_code(rhs1_def_stmt) != GIMPLE_NOP);
 +	if (!gimple_assign_cast_p(rhs1_def_stmt))
 +		return rhs1;
 +
@@ -91847,19 +92323,19 @@ index 0000000..6387ddc
 +
 +	switch (TYPE_MODE(type)) {
 +	case QImode:
-+		new_type = (TYPE_UNSIGNED(type)) ? unsigned_intHI_type_node : intHI_type_node;
++		new_type = intHI_type_node;
 +		break;
 +	case HImode:
-+		new_type = (TYPE_UNSIGNED(type)) ? unsigned_intSI_type_node : intSI_type_node;
++		new_type = intSI_type_node;
 +		break;
 +	case SImode:
-+		new_type = (TYPE_UNSIGNED(type)) ? unsigned_intDI_type_node : intDI_type_node;
++		new_type = intDI_type_node;
 +		break;
 +	case DImode:
 +		if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode))
-+			new_type = (TYPE_UNSIGNED(type)) ? unsigned_intDI_type_node : intDI_type_node;
++			new_type = intDI_type_node;
 +		else
-+			new_type = (TYPE_UNSIGNED(type)) ? unsigned_intTI_type_node : intTI_type_node;
++			new_type = intTI_type_node;
 +		break;
 +	default:
 +		debug_tree((tree)node);
@@ -91918,10 +92394,6 @@ index 0000000..6387ddc
 +	if (gimple_plf(def_stmt, MY_STMT))
 +		return lhs;
 +
-+	// skip char type, except PHI (FIXME: only kernel)
-+	if (TYPE_MODE(TREE_TYPE(lhs)) == QImode && gimple_code(def_stmt) != GIMPLE_PHI)
-+		return create_assign(visited, def_stmt, lhs, AFTER_STMT);
-+
 +	if (pointer_set_contains(visited, def_stmt))
 +		return expand_visited(def_stmt);
 +
@@ -92761,10 +93233,10 @@ index 6789d78..4afd019e 100644
 +
  #endif
 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index ec747dc..d3e1f29 100644
+index ec747dc..ea82dda 100644
 --- a/virt/kvm/kvm_main.c
 +++ b/virt/kvm/kvm_main.c
-@@ -75,7 +75,7 @@ LIST_HEAD(vm_list);
+@@ -75,12 +75,17 @@ LIST_HEAD(vm_list);
  
  static cpumask_var_t cpus_hardware_enabled;
  static int kvm_usage_count = 0;
@@ -92773,7 +93245,18 @@ index ec747dc..d3e1f29 100644
  
  struct kmem_cache *kvm_vcpu_cache;
  EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
-@@ -659,7 +659,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
+ 
+-static __read_mostly struct preempt_ops kvm_preempt_ops;
++static void kvm_sched_in(struct preempt_notifier *pn, int cpu);
++static void kvm_sched_out(struct preempt_notifier *pn, struct task_struct *next);
++static struct preempt_ops kvm_preempt_ops = {
++	.sched_in = kvm_sched_in,
++	.sched_out = kvm_sched_out,
++};
+ 
+ struct dentry *kvm_debugfs_dir;
+ 
+@@ -659,7 +664,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
  	/* We can read the guest memory with __xxx_user() later on. */
  	if (user_alloc &&
  	    ((mem->userspace_addr & (PAGE_SIZE - 1)) ||
@@ -92782,7 +93265,7 @@ index ec747dc..d3e1f29 100644
  			(void __user *)(unsigned long)mem->userspace_addr,
  			mem->memory_size)))
  		goto out;
-@@ -2274,7 +2274,7 @@ static void hardware_enable_nolock(void *junk)
+@@ -2274,7 +2279,7 @@ static void hardware_enable_nolock(void *junk)
  
  	if (r) {
  		cpumask_clear_cpu(cpu, cpus_hardware_enabled);
@@ -92791,7 +93274,7 @@ index ec747dc..d3e1f29 100644
  		printk(KERN_INFO "kvm: enabling virtualization on "
  				 "CPU%d failed\n", cpu);
  	}
-@@ -2328,10 +2328,10 @@ static int hardware_enable_all(void)
+@@ -2328,10 +2333,10 @@ static int hardware_enable_all(void)
  
  	kvm_usage_count++;
  	if (kvm_usage_count == 1) {
@@ -92804,7 +93287,7 @@ index ec747dc..d3e1f29 100644
  			hardware_disable_all_nolock();
  			r = -EBUSY;
  		}
-@@ -2682,7 +2682,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
+@@ -2682,7 +2687,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
  	kvm_arch_vcpu_put(vcpu);
  }
  
@@ -92813,7 +93296,7 @@ index ec747dc..d3e1f29 100644
  		  struct module *module)
  {
  	int r;
-@@ -2745,7 +2745,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2745,7 +2750,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  	if (!vcpu_align)
  		vcpu_align = __alignof__(struct kvm_vcpu);
  	kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
@@ -92822,7 +93305,7 @@ index ec747dc..d3e1f29 100644
  	if (!kvm_vcpu_cache) {
  		r = -ENOMEM;
  		goto out_free_3;
-@@ -2755,9 +2755,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2755,9 +2760,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  	if (r)
  		goto out_free;
  
@@ -92837,3 +93320,13 @@ index ec747dc..d3e1f29 100644
  
  	r = misc_register(&kvm_dev);
  	if (r) {
+@@ -2767,9 +2774,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+ 
+ 	register_syscore_ops(&kvm_syscore_ops);
+ 
+-	kvm_preempt_ops.sched_in = kvm_sched_in;
+-	kvm_preempt_ops.sched_out = kvm_sched_out;
+-
+ 	kvm_init_debug();
+ 
+ 	return 0;
diff --git a/3.2.36/4425_grsec_remove_EI_PAX.patch b/3.2.37/4425_grsec_remove_EI_PAX.patch
index 97e6951..97e6951 100644
--- a/3.2.36/4425_grsec_remove_EI_PAX.patch
+++ b/3.2.37/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.36/4430_grsec-remove-localversion-grsec.patch b/3.2.37/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.36/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.37/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.36/4435_grsec-mute-warnings.patch b/3.2.37/4435_grsec-mute-warnings.patch
index e85abd6..e85abd6 100644
--- a/3.2.36/4435_grsec-mute-warnings.patch
+++ b/3.2.37/4435_grsec-mute-warnings.patch
diff --git a/3.2.36/4440_grsec-remove-protected-paths.patch b/3.2.37/4440_grsec-remove-protected-paths.patch
index 637934a..637934a 100644
--- a/3.2.36/4440_grsec-remove-protected-paths.patch
+++ b/3.2.37/4440_grsec-remove-protected-paths.patch
diff --git a/3.7.1/4450_grsec-kconfig-default-gids.patch b/3.2.37/4450_grsec-kconfig-default-gids.patch
index 5c5b013..e5d7e60 100644
--- a/3.7.1/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.37/4450_grsec-kconfig-default-gids.patch
@@ -43,7 +43,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Setting this GID determines what group TPE restrictions will be
  	  *disabled* for.  If the sysctl option is enabled, a sysctl option
-@@ -843,7 +843,7 @@
+@@ -861,7 +861,7 @@
  config GRKERNSEC_SOCKET_ALL_GID
  	int "GID to deny all sockets for"
  	depends on GRKERNSEC_SOCKET_ALL
@@ -52,7 +52,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Here you can choose the GID to disable socket access for. Remember to
  	  add the users you want socket access disabled for to the GID
-@@ -864,7 +864,7 @@
+@@ -882,7 +882,7 @@
  config GRKERNSEC_SOCKET_CLIENT_GID
  	int "GID to deny client sockets for"
  	depends on GRKERNSEC_SOCKET_CLIENT
@@ -61,7 +61,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Here you can choose the GID to disable client socket access for.
  	  Remember to add the users you want client socket access disabled for to
-@@ -882,7 +882,7 @@
+@@ -900,7 +900,7 @@
  config GRKERNSEC_SOCKET_SERVER_GID
  	int "GID to deny server sockets for"
  	depends on GRKERNSEC_SOCKET_SERVER
diff --git a/3.2.36/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.37/4465_selinux-avc_audit-log-curr_ip.patch
index 439ddca..169fdf1 100644
--- a/3.2.36/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.37/4465_selinux-avc_audit-log-curr_ip.patch
@@ -28,7 +28,7 @@ Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
 diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
 --- a/grsecurity/Kconfig	2011-04-17 19:25:54.000000000 -0400
 +++ b/grsecurity/Kconfig	2011-04-17 19:32:53.000000000 -0400
-@@ -941,6 +941,27 @@
+@@ -959,6 +959,27 @@
  menu "Logging Options"
  depends on GRKERNSEC
  
diff --git a/3.2.36/4470_disable-compat_vdso.patch b/3.2.37/4470_disable-compat_vdso.patch
index 4742d01..4742d01 100644
--- a/3.2.36/4470_disable-compat_vdso.patch
+++ b/3.2.37/4470_disable-compat_vdso.patch
diff --git a/3.7.1/0000_README b/3.7.3/0000_README
index f1aa352..9eea012 100644
--- a/3.7.1/0000_README
+++ b/3.7.3/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.9.1-3.7.1-201301041854.patch
+Patch:	4420_grsecurity-2.9.1-3.7.3-201301181518.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.7.1/4420_grsecurity-2.9.1-3.7.1-201301041854.patch b/3.7.3/4420_grsecurity-2.9.1-3.7.3-201301181518.patch
index 7e9857c..1b79126 100644
--- a/3.7.1/4420_grsecurity-2.9.1-3.7.1-201301041854.patch
+++ b/3.7.3/4420_grsecurity-2.9.1-3.7.3-201301181518.patch
@@ -251,7 +251,7 @@ index 9776f06..18b1856 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index fbf84a4..339f6de 100644
+index 51a9bda..3097345 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -400,7 +400,7 @@ index fbf84a4..339f6de 100644
  
  # clean - Delete most, but leave enough to build external modules
  #
-@@ -1050,6 +1110,7 @@ distclean: mrproper
+@@ -1053,6 +1113,7 @@ distclean: mrproper
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
  		-o -name '.*.rej' \
@@ -408,7 +408,7 @@ index fbf84a4..339f6de 100644
  		-o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
  		-type f -print | xargs rm -f
  
-@@ -1210,6 +1271,8 @@ PHONY += $(module-dirs) modules
+@@ -1213,6 +1274,8 @@ PHONY += $(module-dirs) modules
  $(module-dirs): crmodverdir $(objtree)/Module.symvers
  	$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
  
@@ -417,7 +417,7 @@ index fbf84a4..339f6de 100644
  modules: $(module-dirs)
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1347,17 +1410,21 @@ else
+@@ -1349,17 +1412,21 @@ else
          target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
  endif
  
@@ -443,7 +443,7 @@ index fbf84a4..339f6de 100644
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
  %.symtypes: %.c prepare scripts FORCE
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1367,11 +1434,15 @@ endif
+@@ -1369,11 +1436,15 @@ endif
  	$(cmd_crmodverdir)
  	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
  	$(build)=$(build-dir)
@@ -2259,18 +2259,42 @@ index 025f742..8432b08 100644
  	/*
  	 * This test is stubbed out of the main function above to keep
 diff --git a/arch/arm/mach-kirkwood/common.c b/arch/arm/mach-kirkwood/common.c
-index 2c6c218..f491e87 100644
+index 2c6c218..2b87c2d 100644
 --- a/arch/arm/mach-kirkwood/common.c
 +++ b/arch/arm/mach-kirkwood/common.c
-@@ -150,7 +150,7 @@ static void clk_gate_fn_disable(struct clk_hw *hw)
+@@ -150,7 +150,16 @@ static void clk_gate_fn_disable(struct clk_hw *hw)
  	clk_gate_ops.disable(hw);
  }
  
 -static struct clk_ops clk_gate_fn_ops;
-+static clk_ops_no_const clk_gate_fn_ops;
++static int clk_gate_fn_is_enabled(struct clk_hw *hw)
++{
++	return clk_gate_ops.is_enabled(hw);
++}
++
++static struct clk_ops clk_gate_fn_ops = {
++	.enable = clk_gate_fn_enable,
++	.disable = clk_gate_fn_disable,
++	.is_enabled = clk_gate_fn_is_enabled,
++};
  
  static struct clk __init *clk_register_gate_fn(struct device *dev,
  		const char *name,
+@@ -184,14 +193,6 @@ static struct clk __init *clk_register_gate_fn(struct device *dev,
+ 	gate_fn->fn_en = fn_en;
+ 	gate_fn->fn_dis = fn_dis;
+ 
+-	/* ops is the gate ops, but with our enable/disable functions */
+-	if (clk_gate_fn_ops.enable != clk_gate_fn_enable ||
+-	    clk_gate_fn_ops.disable != clk_gate_fn_disable) {
+-		clk_gate_fn_ops = clk_gate_ops;
+-		clk_gate_fn_ops.enable = clk_gate_fn_enable;
+-		clk_gate_fn_ops.disable = clk_gate_fn_disable;
+-	}
+-
+ 	clk = clk_register(dev, &gate_fn->gate.hw);
+ 
+ 	if (IS_ERR(clk))
 diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
 index d95f727..12f10dd 100644
 --- a/arch/arm/mach-omap2/board-n8x0.c
@@ -2497,7 +2521,7 @@ index ad722f1..46b670e 100644
  	totalram_pages += free_area(__phys_to_pfn(__pa(&__tcm_start)),
  				    __phys_to_pfn(__pa(&__tcm_end)),
 diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
-index ce8cb19..3ec539d 100644
+index ce8cb19..3e96d5f 100644
 --- a/arch/arm/mm/mmap.c
 +++ b/arch/arm/mm/mmap.c
 @@ -93,6 +93,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
@@ -2549,7 +2573,71 @@ index ce8cb19..3ec539d 100644
  			/*
  			 * Remember the place where we stopped the search:
  			 */
-@@ -266,10 +269,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
+@@ -175,6 +178,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 		return addr;
+ 	}
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	/* requesting a specific address */
+ 	if (addr) {
+ 		if (do_align)
+@@ -182,8 +189,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 		else
+ 			addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (TASK_SIZE - len >= addr &&
+-				(!vma || addr + len <= vma->vm_start))
++		if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
+ 			return addr;
+ 	}
+ 
+@@ -203,7 +209,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	/* make sure it can fit in the remaining address space */
+ 	if (addr > len) {
+ 		vma = find_vma(mm, addr-len);
+-		if (!vma || addr <= vma->vm_start)
++		if (check_heap_stack_gap(vma, addr - len, len))
+ 			/* remember the address as a hint for next time */
+ 			return (mm->free_area_cache = addr-len);
+ 	}
+@@ -212,17 +218,17 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 		goto bottomup;
+ 
+ 	addr = mm->mmap_base - len;
+-	if (do_align)
+-		addr = COLOUR_ALIGN_DOWN(addr, pgoff);
+ 
+ 	do {
++		if (do_align)
++			addr = COLOUR_ALIGN_DOWN(addr, pgoff);
+ 		/*
+ 		 * Lookup failure means no vma is above this address,
+ 		 * else if new region fits below vma->vm_start,
+ 		 * return with success:
+ 		 */
+ 		vma = find_vma(mm, addr);
+-		if (!vma || addr+len <= vma->vm_start)
++		if (check_heap_stack_gap(vma, addr, len))
+ 			/* remember the address as a hint for next time */
+ 			return (mm->free_area_cache = addr);
+ 
+@@ -231,10 +237,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 			mm->cached_hole_size = vma->vm_start - addr;
+ 
+ 		/* try just below the current vma->vm_start */
+-		addr = vma->vm_start - len;
+-		if (do_align)
+-			addr = COLOUR_ALIGN_DOWN(addr, pgoff);
+-	} while (len < vma->vm_start);
++		addr = skip_heap_stack_gap(vma, len);
++	} while (!IS_ERR_VALUE(addr));
+ 
+ bottomup:
+ 	/*
+@@ -266,10 +270,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
  
  	if (mmap_is_legacy()) {
  		mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
@@ -2573,7 +2661,7 @@ index ce8cb19..3ec539d 100644
  		mm->unmap_area = arch_unmap_area_topdown;
  	}
 diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
-index 941dfb9..af59618 100644
+index 99b47b9..ede7824 100644
 --- a/arch/arm/mm/mmu.c
 +++ b/arch/arm/mm/mmu.c
 @@ -227,16 +227,16 @@ static struct mem_type mem_types[] = {
@@ -3679,10 +3767,10 @@ index ff44823..97f8906 100644
  
  /*
 diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
-index e9a5fd7..378809a 100644
+index 69b17a9..9db82f9 100644
 --- a/arch/mips/kernel/process.c
 +++ b/arch/mips/kernel/process.c
-@@ -480,15 +480,3 @@ unsigned long get_wchan(struct task_struct *task)
+@@ -478,15 +478,3 @@ unsigned long get_wchan(struct task_struct *task)
  out:
  	return pc;
  }
@@ -5795,62 +5883,6 @@ index afeb710..d1d1289 100644
  
  bottomup:
  	/*
-diff --git a/arch/sparc/crypto/aes_asm.S b/arch/sparc/crypto/aes_asm.S
-index 23f6cbb..1cda8aa 100644
---- a/arch/sparc/crypto/aes_asm.S
-+++ b/arch/sparc/crypto/aes_asm.S
-@@ -1024,7 +1024,11 @@ ENTRY(aes_sparc64_ecb_encrypt_256)
- 	 add		%o2, 0x20, %o2
- 	brlz,pt		%o3, 11f
- 	 nop
--10:	ldx		[%o1 + 0x00], %g3
-+10:	ldd		[%o0 + 0xd0], %f56
-+	ldd		[%o0 + 0xd8], %f58
-+	ldd		[%o0 + 0xe0], %f60
-+	ldd		[%o0 + 0xe8], %f62
-+	ldx		[%o1 + 0x00], %g3
- 	ldx		[%o1 + 0x08], %g7
- 	xor		%g1, %g3, %g3
- 	xor		%g2, %g7, %g7
-@@ -1128,9 +1132,9 @@ ENTRY(aes_sparc64_ecb_decrypt_256)
- 	/* %o0=&key[key_len], %o1=input, %o2=output, %o3=len */
- 	ldx		[%o0 - 0x10], %g1
- 	subcc		%o3, 0x10, %o3
-+	ldx		[%o0 - 0x08], %g2
- 	be		10f
--	 ldx		[%o0 - 0x08], %g2
--	sub		%o0, 0xf0, %o0
-+	 sub		%o0, 0xf0, %o0
- 1:	ldx		[%o1 + 0x00], %g3
- 	ldx		[%o1 + 0x08], %g7
- 	ldx		[%o1 + 0x10], %o4
-@@ -1154,7 +1158,11 @@ ENTRY(aes_sparc64_ecb_decrypt_256)
- 	 add		%o2, 0x20, %o2
- 	brlz,pt		%o3, 11f
- 	 nop
--10:	ldx		[%o1 + 0x00], %g3
-+10:	ldd		[%o0 + 0x18], %f56
-+	ldd		[%o0 + 0x10], %f58
-+	ldd		[%o0 + 0x08], %f60
-+	ldd		[%o0 + 0x00], %f62
-+	ldx		[%o1 + 0x00], %g3
- 	ldx		[%o1 + 0x08], %g7
- 	xor		%g1, %g3, %g3
- 	xor		%g2, %g7, %g7
-@@ -1511,11 +1519,11 @@ ENTRY(aes_sparc64_ctr_crypt_256)
- 	 add		%o2, 0x20, %o2
- 	brlz,pt		%o3, 11f
- 	 nop
--	ldd		[%o0 + 0xd0], %f56
-+10:	ldd		[%o0 + 0xd0], %f56
- 	ldd		[%o0 + 0xd8], %f58
- 	ldd		[%o0 + 0xe0], %f60
- 	ldd		[%o0 + 0xe8], %f62
--10:	xor		%g1, %g3, %o5
-+	xor		%g1, %g3, %o5
- 	MOVXTOD_O5_F0
- 	xor		%g2, %g7, %o5
- 	MOVXTOD_O5_F2
 diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
 index be56a24..443328f 100644
 --- a/arch/sparc/include/asm/atomic_64.h
@@ -12133,51 +12165,9 @@ index a0facf3..c017b15 100644
  
  #endif /* __ASSEMBLY__ */
 diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
-index 142236e..6a6b4a6 100644
+index 142236e..57cf5ea 100644
 --- a/arch/x86/include/asm/paravirt_types.h
 +++ b/arch/x86/include/asm/paravirt_types.h
-@@ -84,20 +84,20 @@ struct pv_init_ops {
- 	 */
- 	unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
- 			  unsigned long addr, unsigned len);
--};
-+} __no_const;
- 
- 
- struct pv_lazy_ops {
- 	/* Set deferred update mode, used for batching operations. */
- 	void (*enter)(void);
- 	void (*leave)(void);
--};
-+} __no_const;
- 
- struct pv_time_ops {
- 	unsigned long long (*sched_clock)(void);
- 	unsigned long long (*steal_clock)(int cpu);
- 	unsigned long (*get_tsc_khz)(void);
--};
-+} __no_const;
- 
- struct pv_cpu_ops {
- 	/* hooks for various privileged instructions */
-@@ -191,7 +191,7 @@ struct pv_cpu_ops {
- 
- 	void (*start_context_switch)(struct task_struct *prev);
- 	void (*end_context_switch)(struct task_struct *next);
--};
-+} __no_const;
- 
- struct pv_irq_ops {
- 	/*
-@@ -222,7 +222,7 @@ struct pv_apic_ops {
- 				 unsigned long start_eip,
- 				 unsigned long start_esp);
- #endif
--};
-+} __no_const;
- 
- struct pv_mmu_ops {
- 	unsigned long (*read_cr2)(void);
 @@ -312,6 +312,7 @@ struct pv_mmu_ops {
  	struct paravirt_callee_save make_pud;
  
@@ -12199,15 +12189,6 @@ index 142236e..6a6b4a6 100644
  };
  
  struct arch_spinlock;
-@@ -333,7 +340,7 @@ struct pv_lock_ops {
- 	void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags);
- 	int (*spin_trylock)(struct arch_spinlock *lock);
- 	void (*spin_unlock)(struct arch_spinlock *lock);
--};
-+} __no_const;
- 
- /* This contains all the paravirt structures: we get a convenient
-  * number for each function using the offset which we use to indicate
 diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
 index b4389a4..7024269 100644
 --- a/arch/x86/include/asm/pgalloc.h
@@ -12946,10 +12927,10 @@ index fe1ec5b..dc5c3fe 100644
  	u32 gdt_base;
  #else
 diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
-index a82c4f1..ac45053 100644
+index a82c4f1..f9c9696 100644
 --- a/arch/x86/include/asm/reboot.h
 +++ b/arch/x86/include/asm/reboot.h
-@@ -6,13 +6,13 @@
+@@ -6,12 +6,12 @@
  struct pt_regs;
  
  struct machine_ops {
@@ -12962,12 +12943,10 @@ index a82c4f1..ac45053 100644
  	void (*shutdown)(void);
  	void (*crash_shutdown)(struct pt_regs *);
 -	void (*emergency_restart)(void);
--};
 +	void (* __noreturn emergency_restart)(void);
-+} __no_const;
+ };
  
  extern struct machine_ops machine_ops;
- 
 diff --git a/arch/x86/include/asm/rwsem.h b/arch/x86/include/asm/rwsem.h
 index 2dbe4a7..ce1db00 100644
 --- a/arch/x86/include/asm/rwsem.h
@@ -13168,7 +13147,7 @@ index c48a950..c6d7468 100644
  
  #endif /* !__ASSEMBLY__ */
 diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
-index 4f19a15..9e14f27 100644
+index 4f19a15..e04d86f 100644
 --- a/arch/x86/include/asm/smp.h
 +++ b/arch/x86/include/asm/smp.h
 @@ -36,7 +36,7 @@ DECLARE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_core_map);
@@ -13180,15 +13159,6 @@ index 4f19a15..9e14f27 100644
  
  static inline struct cpumask *cpu_sibling_mask(int cpu)
  {
-@@ -79,7 +79,7 @@ struct smp_ops {
- 
- 	void (*send_call_func_ipi)(const struct cpumask *mask);
- 	void (*send_call_func_single_ipi)(int cpu);
--};
-+} __no_const;
- 
- /* Globals due to paravirt */
- extern void set_cpu_sibling_map(int cpu);
 @@ -190,14 +190,8 @@ extern unsigned disabled_cpus __cpuinitdata;
  extern int safe_smp_processor_id(void);
  
@@ -14412,135 +14382,6 @@ index 5b238981..77fdd78 100644
  };
  
  #define WORD_AT_A_TIME_CONSTANTS { REPEAT_BYTE(0x01), REPEAT_BYTE(0x80) }
-diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
-index 5769349..d49a4dd 100644
---- a/arch/x86/include/asm/x86_init.h
-+++ b/arch/x86/include/asm/x86_init.h
-@@ -29,7 +29,7 @@ struct x86_init_mpparse {
- 	void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
- 	void (*find_smp_config)(void);
- 	void (*get_smp_config)(unsigned int early);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_resources - platform specific resource related ops
-@@ -43,7 +43,7 @@ struct x86_init_resources {
- 	void (*probe_roms)(void);
- 	void (*reserve_resources)(void);
- 	char *(*memory_setup)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_irqs - platform specific interrupt setup
-@@ -56,7 +56,7 @@ struct x86_init_irqs {
- 	void (*pre_vector_init)(void);
- 	void (*intr_init)(void);
- 	void (*trap_init)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_oem - oem platform specific customizing functions
-@@ -66,7 +66,7 @@ struct x86_init_irqs {
- struct x86_init_oem {
- 	void (*arch_setup)(void);
- 	void (*banner)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_mapping - platform specific initial kernel pagetable setup
-@@ -77,7 +77,7 @@ struct x86_init_oem {
-  */
- struct x86_init_mapping {
- 	void (*pagetable_reserve)(u64 start, u64 end);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_paging - platform specific paging functions
-@@ -88,7 +88,7 @@ struct x86_init_mapping {
-  */
- struct x86_init_paging {
- 	void (*pagetable_init)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_timers - platform specific timer setup
-@@ -103,7 +103,7 @@ struct x86_init_timers {
- 	void (*tsc_pre_init)(void);
- 	void (*timer_init)(void);
- 	void (*wallclock_init)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_iommu - platform specific iommu setup
-@@ -111,7 +111,7 @@ struct x86_init_timers {
-  */
- struct x86_init_iommu {
- 	int (*iommu_init)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_pci - platform specific pci init functions
-@@ -125,7 +125,7 @@ struct x86_init_pci {
- 	int (*init)(void);
- 	void (*init_irq)(void);
- 	void (*fixup_irqs)(void);
--};
-+} __no_const;
- 
- /**
-  * struct x86_init_ops - functions for platform specific setup
-@@ -141,7 +141,7 @@ struct x86_init_ops {
- 	struct x86_init_timers		timers;
- 	struct x86_init_iommu		iommu;
- 	struct x86_init_pci		pci;
--};
-+} __no_const;
- 
- /**
-  * struct x86_cpuinit_ops - platform specific cpu hotplug setups
-@@ -152,7 +152,7 @@ struct x86_cpuinit_ops {
- 	void (*setup_percpu_clockev)(void);
- 	void (*early_percpu_clock_init)(void);
- 	void (*fixup_cpu_id)(struct cpuinfo_x86 *c, int node);
--};
-+} __no_const;
- 
- /**
-  * struct x86_platform_ops - platform specific runtime functions
-@@ -178,7 +178,7 @@ struct x86_platform_ops {
- 	void (*save_sched_clock_state)(void);
- 	void (*restore_sched_clock_state)(void);
- 	void (*apic_post_init)(void);
--};
-+} __no_const;
- 
- struct pci_dev;
- 
-@@ -187,14 +187,14 @@ struct x86_msi_ops {
- 	void (*teardown_msi_irq)(unsigned int irq);
- 	void (*teardown_msi_irqs)(struct pci_dev *dev);
- 	void (*restore_msi_irqs)(struct pci_dev *dev, int irq);
--};
-+} __no_const;
- 
- struct x86_io_apic_ops {
- 	void		(*init)  (void);
- 	unsigned int	(*read)  (unsigned int apic, unsigned int reg);
- 	void		(*write) (unsigned int apic, unsigned int reg, unsigned int value);
- 	void		(*modify)(unsigned int apic, unsigned int reg, unsigned int value);
--};
-+} __no_const;
- 
- extern struct x86_init_ops x86_init;
- extern struct x86_cpuinit_ops x86_cpuinit;
 diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
 index 0415cda..b43d877 100644
 --- a/arch/x86/include/asm/xsave.h
@@ -14586,6 +14427,19 @@ index 91ce48f..a48ea05 100644
  obj-$(CONFIG_X86_64)	+= sys_x86_64.o x8664_ksyms_64.o
  obj-y			+= syscall_$(BITS).o
  obj-$(CONFIG_X86_64)	+= vsyscall_64.o
+diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
+index e651f7a..c995dc4 100644
+--- a/arch/x86/kernel/acpi/boot.c
++++ b/arch/x86/kernel/acpi/boot.c
+@@ -1576,7 +1576,7 @@ int __init acpi_boot_init(void)
+ 	acpi_table_parse(ACPI_SIG_HPET, acpi_parse_hpet);
+ 
+ 	if (!acpi_noirq)
+-		x86_init.pci.init = pci_acpi_init;
++		*(void **)&x86_init.pci.init = pci_acpi_init;
+ 
+ 	return 0;
+ }
 diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
 index 11676cf..a8cf3ec 100644
 --- a/arch/x86/kernel/acpi/sleep.c
@@ -14760,6 +14614,32 @@ index ef5ccca..bd83949 100644
  	return addr;
  }
  
+diff --git a/arch/x86/kernel/amd_gart_64.c b/arch/x86/kernel/amd_gart_64.c
+index e663112..21938a3 100644
+--- a/arch/x86/kernel/amd_gart_64.c
++++ b/arch/x86/kernel/amd_gart_64.c
+@@ -851,7 +851,7 @@ int __init gart_iommu_init(void)
+ 
+ 	flush_gart();
+ 	dma_ops = &gart_dma_ops;
+-	x86_platform.iommu_shutdown = gart_iommu_shutdown;
++	*(void **)&x86_platform.iommu_shutdown = gart_iommu_shutdown;
+ 	swiotlb = 0;
+ 
+ 	return 0;
+diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
+index d5fd66f..6119b16 100644
+--- a/arch/x86/kernel/aperture_64.c
++++ b/arch/x86/kernel/aperture_64.c
+@@ -390,7 +390,7 @@ int __init gart_iommu_hole_init(void)
+ 
+ 			iommu_detected = 1;
+ 			gart_iommu_aperture = 1;
+-			x86_init.iommu.iommu_init = gart_iommu_init;
++			*(void **)&x86_init.iommu.iommu_init = gart_iommu_init;
+ 
+ 			ctl = read_pci_config(bus, slot, 3,
+ 					      AMD64_GARTAPERTURECTL);
 diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
 index b17416e..be6e5dc 100644
 --- a/arch/x86/kernel/apic/apic.c
@@ -14793,6 +14673,19 @@ index b17416e..be6e5dc 100644
  	}
  }
  
+diff --git a/arch/x86/kernel/apic/apic_numachip.c b/arch/x86/kernel/apic/apic_numachip.c
+index a65829a..6ddc249 100644
+--- a/arch/x86/kernel/apic/apic_numachip.c
++++ b/arch/x86/kernel/apic/apic_numachip.c
+@@ -178,7 +178,7 @@ static int __init numachip_system_init(void)
+ 	if (!numachip_system)
+ 		return 0;
+ 
+-	x86_cpuinit.fixup_cpu_id = fixup_cpu_id;
++	*(void **)&x86_cpuinit.fixup_cpu_id = fixup_cpu_id;
+ 
+ 	map_csrs();
+ 
 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
 index 1817fa9..7bff097 100644
 --- a/arch/x86/kernel/apic/io_apic.c
@@ -14833,6 +14726,48 @@ index 1817fa9..7bff097 100644
  
  		eoi_ioapic_irq(irq, cfg);
  	}
+diff --git a/arch/x86/kernel/apic/numaq_32.c b/arch/x86/kernel/apic/numaq_32.c
+index d661ee9..512c0a1 100644
+--- a/arch/x86/kernel/apic/numaq_32.c
++++ b/arch/x86/kernel/apic/numaq_32.c
+@@ -257,14 +257,14 @@ static __init void early_check_numaq(void)
+ 		early_get_smp_config();
+ 
+ 	if (found_numaq) {
+-		x86_init.mpparse.mpc_record = numaq_mpc_record;
+-		x86_init.mpparse.setup_ioapic_ids = x86_init_noop;
+-		x86_init.mpparse.mpc_apic_id = mpc_apic_id;
+-		x86_init.mpparse.smp_read_mpc_oem = smp_read_mpc_oem;
+-		x86_init.mpparse.mpc_oem_pci_bus = mpc_oem_pci_bus;
+-		x86_init.mpparse.mpc_oem_bus_info = mpc_oem_bus_info;
+-		x86_init.timers.tsc_pre_init = numaq_tsc_init;
+-		x86_init.pci.init = pci_numaq_init;
++		*(void **)&x86_init.mpparse.mpc_record = numaq_mpc_record;
++		*(void **)&x86_init.mpparse.setup_ioapic_ids = x86_init_noop;
++		*(void **)&x86_init.mpparse.mpc_apic_id = mpc_apic_id;
++		*(void **)&x86_init.mpparse.smp_read_mpc_oem = smp_read_mpc_oem;
++		*(void **)&x86_init.mpparse.mpc_oem_pci_bus = mpc_oem_pci_bus;
++		*(void **)&x86_init.mpparse.mpc_oem_bus_info = mpc_oem_bus_info;
++		*(void **)&x86_init.timers.tsc_pre_init = numaq_tsc_init;
++		*(void **)&x86_init.pci.init = pci_numaq_init;
+ 	}
+ }
+ 
+diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
+index 8cfade9..8ea7b51 100644
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -139,8 +139,8 @@ static int __init uv_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
+ 			is_uv1 ? UV1_HUB_REVISION_BASE : UV2_HUB_REVISION_BASE;
+ 		pnodeid = early_get_pnodeid();
+ 		early_get_apic_pnode_shift();
+-		x86_platform.is_untracked_pat_range =  uv_is_untracked_pat_range;
+-		x86_platform.nmi_init = uv_nmi_init;
++		*(void **)&x86_platform.is_untracked_pat_range =  uv_is_untracked_pat_range;
++		*(void **)&x86_platform.nmi_init = uv_nmi_init;
+ 		if (!strcmp(oem_table_id, "UVL"))
+ 			uv_system_type = UV_LEGACY_APIC;
+ 		else if (!strcmp(oem_table_id, "UVX"))
 diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
 index d65464e..1035d31 100644
 --- a/arch/x86/kernel/apm_32.c
@@ -15489,6 +15424,19 @@ index 324bb52..1a93d85 100644
  	}
  
  	intel_ds_init();
+diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
+index d22d0c4..088eb6f 100644
+--- a/arch/x86/kernel/cpu/vmware.c
++++ b/arch/x86/kernel/cpu/vmware.c
+@@ -79,7 +79,7 @@ static void __init vmware_platform_setup(void)
+ 	VMWARE_PORT(GETHZ, eax, ebx, ecx, edx);
+ 
+ 	if (ebx != UINT_MAX)
+-		x86_platform.calibrate_tsc = vmware_get_tsc_khz;
++		*(void **)&x86_platform.calibrate_tsc = vmware_get_tsc_khz;
+ 	else
+ 		printk(KERN_WARNING
+ 		       "Failed to get TSC freq from the hypervisor\n");
 diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
 index 13ad899..f642b9a 100644
 --- a/arch/x86/kernel/crash.c
@@ -17773,10 +17721,10 @@ index 1d41402..af9a46a 100644
  		return -EFAULT;
  
 diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
-index c18f59d..9c0c9f6 100644
+index c18f59d..69ddbc4 100644
 --- a/arch/x86/kernel/head32.c
 +++ b/arch/x86/kernel/head32.c
-@@ -18,6 +18,7 @@
+@@ -18,20 +18,20 @@
  #include <asm/io_apic.h>
  #include <asm/bios_ebda.h>
  #include <asm/tlbflush.h>
@@ -17784,7 +17732,14 @@ index c18f59d..9c0c9f6 100644
  
  static void __init i386_default_early_setup(void)
  {
-@@ -30,8 +31,7 @@ static void __init i386_default_early_setup(void)
+ 	/* Initialize 32bit specific setup functions */
+-	x86_init.resources.reserve_resources = i386_reserve_resources;
+-	x86_init.mpparse.setup_ioapic_ids = setup_ioapic_ids_from_mpc;
++	*(void **)&x86_init.resources.reserve_resources = i386_reserve_resources;
++	*(void **)&x86_init.mpparse.setup_ioapic_ids = setup_ioapic_ids_from_mpc;
+ 
+ 	reserve_ebda_region();
+ }
  
  void __init i386_start_kernel(void)
  {
@@ -19096,6 +19051,74 @@ index 57916c0..9e0b9d0 100644
  		return ret;
  
  	switch (val) {
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index 4180a87..4678e4f 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -267,7 +267,7 @@ static void __init paravirt_ops_setup(void)
+ 	pv_info.paravirt_enabled = 1;
+ 
+ 	if (kvm_para_has_feature(KVM_FEATURE_NOP_IO_DELAY))
+-		pv_cpu_ops.io_delay = kvm_io_delay;
++		*(void **)&pv_cpu_ops.io_delay = kvm_io_delay;
+ 
+ #ifdef CONFIG_X86_IO_APIC
+ 	no_timer_check = 1;
+@@ -461,18 +461,18 @@ void __init kvm_guest_init(void)
+ 	for (i = 0; i < KVM_TASK_SLEEP_HASHSIZE; i++)
+ 		spin_lock_init(&async_pf_sleepers[i].lock);
+ 	if (kvm_para_has_feature(KVM_FEATURE_ASYNC_PF))
+-		x86_init.irqs.trap_init = kvm_apf_trap_init;
++		*(void **)&x86_init.irqs.trap_init = kvm_apf_trap_init;
+ 
+ 	if (kvm_para_has_feature(KVM_FEATURE_STEAL_TIME)) {
+ 		has_steal_clock = 1;
+-		pv_time_ops.steal_clock = kvm_steal_clock;
++		*(void **)&pv_time_ops.steal_clock = kvm_steal_clock;
+ 	}
+ 
+ 	if (kvm_para_has_feature(KVM_FEATURE_PV_EOI))
+ 		apic_set_eoi_write(kvm_guest_apic_eoi_write);
+ 
+ #ifdef CONFIG_SMP
+-	smp_ops.smp_prepare_boot_cpu = kvm_smp_prepare_boot_cpu;
++	*(void **)&smp_ops.smp_prepare_boot_cpu = kvm_smp_prepare_boot_cpu;
+ 	register_cpu_notifier(&kvm_cpu_notifier);
+ #else
+ 	kvm_guest_cpu_init();
+diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
+index f1b42b3..27ac4e7 100644
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -211,19 +211,19 @@ void __init kvmclock_init(void)
+ 
+ 	if (kvm_register_clock("boot clock"))
+ 		return;
+-	pv_time_ops.sched_clock = kvm_clock_read;
+-	x86_platform.calibrate_tsc = kvm_get_tsc_khz;
+-	x86_platform.get_wallclock = kvm_get_wallclock;
+-	x86_platform.set_wallclock = kvm_set_wallclock;
++	*(void **)&pv_time_ops.sched_clock = kvm_clock_read;
++	*(void **)&x86_platform.calibrate_tsc = kvm_get_tsc_khz;
++	*(void **)&x86_platform.get_wallclock = kvm_get_wallclock;
++	*(void **)&x86_platform.set_wallclock = kvm_set_wallclock;
+ #ifdef CONFIG_X86_LOCAL_APIC
+-	x86_cpuinit.early_percpu_clock_init =
++	*(void **)&x86_cpuinit.early_percpu_clock_init =
+ 		kvm_setup_secondary_clock;
+ #endif
+-	x86_platform.save_sched_clock_state = kvm_save_sched_clock_state;
+-	x86_platform.restore_sched_clock_state = kvm_restore_sched_clock_state;
+-	machine_ops.shutdown  = kvm_shutdown;
++	*(void **)&x86_platform.save_sched_clock_state = kvm_save_sched_clock_state;
++	*(void **)&x86_platform.restore_sched_clock_state = kvm_restore_sched_clock_state;
++	*(void **)&machine_ops.shutdown  = kvm_shutdown;
+ #ifdef CONFIG_KEXEC
+-	machine_ops.crash_shutdown  = kvm_crash_shutdown;
++	*(void **)&machine_ops.crash_shutdown  = kvm_crash_shutdown;
+ #endif
+ 	kvm_get_preset_lpj();
+ 	clocksource_register_hz(&kvm_clock, NSEC_PER_SEC);
 diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
 index ebc9873..1b9724b 100644
 --- a/arch/x86/kernel/ldt.c
@@ -19388,7 +19411,7 @@ index 676b8c7..870ba04 100644
  	.spin_is_locked = __ticket_spin_is_locked,
  	.spin_is_contended = __ticket_spin_is_contended,
 diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
-index 17fff18..7bb2088 100644
+index 17fff18..0f5f957 100644
 --- a/arch/x86/kernel/paravirt.c
 +++ b/arch/x86/kernel/paravirt.c
 @@ -55,6 +55,9 @@ u64 _paravirt_ident_64(u64 x)
@@ -19442,18 +19465,7 @@ index 17fff18..7bb2088 100644
  	.name = "bare hardware",
  	.paravirt_enabled = 0,
  	.kernel_rpl = 0,
-@@ -315,16 +322,16 @@ struct pv_info pv_info = {
- #endif
- };
- 
--struct pv_init_ops pv_init_ops = {
-+struct pv_init_ops pv_init_ops __read_only = {
- 	.patch = native_patch,
- };
- 
--struct pv_time_ops pv_time_ops = {
-+struct pv_time_ops pv_time_ops __read_only = {
- 	.sched_clock = native_sched_clock,
+@@ -324,7 +331,7 @@ struct pv_time_ops pv_time_ops = {
  	.steal_clock = native_steal_clock,
  };
  
@@ -19462,23 +19474,7 @@ index 17fff18..7bb2088 100644
  	.save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
  	.restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
  	.irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
-@@ -336,7 +343,7 @@ struct pv_irq_ops pv_irq_ops = {
- #endif
- };
- 
--struct pv_cpu_ops pv_cpu_ops = {
-+struct pv_cpu_ops pv_cpu_ops __read_only = {
- 	.cpuid = native_cpuid,
- 	.get_debugreg = native_get_debugreg,
- 	.set_debugreg = native_set_debugreg,
-@@ -395,21 +402,26 @@ struct pv_cpu_ops pv_cpu_ops = {
- 	.end_context_switch = paravirt_nop,
- };
- 
--struct pv_apic_ops pv_apic_ops = {
-+struct pv_apic_ops pv_apic_ops __read_only = {
- #ifdef CONFIG_X86_LOCAL_APIC
- 	.startup_ipi_hook = paravirt_nop,
+@@ -401,15 +408,20 @@ struct pv_apic_ops pv_apic_ops = {
  #endif
  };
  
@@ -19522,6 +19518,19 @@ index 17fff18..7bb2088 100644
  };
  
  EXPORT_SYMBOL_GPL(pv_time_ops);
+diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
+index 299d493..79c13dd 100644
+--- a/arch/x86/kernel/pci-calgary_64.c
++++ b/arch/x86/kernel/pci-calgary_64.c
+@@ -1461,7 +1461,7 @@ int __init detect_calgary(void)
+ 		printk(KERN_INFO "PCI-DMA: Calgary TCE table spec is %d\n",
+ 		       specified_table_size);
+ 
+-		x86_init.iommu.iommu_init = calgary_iommu_init;
++		*(void **)&x86_init.iommu.iommu_init = calgary_iommu_init;
+ 	}
+ 	return calgary_found;
+ 
 diff --git a/arch/x86/kernel/pci-iommu_table.c b/arch/x86/kernel/pci-iommu_table.c
 index 35ccf75..7a15747 100644
 --- a/arch/x86/kernel/pci-iommu_table.c
@@ -21365,9 +21374,18 @@ index 22a1530..8fbaaad 100644
  
  #ifdef CONFIG_SMP
 diff --git a/arch/x86/kernel/vsmp_64.c b/arch/x86/kernel/vsmp_64.c
-index 992f890..fc38904 100644
+index 992f890..0ab1aae 100644
 --- a/arch/x86/kernel/vsmp_64.c
 +++ b/arch/x86/kernel/vsmp_64.c
+@@ -114,7 +114,7 @@ static void __init set_vsmp_pv_ops(void)
+ 		pv_irq_ops.irq_enable  = PV_CALLEE_SAVE(vsmp_irq_enable);
+ 		pv_irq_ops.save_fl  = PV_CALLEE_SAVE(vsmp_save_fl);
+ 		pv_irq_ops.restore_fl  = PV_CALLEE_SAVE(vsmp_restore_fl);
+-		pv_init_ops.patch = vsmp_patch;
++		*(void **)&pv_init_ops.patch = vsmp_patch;
+ 		ctl &= ~(1 << 4);
+ 	}
+ 	writel(ctl, address + 4);
 @@ -217,8 +217,8 @@ static void fill_vector_allocation_domain(int cpu, struct cpumask *retmask,
  static void vsmp_apic_post_init(void)
  {
@@ -21379,6 +21397,15 @@ index 992f890..fc38904 100644
  }
  
  void __init vsmp_init(void)
+@@ -227,7 +227,7 @@ void __init vsmp_init(void)
+ 	if (!is_vsmp_box())
+ 		return;
+ 
+-	x86_platform.apic_post_init = vsmp_apic_post_init;
++	*(void **)&x86_platform.apic_post_init = vsmp_apic_post_init;
+ 
+ 	vsmp_cap_cpus();
+ 
 diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
 index 3a3e8c9..1af9465 100644
 --- a/arch/x86/kernel/vsyscall_64.c
@@ -21747,7 +21774,7 @@ index 4f76417..93429b5 100644
  	int r;
  	struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
 diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
-index 642d880..cc9ebac 100644
+index 642d880..5dd034e 100644
 --- a/arch/x86/lguest/boot.c
 +++ b/arch/x86/lguest/boot.c
 @@ -1116,12 +1116,12 @@ static u32 lguest_apic_safe_wait_icr_idle(void)
@@ -21781,6 +21808,81 @@ index 642d880..cc9ebac 100644
  }
  
  /*G:050
+@@ -1292,28 +1293,28 @@ __init void lguest_init(void)
+ 	pv_irq_ops.safe_halt = lguest_safe_halt;
+ 
+ 	/* Setup operations */
+-	pv_init_ops.patch = lguest_patch;
++	*(void **)&pv_init_ops.patch = lguest_patch;
+ 
+ 	/* Intercepts of various CPU instructions */
+-	pv_cpu_ops.load_gdt = lguest_load_gdt;
+-	pv_cpu_ops.cpuid = lguest_cpuid;
+-	pv_cpu_ops.load_idt = lguest_load_idt;
+-	pv_cpu_ops.iret = lguest_iret;
+-	pv_cpu_ops.load_sp0 = lguest_load_sp0;
+-	pv_cpu_ops.load_tr_desc = lguest_load_tr_desc;
+-	pv_cpu_ops.set_ldt = lguest_set_ldt;
+-	pv_cpu_ops.load_tls = lguest_load_tls;
+-	pv_cpu_ops.set_debugreg = lguest_set_debugreg;
+-	pv_cpu_ops.clts = lguest_clts;
+-	pv_cpu_ops.read_cr0 = lguest_read_cr0;
+-	pv_cpu_ops.write_cr0 = lguest_write_cr0;
+-	pv_cpu_ops.read_cr4 = lguest_read_cr4;
+-	pv_cpu_ops.write_cr4 = lguest_write_cr4;
+-	pv_cpu_ops.write_gdt_entry = lguest_write_gdt_entry;
+-	pv_cpu_ops.write_idt_entry = lguest_write_idt_entry;
+-	pv_cpu_ops.wbinvd = lguest_wbinvd;
+-	pv_cpu_ops.start_context_switch = paravirt_start_context_switch;
+-	pv_cpu_ops.end_context_switch = lguest_end_context_switch;
++	*(void **)&pv_cpu_ops.load_gdt = lguest_load_gdt;
++	*(void **)&pv_cpu_ops.cpuid = lguest_cpuid;
++	*(void **)&pv_cpu_ops.load_idt = lguest_load_idt;
++	*(void **)&pv_cpu_ops.iret = lguest_iret;
++	*(void **)&pv_cpu_ops.load_sp0 = lguest_load_sp0;
++	*(void **)&pv_cpu_ops.load_tr_desc = lguest_load_tr_desc;
++	*(void **)&pv_cpu_ops.set_ldt = lguest_set_ldt;
++	*(void **)&pv_cpu_ops.load_tls = lguest_load_tls;
++	*(void **)&pv_cpu_ops.set_debugreg = lguest_set_debugreg;
++	*(void **)&pv_cpu_ops.clts = lguest_clts;
++	*(void **)&pv_cpu_ops.read_cr0 = lguest_read_cr0;
++	*(void **)&pv_cpu_ops.write_cr0 = lguest_write_cr0;
++	*(void **)&pv_cpu_ops.read_cr4 = lguest_read_cr4;
++	*(void **)&pv_cpu_ops.write_cr4 = lguest_write_cr4;
++	*(void **)&pv_cpu_ops.write_gdt_entry = lguest_write_gdt_entry;
++	*(void **)&pv_cpu_ops.write_idt_entry = lguest_write_idt_entry;
++	*(void **)&pv_cpu_ops.wbinvd = lguest_wbinvd;
++	*(void **)&pv_cpu_ops.start_context_switch = paravirt_start_context_switch;
++	*(void **)&pv_cpu_ops.end_context_switch = lguest_end_context_switch;
+ 
+ 	/* Pagetable management */
+ 	pv_mmu_ops.write_cr3 = lguest_write_cr3;
+@@ -1341,11 +1342,11 @@ __init void lguest_init(void)
+ 	set_lguest_basic_apic_ops();
+ #endif
+ 
+-	x86_init.resources.memory_setup = lguest_memory_setup;
+-	x86_init.irqs.intr_init = lguest_init_IRQ;
+-	x86_init.timers.timer_init = lguest_time_init;
+-	x86_platform.calibrate_tsc = lguest_tsc_khz;
+-	x86_platform.get_wallclock =  lguest_get_wallclock;
++	*(void **)&x86_init.resources.memory_setup = lguest_memory_setup;
++	*(void **)&x86_init.irqs.intr_init = lguest_init_IRQ;
++	*(void **)&x86_init.timers.timer_init = lguest_time_init;
++	*(void **)&x86_platform.calibrate_tsc = lguest_tsc_khz;
++	*(void **)&x86_platform.get_wallclock =  lguest_get_wallclock;
+ 
+ 	/*
+ 	 * Now is a good time to look at the implementations of these functions
+@@ -1434,7 +1435,7 @@ __init void lguest_init(void)
+ 	 * routine.
+ 	 */
+ 	pm_power_off = lguest_power_off;
+-	machine_ops.restart = lguest_restart;
++	*(void **)&machine_ops.restart = lguest_restart;
+ 
+ 	/*
+ 	 * Now we're set up, call i386_start_kernel() in head32.c and we proceed
 diff --git a/arch/x86/lib/atomic64_386_32.S b/arch/x86/lib/atomic64_386_32.S
 index 00933d5..3a64af9 100644
 --- a/arch/x86/lib/atomic64_386_32.S
@@ -27509,6 +27611,19 @@ index d6aa6e8..266395a 100644
  		unsigned long stack = kernel_stack_pointer(regs);
  		if (depth)
  			dump_trace(NULL, regs, (unsigned long *)stack, 0,
+diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
+index 192397c..5ba6f9e 100644
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -568,7 +568,7 @@ int __init pci_acpi_init(void)
+ 	acpi_irq_penalty_init();
+ 	pcibios_enable_irq = acpi_pci_irq_enable;
+ 	pcibios_disable_irq = acpi_pci_irq_disable;
+-	x86_init.pci.init_irq = x86_init_noop;
++	*(void **)&x86_init.pci.init_irq = x86_init_noop;
+ 
+ 	if (pci_routeirq) {
+ 		/*
 diff --git a/arch/x86/pci/mrst.c b/arch/x86/pci/mrst.c
 index e14a2ff..3fd6b58 100644
 --- a/arch/x86/pci/mrst.c
@@ -27832,6 +27947,62 @@ index da8fe05..7ee6704 100644
  	return !(ret & 0xff00);
  }
  EXPORT_SYMBOL(pcibios_set_irq_routing);
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index 56ab749..3cb792a 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -395,9 +395,9 @@ int __init pci_xen_init(void)
+ #endif
+ 
+ #ifdef CONFIG_PCI_MSI
+-	x86_msi.setup_msi_irqs = xen_setup_msi_irqs;
+-	x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
+-	x86_msi.teardown_msi_irqs = xen_teardown_msi_irqs;
++	*(void **)&x86_msi.setup_msi_irqs = xen_setup_msi_irqs;
++	*(void **)&x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
++	*(void **)&x86_msi.teardown_msi_irqs = xen_teardown_msi_irqs;
+ #endif
+ 	return 0;
+ }
+@@ -416,8 +416,8 @@ int __init pci_xen_hvm_init(void)
+ #endif
+ 
+ #ifdef CONFIG_PCI_MSI
+-	x86_msi.setup_msi_irqs = xen_hvm_setup_msi_irqs;
+-	x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
++	*(void **)&x86_msi.setup_msi_irqs = xen_hvm_setup_msi_irqs;
++	*(void **)&x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
+ #endif
+ 	return 0;
+ }
+@@ -474,9 +474,9 @@ int __init pci_xen_initial_domain(void)
+ 	int irq;
+ 
+ #ifdef CONFIG_PCI_MSI
+-	x86_msi.setup_msi_irqs = xen_initdom_setup_msi_irqs;
+-	x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
+-	x86_msi.restore_msi_irqs = xen_initdom_restore_msi_irqs;
++	*(void **)&x86_msi.setup_msi_irqs = xen_initdom_setup_msi_irqs;
++	*(void **)&x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
++	*(void **)&x86_msi.restore_msi_irqs = xen_initdom_restore_msi_irqs;
+ #endif
+ 	xen_setup_acpi_sci();
+ 	__acpi_register_gsi = acpi_register_gsi_xen;
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index ad44391..acef4b5 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -738,8 +738,8 @@ void __init efi_init(void)
+ 	}
+ #ifdef CONFIG_X86_32
+ 	if (efi_is_native()) {
+-		x86_platform.get_wallclock = efi_get_time;
+-		x86_platform.set_wallclock = efi_set_rtc_mmss;
++		*(void **)&x86_platform.get_wallclock = efi_get_time;
++		*(void **)&x86_platform.set_wallclock = efi_set_rtc_mmss;
+ 	}
+ #endif
+ 
 diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
 index 40e4469..1ab536e 100644
 --- a/arch/x86/platform/efi/efi_32.c
@@ -28071,7 +28242,7 @@ index 4c07cca..2c8427d 100644
  	ret
  ENDPROC(efi_call6)
 diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
-index fd41a92..9c33628 100644
+index fd41a92..bc8091d 100644
 --- a/arch/x86/platform/mrst/mrst.c
 +++ b/arch/x86/platform/mrst/mrst.c
 @@ -78,13 +78,15 @@ struct sfi_rtc_table_entry sfi_mrtc_array[SFI_MRTC_MAX];
@@ -28092,6 +28263,118 @@ index fd41a92..9c33628 100644
  }
  
  /* parse all the mtimer info to a static mtimer array */
+@@ -233,14 +235,14 @@ static void __init mrst_time_init(void)
+ 	case MRST_TIMER_APBT_ONLY:
+ 		break;
+ 	case MRST_TIMER_LAPIC_APBT:
+-		x86_init.timers.setup_percpu_clockev = setup_boot_APIC_clock;
+-		x86_cpuinit.setup_percpu_clockev = setup_secondary_APIC_clock;
++		*(void **)&x86_init.timers.setup_percpu_clockev = setup_boot_APIC_clock;
++		*(void **)&x86_cpuinit.setup_percpu_clockev = setup_secondary_APIC_clock;
+ 		break;
+ 	default:
+ 		if (!boot_cpu_has(X86_FEATURE_ARAT))
+ 			break;
+-		x86_init.timers.setup_percpu_clockev = setup_boot_APIC_clock;
+-		x86_cpuinit.setup_percpu_clockev = setup_secondary_APIC_clock;
++		*(void **)&x86_init.timers.setup_percpu_clockev = setup_boot_APIC_clock;
++		*(void **)&x86_cpuinit.setup_percpu_clockev = setup_secondary_APIC_clock;
+ 		return;
+ 	}
+ 	/* we need at least one APB timer */
+@@ -282,35 +284,35 @@ static unsigned char mrst_get_nmi_reason(void)
+  */
+ void __init x86_mrst_early_setup(void)
+ {
+-	x86_init.resources.probe_roms = x86_init_noop;
+-	x86_init.resources.reserve_resources = x86_init_noop;
++	*(void **)&x86_init.resources.probe_roms = x86_init_noop;
++	*(void **)&x86_init.resources.reserve_resources = x86_init_noop;
+ 
+-	x86_init.timers.timer_init = mrst_time_init;
+-	x86_init.timers.setup_percpu_clockev = x86_init_noop;
++	*(void **)&x86_init.timers.timer_init = mrst_time_init;
++	*(void **)&x86_init.timers.setup_percpu_clockev = x86_init_noop;
+ 
+-	x86_init.irqs.pre_vector_init = x86_init_noop;
++	*(void **)&x86_init.irqs.pre_vector_init = x86_init_noop;
+ 
+-	x86_init.oem.arch_setup = mrst_arch_setup;
++	*(void **)&x86_init.oem.arch_setup = mrst_arch_setup;
+ 
+-	x86_cpuinit.setup_percpu_clockev = apbt_setup_secondary_clock;
++	*(void **)&x86_cpuinit.setup_percpu_clockev = apbt_setup_secondary_clock;
+ 
+-	x86_platform.calibrate_tsc = mrst_calibrate_tsc;
+-	x86_platform.i8042_detect = mrst_i8042_detect;
+-	x86_init.timers.wallclock_init = mrst_rtc_init;
+-	x86_platform.get_nmi_reason = mrst_get_nmi_reason;
++	*(void **)&x86_platform.calibrate_tsc = mrst_calibrate_tsc;
++	*(void **)&x86_platform.i8042_detect = mrst_i8042_detect;
++	*(void **)&x86_init.timers.wallclock_init = mrst_rtc_init;
++	*(void **)&x86_platform.get_nmi_reason = mrst_get_nmi_reason;
+ 
+-	x86_init.pci.init = pci_mrst_init;
+-	x86_init.pci.fixup_irqs = x86_init_noop;
++	*(void **)&x86_init.pci.init = pci_mrst_init;
++	*(void **)&x86_init.pci.fixup_irqs = x86_init_noop;
+ 
+ 	legacy_pic = &null_legacy_pic;
+ 
+ 	/* Moorestown specific power_off/restart method */
+ 	pm_power_off = mrst_power_off;
+-	machine_ops.emergency_restart  = mrst_reboot;
++	*(void **)&machine_ops.emergency_restart  = mrst_reboot;
+ 
+ 	/* Avoid searching for BIOS MP tables */
+-	x86_init.mpparse.find_smp_config = x86_init_noop;
+-	x86_init.mpparse.get_smp_config = x86_init_uint_noop;
++	*(void **)&x86_init.mpparse.find_smp_config = x86_init_noop;
++	*(void **)&x86_init.mpparse.get_smp_config = x86_init_uint_noop;
+ 	set_bit(MP_BUS_ISA, mp_bus_not_pci);
+ }
+ 
+diff --git a/arch/x86/platform/mrst/vrtc.c b/arch/x86/platform/mrst/vrtc.c
+index 225bd0f..22e8086 100644
+--- a/arch/x86/platform/mrst/vrtc.c
++++ b/arch/x86/platform/mrst/vrtc.c
+@@ -120,8 +120,8 @@ void __init mrst_rtc_init(void)
+ 
+ 	vrtc_virt_base = (void __iomem *)set_fixmap_offset_nocache(FIX_LNW_VRTC,
+ 								vrtc_paddr);
+-	x86_platform.get_wallclock = vrtc_get_time;
+-	x86_platform.set_wallclock = vrtc_set_mmss;
++	*(void **)&x86_platform.get_wallclock = vrtc_get_time;
++	*(void **)&x86_platform.set_wallclock = vrtc_set_mmss;
+ }
+ 
+ /*
+diff --git a/arch/x86/platform/olpc/olpc.c b/arch/x86/platform/olpc/olpc.c
+index 2737608..0d62cc2 100644
+--- a/arch/x86/platform/olpc/olpc.c
++++ b/arch/x86/platform/olpc/olpc.c
+@@ -395,7 +395,7 @@ static int __init olpc_init(void)
+ 	 * XO-1 only. */
+ 	if (olpc_platform_info.boardrev < olpc_board_pre(0xd0) &&
+ 			!cs5535_has_vsa2())
+-		x86_init.pci.arch_init = pci_olpc_init;
++		*(void **)&x86_init.pci.arch_init = pci_olpc_init;
+ #endif
+ 
+ 	if (olpc_platform_info.boardrev < olpc_board_pre(0xd0)) { /* XO-1 */
+diff --git a/arch/x86/platform/olpc/olpc_dt.c b/arch/x86/platform/olpc/olpc_dt.c
+index d6ee929..3637cb5 100644
+--- a/arch/x86/platform/olpc/olpc_dt.c
++++ b/arch/x86/platform/olpc/olpc_dt.c
+@@ -156,7 +156,7 @@ void * __init prom_early_alloc(unsigned long size)
+ 	return res;
+ }
+ 
+-static struct of_pdt_ops prom_olpc_ops __initdata = {
++static struct of_pdt_ops prom_olpc_ops __initconst = {
+ 	.nextprop = olpc_dt_nextprop,
+ 	.getproplen = olpc_dt_getproplen,
+ 	.getproperty = olpc_dt_getproperty,
 diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
 index 218cdb1..c1178eb 100644
 --- a/arch/x86/power/cpu.c
@@ -28601,8 +28884,19 @@ index 00aaf04..4a26505 100644
 -	return 0;
 -}
 -__setup("vdso=", vdso_setup);
+diff --git a/arch/x86/xen/apic.c b/arch/x86/xen/apic.c
+index 7005ced..530d6eb 100644
+--- a/arch/x86/xen/apic.c
++++ b/arch/x86/xen/apic.c
+@@ -30,5 +30,5 @@ static unsigned int xen_io_apic_read(unsigned apic, unsigned reg)
+ 
+ void __init xen_init_apic(void)
+ {
+-	x86_io_apic_ops.read = xen_io_apic_read;
++	*(void **)&x86_io_apic_ops.read = xen_io_apic_read;
+ }
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 586d838..38cb3ff 100644
+index 586d838..a973e1c 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -99,8 +99,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -28687,6 +28981,45 @@ index 586d838..38cb3ff 100644
  {
  	if (pm_power_off)
  		pm_power_off();
+@@ -1290,14 +1288,14 @@ static const struct machine_ops xen_machine_ops __initconst = {
+  */
+ static void __init xen_setup_stackprotector(void)
+ {
+-	pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry_boot;
+-	pv_cpu_ops.load_gdt = xen_load_gdt_boot;
++	*(void **)&pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry_boot;
++	*(void **)&pv_cpu_ops.load_gdt = xen_load_gdt_boot;
+ 
+ 	setup_stack_canary_segment(0);
+ 	switch_to_new_gdt(0);
+ 
+-	pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
+-	pv_cpu_ops.load_gdt = xen_load_gdt;
++	*(void **)&pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
++	*(void **)&pv_cpu_ops.load_gdt = xen_load_gdt;
+ }
+ 
+ /* First C function to be called on Xen boot */
+@@ -1315,13 +1313,13 @@ asmlinkage void __init xen_start_kernel(void)
+ 
+ 	/* Install Xen paravirt ops */
+ 	pv_info = xen_info;
+-	pv_init_ops = xen_init_ops;
+-	pv_cpu_ops = xen_cpu_ops;
+-	pv_apic_ops = xen_apic_ops;
++	memcpy((void *)&pv_init_ops, &xen_init_ops, sizeof pv_init_ops);
++	memcpy((void *)&pv_cpu_ops, &xen_cpu_ops, sizeof pv_cpu_ops);
++	memcpy((void *)&pv_apic_ops, &xen_apic_ops, sizeof pv_apic_ops);
+ 
+-	x86_init.resources.memory_setup = xen_memory_setup;
+-	x86_init.oem.arch_setup = xen_arch_setup;
+-	x86_init.oem.banner = xen_banner;
++	*(void **)&x86_init.resources.memory_setup = xen_memory_setup;
++	*(void **)&x86_init.oem.arch_setup = xen_arch_setup;
++	*(void **)&x86_init.oem.banner = xen_banner;
+ 
+ 	xen_init_time_ops();
+ 
 @@ -1347,7 +1345,17 @@ asmlinkage void __init xen_start_kernel(void)
  	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
  
@@ -28706,22 +29039,64 @@ index 586d838..38cb3ff 100644
  
  	xen_setup_features();
  
-@@ -1378,13 +1386,6 @@ asmlinkage void __init xen_start_kernel(void)
- 
- 	machine_ops = xen_machine_ops;
+@@ -1376,14 +1384,7 @@ asmlinkage void __init xen_start_kernel(void)
+ 		pv_mmu_ops.ptep_modify_prot_commit = xen_ptep_modify_prot_commit;
+ 	}
  
+-	machine_ops = xen_machine_ops;
+-
 -	/*
 -	 * The only reliable way to retain the initial address of the
 -	 * percpu gdt_page is to remember it here, so we can go and
 -	 * mark it RW later, when the initial percpu area is freed.
 -	 */
 -	xen_initial_gdt = &per_cpu(gdt_page, 0);
--
++	memcpy((void *)&machine_ops, &xen_machine_ops, sizeof machine_ops);
+ 
  	xen_smp_init();
  
- #ifdef CONFIG_ACPI_NUMA
+@@ -1450,7 +1451,7 @@ asmlinkage void __init xen_start_kernel(void)
+ 		add_preferred_console("tty", 0, NULL);
+ 		add_preferred_console("hvc", 0, NULL);
+ 		if (pci_xen)
+-			x86_init.pci.arch_init = pci_xen_init;
++			*(void **)&x86_init.pci.arch_init = pci_xen_init;
+ 	} else {
+ 		const struct dom0_vga_console_info *info =
+ 			(void *)((char *)xen_start_info +
+@@ -1476,8 +1477,8 @@ asmlinkage void __init xen_start_kernel(void)
+ 		xen_acpi_sleep_register();
+ 
+ 		/* Avoid searching for BIOS MP tables */
+-		x86_init.mpparse.find_smp_config = x86_init_noop;
+-		x86_init.mpparse.get_smp_config = x86_init_uint_noop;
++		*(void **)&x86_init.mpparse.find_smp_config = x86_init_noop;
++		*(void **)&x86_init.mpparse.get_smp_config = x86_init_uint_noop;
+ 	}
+ #ifdef CONFIG_PCI
+ 	/* PCI BIOS service won't work from a PV guest. */
+@@ -1583,7 +1584,7 @@ static void __init xen_hvm_guest_init(void)
+ 	xen_hvm_smp_init();
+ 	register_cpu_notifier(&xen_hvm_cpu_notifier);
+ 	xen_unplug_emulated_devices();
+-	x86_init.irqs.intr_init = xen_init_IRQ;
++	*(void **)&x86_init.irqs.intr_init = xen_init_IRQ;
+ 	xen_hvm_init_time_ops();
+ 	xen_hvm_init_mmu_ops();
+ }
+diff --git a/arch/x86/xen/irq.c b/arch/x86/xen/irq.c
+index 01a4dc0..3ca0cc9 100644
+--- a/arch/x86/xen/irq.c
++++ b/arch/x86/xen/irq.c
+@@ -130,5 +130,5 @@ static const struct pv_irq_ops xen_irq_ops __initconst = {
+ void __init xen_init_irq_ops(void)
+ {
+ 	pv_irq_ops = xen_irq_ops;
+-	x86_init.irqs.intr_init = xen_init_IRQ;
++	*(void **)&x86_init.irqs.intr_init = xen_init_IRQ;
+ }
 diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index dcf5f2d..d804c25 100644
+index dcf5f2d..5f72fe7 100644
 --- a/arch/x86/xen/mmu.c
 +++ b/arch/x86/xen/mmu.c
 @@ -1881,6 +1881,9 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
@@ -28763,8 +29138,19 @@ index dcf5f2d..d804c25 100644
  
  	.alloc_pud = xen_alloc_pmd_init,
  	.release_pud = xen_release_pmd_init,
+@@ -2197,8 +2206,8 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
+ 
+ void __init xen_init_mmu_ops(void)
+ {
+-	x86_init.mapping.pagetable_reserve = xen_mapping_pagetable_reserve;
+-	x86_init.paging.pagetable_init = xen_pagetable_init;
++	*(void **)&x86_init.mapping.pagetable_reserve = xen_mapping_pagetable_reserve;
++	*(void **)&x86_init.paging.pagetable_init = xen_pagetable_init;
+ 	pv_mmu_ops = xen_mmu_ops;
+ 
+ 	memset(dummy_mapping, 0xff, PAGE_SIZE);
 diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
-index 353c50f..5b7cb95 100644
+index 353c50f..a0b9b0d 100644
 --- a/arch/x86/xen/smp.c
 +++ b/arch/x86/xen/smp.c
 @@ -229,11 +229,6 @@ static void __init xen_smp_prepare_boot_cpu(void)
@@ -28811,6 +29197,101 @@ index 353c50f..5b7cb95 100644
  #endif
  	xen_setup_runstate_info(cpu);
  	xen_setup_timer(cpu);
+@@ -637,7 +631,7 @@ static const struct smp_ops xen_smp_ops __initconst = {
+ 
+ void __init xen_smp_init(void)
+ {
+-	smp_ops = xen_smp_ops;
++	memcpy((void *)&smp_ops, &xen_smp_ops, sizeof smp_ops);
+ 	xen_fill_possible_map();
+ 	xen_init_spinlocks();
+ }
+@@ -672,10 +666,10 @@ void __init xen_hvm_smp_init(void)
+ {
+ 	if (!xen_have_vector_callback)
+ 		return;
+-	smp_ops.smp_prepare_cpus = xen_hvm_smp_prepare_cpus;
+-	smp_ops.smp_send_reschedule = xen_smp_send_reschedule;
+-	smp_ops.cpu_up = xen_hvm_cpu_up;
+-	smp_ops.cpu_die = xen_hvm_cpu_die;
+-	smp_ops.send_call_func_ipi = xen_smp_send_call_function_ipi;
+-	smp_ops.send_call_func_single_ipi = xen_smp_send_call_function_single_ipi;
++	*(void **)&smp_ops.smp_prepare_cpus = xen_hvm_smp_prepare_cpus;
++	*(void **)&smp_ops.smp_send_reschedule = xen_smp_send_reschedule;
++	*(void **)&smp_ops.cpu_up = xen_hvm_cpu_up;
++	*(void **)&smp_ops.cpu_die = xen_hvm_cpu_die;
++	*(void **)&smp_ops.send_call_func_ipi = xen_smp_send_call_function_ipi;
++	*(void **)&smp_ops.send_call_func_single_ipi = xen_smp_send_call_function_single_ipi;
+ }
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index 83e866d..ef60385 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -390,12 +390,12 @@ void __init xen_init_spinlocks(void)
+ {
+ 	BUILD_BUG_ON(sizeof(struct xen_spinlock) > sizeof(arch_spinlock_t));
+ 
+-	pv_lock_ops.spin_is_locked = xen_spin_is_locked;
+-	pv_lock_ops.spin_is_contended = xen_spin_is_contended;
+-	pv_lock_ops.spin_lock = xen_spin_lock;
+-	pv_lock_ops.spin_lock_flags = xen_spin_lock_flags;
+-	pv_lock_ops.spin_trylock = xen_spin_trylock;
+-	pv_lock_ops.spin_unlock = xen_spin_unlock;
++	*(void **)&pv_lock_ops.spin_is_locked = xen_spin_is_locked;
++	*(void **)&pv_lock_ops.spin_is_contended = xen_spin_is_contended;
++	*(void **)&pv_lock_ops.spin_lock = xen_spin_lock;
++	*(void **)&pv_lock_ops.spin_lock_flags = xen_spin_lock_flags;
++	*(void **)&pv_lock_ops.spin_trylock = xen_spin_trylock;
++	*(void **)&pv_lock_ops.spin_unlock = xen_spin_unlock;
+ }
+ 
+ #ifdef CONFIG_XEN_DEBUG_FS
+diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
+index 0296a95..3c51a2d 100644
+--- a/arch/x86/xen/time.c
++++ b/arch/x86/xen/time.c
+@@ -481,15 +481,15 @@ static void __init xen_time_init(void)
+ 
+ void __init xen_init_time_ops(void)
+ {
+-	pv_time_ops = xen_time_ops;
++	memcpy((void *)&pv_time_ops, &xen_time_ops, sizeof pv_time_ops);
+ 
+-	x86_init.timers.timer_init = xen_time_init;
+-	x86_init.timers.setup_percpu_clockev = x86_init_noop;
+-	x86_cpuinit.setup_percpu_clockev = x86_init_noop;
++	*(void **)&x86_init.timers.timer_init = xen_time_init;
++	*(void **)&x86_init.timers.setup_percpu_clockev = x86_init_noop;
++	*(void **)&x86_cpuinit.setup_percpu_clockev = x86_init_noop;
+ 
+-	x86_platform.calibrate_tsc = xen_tsc_khz;
+-	x86_platform.get_wallclock = xen_get_wallclock;
+-	x86_platform.set_wallclock = xen_set_wallclock;
++	*(void **)&x86_platform.calibrate_tsc = xen_tsc_khz;
++	*(void **)&x86_platform.get_wallclock = xen_get_wallclock;
++	*(void **)&x86_platform.set_wallclock = xen_set_wallclock;
+ }
+ 
+ #ifdef CONFIG_XEN_PVHVM
+@@ -514,12 +514,12 @@ void __init xen_hvm_init_time_ops(void)
+ 		return;
+ 	}
+ 
+-	pv_time_ops = xen_time_ops;
+-	x86_init.timers.setup_percpu_clockev = xen_time_init;
+-	x86_cpuinit.setup_percpu_clockev = xen_hvm_setup_cpu_clockevents;
++	memcpy((void *)&pv_time_ops, &xen_time_ops, sizeof pv_time_ops);
++	*(void **)&x86_init.timers.setup_percpu_clockev = xen_time_init;
++	*(void **)&x86_cpuinit.setup_percpu_clockev = xen_hvm_setup_cpu_clockevents;
+ 
+-	x86_platform.calibrate_tsc = xen_tsc_khz;
+-	x86_platform.get_wallclock = xen_get_wallclock;
+-	x86_platform.set_wallclock = xen_set_wallclock;
++	*(void **)&x86_platform.calibrate_tsc = xen_tsc_khz;
++	*(void **)&x86_platform.get_wallclock = xen_get_wallclock;
++	*(void **)&x86_platform.set_wallclock = xen_set_wallclock;
+ }
+ #endif
 diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
 index f9643fc..602e8af 100644
 --- a/arch/x86/xen/xen-asm_32.S
@@ -29117,19 +29598,6 @@ index 7bdd61b..afec999 100644
  
  static void cryptd_queue_worker(struct work_struct *work);
  
-diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
-index b2c99dc..2a10085 100644
---- a/crypto/pcrypt.c
-+++ b/crypto/pcrypt.c
-@@ -52,7 +52,7 @@ struct padata_pcrypt {
- 	struct pcrypt_cpumask {
- 		cpumask_var_t mask;
- 	} *cb_cpumask;
--	struct notifier_block nblock;
-+	notifier_block_no_const nblock;
- };
- 
- static struct padata_pcrypt pencrypt;
 diff --git a/drivers/acpi/apei/cper.c b/drivers/acpi/apei/cper.c
 index e6defd8..c26a225 100644
 --- a/drivers/acpi/apei/cper.c
@@ -29151,19 +29619,6 @@ index e6defd8..c26a225 100644
  }
  EXPORT_SYMBOL_GPL(cper_next_record_id);
  
-diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
-index 7efaeaa..53372fb 100644
---- a/drivers/acpi/battery.c
-+++ b/drivers/acpi/battery.c
-@@ -115,7 +115,7 @@ struct acpi_battery {
- 	struct mutex sysfs_lock;
- 	struct power_supply bat;
- 	struct acpi_device *device;
--	struct notifier_block pm_nb;
-+	notifier_block_no_const pm_nb;
- 	unsigned long update_time;
- 	int rate_now;
- 	int capacity_now;
 diff --git a/drivers/acpi/ec_sys.c b/drivers/acpi/ec_sys.c
 index 7586544..636a2f0 100644
 --- a/drivers/acpi/ec_sys.c
@@ -29268,24 +29723,11 @@ index bd4e5dc..0497b66 100644
  
  	/*
  	 * Buggy BIOS check
-diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
-index ac9a69c..6b2a391 100644
---- a/drivers/acpi/video.c
-+++ b/drivers/acpi/video.c
-@@ -157,7 +157,7 @@ struct acpi_video_bus {
- 	struct mutex device_list_lock;	/* protects video_device_list */
- 	struct input_dev *input;
- 	char phys[32];	/* for input device */
--	struct notifier_block pm_nb;
-+	notifier_block_no_const pm_nb;
- };
- 
- struct acpi_video_device_flags {
 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index f46fbd3..b8341f3 100644
+index 586362e..ca71b9b 100644
 --- a/drivers/ata/libata-core.c
 +++ b/drivers/ata/libata-core.c
-@@ -4774,7 +4774,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
+@@ -4775,7 +4775,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	unsigned int tag;
  
@@ -29294,7 +29736,7 @@ index f46fbd3..b8341f3 100644
  	ap = qc->ap;
  
  	qc->flags = 0;
-@@ -4790,7 +4790,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
+@@ -4791,7 +4791,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	struct ata_link *link;
  
@@ -29303,7 +29745,7 @@ index f46fbd3..b8341f3 100644
  	WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
  	ap = qc->ap;
  	link = qc->dev->link;
-@@ -5886,6 +5886,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5887,6 +5887,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		return;
  
  	spin_lock(&lock);
@@ -29311,7 +29753,7 @@ index f46fbd3..b8341f3 100644
  
  	for (cur = ops->inherits; cur; cur = cur->inherits) {
  		void **inherit = (void **)cur;
-@@ -5899,8 +5900,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5900,8 +5901,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		if (IS_ERR(*pp))
  			*pp = NULL;
  
@@ -30218,7 +30660,7 @@ index 1c70c45..300718d 100644
  		}
  
 diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
-index 9851093..adb2b1e 100644
+index 1853a45..cf2426d 100644
 --- a/drivers/atm/solos-pci.c
 +++ b/drivers/atm/solos-pci.c
 @@ -714,7 +714,7 @@ void solos_bh(unsigned long card_arg)
@@ -30230,7 +30672,7 @@ index 9851093..adb2b1e 100644
  				break;
  
  			case PKT_STATUS:
-@@ -1009,7 +1009,7 @@ static uint32_t fpga_tx(struct solos_card *card)
+@@ -1010,7 +1010,7 @@ static uint32_t fpga_tx(struct solos_card *card)
  			vcc = SKB_CB(oldskb)->vcc;
  
  			if (vcc) {
@@ -30346,19 +30788,6 @@ index 147d1a4..d0fd4b0 100644
  	if (err)
  		printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
  	else
-diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
-index 8945f4e..4b47cf4 100644
---- a/drivers/base/firmware_class.c
-+++ b/drivers/base/firmware_class.c
-@@ -118,7 +118,7 @@ struct firmware_cache {
- 
- 	struct delayed_work work;
- 
--	struct notifier_block   pm_notify;
-+	notifier_block_no_const pm_notify;
- #endif
- };
- 
 diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
 index e6ee5e8..98ad7fc 100644
 --- a/drivers/base/power/wakeup.c
@@ -31736,6 +32165,23 @@ index b298158..7ed8432 100644
  
  	iounmap(buf);
  	return 0;
+diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
+index d10c987..ebe5400 100644
+--- a/drivers/firmware/efivars.c
++++ b/drivers/firmware/efivars.c
+@@ -1234,9 +1234,9 @@ efivars_init(void)
+ 		return -ENOMEM;
+ 	}
+ 
+-	ops.get_variable = efi.get_variable;
+-	ops.set_variable = efi.set_variable;
+-	ops.get_next_variable = efi.get_next_variable;
++	*(void **)&ops.get_variable = efi.get_variable;
++	*(void **)&ops.set_variable = efi.set_variable;
++	*(void **)&ops.get_next_variable = efi.get_next_variable;
+ 	error = register_efivars(&__efivars, &ops, efi_kobj);
+ 	if (error)
+ 		goto err_put;
 diff --git a/drivers/gpio/gpio-vr41xx.c b/drivers/gpio/gpio-vr41xx.c
 index 82d5c20..44a7177 100644
 --- a/drivers/gpio/gpio-vr41xx.c
@@ -32074,7 +32520,7 @@ index 6e0acad..93c8289 100644
  	int front_offset;
  } drm_i810_private_t;
 diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
-index dde8b50..da88e32 100644
+index da21b11..14c8749 100644
 --- a/drivers/gpu/drm/i915/i915_debugfs.c
 +++ b/drivers/gpu/drm/i915/i915_debugfs.c
 @@ -495,7 +495,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
@@ -32100,24 +32546,9 @@ index 61ae104..f8a4bc1 100644
  	return can_switch;
  }
 diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index f511fa2..cebdc1c 100644
+index 92f1750..3beba74 100644
 --- a/drivers/gpu/drm/i915/i915_drv.h
 +++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -274,12 +274,12 @@ struct drm_i915_display_funcs {
- 	/* render clock increase/decrease */
- 	/* display clock increase/decrease */
- 	/* pll clock increase/decrease */
--};
-+} __no_const;
- 
- struct drm_i915_gt_funcs {
- 	void (*force_wake_get)(struct drm_i915_private *dev_priv);
- 	void (*force_wake_put)(struct drm_i915_private *dev_priv);
--};
-+} __no_const;
- 
- #define DEV_INFO_FLAGS \
- 	DEV_INFO_FLAG(is_mobile) DEV_INFO_SEP \
 @@ -430,7 +430,7 @@ typedef struct drm_i915_private {
  
  	struct resource mch_res;
@@ -32127,15 +32558,6 @@ index f511fa2..cebdc1c 100644
  
  	/* protects the irq masks */
  	spinlock_t irq_lock;
-@@ -500,7 +500,7 @@ typedef struct drm_i915_private {
- 	} edp;
- 	bool no_aux_handshake;
- 
--	struct notifier_block lid_notifier;
-+	notifier_block_no_const lid_notifier;
- 
- 	int crt_ddc_pin;
- 	struct drm_i915_fence_reg fence_regs[I915_MAX_NUM_FENCES]; /* assume 965 */
 @@ -1055,7 +1055,7 @@ struct drm_i915_gem_object {
  	 * will be page flipped away on the next vblank.  When it
  	 * reaches 0, dev_priv->pending_flip_queue will be woken up.
@@ -32180,7 +32602,7 @@ index 3eea143..a0b77db 100644
  	for (i = 0; i < count; i++) {
  		char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
 diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index 32e1bda..9b2ca91 100644
+index dc29ace..137d83a 100644
 --- a/drivers/gpu/drm/i915/i915_irq.c
 +++ b/drivers/gpu/drm/i915/i915_irq.c
 @@ -531,7 +531,7 @@ static irqreturn_t valleyview_irq_handler(DRM_IRQ_ARGS)
@@ -32210,7 +32632,7 @@ index 32e1bda..9b2ca91 100644
  
  	/* disable master interrupt before clearing iir  */
  	de_ier = I915_READ(DEIER);
-@@ -1760,7 +1760,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
+@@ -1762,7 +1762,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
  {
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  
@@ -32219,7 +32641,7 @@ index 32e1bda..9b2ca91 100644
  
  	I915_WRITE(HWSTAM, 0xeffe);
  
-@@ -1786,7 +1786,7 @@ static void valleyview_irq_preinstall(struct drm_device *dev)
+@@ -1788,7 +1788,7 @@ static void valleyview_irq_preinstall(struct drm_device *dev)
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  	int pipe;
  
@@ -32228,7 +32650,7 @@ index 32e1bda..9b2ca91 100644
  
  	/* VLV magic */
  	I915_WRITE(VLV_IMR, 0);
-@@ -2091,7 +2091,7 @@ static void i8xx_irq_preinstall(struct drm_device * dev)
+@@ -2093,7 +2093,7 @@ static void i8xx_irq_preinstall(struct drm_device * dev)
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  	int pipe;
  
@@ -32237,7 +32659,7 @@ index 32e1bda..9b2ca91 100644
  
  	for_each_pipe(pipe)
  		I915_WRITE(PIPESTAT(pipe), 0);
-@@ -2142,7 +2142,7 @@ static irqreturn_t i8xx_irq_handler(DRM_IRQ_ARGS)
+@@ -2144,7 +2144,7 @@ static irqreturn_t i8xx_irq_handler(DRM_IRQ_ARGS)
  		I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
  		I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
  
@@ -32246,7 +32668,7 @@ index 32e1bda..9b2ca91 100644
  
  	iir = I915_READ16(IIR);
  	if (iir == 0)
-@@ -2227,7 +2227,7 @@ static void i915_irq_preinstall(struct drm_device * dev)
+@@ -2229,7 +2229,7 @@ static void i915_irq_preinstall(struct drm_device * dev)
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  	int pipe;
  
@@ -32255,7 +32677,7 @@ index 32e1bda..9b2ca91 100644
  
  	if (I915_HAS_HOTPLUG(dev)) {
  		I915_WRITE(PORT_HOTPLUG_EN, 0);
-@@ -2322,7 +2322,7 @@ static irqreturn_t i915_irq_handler(DRM_IRQ_ARGS)
+@@ -2324,7 +2324,7 @@ static irqreturn_t i915_irq_handler(DRM_IRQ_ARGS)
  	};
  	int pipe, ret = IRQ_NONE;
  
@@ -32264,7 +32686,7 @@ index 32e1bda..9b2ca91 100644
  
  	iir = I915_READ(IIR);
  	do {
-@@ -2448,7 +2448,7 @@ static void i965_irq_preinstall(struct drm_device * dev)
+@@ -2450,7 +2450,7 @@ static void i965_irq_preinstall(struct drm_device * dev)
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  	int pipe;
  
@@ -32273,7 +32695,7 @@ index 32e1bda..9b2ca91 100644
  
  	I915_WRITE(PORT_HOTPLUG_EN, 0);
  	I915_WRITE(PORT_HOTPLUG_STAT, I915_READ(PORT_HOTPLUG_STAT));
-@@ -2555,7 +2555,7 @@ static irqreturn_t i965_irq_handler(DRM_IRQ_ARGS)
+@@ -2557,7 +2557,7 @@ static irqreturn_t i965_irq_handler(DRM_IRQ_ARGS)
  	int irq_received;
  	int ret = IRQ_NONE, pipe;
  
@@ -32283,7 +32705,7 @@ index 32e1bda..9b2ca91 100644
  	iir = I915_READ(IIR);
  
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index b426d44..1b9038d 100644
+index 4d3c7c6..eaac87b 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
 @@ -2131,7 +2131,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
@@ -32295,29 +32717,29 @@ index b426d44..1b9038d 100644
  
  	/* Big Hammer, we also need to ensure that any pending
  	 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
-@@ -6236,8 +6236,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
+@@ -6221,8 +6221,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
  
  	obj = work->old_fb_obj;
  
 -	atomic_clear_mask(1 << intel_crtc->plane,
 -			  &obj->pending_flip.counter);
 +	atomic_clear_mask_unchecked(1 << intel_crtc->plane, &obj->pending_flip);
- 
  	wake_up(&dev_priv->pending_flip_queue);
- 	schedule_work(&work->work);
-@@ -6583,7 +6582,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+ 
+ 	queue_work(dev_priv->wq, &work->work);
+@@ -6589,7 +6588,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
  	/* Block clients from rendering to the new back buffer until
  	 * the flip occurs and the object is no longer visible.
  	 */
 -	atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
 +	atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
+ 	atomic_inc(&intel_crtc->unpin_work_count);
  
  	ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
- 	if (ret)
-@@ -6598,7 +6597,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
- 	return 0;
+@@ -6606,7 +6605,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
  
  cleanup_pending:
+ 	atomic_dec(&intel_crtc->unpin_work_count);
 -	atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
 +	atomic_sub_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
  	drm_gem_object_unreference(&work->old_fb_obj->base);
@@ -32406,7 +32828,7 @@ index a101699..a163f0a 100644
  			    struct ttm_buffer_object *,
  			    struct ttm_mem_reg *, struct ttm_mem_reg *);
 diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.h b/drivers/gpu/drm/nouveau/nouveau_fence.h
-index bedafd1..ca5330a 100644
+index cdb83ac..27f0a16 100644
 --- a/drivers/gpu/drm/nouveau/nouveau_fence.h
 +++ b/drivers/gpu/drm/nouveau/nouveau_fence.h
 @@ -43,7 +43,7 @@ struct nouveau_fence_priv {
@@ -32431,19 +32853,6 @@ index 5e2f521..0d21436 100644
  retry:
  	if (++trycnt > 100000) {
  		NV_ERROR(drm, "%s failed and gave up.\n", __func__);
-diff --git a/drivers/gpu/drm/nouveau/nouveau_pm.h b/drivers/gpu/drm/nouveau/nouveau_pm.h
-index 73b789c..ca5aa90 100644
---- a/drivers/gpu/drm/nouveau/nouveau_pm.h
-+++ b/drivers/gpu/drm/nouveau/nouveau_pm.h
-@@ -168,7 +168,7 @@ struct nouveau_pm {
- 	struct nouveau_pm_level *cur;
- 
- 	struct device *hwmon;
--	struct notifier_block acpi_nb;
-+	notifier_block_no_const acpi_nb;
- 
- 	int  (*clocks_get)(struct drm_device *, struct nouveau_pm_level *);
- 	void *(*clocks_pre)(struct drm_device *, struct nouveau_pm_level *);
 diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
 index 6f0ac64..9c2dfb4 100644
 --- a/drivers/gpu/drm/nouveau/nouveau_vga.c
@@ -32594,39 +33003,8 @@ index 5a82b6b..9e69c73 100644
  
  	if (regcomp
  	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
-diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
-index 8c42d54..5b6b963 100644
---- a/drivers/gpu/drm/radeon/radeon.h
-+++ b/drivers/gpu/drm/radeon/radeon.h
-@@ -728,7 +728,7 @@ struct r600_blit_cp_primitives {
- 			     int x2, int y2);
- 	void (*draw_auto)(struct radeon_device *rdev);
- 	void (*set_default_state)(struct radeon_device *rdev);
--};
-+} __no_const;
- 
- struct r600_blit {
- 	struct radeon_bo	*shader_obj;
-@@ -1248,7 +1248,7 @@ struct radeon_asic {
- 		u32 (*page_flip)(struct radeon_device *rdev, int crtc, u64 crtc_base);
- 		void (*post_page_flip)(struct radeon_device *rdev, int crtc);
- 	} pflip;
--};
-+} __no_const;
- 
- /*
-  * Asic structures
-@@ -1590,7 +1590,7 @@ struct radeon_device {
- 	struct mutex dc_hw_i2c_mutex; /* display controller hw i2c mutex */
- 	bool audio_enabled;
- 	struct r600_audio audio_status; /* audio stuff */
--	struct notifier_block acpi_nb;
-+	notifier_block_no_const acpi_nb;
- 	/* only one userspace can use Hyperz features or CMASK at a time */
- 	struct drm_file *hyperz_filp;
- 	struct drm_file *cmask_filp;
 diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index e2f5f88..82f22da 100644
+index ad4c973..aa27bcb 100644
 --- a/drivers/gpu/drm/radeon/radeon_device.c
 +++ b/drivers/gpu/drm/radeon/radeon_device.c
 @@ -940,7 +940,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
@@ -32857,7 +33235,7 @@ index ac98964..5dbf512 100644
  	case VIA_IRQ_ABSOLUTE:
  		break;
 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
-index 88a179e..cf13317 100644
+index 88a179e..57fe50481c 100644
 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
 @@ -263,7 +263,7 @@ struct vmw_private {
@@ -32869,15 +33247,6 @@ index 88a179e..cf13317 100644
  	wait_queue_head_t fence_queue;
  	wait_queue_head_t fifo_queue;
  	int fence_queue_waiters; /* Protected by hw_mutex */
-@@ -306,7 +306,7 @@ struct vmw_private {
- 
- 	struct vmw_master *active_master;
- 	struct vmw_master fbdev_master;
--	struct notifier_block pm_nb;
-+	notifier_block_no_const pm_nb;
- 	bool suspended;
- 
- 	struct mutex release_mutex;
 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
 index 3eb1486..0a47ee9 100644
 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -32954,10 +33323,10 @@ index 8a8725c..afed796 100644
  			marker = list_first_entry(&queue->head,
  						 struct vmw_marker, head);
 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
-index f4109fd..7c62889 100644
+index 52146db..ae33762 100644
 --- a/drivers/hid/hid-core.c
 +++ b/drivers/hid/hid-core.c
-@@ -2200,7 +2200,7 @@ static bool hid_ignore(struct hid_device *hdev)
+@@ -2201,7 +2201,7 @@ static bool hid_ignore(struct hid_device *hdev)
  
  int hid_add_device(struct hid_device *hdev)
  {
@@ -32966,7 +33335,7 @@ index f4109fd..7c62889 100644
  	int ret;
  
  	if (WARN_ON(hdev->status & HID_STAT_ADDED))
-@@ -2235,7 +2235,7 @@ int hid_add_device(struct hid_device *hdev)
+@@ -2236,7 +2236,7 @@ int hid_add_device(struct hid_device *hdev)
  	/* XXX hack, any other cleaner solution after the driver core
  	 * is converted to allow more than 20 bytes as the device name? */
  	dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
@@ -33060,15 +33429,10 @@ index 8e1a9ec..4687821 100644
  	child_device_obj->device.bus = &hv_bus;
  	child_device_obj->device.parent = &hv_acpi_dev->dev;
 diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
-index 07a0c1a..9fa531f 100644
+index 07a0c1a..0cac334 100644
 --- a/drivers/hwmon/sht15.c
 +++ b/drivers/hwmon/sht15.c
-@@ -165,11 +165,11 @@ struct sht15_data {
- 	struct device			*dev;
- 	struct device			*hwmon_dev;
- 	struct regulator		*reg;
--	struct notifier_block		nb;
-+	notifier_block_no_const		nb;
+@@ -169,7 +169,7 @@ struct sht15_data {
  	int				supply_uV;
  	bool				supply_uV_valid;
  	struct work_struct		update_supply_work;
@@ -33142,19 +33506,6 @@ index 29015eb..af2d8e9 100644
  
  /* Wrapper access functions for multiplexed SMBus */
  static DEFINE_MUTEX(nforce2_lock);
-diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
-index d94e0ce..7055125 100644
---- a/drivers/i2c/i2c-mux.c
-+++ b/drivers/i2c/i2c-mux.c
-@@ -30,7 +30,7 @@
- /* multiplexer per channel data */
- struct i2c_mux_priv {
- 	struct i2c_adapter adap;
--	struct i2c_algorithm algo;
-+	i2c_algorithm_no_const algo;
- 
- 	struct i2c_adapter *parent;
- 	void *mux_priv;	/* the mux chip/device */
 diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
 index 8126824..55a2798 100644
 --- a/drivers/ide/ide-cd.c
@@ -33458,19 +33809,6 @@ index 1f95bba..9530f87 100644
  			(u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
  				      sdata, wqe->wr.wr.atomic.swap);
  		goto send_comp;
-diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
-index e04cbc9..8c247a7 100644
---- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
-+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
-@@ -416,7 +416,7 @@ struct mlx4_ib_sriov {
- struct mlx4_ib_iboe {
- 	spinlock_t		lock;
- 	struct net_device      *netdevs[MLX4_MAX_PORTS];
--	struct notifier_block 	nb;
-+	notifier_block_no_const nb;
- 	union ib_gid		gid_table[MLX4_MAX_PORTS][128];
- };
- 
 diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
 index 748db2d..5f75cc3 100644
 --- a/drivers/infiniband/hw/nes/nes.c
@@ -33494,7 +33832,7 @@ index 748db2d..5f75cc3 100644
  	/* Free the control structures */
  
 diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
-index 5cac29e..c471744 100644
+index 33cc589..3bd6538 100644
 --- a/drivers/infiniband/hw/nes/nes.h
 +++ b/drivers/infiniband/hw/nes/nes.h
 @@ -177,17 +177,17 @@ extern unsigned int nes_debug_level;
@@ -33850,7 +34188,7 @@ index 0564be7..f68b0f1 100644
  
  /**
 diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
-index cd0ecb2..7099ff0 100644
+index 07e4fba..685f041 100644
 --- a/drivers/infiniband/hw/nes/nes_verbs.c
 +++ b/drivers/infiniband/hw/nes/nes_verbs.c
 @@ -46,9 +46,9 @@
@@ -33875,7 +34213,7 @@ index cd0ecb2..7099ff0 100644
  	switch (init_attr->qp_type) {
  		case IB_QPT_RC:
  			if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
-@@ -1460,7 +1460,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
+@@ -1462,7 +1462,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
  	struct iw_cm_event cm_event;
  	int ret = 0;
  
@@ -33973,19 +34311,6 @@ index 83811e4..0822b90 100644
  
  	snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
  	led->xpad = xpad;
-diff --git a/drivers/input/keyboard/adp5520-keys.c b/drivers/input/keyboard/adp5520-keys.c
-index e9e8674..f098622 100644
---- a/drivers/input/keyboard/adp5520-keys.c
-+++ b/drivers/input/keyboard/adp5520-keys.c
-@@ -16,7 +16,7 @@
- 
- struct adp5520_keys {
- 	struct input_dev *input;
--	struct notifier_block notifier;
-+	notifier_block_no_const notifier;
- 	struct device *master;
- 	unsigned short keycode[ADP5520_KEYMAPSIZE];
- };
 diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
 index 4c842c3..590b0bf 100644
 --- a/drivers/input/mousedev.c
@@ -34021,19 +34346,41 @@ index d0f7533..fb8215b 100644
  	serio->dev.bus = &serio_bus;
  	serio->dev.release = serio_release_port;
  	serio->dev.groups = serio_device_attr_groups;
-diff --git a/drivers/input/touchscreen/da9034-ts.c b/drivers/input/touchscreen/da9034-ts.c
-index 36b65cf..6fbd367 100644
---- a/drivers/input/touchscreen/da9034-ts.c
-+++ b/drivers/input/touchscreen/da9034-ts.c
-@@ -55,7 +55,7 @@ struct da9034_touch {
- 	struct input_dev	*input_dev;
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 81837b0..d7470e8 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -1888,7 +1888,7 @@ static int __init state_next(void)
+ 	case IOMMU_ACPI_FINISHED:
+ 		early_enable_iommus();
+ 		register_syscore_ops(&amd_iommu_syscore_ops);
+-		x86_platform.iommu_shutdown = disable_iommus;
++		*(void **)&x86_platform.iommu_shutdown = disable_iommus;
+ 		init_state = IOMMU_ENABLED;
+ 		break;
+ 	case IOMMU_ENABLED:
+@@ -2030,7 +2030,7 @@ int __init amd_iommu_detect(void)
  
- 	struct delayed_work	tsi_work;
--	struct notifier_block	notifier;
-+	notifier_block_no_const	notifier;
+ 	amd_iommu_detected = true;
+ 	iommu_detected = 1;
+-	x86_init.iommu.iommu_init = amd_iommu_init;
++	*(void **)&x86_init.iommu.iommu_init = amd_iommu_init;
  
- 	int	state;
+ 	return 0;
+ }
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 86e2f4a..d1cec5d 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -555,7 +555,7 @@ int __init detect_intel_iommu(void)
  
+ #ifdef CONFIG_X86
+ 		if (ret)
+-			x86_init.iommu.iommu_init = intel_iommu_init;
++			*(void **)&x86_init.iommu.iommu_init = intel_iommu_init;
+ #endif
+ 	}
+ 	early_acpi_os_unmap_memory(dmar_tbl, dmar_tbl_size);
 diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
 index c679867..6e2e34d 100644
 --- a/drivers/isdn/capi/capi.c
@@ -34125,32 +34472,6 @@ index 821f7ac..28d4030 100644
  				return -EFAULT;
  		} else {
  			memcpy(buf, dp, left);
-diff --git a/drivers/isdn/hardware/eicon/divasync.h b/drivers/isdn/hardware/eicon/divasync.h
-index dd6b53a..19d9ee6 100644
---- a/drivers/isdn/hardware/eicon/divasync.h
-+++ b/drivers/isdn/hardware/eicon/divasync.h
-@@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
- } diva_didd_add_adapter_t;
- typedef struct _diva_didd_remove_adapter {
- 	IDI_CALL p_request;
--} diva_didd_remove_adapter_t;
-+} __no_const diva_didd_remove_adapter_t;
- typedef struct _diva_didd_read_adapter_array {
- 	void *buffer;
- 	dword length;
-diff --git a/drivers/isdn/hardware/eicon/xdi_adapter.h b/drivers/isdn/hardware/eicon/xdi_adapter.h
-index d303e65..28bcb7b 100644
---- a/drivers/isdn/hardware/eicon/xdi_adapter.h
-+++ b/drivers/isdn/hardware/eicon/xdi_adapter.h
-@@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
- typedef struct _diva_os_idi_adapter_interface {
- 	diva_init_card_proc_t cleanup_adapter_proc;
- 	diva_cmd_card_proc_t cmd_proc;
--} diva_os_idi_adapter_interface_t;
-+} __no_const diva_os_idi_adapter_interface_t;
- 
- typedef struct _diva_os_xdi_adapter {
- 	struct list_head link;
 diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
 index b817809..409caff 100644
 --- a/drivers/isdn/i4l/isdn_tty.c
@@ -34229,19 +34550,6 @@ index e74df7c..03a03ba 100644
  				return -EFAULT;
  		} else
  			memcpy(msg, buf, count);
-diff --git a/drivers/leds/ledtrig-backlight.c b/drivers/leds/ledtrig-backlight.c
-index b941685..f7e816b 100644
---- a/drivers/leds/ledtrig-backlight.c
-+++ b/drivers/leds/ledtrig-backlight.c
-@@ -25,7 +25,7 @@ struct bl_trig_notifier {
- 	struct led_classdev *led;
- 	int brightness;
- 	int old_status;
--	struct notifier_block notifier;
-+	notifier_block_no_const notifier;
- 	unsigned invert;
- };
- 
 diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
 index b5fdcb7..5b6c59f 100644
 --- a/drivers/lguest/core.c
@@ -34394,10 +34702,10 @@ index 7155945..4bcc562 100644
  
  	seq_printf(seq, "\n");
 diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
-index afd9598..528d8f9 100644
+index a651d52..82f8a95 100644
 --- a/drivers/md/dm-ioctl.c
 +++ b/drivers/md/dm-ioctl.c
-@@ -1593,7 +1593,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
+@@ -1601,7 +1601,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
  	    cmd == DM_LIST_VERSIONS_CMD)
  		return 0;
  
@@ -34525,7 +34833,7 @@ index e2f87653..f279abe 100644
  				schedule_work(&sc->trigger_event);
  		}
 diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
-index 100368e..64262ce 100644
+index fa29557..d24a5b7 100644
 --- a/drivers/md/dm-table.c
 +++ b/drivers/md/dm-table.c
 @@ -390,7 +390,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
@@ -34755,32 +35063,6 @@ index af443ab..0f93be3 100644
  }
  
  struct md_personality
-diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
-index f6d29e6..7917f5e 100644
---- a/drivers/md/persistent-data/dm-space-map-disk.c
-+++ b/drivers/md/persistent-data/dm-space-map-disk.c
-@@ -22,7 +22,7 @@
-  * Space map interface.
-  */
- struct sm_disk {
--	struct dm_space_map sm;
-+	dm_space_map_no_const sm;
- 
- 	struct ll_disk ll;
- 	struct ll_disk old_ll;
-diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
-index e89ae5e..062e4c2 100644
---- a/drivers/md/persistent-data/dm-space-map-metadata.c
-+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
-@@ -43,7 +43,7 @@ struct block_op {
- };
- 
- struct sm_metadata {
--	struct dm_space_map sm;
-+	dm_space_map_no_const sm;
- 
- 	struct ll_disk ll;
- 	struct ll_disk old_ll;
 diff --git a/drivers/md/persistent-data/dm-space-map.h b/drivers/md/persistent-data/dm-space-map.h
 index 1cbfc6b..56e1dbb 100644
 --- a/drivers/md/persistent-data/dm-space-map.h
@@ -34917,32 +35199,6 @@ index a450268..c4168a9 100644
  			 > conf->max_nr_stripes)
  			printk(KERN_WARNING
  			       "md/raid:%s: Too many read errors, failing device %s.\n",
-diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
-index 18b2c4a..3d7d59f 100644
---- a/drivers/md/raid5.h
-+++ b/drivers/md/raid5.h
-@@ -439,7 +439,7 @@ struct r5conf {
- 					       * cpu hotplug while reshaping
- 					       */
- #ifdef CONFIG_HOTPLUG_CPU
--	struct notifier_block	cpu_notify;
-+	notifier_block_no_const	cpu_notify;
- #endif
- 
- 	/*
-diff --git a/drivers/media/dvb-core/dvb_demux.h b/drivers/media/dvb-core/dvb_demux.h
-index fa7188a..04a045e 100644
---- a/drivers/media/dvb-core/dvb_demux.h
-+++ b/drivers/media/dvb-core/dvb_demux.h
-@@ -73,7 +73,7 @@ struct dvb_demux_feed {
- 	union {
- 		dmx_ts_cb ts;
- 		dmx_section_cb sec;
--	} cb;
-+	} __no_const cb;
- 
- 	struct dvb_demux *demux;
- 	void *priv;
 diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
 index d33101a..6b13069 100644
 --- a/drivers/media/dvb-core/dvbdev.c
@@ -35045,7 +35301,7 @@ index a3b1a34..71ce0e3 100644
  
  	videobuf_queue_dma_contig_init(q, &video_vbq_ops, q->dev,
 diff --git a/drivers/media/platform/timblogiw.c b/drivers/media/platform/timblogiw.c
-index 02194c0..091733b 100644
+index 02194c0..36d69c1 100644
 --- a/drivers/media/platform/timblogiw.c
 +++ b/drivers/media/platform/timblogiw.c
 @@ -745,7 +745,7 @@ static int timblogiw_mmap(struct file *file, struct vm_area_struct *vma)
@@ -35053,7 +35309,7 @@ index 02194c0..091733b 100644
  /* Platform device functions */
  
 -static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
-+static __devinitconst v4l2_ioctl_ops_no_const timblogiw_ioctl_ops = {
++static struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
  	.vidioc_querycap		= timblogiw_querycap,
  	.vidioc_enum_fmt_vid_cap	= timblogiw_enum_fmt,
  	.vidioc_g_fmt_vid_cap		= timblogiw_g_fmt,
@@ -35062,7 +35318,7 @@ index 02194c0..091733b 100644
  };
  
 -static __devinitconst struct v4l2_file_operations timblogiw_fops = {
-+static __devinitconst v4l2_file_operations_no_const timblogiw_fops = {
++static struct v4l2_file_operations timblogiw_fops = {
  	.owner		= THIS_MODULE,
  	.open		= timblogiw_open,
  	.release	= timblogiw_close,
@@ -35088,32 +35344,6 @@ index 697a421..16c5a5f 100644
  		i = -EFAULT;
  unlock:
  	mutex_unlock(&dev->lock);
-diff --git a/drivers/media/radio/radio-tea5777.h b/drivers/media/radio/radio-tea5777.h
-index 4ea43a9..66f4a8f 100644
---- a/drivers/media/radio/radio-tea5777.h
-+++ b/drivers/media/radio/radio-tea5777.h
-@@ -63,7 +63,7 @@ struct radio_tea5777_ops {
- 
- struct radio_tea5777 {
- 	struct v4l2_device *v4l2_dev;
--	struct v4l2_file_operations fops;
-+	v4l2_file_operations_no_const fops;
- 	struct video_device vd;		/* video device */
- 	bool has_am;			/* Device can tune to AM freqs */
- 	bool write_before_read;		/* must write before read quirk */
-diff --git a/drivers/media/usb/au0828/au0828.h b/drivers/media/usb/au0828/au0828.h
-index 66a56ef..d139911 100644
---- a/drivers/media/usb/au0828/au0828.h
-+++ b/drivers/media/usb/au0828/au0828.h
-@@ -191,7 +191,7 @@ struct au0828_dev {
- 
- 	/* I2C */
- 	struct i2c_adapter		i2c_adap;
--	struct i2c_algorithm		i2c_algo;
-+	i2c_algorithm_no_const		i2c_algo;
- 	struct i2c_client		i2c_client;
- 	u32 				i2c_rc;
- 
 diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
 index 3940bb0..fb3952a 100644
 --- a/drivers/media/usb/dvb-usb/cxusb.c
@@ -35140,19 +35370,6 @@ index 9382895..ac8093c 100644
  
  /* debug */
  static int dvb_usb_dw2102_debug;
-diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw-internal.h b/drivers/media/usb/pvrusb2/pvrusb2-hdw-internal.h
-index 036952f..80d356d 100644
---- a/drivers/media/usb/pvrusb2/pvrusb2-hdw-internal.h
-+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw-internal.h
-@@ -196,7 +196,7 @@ struct pvr2_hdw {
- 
- 	/* I2C stuff */
- 	struct i2c_adapter i2c_adap;
--	struct i2c_algorithm i2c_algo;
-+	i2c_algorithm_no_const i2c_algo;
- 	pvr2_i2c_func i2c_func[PVR2_I2C_FUNC_CNT];
- 	int i2c_cx25840_hack_state;
- 	int i2c_linked;
 diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
 index fb69baa..cf7ad22 100644
 --- a/drivers/message/fusion/mptbase.c
@@ -35411,19 +35628,6 @@ index a8c08f3..155fe3d 100644
  	INIT_LIST_HEAD(&c->context_list);
  #endif
  
-diff --git a/drivers/mfd/abx500-core.c b/drivers/mfd/abx500-core.c
-index 7ce65f4..e66e9bc 100644
---- a/drivers/mfd/abx500-core.c
-+++ b/drivers/mfd/abx500-core.c
-@@ -15,7 +15,7 @@ static LIST_HEAD(abx500_list);
- 
- struct abx500_device_entry {
- 	struct list_head list;
--	struct abx500_ops ops;
-+	abx500_ops_no_const ops;
- 	struct device *dev;
- };
- 
 diff --git a/drivers/mfd/janz-cmodio.c b/drivers/mfd/janz-cmodio.c
 index 965c480..71f2db9 100644
 --- a/drivers/mfd/janz-cmodio.c
@@ -35769,10 +35973,10 @@ index b94d5f7..7f494c5 100644
  extern int xpc_disengage_timedout;
  extern int xpc_activate_IRQ_rcvd;
 diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
-index 8d082b4..aa749ae 100644
+index d971817..3805cce 100644
 --- a/drivers/misc/sgi-xp/xpc_main.c
 +++ b/drivers/misc/sgi-xp/xpc_main.c
-@@ -162,7 +162,7 @@ static struct notifier_block xpc_die_notifier = {
+@@ -166,7 +166,7 @@ static struct notifier_block xpc_die_notifier = {
  	.notifier_call = xpc_system_die,
  };
  
@@ -35859,19 +36063,58 @@ index 203ff9d..0968ca8 100644
  	}
  
  	if (!request_mem_region(mem->start, mem_size, pdev->name)) {
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+index 9c5ea6c..eaad276 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+@@ -1046,7 +1046,7 @@ static inline u8 bnx2x_get_path_func_num(struct bnx2x *bp)
+ static inline void bnx2x_init_bp_objs(struct bnx2x *bp)
+ {
+ 	/* RX_MODE controlling object */
+-	bnx2x_init_rx_mode_obj(bp, &bp->rx_mode_obj);
++	bnx2x_init_rx_mode_obj(bp);
+ 
+ 	/* multicast configuration controlling object */
+ 	bnx2x_init_mcast_obj(bp, &bp->mcast_obj, bp->fp->cl_id, bp->fp->cid,
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+index 614981c..11216c7 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+@@ -2375,15 +2375,14 @@ int bnx2x_config_rx_mode(struct bnx2x *bp,
+ 	return rc;
+ }
+ 
+-void bnx2x_init_rx_mode_obj(struct bnx2x *bp,
+-			    struct bnx2x_rx_mode_obj *o)
++void bnx2x_init_rx_mode_obj(struct bnx2x *bp)
+ {
+ 	if (CHIP_IS_E1x(bp)) {
+-		o->wait_comp      = bnx2x_empty_rx_mode_wait;
+-		o->config_rx_mode = bnx2x_set_rx_mode_e1x;
++		bp->rx_mode_obj.wait_comp      = bnx2x_empty_rx_mode_wait;
++		bp->rx_mode_obj.config_rx_mode = bnx2x_set_rx_mode_e1x;
+ 	} else {
+-		o->wait_comp      = bnx2x_wait_rx_mode_comp_e2;
+-		o->config_rx_mode = bnx2x_set_rx_mode_e2;
++		bp->rx_mode_obj.wait_comp      = bnx2x_wait_rx_mode_comp_e2;
++		bp->rx_mode_obj.config_rx_mode = bnx2x_set_rx_mode_e2;
+ 	}
+ }
+ 
 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
-index acf2fe4..25cf8fd 100644
+index acf2fe4..efb96df 100644
 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
-@@ -486,7 +486,7 @@ struct bnx2x_rx_mode_obj {
+@@ -1281,8 +1281,7 @@ int bnx2x_vlan_mac_move(struct bnx2x *bp,
  
- 	int (*wait_comp)(struct bnx2x *bp,
- 			 struct bnx2x_rx_mode_ramrod_params *p);
--};
-+} __no_const;
+ /********************* RX MODE ****************/
  
- /********************** Set multicast group ***********************************/
+-void bnx2x_init_rx_mode_obj(struct bnx2x *bp,
+-			    struct bnx2x_rx_mode_obj *o);
++void bnx2x_init_rx_mode_obj(struct bnx2x *bp);
  
+ /**
+  * bnx2x_config_rx_mode - Send and RX_MODE ramrod according to the provided parameters.
 diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
 index d9308c32..d87b824 100644
 --- a/drivers/net/ethernet/broadcom/tg3.h
@@ -35919,19 +36162,6 @@ index f879e92..726f20f 100644
  		return -EFAULT;
  	break;
      }
-diff --git a/drivers/net/ethernet/dec/tulip/uli526x.c b/drivers/net/ethernet/dec/tulip/uli526x.c
-index 75d45f8..3d9c55b 100644
---- a/drivers/net/ethernet/dec/tulip/uli526x.c
-+++ b/drivers/net/ethernet/dec/tulip/uli526x.c
-@@ -129,7 +129,7 @@ struct uli526x_board_info {
- 	struct uli_phy_ops {
- 		void (*write)(struct uli526x_board_info *, u8, u8, u16);
- 		u16 (*read)(struct uli526x_board_info *, u8, u8);
--	} phy;
-+	} __no_const phy;
- 	struct net_device *next_dev;	/* next device */
- 	struct pci_dev *pdev;		/* PCI device */
- 	spinlock_t lock;
 diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
 index d1b6cc5..cde0d97 100644
 --- a/drivers/net/ethernet/emulex/benet/be_main.c
@@ -35971,161 +36201,6 @@ index b901a01..1ff32ee 100644
  
  #include "ftmac100.h"
  
-diff --git a/drivers/net/ethernet/intel/e1000e/hw.h b/drivers/net/ethernet/intel/e1000e/hw.h
-index d37bfd9..5e13032 100644
---- a/drivers/net/ethernet/intel/e1000e/hw.h
-+++ b/drivers/net/ethernet/intel/e1000e/hw.h
-@@ -799,6 +799,7 @@ struct e1000_mac_operations {
- 	void (*rar_set)(struct e1000_hw *, u8 *, u32);
- 	s32  (*read_mac_addr)(struct e1000_hw *);
- };
-+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
- 
- /*
-  * When to use various PHY register access functions:
-@@ -839,6 +840,7 @@ struct e1000_phy_operations {
- 	void (*power_up)(struct e1000_hw *);
- 	void (*power_down)(struct e1000_hw *);
- };
-+typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
- 
- /* Function pointers for the NVM. */
- struct e1000_nvm_operations {
-@@ -851,9 +853,10 @@ struct e1000_nvm_operations {
- 	s32  (*validate)(struct e1000_hw *);
- 	s32  (*write)(struct e1000_hw *, u16, u16, u16 *);
- };
-+typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
- 
- struct e1000_mac_info {
--	struct e1000_mac_operations ops;
-+	e1000_mac_operations_no_const ops;
- 	u8 addr[ETH_ALEN];
- 	u8 perm_addr[ETH_ALEN];
- 
-@@ -894,7 +897,7 @@ struct e1000_mac_info {
- };
- 
- struct e1000_phy_info {
--	struct e1000_phy_operations ops;
-+	e1000_phy_operations_no_const ops;
- 
- 	enum e1000_phy_type type;
- 
-@@ -928,7 +931,7 @@ struct e1000_phy_info {
- };
- 
- struct e1000_nvm_info {
--	struct e1000_nvm_operations ops;
-+	e1000_nvm_operations_no_const ops;
- 
- 	enum e1000_nvm_type type;
- 	enum e1000_nvm_override override;
-diff --git a/drivers/net/ethernet/intel/igb/e1000_hw.h b/drivers/net/ethernet/intel/igb/e1000_hw.h
-index c2a51dc..c2bd262 100644
---- a/drivers/net/ethernet/intel/igb/e1000_hw.h
-+++ b/drivers/net/ethernet/intel/igb/e1000_hw.h
-@@ -327,6 +327,7 @@ struct e1000_mac_operations {
- 	void (*release_swfw_sync)(struct e1000_hw *, u16);
- 
- };
-+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
- 
- struct e1000_phy_operations {
- 	s32  (*acquire)(struct e1000_hw *);
-@@ -343,6 +344,7 @@ struct e1000_phy_operations {
- 	s32  (*set_d3_lplu_state)(struct e1000_hw *, bool);
- 	s32  (*write_reg)(struct e1000_hw *, u32, u16);
- };
-+typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
- 
- struct e1000_nvm_operations {
- 	s32  (*acquire)(struct e1000_hw *);
-@@ -353,6 +355,7 @@ struct e1000_nvm_operations {
- 	s32  (*validate)(struct e1000_hw *);
- 	s32  (*valid_led_default)(struct e1000_hw *, u16 *);
- };
-+typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
- 
- struct e1000_info {
- 	s32 (*get_invariants)(struct e1000_hw *);
-@@ -364,7 +367,7 @@ struct e1000_info {
- extern const struct e1000_info e1000_82575_info;
- 
- struct e1000_mac_info {
--	struct e1000_mac_operations ops;
-+	e1000_mac_operations_no_const ops;
- 
- 	u8 addr[6];
- 	u8 perm_addr[6];
-@@ -402,7 +405,7 @@ struct e1000_mac_info {
- };
- 
- struct e1000_phy_info {
--	struct e1000_phy_operations ops;
-+	e1000_phy_operations_no_const ops;
- 
- 	enum e1000_phy_type type;
- 
-@@ -437,7 +440,7 @@ struct e1000_phy_info {
- };
- 
- struct e1000_nvm_info {
--	struct e1000_nvm_operations ops;
-+	e1000_nvm_operations_no_const ops;
- 	enum e1000_nvm_type type;
- 	enum e1000_nvm_override override;
- 
-@@ -482,6 +485,7 @@ struct e1000_mbx_operations {
- 	s32 (*check_for_ack)(struct e1000_hw *, u16);
- 	s32 (*check_for_rst)(struct e1000_hw *, u16);
- };
-+typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
- 
- struct e1000_mbx_stats {
- 	u32 msgs_tx;
-@@ -493,7 +497,7 @@ struct e1000_mbx_stats {
- };
- 
- struct e1000_mbx_info {
--	struct e1000_mbx_operations ops;
-+	e1000_mbx_operations_no_const ops;
- 	struct e1000_mbx_stats stats;
- 	u32 timeout;
- 	u32 usec_delay;
-diff --git a/drivers/net/ethernet/intel/igbvf/vf.h b/drivers/net/ethernet/intel/igbvf/vf.h
-index 57db3c6..aa825fc 100644
---- a/drivers/net/ethernet/intel/igbvf/vf.h
-+++ b/drivers/net/ethernet/intel/igbvf/vf.h
-@@ -189,9 +189,10 @@ struct e1000_mac_operations {
- 	s32  (*read_mac_addr)(struct e1000_hw *);
- 	s32  (*set_vfta)(struct e1000_hw *, u16, bool);
- };
-+typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
- 
- struct e1000_mac_info {
--	struct e1000_mac_operations ops;
-+	e1000_mac_operations_no_const ops;
- 	u8 addr[6];
- 	u8 perm_addr[6];
- 
-@@ -213,6 +214,7 @@ struct e1000_mbx_operations {
- 	s32 (*check_for_ack)(struct e1000_hw *);
- 	s32 (*check_for_rst)(struct e1000_hw *);
- };
-+typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
- 
- struct e1000_mbx_stats {
- 	u32 msgs_tx;
-@@ -224,7 +226,7 @@ struct e1000_mbx_stats {
- };
- 
- struct e1000_mbx_info {
--	struct e1000_mbx_operations ops;
-+	e1000_mbx_operations_no_const ops;
- 	struct e1000_mbx_stats stats;
- 	u32 timeout;
- 	u32 usec_delay;
 diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
 index d929131..aed108f 100644
 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
@@ -36139,137 +36214,31 @@ index d929131..aed108f 100644
  	smp_mb();
  
  	/* grab the ptp lock */
-diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
-index 0722f33..771758a 100644
---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
-+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
-@@ -2800,6 +2800,7 @@ struct ixgbe_eeprom_operations {
- 	s32 (*update_checksum)(struct ixgbe_hw *);
- 	u16 (*calc_checksum)(struct ixgbe_hw *);
- };
-+typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
- 
- struct ixgbe_mac_operations {
- 	s32 (*init_hw)(struct ixgbe_hw *);
-@@ -2866,6 +2867,7 @@ struct ixgbe_mac_operations {
- 	s32 (*get_thermal_sensor_data)(struct ixgbe_hw *);
- 	s32 (*init_thermal_sensor_thresh)(struct ixgbe_hw *hw);
- };
-+typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
- 
- struct ixgbe_phy_operations {
- 	s32 (*identify)(struct ixgbe_hw *);
-@@ -2885,9 +2887,10 @@ struct ixgbe_phy_operations {
- 	s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
- 	s32 (*check_overtemp)(struct ixgbe_hw *);
- };
-+typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
- 
- struct ixgbe_eeprom_info {
--	struct ixgbe_eeprom_operations  ops;
-+	ixgbe_eeprom_operations_no_const ops;
- 	enum ixgbe_eeprom_type          type;
- 	u32                             semaphore_delay;
- 	u16                             word_size;
-@@ -2897,7 +2900,7 @@ struct ixgbe_eeprom_info {
- 
- #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED	0x01
- struct ixgbe_mac_info {
--	struct ixgbe_mac_operations     ops;
-+	ixgbe_mac_operations_no_const   ops;
- 	enum ixgbe_mac_type             type;
- 	u8                              addr[ETH_ALEN];
- 	u8                              perm_addr[ETH_ALEN];
-@@ -2927,7 +2930,7 @@ struct ixgbe_mac_info {
- };
- 
- struct ixgbe_phy_info {
--	struct ixgbe_phy_operations     ops;
-+	ixgbe_phy_operations_no_const   ops;
- 	struct mdio_if_info		mdio;
- 	enum ixgbe_phy_type             type;
- 	u32                             id;
-@@ -2955,6 +2958,7 @@ struct ixgbe_mbx_operations {
- 	s32 (*check_for_ack)(struct ixgbe_hw *, u16);
- 	s32 (*check_for_rst)(struct ixgbe_hw *, u16);
- };
-+typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
- 
- struct ixgbe_mbx_stats {
- 	u32 msgs_tx;
-@@ -2966,7 +2970,7 @@ struct ixgbe_mbx_stats {
- };
- 
- struct ixgbe_mbx_info {
--	struct ixgbe_mbx_operations ops;
-+	ixgbe_mbx_operations_no_const ops;
- 	struct ixgbe_mbx_stats stats;
- 	u32 timeout;
- 	u32 usec_delay;
-diff --git a/drivers/net/ethernet/intel/ixgbevf/vf.h b/drivers/net/ethernet/intel/ixgbevf/vf.h
-index 47f11a5..c817d97 100644
---- a/drivers/net/ethernet/intel/ixgbevf/vf.h
-+++ b/drivers/net/ethernet/intel/ixgbevf/vf.h
-@@ -70,6 +70,7 @@ struct ixgbe_mac_operations {
- 	s32 (*clear_vfta)(struct ixgbe_hw *);
- 	s32 (*set_vfta)(struct ixgbe_hw *, u32, u32, bool);
- };
-+typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
- 
- enum ixgbe_mac_type {
- 	ixgbe_mac_unknown = 0,
-@@ -79,7 +80,7 @@ enum ixgbe_mac_type {
- };
- 
- struct ixgbe_mac_info {
--	struct ixgbe_mac_operations ops;
-+	ixgbe_mac_operations_no_const ops;
- 	u8 addr[6];
- 	u8 perm_addr[6];
- 
-@@ -103,6 +104,7 @@ struct ixgbe_mbx_operations {
- 	s32 (*check_for_ack)(struct ixgbe_hw *);
- 	s32 (*check_for_rst)(struct ixgbe_hw *);
- };
-+typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
- 
- struct ixgbe_mbx_stats {
- 	u32 msgs_tx;
-@@ -114,7 +116,7 @@ struct ixgbe_mbx_stats {
- };
- 
- struct ixgbe_mbx_info {
--	struct ixgbe_mbx_operations ops;
-+	ixgbe_mbx_operations_no_const ops;
- 	struct ixgbe_mbx_stats stats;
- 	u32 timeout;
- 	u32 udelay;
-diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.h b/drivers/net/ethernet/neterion/vxge/vxge-config.h
-index 9e0c1ee..8471f77 100644
---- a/drivers/net/ethernet/neterion/vxge/vxge-config.h
-+++ b/drivers/net/ethernet/neterion/vxge/vxge-config.h
-@@ -514,7 +514,7 @@ struct vxge_hw_uld_cbs {
- 	void (*link_down)(struct __vxge_hw_device *devh);
- 	void (*crit_err)(struct __vxge_hw_device *devh,
- 			enum vxge_hw_event type, u64 ext_data);
--};
-+} __no_const;
+diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
+index c2e420a..26a75e0 100644
+--- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
++++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
+@@ -3461,7 +3461,10 @@ __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
+ 	struct __vxge_hw_fifo *fifo;
+ 	struct vxge_hw_fifo_config *config;
+ 	u32 txdl_size, txdl_per_memblock;
+-	struct vxge_hw_mempool_cbs fifo_mp_callback;
++	static struct vxge_hw_mempool_cbs fifo_mp_callback = {
++		.item_func_alloc = __vxge_hw_fifo_mempool_item_alloc,
++	};
++
+ 	struct __vxge_hw_virtualpath *vpath;
  
- /*
-  * struct __vxge_hw_blockpool_entry - Block private data structure
-diff --git a/drivers/net/ethernet/neterion/vxge/vxge-traffic.h b/drivers/net/ethernet/neterion/vxge/vxge-traffic.h
-index 4a518a3..936b334 100644
---- a/drivers/net/ethernet/neterion/vxge/vxge-traffic.h
-+++ b/drivers/net/ethernet/neterion/vxge/vxge-traffic.h
-@@ -2088,7 +2088,7 @@ struct vxge_hw_mempool_cbs {
- 			struct vxge_hw_mempool_dma	*dma_object,
- 			u32			index,
- 			u32			is_last);
--};
-+} __no_const;
+ 	if ((vp == NULL) || (attr == NULL)) {
+@@ -3544,8 +3547,6 @@ __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
+ 		goto exit;
+ 	}
  
- #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath)				\
- 		((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next)
+-	fifo_mp_callback.item_func_alloc = __vxge_hw_fifo_mempool_item_alloc;
+-
+ 	fifo->mempool =
+ 		__vxge_hw_mempool_create(vpath->hldev,
+ 			fifo->config->memblock_size,
 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
 index 927aa33..a6c2518 100644
 --- a/drivers/net/ethernet/realtek/r8169.c
@@ -36551,31 +36520,6 @@ index 605a4ba..a883dd1 100644
  				result =
  				    hso_start_serial_device(serial_table[i], GFP_NOIO);
  				hso_kick_transmit(dev2ser(serial_table[i]));
-diff --git a/drivers/net/wimax/i2400m/i2400m.h b/drivers/net/wimax/i2400m/i2400m.h
-index 79c6505..3d957fd 100644
---- a/drivers/net/wimax/i2400m/i2400m.h
-+++ b/drivers/net/wimax/i2400m/i2400m.h
-@@ -643,7 +643,7 @@ struct i2400m {
- 	struct i2400m_fw *fw_cached;	/* protected by rx_lock */
- 	struct i2400m_barker_db *barker;
- 
--	struct notifier_block pm_notifier;
-+	notifier_block_no_const pm_notifier;
- 
- 	/* counting bus reset retries in this boot */
- 	atomic_t bus_reset_retries;
-diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
-index 4521342..9f0a994d 100644
---- a/drivers/net/wireless/ath/ath.h
-+++ b/drivers/net/wireless/ath/ath.h
-@@ -119,6 +119,7 @@ struct ath_ops {
- 	void (*write_flush) (void *);
- 	u32 (*rmw)(void *, u32 reg_offset, u32 set, u32 clr);
- };
-+typedef struct ath_ops __no_const ath_ops_no_const;
- 
- struct ath_common;
- struct ath_bus_ops;
 diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
 index 8d78253..bebbb68 100644
 --- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
@@ -36782,7 +36726,7 @@ index 301bf72..3f5654f 100644
  
  static u16 ar9003_calc_ptr_chksum(struct ar9003_txc *ads)
 diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
-index dbc1b7a..addccc0 100644
+index dbc1b7a..67e2ca2 100644
 --- a/drivers/net/wireless/ath/ath9k/hw.h
 +++ b/drivers/net/wireless/ath/ath9k/hw.h
 @@ -657,7 +657,7 @@ struct ath_hw_private_ops {
@@ -36803,28 +36747,28 @@ index dbc1b7a..addccc0 100644
  
  struct ath_nf_limits {
  	s16 max;
-@@ -707,7 +707,7 @@ enum ath_cal_list {
- #define AH_FASTCC       0x4
- 
- struct ath_hw {
--	struct ath_ops reg_ops;
-+	ath_ops_no_const reg_ops;
- 
- 	struct ieee80211_hw *hw;
- 	struct ath_common common;
-diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
-index af00e2c..ab04d34 100644
---- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
-@@ -545,7 +545,7 @@ struct phy_func_ptr {
- 	void (*carrsuppr)(struct brcms_phy *);
- 	s32 (*rxsigpwr)(struct brcms_phy *, s32);
- 	void (*detach)(struct brcms_phy *);
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+index 71ced17..cd82b12 100644
+--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
++++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+@@ -184,7 +184,7 @@ struct brcmf_cfg80211_event_loop {
+ 				     struct net_device *ndev,
+ 				     const struct brcmf_event_msg *e,
+ 				     void *data);
 -};
 +} __no_const;
  
- struct brcms_phy {
- 	struct brcms_phy_pub pubpi_ro;
+ /* basic structure of scan request */
+ struct brcmf_cfg80211_scan_req {
+@@ -239,7 +239,7 @@ struct brcmf_cfg80211_profile {
+ struct brcmf_cfg80211_iscan_eloop {
+ 	s32 (*handler[WL_SCAN_ERSULTS_LAST])
+ 		(struct brcmf_cfg80211_info *cfg);
+-};
++} __no_const;
+ 
+ /* dongle iscan controller */
+ struct brcmf_cfg80211_iscan_ctrl {
 diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
 index e252acb..6ad1e65 100644
 --- a/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -37002,19 +36946,6 @@ index 429ca32..f86236b 100644
  	}
  
  	spin_lock_init(&hwsim_radio_lock);
-diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
-index c2d0ab1..fb9afe2 100644
---- a/drivers/net/wireless/mwifiex/main.h
-+++ b/drivers/net/wireless/mwifiex/main.h
-@@ -603,7 +603,7 @@ struct mwifiex_if_ops {
- 	int (*event_complete) (struct mwifiex_adapter *, struct sk_buff *);
- 	int (*data_complete) (struct mwifiex_adapter *, struct sk_buff *);
- 	int (*dnld_fw) (struct mwifiex_adapter *, struct mwifiex_fw_image *);
--};
-+} __no_const;
- 
- struct mwifiex_adapter {
- 	u8 iface_type;
 diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
 index bd1f0cb..db85ab0 100644
 --- a/drivers/net/wireless/rndis_wlan.c
@@ -37057,32 +36988,75 @@ index e488b94..14b6a0c 100644
  
  	hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
  	hdr->seq_ctrl |= cpu_to_le16(seqno);
-diff --git a/drivers/net/wireless/ti/wl1251/wl1251.h b/drivers/net/wireless/ti/wl1251/wl1251.h
-index fd02060..74ee481 100644
---- a/drivers/net/wireless/ti/wl1251/wl1251.h
-+++ b/drivers/net/wireless/ti/wl1251/wl1251.h
-@@ -266,7 +266,7 @@ struct wl1251_if_operations {
- 	void (*reset)(struct wl1251 *wl);
- 	void (*enable_irq)(struct wl1251 *wl);
- 	void (*disable_irq)(struct wl1251 *wl);
--};
-+} __no_const;
+diff --git a/drivers/net/wireless/ti/wl1251/sdio.c b/drivers/net/wireless/ti/wl1251/sdio.c
+index e2750a1..797e179 100644
+--- a/drivers/net/wireless/ti/wl1251/sdio.c
++++ b/drivers/net/wireless/ti/wl1251/sdio.c
+@@ -269,13 +269,17 @@ static int wl1251_sdio_probe(struct sdio_func *func,
  
- struct wl1251 {
- 	struct ieee80211_hw *hw;
-diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
-index 68584aa..10fc178 100644
---- a/drivers/net/wireless/ti/wlcore/wlcore.h
-+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
-@@ -88,7 +88,7 @@ struct wlcore_ops {
- 		       struct ieee80211_sta *sta,
- 		       struct ieee80211_key_conf *key_conf);
- 	u32 (*pre_pkt_send)(struct wl1271 *wl, u32 buf_offset, u32 last_len);
--};
-+} __no_const;
+ 		irq_set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
  
- enum wlcore_partitions {
- 	PART_DOWN,
+-		wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
+-		wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
++		pax_open_kernel();
++		*(void **)&wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
++		*(void **)&wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
++		pax_close_kernel();
+ 
+ 		wl1251_info("using dedicated interrupt line");
+ 	} else {
+-		wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq;
+-		wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq;
++		pax_open_kernel();
++		*(void **)&wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq;
++		*(void **)&wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq;
++		pax_close_kernel();
+ 
+ 		wl1251_info("using SDIO interrupt");
+ 	}
+diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
+index dadf1db..d9db7a7 100644
+--- a/drivers/net/wireless/ti/wl12xx/main.c
++++ b/drivers/net/wireless/ti/wl12xx/main.c
+@@ -644,7 +644,9 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
+ 		       sizeof(wl->conf.mem));
+ 
+ 		/* read data preparation is only needed by wl127x */
+-		wl->ops->prepare_read = wl127x_prepare_read;
++		pax_open_kernel();
++		*(void **)&wl->ops->prepare_read = wl127x_prepare_read;
++		pax_close_kernel();
+ 
+ 		wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER, WL127X_IFTYPE_VER,
+ 				      WL127X_MAJOR_VER, WL127X_SUBTYPE_VER,
+@@ -665,7 +667,9 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
+ 		       sizeof(wl->conf.mem));
+ 
+ 		/* read data preparation is only needed by wl127x */
+-		wl->ops->prepare_read = wl127x_prepare_read;
++		pax_open_kernel();
++		*(void **)&wl->ops->prepare_read = wl127x_prepare_read;
++		pax_close_kernel();
+ 
+ 		wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER, WL127X_IFTYPE_VER,
+ 				      WL127X_MAJOR_VER, WL127X_SUBTYPE_VER,
+diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
+index a39682a..1e8220c 100644
+--- a/drivers/net/wireless/ti/wl18xx/main.c
++++ b/drivers/net/wireless/ti/wl18xx/main.c
+@@ -1489,8 +1489,10 @@ static int wl18xx_setup(struct wl1271 *wl)
+ 	}
+ 
+ 	if (!checksum_param) {
+-		wl18xx_ops.set_rx_csum = NULL;
+-		wl18xx_ops.init_vif = NULL;
++		pax_open_kernel();
++		*(void **)&wl18xx_ops.set_rx_csum = NULL;
++		*(void **)&wl18xx_ops.init_vif = NULL;
++		pax_close_kernel();
+ 	}
+ 
+ 	/* Enable 11a Band only if we have 5G antennas */
 diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
 index d93b2b6..ae50401 100644
 --- a/drivers/oprofile/buffer_sync.c
@@ -37225,32 +37199,82 @@ index 3f56bc0..707d642 100644
  }
  #endif /* IEEE1284.3 support. */
  
-diff --git a/drivers/pci/hotplug/acpiphp.h b/drivers/pci/hotplug/acpiphp.h
-index a1afb5b..e6baac9 100644
---- a/drivers/pci/hotplug/acpiphp.h
-+++ b/drivers/pci/hotplug/acpiphp.h
-@@ -123,7 +123,7 @@ struct acpiphp_func {
- 	struct acpiphp_bridge *bridge;	/* Ejectable PCI-to-PCI bridge */
- 
- 	struct list_head sibling;
--	struct notifier_block nb;
-+	notifier_block_no_const nb;
- 	acpi_handle	handle;
- 
- 	u8		function;	/* pci function# */
-diff --git a/drivers/pci/hotplug/cpci_hotplug.h b/drivers/pci/hotplug/cpci_hotplug.h
-index 9fff878..ad0ad53 100644
---- a/drivers/pci/hotplug/cpci_hotplug.h
-+++ b/drivers/pci/hotplug/cpci_hotplug.h
-@@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
- 	int (*hardware_test) (struct slot* slot, u32 value);
- 	u8  (*get_power) (struct slot* slot);
- 	int (*set_power) (struct slot* slot, int value);
--};
-+} __no_const;
+diff --git a/drivers/pci/hotplug/cpcihp_generic.c b/drivers/pci/hotplug/cpcihp_generic.c
+index a6a71c4..c91097b 100644
+--- a/drivers/pci/hotplug/cpcihp_generic.c
++++ b/drivers/pci/hotplug/cpcihp_generic.c
+@@ -73,7 +73,6 @@ static u16 port;
+ static unsigned int enum_bit;
+ static u8 enum_mask;
+ 
+-static struct cpci_hp_controller_ops generic_hpc_ops;
+ static struct cpci_hp_controller generic_hpc;
+ 
+ static int __init validate_parameters(void)
+@@ -139,6 +138,10 @@ static int query_enum(void)
+ 	return ((value & enum_mask) == enum_mask);
+ }
+ 
++static struct cpci_hp_controller_ops generic_hpc_ops = {
++	.query_enum = query_enum,
++};
++
+ static int __init cpcihp_generic_init(void)
+ {
+ 	int status;
+@@ -165,7 +168,6 @@ static int __init cpcihp_generic_init(void)
+ 	pci_dev_put(dev);
+ 
+ 	memset(&generic_hpc, 0, sizeof (struct cpci_hp_controller));
+-	generic_hpc_ops.query_enum = query_enum;
+ 	generic_hpc.ops = &generic_hpc_ops;
+ 
+ 	status = cpci_hp_register_controller(&generic_hpc);
+diff --git a/drivers/pci/hotplug/cpcihp_zt5550.c b/drivers/pci/hotplug/cpcihp_zt5550.c
+index 6bf8d2a..9711ce0 100644
+--- a/drivers/pci/hotplug/cpcihp_zt5550.c
++++ b/drivers/pci/hotplug/cpcihp_zt5550.c
+@@ -59,7 +59,6 @@
+ /* local variables */
+ static bool debug;
+ static bool poll;
+-static struct cpci_hp_controller_ops zt5550_hpc_ops;
+ static struct cpci_hp_controller zt5550_hpc;
+ 
+ /* Primary cPCI bus bridge device */
+@@ -205,6 +204,10 @@ static int zt5550_hc_disable_irq(void)
+ 	return 0;
+ }
  
- struct cpci_hp_controller {
- 	unsigned int irq;
++static struct cpci_hp_controller_ops zt5550_hpc_ops = {
++	.query_enum = zt5550_hc_query_enum,
++};
++
+ static int zt5550_hc_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ 	int status;
+@@ -216,16 +219,17 @@ static int zt5550_hc_init_one (struct pci_dev *pdev, const struct pci_device_id
+ 	dbg("returned from zt5550_hc_config");
+ 
+ 	memset(&zt5550_hpc, 0, sizeof (struct cpci_hp_controller));
+-	zt5550_hpc_ops.query_enum = zt5550_hc_query_enum;
+ 	zt5550_hpc.ops = &zt5550_hpc_ops;
+ 	if(!poll) {
+ 		zt5550_hpc.irq = hc_dev->irq;
+ 		zt5550_hpc.irq_flags = IRQF_SHARED;
+ 		zt5550_hpc.dev_id = hc_dev;
+ 
+-		zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
+-		zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
+-		zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
++		pax_open_kernel();
++		*(void **)&zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
++		*(void **)&zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
++		*(void **)&zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
++		pax_open_kernel();
+ 	} else {
+ 		info("using ENUM# polling mode");
+ 	}
 diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
 index 76ba8a1..20ca857 100644
 --- a/drivers/pci/hotplug/cpqphp_nvram.c
@@ -37534,58 +37558,6 @@ index b0ecacb..7c9da2e 100644
  		return 0;
  
  	/* check if the resource is reserved */
-diff --git a/drivers/power/bq27x00_battery.c b/drivers/power/bq27x00_battery.c
-index 5860d4d..d90d268 100644
---- a/drivers/power/bq27x00_battery.c
-+++ b/drivers/power/bq27x00_battery.c
-@@ -80,7 +80,7 @@
- struct bq27x00_device_info;
- struct bq27x00_access_methods {
- 	int (*read)(struct bq27x00_device_info *di, u8 reg, bool single);
--};
-+} __no_const;
- 
- enum bq27x00_chip { BQ27000, BQ27500, BQ27425};
- 
-diff --git a/drivers/power/da9030_battery.c b/drivers/power/da9030_battery.c
-index 94762e6..d35ff48 100644
---- a/drivers/power/da9030_battery.c
-+++ b/drivers/power/da9030_battery.c
-@@ -110,7 +110,7 @@ struct da9030_charger {
- 	int mV;
- 	bool is_on;
- 
--	struct notifier_block nb;
-+	notifier_block_no_const nb;
- 
- 	/* platform callbacks for battery low and critical events */
- 	void (*battery_low)(void);
-diff --git a/drivers/power/da9052-battery.c b/drivers/power/da9052-battery.c
-index d9d034d..3c9a5e1 100644
---- a/drivers/power/da9052-battery.c
-+++ b/drivers/power/da9052-battery.c
-@@ -170,7 +170,7 @@ static u32 const vc_tbl[3][68][2] = {
- struct da9052_battery {
- 	struct da9052 *da9052;
- 	struct power_supply psy;
--	struct notifier_block nb;
-+	notifier_block_no_const nb;
- 	int charger_type;
- 	int status;
- 	int health;
-diff --git a/drivers/power/isp1704_charger.c b/drivers/power/isp1704_charger.c
-index 1229119..f53b75d 100644
---- a/drivers/power/isp1704_charger.c
-+++ b/drivers/power/isp1704_charger.c
-@@ -57,7 +57,7 @@ struct isp1704_charger {
- 	struct device		*dev;
- 	struct power_supply	psy;
- 	struct usb_phy		*phy;
--	struct notifier_block	nb;
-+	notifier_block_no_const	nb;
- 	struct work_struct	work;
- 
- 	/* properties */
 diff --git a/drivers/power/pda_power.c b/drivers/power/pda_power.c
 index 7df7c5f..bd48c47 100644
 --- a/drivers/power/pda_power.c
@@ -37611,19 +37583,6 @@ index 7df7c5f..bd48c47 100644
  		ret = usb_register_notifier(transceiver, &otg_nb);
  		if (ret) {
  			dev_err(dev, "failure to register otg notifier\n");
-diff --git a/drivers/power/twl4030_charger.c b/drivers/power/twl4030_charger.c
-index f9e70cf..2a21d8b 100644
---- a/drivers/power/twl4030_charger.c
-+++ b/drivers/power/twl4030_charger.c
-@@ -84,7 +84,7 @@ struct twl4030_bci {
- 	struct power_supply	ac;
- 	struct power_supply	usb;
- 	struct usb_phy		*transceiver;
--	struct notifier_block	usb_nb;
-+	notifier_block_no_const	usb_nb;
- 	struct work_struct	work;
- 	int			irq_chg;
- 	int			irq_bci;
 diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
 index 8d53174..04c65de 100644
 --- a/drivers/regulator/max8660.c
@@ -37681,19 +37640,6 @@ index cace6d3..f623fda 100644
  		return rtc_set_time(rtc, &tm);
  
  	case RTC_PIE_ON:
-diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
-index 9e933a8..4f969f7 100644
---- a/drivers/scsi/aacraid/aacraid.h
-+++ b/drivers/scsi/aacraid/aacraid.h
-@@ -503,7 +503,7 @@ struct adapter_ops
- 	int  (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
- 	/* Administrative operations */
- 	int  (*adapter_comm)(struct aac_dev * dev, int comm);
--};
-+} __no_const;
- 
- /*
-  *	Define which interrupt handler needs to be installed
 diff --git a/drivers/scsi/bfa/bfa.h b/drivers/scsi/bfa/bfa.h
 index 4ad7e36..d004679 100644
 --- a/drivers/scsi/bfa/bfa.h
@@ -37707,49 +37653,19 @@ index 4ad7e36..d004679 100644
  typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
  
  struct bfa_faa_cbfn_s {
-diff --git a/drivers/scsi/bfa/bfa_fcpim.c b/drivers/scsi/bfa/bfa_fcpim.c
-index 27b5609..e08d9c4 100644
---- a/drivers/scsi/bfa/bfa_fcpim.c
-+++ b/drivers/scsi/bfa/bfa_fcpim.c
-@@ -3731,7 +3731,7 @@ bfa_fcp_attach(struct bfa_s *bfa, void *bfad, struct bfa_iocfc_cfg_s *cfg,
- 
- 	bfa_iotag_attach(fcp);
- 
--	fcp->itn_arr = (struct bfa_itn_s *) bfa_mem_kva_curp(fcp);
-+	fcp->itn_arr = (bfa_itn_s_no_const *) bfa_mem_kva_curp(fcp);
- 	bfa_mem_kva_curp(fcp) = (u8 *)fcp->itn_arr +
- 			(fcp->num_itns * sizeof(struct bfa_itn_s));
- 	memset(fcp->itn_arr, 0,
-@@ -3799,7 +3799,7 @@ bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
- 		void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m))
- {
- 	struct bfa_fcp_mod_s *fcp = BFA_FCP_MOD(bfa);
--	struct bfa_itn_s *itn;
-+	bfa_itn_s_no_const *itn;
- 
- 	itn =  BFA_ITN_FROM_TAG(fcp, rport->rport_tag);
- 	itn->isr = isr;
 diff --git a/drivers/scsi/bfa/bfa_fcpim.h b/drivers/scsi/bfa/bfa_fcpim.h
-index e693af6..4faba24 100644
+index e693af6..2e525b6 100644
 --- a/drivers/scsi/bfa/bfa_fcpim.h
 +++ b/drivers/scsi/bfa/bfa_fcpim.h
-@@ -37,6 +37,7 @@ struct bfa_iotag_s {
+@@ -36,7 +36,7 @@ struct bfa_iotag_s {
+ 
  struct bfa_itn_s {
  	bfa_isr_func_t isr;
- };
-+typedef struct bfa_itn_s __no_const bfa_itn_s_no_const;
+-};
++} __no_const;
  
  void bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
  		void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m));
-@@ -149,7 +150,7 @@ struct bfa_fcp_mod_s {
- 	struct list_head	iotag_tio_free_q;	/* free IO resources */
- 	struct list_head	iotag_unused_q;	/* unused IO resources*/
- 	struct bfa_iotag_s	*iotag_arr;
--	struct bfa_itn_s	*itn_arr;
-+	bfa_itn_s_no_const	*itn_arr;
- 	int			max_ioim_reqs;
- 	int			num_ioim_reqs;
- 	int			num_fwtio_reqs;
 diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
 index 23a90e7..9cf04ee 100644
 --- a/drivers/scsi/bfa/bfa_ioc.h
@@ -37934,19 +37850,6 @@ index 9816479..c5d4e97 100644
  
  	/* queue and queue Info */
  	struct list_head reqQ;
-diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
-index f2df059..a3a9930 100644
---- a/drivers/scsi/ips.h
-+++ b/drivers/scsi/ips.h
-@@ -1027,7 +1027,7 @@ typedef struct {
-    int       (*intr)(struct ips_ha *);
-    void      (*enableint)(struct ips_ha *);
-    uint32_t (*statupd)(struct ips_ha *);
--} ips_hw_func_t;
-+} __no_const ips_hw_func_t;
- 
- typedef struct ips_ha {
-    uint8_t            ha_id[IPS_MAX_CHANNELS+1];
 diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
 index c772d8d..35c362c 100644
 --- a/drivers/scsi/libfc/fc_exch.c
@@ -38401,10 +38304,10 @@ index e1d150f..6c6df44 100644
  	/* To indicate add/delete/modify during CCN */
  	u8 change_detected;
 diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
-index 1c28215..86991a1 100644
+index 83d7984..a27d947 100644
 --- a/drivers/scsi/qla2xxx/qla_attr.c
 +++ b/drivers/scsi/qla2xxx/qla_attr.c
-@@ -1970,7 +1970,7 @@ qla24xx_vport_disable(struct fc_vport *fc_vport, bool disable)
+@@ -1969,7 +1969,7 @@ qla24xx_vport_disable(struct fc_vport *fc_vport, bool disable)
  	return 0;
  }
  
@@ -38413,7 +38316,7 @@ index 1c28215..86991a1 100644
  
  	.show_host_node_name = 1,
  	.show_host_port_name = 1,
-@@ -2017,7 +2017,7 @@ struct fc_function_template qla2xxx_transport_functions = {
+@@ -2016,7 +2016,7 @@ struct fc_function_template qla2xxx_transport_functions = {
  	.bsg_timeout = qla24xx_bsg_timeout,
  };
  
@@ -38422,19 +38325,6 @@ index 1c28215..86991a1 100644
  
  	.show_host_node_name = 1,
  	.show_host_port_name = 1,
-diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
-index a9725bf..18eeb73 100644
---- a/drivers/scsi/qla2xxx/qla_def.h
-+++ b/drivers/scsi/qla2xxx/qla_def.h
-@@ -2385,7 +2385,7 @@ struct isp_operations {
- 	int (*start_scsi) (srb_t *);
- 	int (*abort_isp) (struct scsi_qla_host *);
- 	int (*iospace_config)(struct qla_hw_data*);
--};
-+} __no_const;
- 
- /* MSI-X Support *************************************************************/
- 
 diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
 index 6acb397..d86e3e0 100644
 --- a/drivers/scsi/qla2xxx/qla_gbl.h
@@ -38450,6 +38340,23 @@ index 6acb397..d86e3e0 100644
  extern void qla2x00_alloc_sysfs_attr(scsi_qla_host_t *);
  extern void qla2x00_free_sysfs_attr(scsi_qla_host_t *);
  extern void qla2x00_init_host_attr(scsi_qla_host_t *);
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index f4b1fc8..a1ce4dd 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1462,8 +1462,10 @@ qla2x00_config_dma_addressing(struct qla_hw_data *ha)
+ 		    !pci_set_consistent_dma_mask(ha->pdev, DMA_BIT_MASK(64))) {
+ 			/* Ok, a 64bit DMA mask is applicable. */
+ 			ha->flags.enable_64bit_addressing = 1;
+-			ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
+-			ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
++			pax_open_kernel();
++			*(void **)&ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
++			*(void **)&ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
++			pax_close_kernel();
+ 			return;
+ 		}
+ 	}
 diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
 index 329d553..f20d31d 100644
 --- a/drivers/scsi/qla4xxx/ql4_def.h
@@ -38530,10 +38437,10 @@ index 9032e91..7a805d0 100644
  	disposition = scsi_decide_disposition(cmd);
  	if (disposition != SUCCESS &&
 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
-index ce5224c..8c6d071 100644
+index 931a7d9..0c2a754 100644
 --- a/drivers/scsi/scsi_sysfs.c
 +++ b/drivers/scsi/scsi_sysfs.c
-@@ -661,7 +661,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr,	\
+@@ -658,7 +658,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr,	\
  		    char *buf)						\
  {									\
  	struct scsi_device *sdev = to_scsi_device(dev);			\
@@ -38696,19 +38603,6 @@ index 84c2861..ece0a31 100644
  
  static u8	*buf;
  
-diff --git a/drivers/staging/csr/sdio_mmc.c b/drivers/staging/csr/sdio_mmc.c
-index af3e40b..29de4f5 100644
---- a/drivers/staging/csr/sdio_mmc.c
-+++ b/drivers/staging/csr/sdio_mmc.c
-@@ -898,7 +898,7 @@ struct uf_sdio_mmc_pm_notifier
-     struct list_head list;
- 
-     CsrSdioFunction *sdio_ctx;
--    struct notifier_block pm_notifier;
-+    notifier_block_no_const pm_notifier;
- };
- 
- /* PM notifier list head */
 diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
 index 34afc16..ffe44dd 100644
 --- a/drivers/staging/octeon/ethernet-rx.c
@@ -39008,19 +38902,6 @@ index 180c963..1f18377 100644
  			return -EFAULT;
  
  	return 0;
-diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h
-index 5d89c0f..9261317 100644
---- a/drivers/staging/usbip/usbip_common.h
-+++ b/drivers/staging/usbip/usbip_common.h
-@@ -289,7 +289,7 @@ struct usbip_device {
- 		void (*shutdown)(struct usbip_device *);
- 		void (*reset)(struct usbip_device *);
- 		void (*unusable)(struct usbip_device *);
--	} eh_ops;
-+	} __no_const eh_ops;
- };
- 
- #define kthread_get_run(threadfn, data, namefmt, ...)			   \
 diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
 index c66b8b3..a4a035b 100644
 --- a/drivers/staging/usbip/vhci.h
@@ -39138,19 +39019,6 @@ index 0a73d40..6fda560 100644
  	pDevice->apdev->netdev_ops = &apdev_netdev_ops;
  
  	pDevice->apdev->type = ARPHRD_IEEE80211;
-diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
-index f180c3d..4b9ecfc 100644
---- a/drivers/staging/wlan-ng/hfa384x_usb.c
-+++ b/drivers/staging/wlan-ng/hfa384x_usb.c
-@@ -204,7 +204,7 @@ static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
- 
- struct usbctlx_completor {
- 	int (*complete) (struct usbctlx_completor *);
--};
-+} __no_const;
- 
- static int
- hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
 diff --git a/drivers/staging/zcache/tmem.c b/drivers/staging/zcache/tmem.c
 index 56c8e60..1920c63 100644
 --- a/drivers/staging/zcache/tmem.c
@@ -40378,19 +40246,6 @@ index 681765b..d3ccdf2 100644
  		if (!perm) {
  			ret = -EPERM;
  			goto reterr;
-diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
-index fa7268a..cb08d48 100644
---- a/drivers/tty/vt/vc_screen.c
-+++ b/drivers/tty/vt/vc_screen.c
-@@ -51,7 +51,7 @@
- #define CON_BUF_SIZE (CONFIG_BASE_SMALL ? 256 : PAGE_SIZE)
- 
- struct vcs_poll_data {
--	struct notifier_block notifier;
-+	notifier_block_no_const notifier;
- 	unsigned int cons_num;
- 	bool seen_last_update;
- 	wait_queue_head_t waitq;
 diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
 index 5110f36..8dc0a74 100644
 --- a/drivers/uio/uio.c
@@ -40787,19 +40642,6 @@ index f173952..83d6ec0 100644
  		gs_buf_free(&port->port_write_buf);
  	gs_free_requests(gser->out, &port->read_pool, NULL);
  	gs_free_requests(gser->out, &port->read_queue, NULL);
-diff --git a/drivers/usb/musb/musb_dma.h b/drivers/usb/musb/musb_dma.h
-index 24d3921..0c652ed 100644
---- a/drivers/usb/musb/musb_dma.h
-+++ b/drivers/usb/musb/musb_dma.h
-@@ -172,7 +172,7 @@ struct dma_controller {
- 	int			(*is_compatible)(struct dma_channel *channel,
- 							u16 maxpacket,
- 							void *buf, u32 length);
--};
-+} __no_const;
- 
- /* called after channel_program(), may indicate a fault */
- extern void musb_dma_completion(struct musb *musb, u8 epnum, u8 transmit);
 diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
 index 5f3bcd3..bfca43f 100644
 --- a/drivers/usb/serial/console.c
@@ -40866,19 +40708,6 @@ index 57c01ab..8a05959 100644
  }
  
  /*
-diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
-index 56097c6..4f38643 100644
---- a/drivers/vfio/vfio.c
-+++ b/drivers/vfio/vfio.c
-@@ -71,7 +71,7 @@ struct vfio_group {
- 	struct list_head		device_list;
- 	struct mutex			device_lock;
- 	struct device			*dev;
--	struct notifier_block		nb;
-+	notifier_block_no_const		nb;
- 	struct list_head		vfio_next;
- 	struct list_head		container_next;
- };
 diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
 index dedaf81..b0f11ab 100644
 --- a/drivers/vhost/vhost.c
@@ -43997,29 +43826,6 @@ index 6b1b7e1..b2fa4d5 100644
  			&base, &resources[1].start, &consumed,
  			&vm_cmdline_id, &consumed);
  
-diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
-index e56c934..fc22f4b 100644
---- a/drivers/xen/xen-pciback/conf_space.h
-+++ b/drivers/xen/xen-pciback/conf_space.h
-@@ -44,15 +44,15 @@ struct config_field {
- 		struct {
- 			conf_dword_write write;
- 			conf_dword_read read;
--		} dw;
-+		} __no_const dw;
- 		struct {
- 			conf_word_write write;
- 			conf_word_read read;
--		} w;
-+		} __no_const w;
- 		struct {
- 			conf_byte_write write;
- 			conf_byte_read read;
--		} b;
-+		} __no_const b;
- 	} u;
- 	struct list_head list;
- };
 diff --git a/drivers/xen/xenfs/xenstored.c b/drivers/xen/xenfs/xenstored.c
 index fef20db..d28b1ab 100644
 --- a/drivers/xen/xenfs/xenstored.c
@@ -45205,19 +45011,6 @@ index ab3a456..7da538b 100644
  		return true; 	 /* is a partition of a device that is being partitioned */
  	else if (whole->bd_holder != NULL)
  		return false;	 /* is a partition of a held device */
-diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
-index 5a3e45d..ad19cc3 100644
---- a/fs/btrfs/check-integrity.c
-+++ b/fs/btrfs/check-integrity.c
-@@ -156,7 +156,7 @@ struct btrfsic_block {
- 	union {
- 		bio_end_io_t *bio;
- 		bh_end_io_t *bh;
--	} orig_bio_bh_end_io;
-+	} __no_const orig_bio_bh_end_io;
- 	int submit_bio_bh_rw;
- 	u64 flush_gen; /* only valid if !never_written */
- };
 diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
 index cdfb4c4..da736d4 100644
 --- a/fs/btrfs/ctree.c
@@ -45671,10 +45464,10 @@ index 3a00c0d..42d901c 100644
  
  	}
 diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
-index 34cea27..3fbdf6f 100644
+index 591bf19..690d600 100644
 --- a/fs/cifs/smb1ops.c
 +++ b/fs/cifs/smb1ops.c
-@@ -610,27 +610,27 @@ static void
+@@ -617,27 +617,27 @@ static void
  cifs_clear_stats(struct cifs_tcon *tcon)
  {
  #ifdef CONFIG_CIFS_STATS
@@ -45723,7 +45516,7 @@ index 34cea27..3fbdf6f 100644
  #endif
  }
  
-@@ -639,36 +639,36 @@ cifs_print_stats(struct seq_file *m, struct cifs_tcon *tcon)
+@@ -646,36 +646,36 @@ cifs_print_stats(struct seq_file *m, struct cifs_tcon *tcon)
  {
  #ifdef CONFIG_CIFS_STATS
  	seq_printf(m, " Oplocks breaks: %d",
@@ -46261,7 +46054,7 @@ index ce47379..68c8e43 100644
  EXPORT_SYMBOL(dump_write);
  
 diff --git a/fs/dcache.c b/fs/dcache.c
-index 3a463d0..9f345c8 100644
+index 0d0adb6..f4646e9 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
 @@ -3164,7 +3164,7 @@ void __init vfs_caches_init(unsigned long mempages)
@@ -46347,7 +46140,7 @@ index b2a34a1..162fa69 100644
  	return rc;
  }
 diff --git a/fs/exec.c b/fs/exec.c
-index 0039055..03fb669 100644
+index c6e6de4..de6841c 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -55,6 +55,16 @@
@@ -46489,7 +46282,7 @@ index 0039055..03fb669 100644
  
  	return native;
  }
-@@ -431,7 +455,7 @@ static int count(struct user_arg_ptr argv, int max)
+@@ -431,11 +455,12 @@ static int count(struct user_arg_ptr argv, int max)
  			if (!p)
  				break;
  
@@ -46497,8 +46290,14 @@ index 0039055..03fb669 100644
 +			if (IS_ERR((const char __force_kernel *)p))
  				return -EFAULT;
  
- 			if (i++ >= max)
-@@ -465,7 +489,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
+-			if (i++ >= max)
++			if (i >= max)
+ 				return -E2BIG;
++			++i;
+ 
+ 			if (fatal_signal_pending(current))
+ 				return -ERESTARTNOHAND;
+@@ -465,7 +490,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
  
  		ret = -EFAULT;
  		str = get_user_arg_ptr(argv, argc);
@@ -46507,7 +46306,7 @@ index 0039055..03fb669 100644
  			goto out;
  
  		len = strnlen_user(str, MAX_ARG_STRLEN);
-@@ -547,7 +571,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
+@@ -547,7 +572,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
  	int r;
  	mm_segment_t oldfs = get_fs();
  	struct user_arg_ptr argv = {
@@ -46516,7 +46315,7 @@ index 0039055..03fb669 100644
  	};
  
  	set_fs(KERNEL_DS);
-@@ -582,7 +606,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -582,7 +607,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  	unsigned long new_end = old_end - shift;
  	struct mmu_gather tlb;
  
@@ -46526,7 +46325,7 @@ index 0039055..03fb669 100644
  
  	/*
  	 * ensure there are no vmas between where we want to go
-@@ -591,6 +616,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -591,6 +617,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  	if (vma != find_vma(mm, new_start))
  		return -EFAULT;
  
@@ -46537,7 +46336,7 @@ index 0039055..03fb669 100644
  	/*
  	 * cover the whole range: [new_start, old_end)
  	 */
-@@ -671,10 +700,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -671,10 +701,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
  	stack_top = arch_align_stack(stack_top);
  	stack_top = PAGE_ALIGN(stack_top);
  
@@ -46548,7 +46347,7 @@ index 0039055..03fb669 100644
  	stack_shift = vma->vm_end - stack_top;
  
  	bprm->p -= stack_shift;
-@@ -686,8 +711,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -686,8 +712,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
  	bprm->exec -= stack_shift;
  
  	down_write(&mm->mmap_sem);
@@ -46577,7 +46376,7 @@ index 0039055..03fb669 100644
  	/*
  	 * Adjust stack execute permissions; explicitly enable for
  	 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
-@@ -706,13 +751,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -706,13 +752,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
  		goto out_unlock;
  	BUG_ON(prev != vma);
  
@@ -46591,7 +46390,7 @@ index 0039055..03fb669 100644
  	/* mprotect_fixup is overkill to remove the temporary stack flags */
  	vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
  
-@@ -771,6 +809,8 @@ struct file *open_exec(const char *name)
+@@ -771,6 +810,8 @@ struct file *open_exec(const char *name)
  
  	fsnotify_open(file);
  
@@ -46600,7 +46399,7 @@ index 0039055..03fb669 100644
  	err = deny_write_access(file);
  	if (err)
  		goto exit;
-@@ -794,7 +834,7 @@ int kernel_read(struct file *file, loff_t offset,
+@@ -794,7 +835,7 @@ int kernel_read(struct file *file, loff_t offset,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -46609,7 +46408,7 @@ index 0039055..03fb669 100644
  	set_fs(old_fs);
  	return result;
  }
-@@ -1231,7 +1271,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
+@@ -1246,7 +1287,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
  	}
  	rcu_read_unlock();
  
@@ -46618,7 +46417,7 @@ index 0039055..03fb669 100644
  		bprm->unsafe |= LSM_UNSAFE_SHARE;
  	} else {
  		res = -EAGAIN;
-@@ -1434,6 +1474,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+@@ -1449,6 +1490,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
  
  EXPORT_SYMBOL(search_binary_handler);
  
@@ -46647,7 +46446,7 @@ index 0039055..03fb669 100644
  /*
   * sys_execve() executes a new program.
   */
-@@ -1442,6 +1504,11 @@ static int do_execve_common(const char *filename,
+@@ -1457,6 +1520,11 @@ static int do_execve_common(const char *filename,
  				struct user_arg_ptr envp,
  				struct pt_regs *regs)
  {
@@ -46659,7 +46458,7 @@ index 0039055..03fb669 100644
  	struct linux_binprm *bprm;
  	struct file *file;
  	struct files_struct *displaced;
-@@ -1449,6 +1516,8 @@ static int do_execve_common(const char *filename,
+@@ -1464,6 +1532,8 @@ static int do_execve_common(const char *filename,
  	int retval;
  	const struct cred *cred = current_cred();
  
@@ -46668,7 +46467,7 @@ index 0039055..03fb669 100644
  	/*
  	 * We move the actual failure in case of RLIMIT_NPROC excess from
  	 * set*uid() to execve() because too many poorly written programs
-@@ -1489,12 +1558,27 @@ static int do_execve_common(const char *filename,
+@@ -1504,12 +1574,27 @@ static int do_execve_common(const char *filename,
  	if (IS_ERR(file))
  		goto out_unmark;
  
@@ -46696,7 +46495,7 @@ index 0039055..03fb669 100644
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1511,24 +1595,65 @@ static int do_execve_common(const char *filename,
+@@ -1526,24 +1611,65 @@ static int do_execve_common(const char *filename,
  	if (retval < 0)
  		goto out;
  
@@ -46766,7 +46565,7 @@ index 0039055..03fb669 100644
  	current->fs->in_exec = 0;
  	current->in_execve = 0;
  	acct_update_integrals(current);
-@@ -1537,6 +1662,14 @@ static int do_execve_common(const char *filename,
+@@ -1552,6 +1678,14 @@ static int do_execve_common(const char *filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -46781,7 +46580,7 @@ index 0039055..03fb669 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1712,3 +1845,253 @@ int kernel_execve(const char *filename,
+@@ -1727,3 +1861,253 @@ int kernel_execve(const char *filename,
  	ret_from_kernel_execve(p);
  }
  #endif
@@ -47118,26 +46917,6 @@ index 3c20de1..6ff2460 100644
  	atomic_t s_lock_busy;
  
  	/* locality groups */
-diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
-index 3a100e7..c7efa88 100644
---- a/fs/ext4/ialloc.c
-+++ b/fs/ext4/ialloc.c
-@@ -762,7 +762,6 @@ got:
- 
- 		BUFFER_TRACE(block_bitmap_bh, "dirty block bitmap");
- 		err = ext4_handle_dirty_metadata(handle, NULL, block_bitmap_bh);
--		brelse(block_bitmap_bh);
- 
- 		/* recheck and clear flag under lock if we still need to */
- 		ext4_lock_group(sb, group);
-@@ -775,6 +774,7 @@ got:
- 			ext4_group_desc_csum_set(sb, group, gdp);
- 		}
- 		ext4_unlock_group(sb, group);
-+		brelse(block_bitmap_bh);
- 
- 		if (err)
- 			goto fail;
 diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
 index b3c243b..772c318 100644
 --- a/fs/ext4/inode.c
@@ -47268,10 +47047,10 @@ index 526e553..3f2de85 100644
  
  	return 0;
 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 80928f7..c3f2b1f 100644
+index d59b351..775f8c8 100644
 --- a/fs/ext4/super.c
 +++ b/fs/ext4/super.c
-@@ -3202,7 +3202,6 @@ int ext4_calculate_overhead(struct super_block *sb)
+@@ -3212,7 +3212,6 @@ int ext4_calculate_overhead(struct super_block *sb)
  	ext4_fsblk_t overhead = 0;
  	char *buf = (char *) get_zeroed_page(GFP_KERNEL);
  
@@ -47423,7 +47202,7 @@ index da165f6..3671bdb 100644
  
  	if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
 diff --git a/fs/fs_struct.c b/fs/fs_struct.c
-index 5df4775..f656176 100644
+index 5df4775..9d9336f 100644
 --- a/fs/fs_struct.c
 +++ b/fs/fs_struct.c
 @@ -4,6 +4,7 @@
@@ -47473,14 +47252,7 @@ index 5df4775..f656176 100644
  			hits += replace_path(&fs->pwd, old_root, new_root);
  			write_seqcount_end(&fs->seq);
  			while (hits--) {
-@@ -94,12 +111,15 @@ void exit_fs(struct task_struct *tsk)
- {
- 	struct fs_struct *fs = tsk->fs;
- 
-+	gr_put_exec_file(tsk);
-+	
- 	if (fs) {
- 		int kill;
+@@ -99,7 +116,8 @@ void exit_fs(struct task_struct *tsk)
  		task_lock(tsk);
  		spin_lock(&fs->lock);
  		tsk->fs = NULL;
@@ -47490,7 +47262,7 @@ index 5df4775..f656176 100644
  		spin_unlock(&fs->lock);
  		task_unlock(tsk);
  		if (kill)
-@@ -112,7 +132,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
+@@ -112,7 +130,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
  	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
  	/* We don't need to lock fs - think why ;-) */
  	if (fs) {
@@ -47499,7 +47271,7 @@ index 5df4775..f656176 100644
  		fs->in_exec = 0;
  		spin_lock_init(&fs->lock);
  		seqcount_init(&fs->seq);
-@@ -121,6 +141,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
+@@ -121,6 +139,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
  		spin_lock(&old->lock);
  		fs->root = old->root;
  		path_get(&fs->root);
@@ -47509,7 +47281,7 @@ index 5df4775..f656176 100644
  		fs->pwd = old->pwd;
  		path_get(&fs->pwd);
  		spin_unlock(&old->lock);
-@@ -139,8 +162,9 @@ int unshare_fs_struct(void)
+@@ -139,8 +160,9 @@ int unshare_fs_struct(void)
  
  	task_lock(current);
  	spin_lock(&fs->lock);
@@ -47520,7 +47292,7 @@ index 5df4775..f656176 100644
  	spin_unlock(&fs->lock);
  	task_unlock(current);
  
-@@ -153,13 +177,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
+@@ -153,13 +175,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
  
  int current_umask(void)
  {
@@ -47536,15 +47308,7 @@ index 5df4775..f656176 100644
  	.lock		= __SPIN_LOCK_UNLOCKED(init_fs.lock),
  	.seq		= SEQCNT_ZERO,
  	.umask		= 0022,
-@@ -169,18 +193,21 @@ void daemonize_fs_struct(void)
- {
- 	struct fs_struct *fs = current->fs;
- 
-+	gr_put_exec_file(current);
-+
- 	if (fs) {
- 		int kill;
- 
+@@ -175,12 +197,13 @@ void daemonize_fs_struct(void)
  		task_lock(current);
  
  		spin_lock(&init_fs.lock);
@@ -49757,7 +49521,7 @@ index 6fa01ae..2790820 100644
  
  void nfs_fattr_init(struct nfs_fattr *fattr)
 diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
-index c120b48..8ac4140 100644
+index f59169e..fd7d359 100644
 --- a/fs/nfsd/vfs.c
 +++ b/fs/nfsd/vfs.c
 @@ -941,7 +941,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
@@ -49778,7 +49542,7 @@ index c120b48..8ac4140 100644
  	set_fs(oldfs);
  	if (host_err < 0)
  		goto out_nfserr;
-@@ -1581,7 +1581,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
+@@ -1587,7 +1587,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
  	 */
  
  	oldfs = get_fs(); set_fs(KERNEL_DS);
@@ -50245,7 +50009,7 @@ index 15af622..0e9f4467 100644
   	help
  	  Various /proc files exist to monitor process memory utilization:
 diff --git a/fs/proc/array.c b/fs/proc/array.c
-index c1c207c..01ce725 100644
+index bd31e02..15cae71 100644
 --- a/fs/proc/array.c
 +++ b/fs/proc/array.c
 @@ -60,6 +60,7 @@
@@ -51643,7 +51407,7 @@ index 2ef72d9..f213b17 100644
  		return -EINVAL;
  
 diff --git a/fs/seq_file.c b/fs/seq_file.c
-index 99dffab..884a1eb 100644
+index 99dffab..e4fcb71 100644
 --- a/fs/seq_file.c
 +++ b/fs/seq_file.c
 @@ -10,6 +10,7 @@
@@ -51705,12 +51469,12 @@ index 99dffab..884a1eb 100644
  		void *data)
  {
 -	struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
-+	seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
++	seq_operations_no_const *op = kzalloc(sizeof(*op), GFP_KERNEL);
  	int res = -ENOMEM;
  
  	if (op) {
 diff --git a/fs/splice.c b/fs/splice.c
-index 13e5b47..2262998 100644
+index 48c7bd1..d0740e4 100644
 --- a/fs/splice.c
 +++ b/fs/splice.c
 @@ -194,7 +194,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
@@ -51761,7 +51525,7 @@ index 13e5b47..2262998 100644
  		vec[i].iov_len = this_len;
  		spd.pages[i] = page;
  		spd.nr_pages++;
-@@ -849,10 +849,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
+@@ -851,10 +851,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
  int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
  {
  	while (!pipe->nrbufs) {
@@ -51774,7 +51538,7 @@ index 13e5b47..2262998 100644
  			return 0;
  
  		if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -1190,7 +1190,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+@@ -1192,7 +1192,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
  		 * out of the pipe right after the splice_to_pipe(). So set
  		 * PIPE_READERS appropriately.
  		 */
@@ -51783,7 +51547,7 @@ index 13e5b47..2262998 100644
  
  		current->splice_pipe = pipe;
  	}
-@@ -1739,9 +1739,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1741,9 +1741,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -51795,7 +51559,7 @@ index 13e5b47..2262998 100644
  			if (flags & SPLICE_F_NONBLOCK) {
  				ret = -EAGAIN;
  				break;
-@@ -1773,7 +1773,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1775,7 +1775,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  	pipe_lock(pipe);
  
  	while (pipe->nrbufs >= pipe->buffers) {
@@ -51804,7 +51568,7 @@ index 13e5b47..2262998 100644
  			send_sig(SIGPIPE, current, 0);
  			ret = -EPIPE;
  			break;
-@@ -1786,9 +1786,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1788,9 +1788,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -51816,7 +51580,7 @@ index 13e5b47..2262998 100644
  	}
  
  	pipe_unlock(pipe);
-@@ -1824,14 +1824,14 @@ retry:
+@@ -1826,14 +1826,14 @@ retry:
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -51833,7 +51597,7 @@ index 13e5b47..2262998 100644
  			break;
  
  		/*
-@@ -1928,7 +1928,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+@@ -1930,7 +1930,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -51842,7 +51606,7 @@ index 13e5b47..2262998 100644
  			send_sig(SIGPIPE, current, 0);
  			if (!ret)
  				ret = -EPIPE;
-@@ -1973,7 +1973,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+@@ -1975,7 +1975,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
  	 * return EAGAIN if we have the potential of some data in the
  	 * future, otherwise just return 0
  	 */
@@ -52113,25 +51877,12 @@ index 4e00cf0..3374374 100644
  
  	if (!IS_ERR(s))
  		kfree(s);
-diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
-index deee09e..1c74028 100644
---- a/fs/xfs/xfs_mount.h
-+++ b/fs/xfs/xfs_mount.h
-@@ -193,7 +193,7 @@ typedef struct xfs_mount {
- #ifdef HAVE_PERCPU_SB
- 	xfs_icsb_cnts_t __percpu *m_sb_cnts;	/* per-cpu superblock counters */
- 	unsigned long		m_icsb_counters; /* disabled per-cpu counters */
--	struct notifier_block	m_icsb_notifier; /* hotplug cpu notifier */
-+	notifier_block_no_const	m_icsb_notifier; /* hotplug cpu notifier */
- 	struct mutex		m_icsb_mutex;	/* balancer sync lock */
- #endif
- 	struct xfs_mru_cache	*m_filestream;  /* per-mount filestream data */
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..3900064
+index 0000000..ba93743
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,964 @@
+@@ -0,0 +1,982 @@
 +#
 +# grecurity configuration
 +#
@@ -52956,6 +52707,24 @@ index 0000000..3900064
 +	  prevents a socket from lasting more than 45 seconds in LAST_ACK
 +	  state.
 +
++config GRKERNSEC_NO_SIMULT_CONNECT
++	bool "Disable TCP Simultaneous Connect"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on NET
++	help
++	  If you say Y here, a feature by Willy Tarreau will be enabled that
++	  removes a weakness in Linux's strict implementation of TCP that
++	  allows two clients to connect to each other without either entering
++	  a listening state.  The weakness allows an attacker to easily prevent
++	  a client from connecting to a known server provided the source port
++	  for the connection is guessed correctly.
++
++	  As the weakness could be used to prevent an antivirus or IPS from
++	  fetching updates, or prevent an SSL gateway from fetching a CRL,
++	  it should be eliminated by enabling this option.  Though Linux is
++	  one of few operating systems supporting simultaneous connect, it
++	  has no legitimate use in practice and is rarely supported by firewalls.
++	
 +config GRKERNSEC_SOCKET
 +	bool "Socket restrictions"
 +	depends on NET
@@ -57414,10 +57183,10 @@ index 0000000..6d21049
 +
 diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
 new file mode 100644
-index 0000000..decb035
+index 0000000..a340c17
 --- /dev/null
 +++ b/grsecurity/gracl_fs.c
-@@ -0,0 +1,437 @@
+@@ -0,0 +1,431 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/types.h>
@@ -57825,7 +57594,6 @@ index 0000000..decb035
 +{
 +	u16 id;
 +	char *rolename;
-+	struct file *exec_file;
 +
 +	if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
 +	    !(current->role->roletype & GR_ROLE_PERSIST))) {
@@ -57835,13 +57603,8 @@ index 0000000..decb035
 +		gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
 +	}
 +
-+	write_lock(&grsec_exec_file_lock);
-+	exec_file = current->exec_file;
-+	current->exec_file = NULL;
-+	write_unlock(&grsec_exec_file_lock);
-+
-+	if (exec_file)
-+		fput(exec_file);
++	gr_put_exec_file(current);
++	return;
 +}
 +
 +int
@@ -61963,19 +61726,6 @@ index 0000000..9f7b1ac
 +
 +	return retval;
 +}
-diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
-index 0daa0fb..f548aa4 100644
---- a/include/acpi/acpi_bus.h
-+++ b/include/acpi/acpi_bus.h
-@@ -107,7 +107,7 @@ struct acpi_device_ops {
- 	acpi_op_bind bind;
- 	acpi_op_unbind unbind;
- 	acpi_op_notify notify;
--};
-+} __no_const;
- 
- #define ACPI_DRIVER_ALL_NOTIFY_EVENTS	0x1	/* system AND device events */
- 
 diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
 index 77ff547..181834f 100644
 --- a/include/asm-generic/4level-fixup.h
@@ -62642,18 +62392,9 @@ index 3fd8280..2b3c415 100644
  
  	struct list_head filelist;
 diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
-index e01cc80..319855d 100644
+index e01cc80..6fb6f25 100644
 --- a/include/drm/drm_crtc_helper.h
 +++ b/include/drm/drm_crtc_helper.h
-@@ -81,7 +81,7 @@ struct drm_crtc_helper_funcs {
- 
- 	/* disable crtc when not in use - more explicit than dpms off */
- 	void (*disable)(struct drm_crtc *crtc);
--};
-+} __no_const;
- 
- /**
-  * drm_encoder_helper_funcs - helper operations for encoders
 @@ -109,7 +109,7 @@ struct drm_encoder_helper_funcs {
  					    struct drm_connector *connector);
  	/* disable encoder when not in use - more explicit than dpms off */
@@ -62689,21 +62430,8 @@ index 22ef21c..75904ba 100644
  	__AAL_STAT_ITEMS
  #undef __HANDLE_ITEM
  };
-diff --git a/include/linux/backlight.h b/include/linux/backlight.h
-index 5ffc6dd..e5a41ab 100644
---- a/include/linux/backlight.h
-+++ b/include/linux/backlight.h
-@@ -98,7 +98,7 @@ struct backlight_device {
- 	const struct backlight_ops *ops;
- 
- 	/* The framebuffer notifier block */
--	struct notifier_block fb_notif;
-+	notifier_block_no_const fb_notif;
- 
- 	struct device dev;
- };
 diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
-index cfcc6bf..9a7c73e 100644
+index de0628e..38f42eb 100644
 --- a/include/linux/binfmts.h
 +++ b/include/linux/binfmts.h
 @@ -75,6 +75,7 @@ struct linux_binfmt {
@@ -62798,18 +62526,6 @@ index 42e55de..1cd0e66 100644
  
  extern struct cleancache_ops
  	cleancache_register_ops(struct cleancache_ops *ops);
-diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
-index f9f5e9e..9fb4d36 100644
---- a/include/linux/clk-provider.h
-+++ b/include/linux/clk-provider.h
-@@ -112,6 +112,7 @@ struct clk_ops {
- 				    unsigned long);
- 	void		(*init)(struct clk_hw *hw);
- };
-+typedef struct clk_ops __no_const clk_ops_no_const;
- 
- /**
-  * struct clk_init_data - holds init data that's common to all clocks and is
 diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
 index 412bc6c..c31666e 100644
 --- a/include/linux/compiler-gcc4.h
@@ -63040,19 +62756,6 @@ index 7925bf0..d5143d2 100644
  #define free(a) kfree(a)
  
  #define large_malloc(a) vmalloc(a)
-diff --git a/include/linux/devfreq.h b/include/linux/devfreq.h
-index 281c72a..6438a5e 100644
---- a/include/linux/devfreq.h
-+++ b/include/linux/devfreq.h
-@@ -152,7 +152,7 @@ struct devfreq {
- 	struct device dev;
- 	struct devfreq_dev_profile *profile;
- 	const struct devfreq_governor *governor;
--	struct notifier_block nb;
-+	notifier_block_no_const nb;
- 
- 	unsigned long polling_jiffies;
- 	unsigned long previous_freq;
 diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
 index 94af418..b1ca7a2 100644
 --- a/include/linux/dma-mapping.h
@@ -63082,19 +62785,6 @@ index d3201e4..8281e63 100644
  	struct dma_pinned_list *pinned_list, struct page *page,
  	unsigned int offset, size_t len);
  
-diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 8670eb1..7eb3ade 100644
---- a/include/linux/efi.h
-+++ b/include/linux/efi.h
-@@ -643,7 +643,7 @@ struct efivar_operations {
- 	efi_get_variable_t *get_variable;
- 	efi_get_next_variable_t *get_next_variable;
- 	efi_set_variable_t *set_variable;
--};
-+} __no_const;
- 
- struct efivars {
- 	/*
 diff --git a/include/linux/elf.h b/include/linux/elf.h
 index 8c9048e..16a4665 100644
 --- a/include/linux/elf.h
@@ -63115,19 +62805,6 @@ index 8c9048e..16a4665 100644
  
  #endif
  
-diff --git a/include/linux/extcon.h b/include/linux/extcon.h
-index 2c26c14..8d0cb0f 100644
---- a/include/linux/extcon.h
-+++ b/include/linux/extcon.h
-@@ -165,7 +165,7 @@ struct extcon_cable {
-  * @previous_value	the saved previous event value.
-  */
- struct extcon_specific_cable_nb {
--	struct notifier_block internal_nb;
-+	notifier_block_no_const internal_nb;
- 	struct notifier_block *user_nb;
- 	int cable_index;
- 	struct extcon_dev *edev;
 diff --git a/include/linux/filter.h b/include/linux/filter.h
 index 24d251f..7afb83d 100644
 --- a/include/linux/filter.h
@@ -63150,19 +62827,6 @@ index 24d251f..7afb83d 100644
  	struct rcu_head		rcu;
  	struct sock_filter     	insns[0];
  };
-diff --git a/include/linux/firewire.h b/include/linux/firewire.h
-index 191501a..3952e37 100644
---- a/include/linux/firewire.h
-+++ b/include/linux/firewire.h
-@@ -438,7 +438,7 @@ struct fw_iso_context {
- 	union {
- 		fw_iso_callback_t sc;
- 		fw_iso_mc_callback_t mc;
--	} callback;
-+	} __no_const callback;
- 	void *callback_data;
- };
- 
 diff --git a/include/linux/frontswap.h b/include/linux/frontswap.h
 index 3044254..9767f41 100644
 --- a/include/linux/frontswap.h
@@ -63238,31 +62902,10 @@ index 0fbfb46..52a6556 100644
  }
  
  /*
-diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
-index 63d966d..cdcb717 100644
---- a/include/linux/fsnotify_backend.h
-+++ b/include/linux/fsnotify_backend.h
-@@ -105,6 +105,7 @@ struct fsnotify_ops {
- 	void (*freeing_mark)(struct fsnotify_mark *mark, struct fsnotify_group *group);
- 	void (*free_event_priv)(struct fsnotify_event_private_data *priv);
- };
-+typedef struct fsnotify_ops __no_const fsnotify_ops_no_const;
- 
- /*
-  * A group is a "thing" that wants to receive notification about filesystem
 diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
-index 642928c..e6c83a7 100644
+index 642928c..93afe6a 100644
 --- a/include/linux/ftrace_event.h
 +++ b/include/linux/ftrace_event.h
-@@ -97,7 +97,7 @@ struct trace_event_functions {
- 	trace_print_func	raw;
- 	trace_print_func	hex;
- 	trace_print_func	binary;
--};
-+} __no_const;
- 
- struct trace_event {
- 	struct hlist_node		node;
 @@ -266,7 +266,7 @@ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
  extern int trace_add_event_call(struct ftrace_event_call *call);
  extern void trace_remove_event_call(struct ftrace_event_call *call);
@@ -64430,19 +64073,6 @@ index 0000000..e7ffaaf
 +			    const int protocol);
 +
 +#endif
-diff --git a/include/linux/hid.h b/include/linux/hid.h
-index c076041..6f54d73 100644
---- a/include/linux/hid.h
-+++ b/include/linux/hid.h
-@@ -671,7 +671,7 @@ struct hid_ll_driver {
- 			unsigned int code, int value);
- 
- 	int (*parse)(struct hid_device *hdev);
--};
-+} __no_const;
- 
- #define	PM_HINT_FULLON	1<<5
- #define PM_HINT_NORMAL	1<<1
 diff --git a/include/linux/highmem.h b/include/linux/highmem.h
 index ef788b5..ac41b7b 100644
 --- a/include/linux/highmem.h
@@ -64466,19 +64096,6 @@ index ef788b5..ac41b7b 100644
  static inline void zero_user_segments(struct page *page,
  	unsigned start1, unsigned end1,
  	unsigned start2, unsigned end2)
-diff --git a/include/linux/hsi/hsi.h b/include/linux/hsi/hsi.h
-index 56fae86..5565cde 100644
---- a/include/linux/hsi/hsi.h
-+++ b/include/linux/hsi/hsi.h
-@@ -132,7 +132,7 @@ struct hsi_client {
- 	/* private: */
- 	void			(*ehandler)(struct hsi_client *, unsigned long);
- 	unsigned int		pclaimed:1;
--	struct notifier_block	nb;
-+	notifier_block_no_const	nb;
- };
- 
- #define to_hsi_client(dev) container_of(dev, struct hsi_client, device)
 diff --git a/include/linux/i2c.h b/include/linux/i2c.h
 index 800de22..7a2fa46 100644
 --- a/include/linux/i2c.h
@@ -64517,27 +64134,6 @@ index aff7ad8..3942bbd 100644
  
  extern int register_pppox_proto(int proto_num, const struct pppox_proto *pp);
  extern void unregister_pppox_proto(int proto_num);
-diff --git a/include/linux/if_team.h b/include/linux/if_team.h
-index 0245def..1199c5a 100644
---- a/include/linux/if_team.h
-+++ b/include/linux/if_team.h
-@@ -111,6 +111,7 @@ struct team_mode_ops {
- 	void (*port_enabled)(struct team *team, struct team_port *port);
- 	void (*port_disabled)(struct team *team, struct team_port *port);
- };
-+typedef struct team_mode_ops __no_const team_mode_ops_no_const;
- 
- enum team_option_type {
- 	TEAM_OPTION_TYPE_U32,
-@@ -185,7 +186,7 @@ struct team {
- 	struct list_head option_inst_list; /* list of option instances */
- 
- 	const struct team_mode *mode;
--	struct team_mode_ops ops;
-+	team_mode_ops_no_const ops;
- 	bool queue_override_enabled;
- 	struct list_head *qom_lists; /* array of queue override mapping lists */
- 	long mode_priv[TEAM_MODE_PRIV_LONGS];
 diff --git a/include/linux/init.h b/include/linux/init.h
 index e59041e..df0a975 100644
 --- a/include/linux/init.h
@@ -64632,19 +64228,6 @@ index 6d087c5..401cab8 100644
  	.fs		= &init_fs,					\
  	.files		= &init_files,					\
  	.signal		= &init_signals,				\
-diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
-index 78e2ada..745564d 100644
---- a/include/linux/intel-iommu.h
-+++ b/include/linux/intel-iommu.h
-@@ -296,7 +296,7 @@ struct iommu_flush {
- 			      u8 fm, u64 type);
- 	void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
- 			    unsigned int size_order, u64 type);
--};
-+} __no_const;
- 
- enum {
- 	SR_DMAR_FECTL_REG,
 diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
 index 5e4e617..eee383d 100644
 --- a/include/linux/interrupt.h
@@ -64673,19 +64256,6 @@ index 5e4e617..eee383d 100644
  extern void softirq_init(void);
  extern void __raise_softirq_irqoff(unsigned int nr);
  
-diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
-index 5499c92..e6770b3 100644
---- a/include/linux/ipc_namespace.h
-+++ b/include/linux/ipc_namespace.h
-@@ -50,7 +50,7 @@ struct ipc_namespace {
- 	 */
- 	int		shm_rmid_forced;
- 
--	struct notifier_block ipcns_nb;
-+	notifier_block_no_const ipcns_nb;
- 
- 	/* The kern_mount of the mqueuefs sb.  We take a ref on it */
- 	struct vfsmount	*mq_mnt;
 diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
 index 6883e19..06992b1 100644
 --- a/include/linux/kallsyms.h
@@ -64810,24 +64380,11 @@ index ecc5543..0e96bcc 100644
  void kvm_arch_exit(void);
  
  int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
-diff --git a/include/linux/lcd.h b/include/linux/lcd.h
-index e00c3b0..2ab1e49 100644
---- a/include/linux/lcd.h
-+++ b/include/linux/lcd.h
-@@ -74,7 +74,7 @@ struct lcd_device {
- 	/* Serialise access to set_power method */
- 	struct mutex update_lock;
- 	/* The framebuffer notifier block */
--	struct notifier_block fb_notif;
-+	notifier_block_no_const fb_notif;
- 
- 	struct device dev;
- };
 diff --git a/include/linux/libata.h b/include/linux/libata.h
-index 77eeeda..062ed69c 100644
+index e931c9a..7aa8f6f 100644
 --- a/include/linux/libata.h
 +++ b/include/linux/libata.h
-@@ -914,7 +914,7 @@ struct ata_port_operations {
+@@ -915,7 +915,7 @@ struct ata_port_operations {
  	 * fields must be pointers.
  	 */
  	const struct ata_port_operations	*inherits;
@@ -64850,46 +64407,8 @@ index cc6d2aa..71febca 100644
  /**
   * list_replace - replace old entry by new one
   * @old : the element to be replaced
-diff --git a/include/linux/memory.h b/include/linux/memory.h
-index ff9a9f8..c715deb 100644
---- a/include/linux/memory.h
-+++ b/include/linux/memory.h
-@@ -143,7 +143,7 @@ struct memory_accessor {
- 			size_t count);
- 	ssize_t (*write)(struct memory_accessor *, const char *buf,
- 			 off_t offset, size_t count);
--};
-+} __no_const;
- 
- /*
-  * Kernel text modification mutex, used for code patching. Users of this lock
-diff --git a/include/linux/mfd/abx500.h b/include/linux/mfd/abx500.h
-index 5d5298d..e3e5a2e 100644
---- a/include/linux/mfd/abx500.h
-+++ b/include/linux/mfd/abx500.h
-@@ -337,6 +337,7 @@ struct abx500_ops {
- 	int (*event_registers_startup_state_get) (struct device *, u8 *);
- 	int (*startup_irq_enabled) (struct device *, unsigned int);
- };
-+typedef struct abx500_ops __no_const abx500_ops_no_const;
- 
- int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
- void abx500_remove_ops(struct device *dev);
-diff --git a/include/linux/mfd/abx500/ux500_chargalg.h b/include/linux/mfd/abx500/ux500_chargalg.h
-index 9b07725..3d55001 100644
---- a/include/linux/mfd/abx500/ux500_chargalg.h
-+++ b/include/linux/mfd/abx500/ux500_chargalg.h
-@@ -19,7 +19,7 @@ struct ux500_charger_ops {
- 	int (*enable) (struct ux500_charger *, int, int, int);
- 	int (*kick_wd) (struct ux500_charger *);
- 	int (*update_curr) (struct ux500_charger *, int);
--};
-+} __no_const;
- 
- /**
-  * struct ux500_charger - power supply ux500 charger sub class
 diff --git a/include/linux/mm.h b/include/linux/mm.h
-index bcaab4e..f842186 100644
+index 280dae5..39046ec 100644
 --- a/include/linux/mm.h
 +++ b/include/linux/mm.h
 @@ -101,6 +101,11 @@ extern unsigned int kobjsize(const void *objp);
@@ -64904,7 +64423,7 @@ index bcaab4e..f842186 100644
  #define VM_DONTDUMP	0x04000000	/* Do not include in the core dump */
  
  #define VM_MIXEDMAP	0x10000000	/* Can contain "struct page" and pure PFN pages */
-@@ -1040,34 +1045,6 @@ int set_page_dirty(struct page *page);
+@@ -1039,34 +1044,6 @@ int set_page_dirty(struct page *page);
  int set_page_dirty_lock(struct page *page);
  int clear_page_dirty_for_io(struct page *page);
  
@@ -64939,7 +64458,7 @@ index bcaab4e..f842186 100644
  extern pid_t
  vm_is_stack(struct task_struct *task, struct vm_area_struct *vma, int in_group);
  
-@@ -1167,6 +1144,15 @@ static inline void sync_mm_rss(struct mm_struct *mm)
+@@ -1166,6 +1143,15 @@ static inline void sync_mm_rss(struct mm_struct *mm)
  }
  #endif
  
@@ -64955,7 +64474,7 @@ index bcaab4e..f842186 100644
  int vma_wants_writenotify(struct vm_area_struct *vma);
  
  extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
-@@ -1185,8 +1171,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
+@@ -1184,8 +1170,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
  {
  	return 0;
  }
@@ -64971,7 +64490,7 @@ index bcaab4e..f842186 100644
  #endif
  
  #ifdef __PAGETABLE_PMD_FOLDED
-@@ -1195,8 +1188,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud,
+@@ -1194,8 +1187,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud,
  {
  	return 0;
  }
@@ -64987,7 +64506,7 @@ index bcaab4e..f842186 100644
  #endif
  
  int __pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
-@@ -1214,11 +1214,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a
+@@ -1213,11 +1213,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a
  		NULL: pud_offset(pgd, address);
  }
  
@@ -65011,7 +64530,7 @@ index bcaab4e..f842186 100644
  #endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */
  
  #if USE_SPLIT_PTLOCKS
-@@ -1448,6 +1460,7 @@ extern unsigned long do_mmap_pgoff(struct file *, unsigned long,
+@@ -1447,6 +1459,7 @@ extern unsigned long do_mmap_pgoff(struct file *, unsigned long,
          unsigned long, unsigned long,
          unsigned long, unsigned long);
  extern int do_munmap(struct mm_struct *, unsigned long, size_t);
@@ -65019,7 +64538,7 @@ index bcaab4e..f842186 100644
  
  /* These take the mm semaphore themselves */
  extern unsigned long vm_brk(unsigned long, unsigned long);
-@@ -1511,6 +1524,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
+@@ -1510,6 +1523,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
  extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
  					     struct vm_area_struct **pprev);
  
@@ -65030,7 +64549,7 @@ index bcaab4e..f842186 100644
  /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
     NULL if none.  Assume start_addr < end_addr. */
  static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -1539,15 +1556,6 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
+@@ -1538,15 +1555,6 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
  	return vma;
  }
  
@@ -65046,7 +64565,7 @@ index bcaab4e..f842186 100644
  struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
  int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
  			unsigned long pfn, unsigned long size, pgprot_t);
-@@ -1653,7 +1661,7 @@ extern int unpoison_memory(unsigned long pfn);
+@@ -1652,7 +1660,7 @@ extern int unpoison_memory(unsigned long pfn);
  extern int sysctl_memory_failure_early_kill;
  extern int sysctl_memory_failure_recovery;
  extern void shake_page(struct page *p, int access);
@@ -65055,7 +64574,7 @@ index bcaab4e..f842186 100644
  extern int soft_offline_page(struct page *page, int flags);
  
  extern void dump_page(struct page *page);
-@@ -1684,5 +1692,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; }
+@@ -1683,5 +1691,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; }
  static inline bool page_is_guard(struct page *page) { return false; }
  #endif /* CONFIG_DEBUG_PAGEALLOC */
  
@@ -65114,19 +64633,6 @@ index 31f8a3a..499f1db 100644
  };
  
  static inline void mm_init_cpumask(struct mm_struct *mm)
-diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
-index 7abb0e1..cf526e3 100644
---- a/include/linux/mmc/host.h
-+++ b/include/linux/mmc/host.h
-@@ -188,7 +188,7 @@ struct mmc_host {
- 	u32			ocr_avail_sdio;	/* SDIO-specific OCR */
- 	u32			ocr_avail_sd;	/* SD-specific OCR */
- 	u32			ocr_avail_mmc;	/* MMC-specific OCR */
--	struct notifier_block	pm_notify;
-+	notifier_block_no_const	pm_notify;
- 	u32			max_current_330;
- 	u32			max_current_300;
- 	u32			max_current_180;
 diff --git a/include/linux/mmiotrace.h b/include/linux/mmiotrace.h
 index c5d5278..f0b68c8 100644
 --- a/include/linux/mmiotrace.h
@@ -65357,19 +64863,6 @@ index d6a5806..7c13347 100644
  	= { .max = ARRAY_SIZE(array), .num = nump,                      \
  	    .ops = &param_ops_##type,					\
  	    .elemsize = sizeof(array[0]), .elem = array };		\
-diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h
-index 81d61e7..eadc192 100644
---- a/include/linux/mtd/mtd.h
-+++ b/include/linux/mtd/mtd.h
-@@ -238,7 +238,7 @@ struct mtd_info {
- 	 */
- 	struct backing_dev_info *backing_dev_info;
- 
--	struct notifier_block reboot_notifier;  /* default mode before reboot */
-+	notifier_block_no_const reboot_notifier;  /* default mode before reboot */
- 
- 	/* ECC status information */
- 	struct mtd_ecc_stats ecc_stats;
 diff --git a/include/linux/namei.h b/include/linux/namei.h
 index 4bf19d8..5268cea 100644
 --- a/include/linux/namei.h
@@ -65474,19 +64967,6 @@ index d65746e..62e72c2 100644
  
  struct atomic_notifier_head {
  	spinlock_t lock;
-diff --git a/include/linux/of_pdt.h b/include/linux/of_pdt.h
-index c65a18a..0c05f3a 100644
---- a/include/linux/of_pdt.h
-+++ b/include/linux/of_pdt.h
-@@ -32,7 +32,7 @@ struct of_pdt_ops {
- 
- 	/* return 0 on success; fill in 'len' with number of bytes in path */
- 	int (*pkg2path)(phandle node, char *buf, const int buflen, int *len);
--};
-+} __no_const;
- 
- extern void *prom_early_alloc(unsigned long size);
- 
 diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
 index a4c5624..79d6d88 100644
 --- a/include/linux/oprofile.h
@@ -65503,47 +64983,6 @@ index a4c5624..79d6d88 100644
   
  /** create a directory */
  struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
-diff --git a/include/linux/padata.h b/include/linux/padata.h
-index 86292be..d67326a 100644
---- a/include/linux/padata.h
-+++ b/include/linux/padata.h
-@@ -152,7 +152,7 @@ struct parallel_data {
-  * @flags: padata flags.
-  */
- struct padata_instance {
--	struct notifier_block		 cpu_notifier;
-+	notifier_block_no_const		 cpu_notifier;
- 	struct workqueue_struct		*wq;
- 	struct parallel_data		*pd;
- 	struct padata_cpumask		cpumask;
-diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
-index b5d1384..70473da 100644
---- a/include/linux/page-flags.h
-+++ b/include/linux/page-flags.h
-@@ -362,7 +362,7 @@ static inline void ClearPageCompound(struct page *page)
-  * pages on the LRU and/or pagecache.
-  */
- TESTPAGEFLAG(Compound, compound)
--__PAGEFLAG(Head, compound)
-+__SETPAGEFLAG(Head, compound)  __CLEARPAGEFLAG(Head, compound)
- 
- /*
-  * PG_reclaim is used in combination with PG_compound to mark the
-@@ -374,8 +374,14 @@ __PAGEFLAG(Head, compound)
-  * PG_compound & PG_reclaim	=> Tail page
-  * PG_compound & ~PG_reclaim	=> Head page
-  */
-+#define PG_head_mask ((1L << PG_compound))
- #define PG_head_tail_mask ((1L << PG_compound) | (1L << PG_reclaim))
- 
-+static inline int PageHead(struct page *page)
-+{
-+	return ((page->flags & PG_head_tail_mask) == PG_head_mask);
-+}
-+
- static inline int PageTail(struct page *page)
- {
- 	return ((page->flags & PG_head_tail_mask) == PG_head_tail_mask);
 diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
 index 6bfb2faa..1204767 100644
 --- a/include/linux/perf_event.h
@@ -65600,19 +65039,6 @@ index 5f28cae..3d23723 100644
  
  extern void s5p_ehci_set_platdata(struct s5p_ehci_platdata *pd);
  
-diff --git a/include/linux/pm_clock.h b/include/linux/pm_clock.h
-index 8348866..25604bd 100644
---- a/include/linux/pm_clock.h
-+++ b/include/linux/pm_clock.h
-@@ -13,7 +13,7 @@
- #include <linux/notifier.h>
- 
- struct pm_clk_notifier_block {
--	struct notifier_block nb;
-+	notifier_block_no_const nb;
- 	struct dev_pm_domain *pm_domain;
- 	char *con_ids[];
- };
 diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
 index f271860..6b3bec5 100644
 --- a/include/linux/pm_runtime.h
@@ -65641,19 +65067,6 @@ index 2110a81..13a11bb 100644
  
  /********** include/linux/timer.h **********/
  /*
-diff --git a/include/linux/power/charger-manager.h b/include/linux/power/charger-manager.h
-index 0e86840..13032aa 100644
---- a/include/linux/power/charger-manager.h
-+++ b/include/linux/power/charger-manager.h
-@@ -88,7 +88,7 @@ struct charger_cable {
- 	/* The charger-manager use Exton framework*/
- 	struct extcon_specific_cable_nb extcon_dev;
- 	struct work_struct wq;
--	struct notifier_block nb;
-+	notifier_block_no_const nb;
- 
- 	/* The state of charger cable */
- 	bool attached;
 diff --git a/include/linux/power/smartreflex.h b/include/linux/power/smartreflex.h
 index 4a496eb..d9c5659 100644
 --- a/include/linux/power/smartreflex.h
@@ -65667,19 +65080,6 @@ index 4a496eb..d9c5659 100644
  
  /**
   * struct omap_sr_nvalue_table	- Smartreflex n-target value info
-diff --git a/include/linux/preempt.h b/include/linux/preempt.h
-index 5a710b9..0b0dab9 100644
---- a/include/linux/preempt.h
-+++ b/include/linux/preempt.h
-@@ -126,7 +126,7 @@ struct preempt_ops {
- 	void (*sched_in)(struct preempt_notifier *notifier, int cpu);
- 	void (*sched_out)(struct preempt_notifier *notifier,
- 			  struct task_struct *next);
--};
-+} __no_const;
- 
- /**
-  * preempt_notifier - key for installing preemption notifiers
 diff --git a/include/linux/printk.h b/include/linux/printk.h
 index 9afc01e..92c32e8 100644
 --- a/include/linux/printk.h
@@ -65702,7 +65102,7 @@ index 9afc01e..92c32e8 100644
  void log_buf_kexec_setup(void);
  void __init setup_log_buf(int early);
 diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
-index 3fd2e87..d93a721 100644
+index 3fd2e87..75db910 100644
 --- a/include/linux/proc_fs.h
 +++ b/include/linux/proc_fs.h
 @@ -155,6 +155,18 @@ static inline struct proc_dir_entry *proc_create(const char *name, umode_t mode,
@@ -65724,15 +65124,6 @@ index 3fd2e87..d93a721 100644
  static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
  	umode_t mode, struct proc_dir_entry *base, 
  	read_proc_t *read_proc, void * data)
-@@ -258,7 +270,7 @@ union proc_op {
- 	int (*proc_show)(struct seq_file *m,
- 		struct pid_namespace *ns, struct pid *pid,
- 		struct task_struct *task);
--};
-+} __no_const;
- 
- struct ctl_table_header;
- struct ctl_table;
 diff --git a/include/linux/random.h b/include/linux/random.h
 index 6330ed4..419c6c3 100644
 --- a/include/linux/random.h
@@ -65821,18 +65212,6 @@ index 91cacc3..b55ff74 100644
  
  /*
   * CONFIG_RELAY kernel API, kernel/relay.c
-diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
-index d901078..0b7d00e 100644
---- a/include/linux/rfkill.h
-+++ b/include/linux/rfkill.h
-@@ -63,6 +63,7 @@ struct rfkill_ops {
- 	void	(*query)(struct rfkill *rfkill, void *data);
- 	int	(*set_block)(void *data, bool blocked);
- };
-+typedef struct rfkill_ops __no_const rfkill_ops_no_const;
- 
- #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
- /**
 diff --git a/include/linux/rio.h b/include/linux/rio.h
 index a3e7842..d973ca6 100644
 --- a/include/linux/rio.h
@@ -66474,18 +65853,6 @@ index 34206b8..f019e06 100644
  }
  
  #endif /* __KERNEL__ */
-diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
-index dc0c3cc..8503fb6 100644
---- a/include/linux/sunrpc/sched.h
-+++ b/include/linux/sunrpc/sched.h
-@@ -106,6 +106,7 @@ struct rpc_call_ops {
- 	void (*rpc_count_stats)(struct rpc_task *, void *);
- 	void (*rpc_release)(void *);
- };
-+typedef struct rpc_call_ops __no_const rpc_call_ops_no_const;
- 
- struct rpc_task_setup {
- 	struct rpc_task *task;
 diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
 index 0b8e3e6..33e0a01 100644
 --- a/include/linux/sunrpc/svc_rdma.h
@@ -66696,7 +66063,7 @@ index 10278d1..e21ec3c 100644
  	unsigned long active_duration;
  
 diff --git a/include/linux/usb/renesas_usbhs.h b/include/linux/usb/renesas_usbhs.h
-index c5d36c6..8478c90 100644
+index c5d36c6..108f4f9 100644
 --- a/include/linux/usb/renesas_usbhs.h
 +++ b/include/linux/usb/renesas_usbhs.h
 @@ -39,7 +39,7 @@ enum {
@@ -66708,15 +66075,6 @@ index c5d36c6..8478c90 100644
  
  /*
   * callback functions for platform
-@@ -97,7 +97,7 @@ struct renesas_usbhs_platform_callback {
- 	 * VBUS control is needed for Host
- 	 */
- 	int (*set_vbus)(struct platform_device *pdev, int enable);
--};
-+} __no_const;
- 
- /*
-  * parameters for renesas usbhs
 diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
 index 6f8fbcf..8259001 100644
 --- a/include/linux/vermagic.h
@@ -66861,74 +66219,31 @@ index 92a86b2..1d9eb3c 100644
  }
  
  static inline void __dec_zone_page_state(struct page *page,
-diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h
-index 944ecdf..a3994fc 100644
---- a/include/media/saa7146_vv.h
-+++ b/include/media/saa7146_vv.h
-@@ -161,8 +161,8 @@ struct saa7146_ext_vv
- 	int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
- 
- 	/* the extension can override this */
--	struct v4l2_ioctl_ops vid_ops;
--	struct v4l2_ioctl_ops vbi_ops;
-+	v4l2_ioctl_ops_no_const vid_ops;
-+	v4l2_ioctl_ops_no_const vbi_ops;
- 	/* pointer to the saa7146 core ops */
- 	const struct v4l2_ioctl_ops *core_ops;
- 
 diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
-index 95d1c91..19a5d94 100644
+index 95d1c91..6798cca 100644
 --- a/include/media/v4l2-dev.h
 +++ b/include/media/v4l2-dev.h
-@@ -76,7 +76,8 @@ struct v4l2_file_operations {
+@@ -76,7 +76,7 @@ struct v4l2_file_operations {
  	int (*mmap) (struct file *, struct vm_area_struct *);
  	int (*open) (struct file *);
  	int (*release) (struct file *);
 -};
 +} __do_const;
-+typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const;
  
  /*
   * Newer version of video_device, handled by videodev2.c
 diff --git a/include/media/v4l2-ioctl.h b/include/media/v4l2-ioctl.h
-index e48b571..cec1748 100644
+index e48b571..7e40de4 100644
 --- a/include/media/v4l2-ioctl.h
 +++ b/include/media/v4l2-ioctl.h
-@@ -281,7 +281,7 @@ struct v4l2_ioctl_ops {
- 	long (*vidioc_default)	       (struct file *file, void *fh,
+@@ -282,7 +282,6 @@ struct v4l2_ioctl_ops {
  					bool valid_prio, int cmd, void *arg);
  };
--
-+typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
  
+-
  /* v4l debugging and diagnostics */
  
-diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
-index ede0369..067cf12 100644
---- a/include/net/bluetooth/bluetooth.h
-+++ b/include/net/bluetooth/bluetooth.h
-@@ -204,7 +204,7 @@ struct bt_sock_list {
- 	struct hlist_head head;
- 	rwlock_t          lock;
- #ifdef CONFIG_PROC_FS
--        struct file_operations   fops;
-+        file_operations_no_const fops;
-         int (* custom_seq_show)(struct seq_file *, void *);
- #endif
- };
-diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
-index bcb9cc3..f4ec722e 100644
---- a/include/net/caif/caif_hsi.h
-+++ b/include/net/caif/caif_hsi.h
-@@ -98,7 +98,7 @@ struct cfhsi_cb_ops {
- 	void (*rx_done_cb) (struct cfhsi_cb_ops *drv);
- 	void (*wake_up_cb) (struct cfhsi_cb_ops *drv);
- 	void (*wake_down_cb) (struct cfhsi_cb_ops *drv);
--};
-+} __no_const;
- 
- /* Structure implemented by HSI device. */
- struct cfhsi_ops {
+ /* Debug bitmask flags to be used on V4L2 */
 diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
 index 9e5425b..8136ffc 100644
 --- a/include/net/caif/cfctrl.h
@@ -66966,10 +66281,10 @@ index 628e11b..4c475df 100644
  
  #endif
 diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h
-index 4fd8a4b..123e31a 100644
+index e5062c9..e709988 100644
 --- a/include/net/gro_cells.h
 +++ b/include/net/gro_cells.h
-@@ -30,7 +30,7 @@ static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *s
+@@ -29,7 +29,7 @@ static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *s
  		cell += skb_get_rx_queue(skb) & gcells->gro_cells_mask;
  
  	if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) {
@@ -66979,7 +66294,7 @@ index 4fd8a4b..123e31a 100644
  		return;
  	}
 diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
-index ba1d361..8163a9c 100644
+index 1832927..ce39aea 100644
 --- a/include/net/inet_connection_sock.h
 +++ b/include/net/inet_connection_sock.h
 @@ -62,7 +62,7 @@ struct inet_connection_sock_af_ops {
@@ -67055,19 +66370,6 @@ index ee75ccd..2cc2b95 100644
  	atomic_t		weight;		/* server weight */
  
  	atomic_t		refcnt;		/* reference counter */
-diff --git a/include/net/irda/ircomm_core.h b/include/net/irda/ircomm_core.h
-index 69b610a..fe3962c 100644
---- a/include/net/irda/ircomm_core.h
-+++ b/include/net/irda/ircomm_core.h
-@@ -51,7 +51,7 @@ typedef struct {
- 	int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
- 	int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *, 
- 				  struct ircomm_info *);	
--} call_t;
-+} __no_const call_t;
- 
- struct ircomm_cb {
- 	irda_queue_t queue;
 diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
 index 80ffde3..968b0f4 100644
 --- a/include/net/irda/ircomm_tty.h
@@ -67279,7 +66581,7 @@ index c945fba..e162e56 100644
  /**
   * sk_page_frag - return an appropriate page_frag
 diff --git a/include/net/tcp.h b/include/net/tcp.h
-index 4af45e3..32163a9 100644
+index 4af45e3..af97861 100644
 --- a/include/net/tcp.h
 +++ b/include/net/tcp.h
 @@ -531,7 +531,7 @@ extern void tcp_retransmit_timer(struct sock *sk);
@@ -67311,28 +66613,6 @@ index 4af45e3..32163a9 100644
  };
  
  #define TCP_SKB_CB(__skb)	((struct tcp_skb_cb *)&((__skb)->cb[0]))
-@@ -1563,7 +1563,7 @@ struct tcp_seq_afinfo {
- 	char				*name;
- 	sa_family_t			family;
- 	const struct file_operations	*seq_fops;
--	struct seq_operations		seq_ops;
-+	seq_operations_no_const		seq_ops;
- };
- 
- struct tcp_iter_state {
-diff --git a/include/net/udp.h b/include/net/udp.h
-index 065f379..b661b40 100644
---- a/include/net/udp.h
-+++ b/include/net/udp.h
-@@ -244,7 +244,7 @@ struct udp_seq_afinfo {
- 	sa_family_t			family;
- 	struct udp_table		*udp_table;
- 	const struct file_operations	*seq_fops;
--	struct seq_operations		seq_ops;
-+	seq_operations_no_const		seq_ops;
- };
- 
- struct udp_iter_state {
 diff --git a/include/net/xfrm.h b/include/net/xfrm.h
 index 63445ed..74ef61d 100644
 --- a/include/net/xfrm.h
@@ -67420,72 +66700,8 @@ index b797e8f..8e2c3aa 100644
  
  
  /**
-diff --git a/include/sound/ak4xxx-adda.h b/include/sound/ak4xxx-adda.h
-index 030b87c..98a6954 100644
---- a/include/sound/ak4xxx-adda.h
-+++ b/include/sound/ak4xxx-adda.h
-@@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
- 	void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
- 		      unsigned char val);
- 	void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
--};
-+} __no_const;
- 
- #define AK4XXX_IMAGE_SIZE	(AK4XXX_MAX_CHIPS * 16)	/* 64 bytes */
- 
-diff --git a/include/sound/hwdep.h b/include/sound/hwdep.h
-index 8c05e47..2b5df97 100644
---- a/include/sound/hwdep.h
-+++ b/include/sound/hwdep.h
-@@ -49,7 +49,7 @@ struct snd_hwdep_ops {
- 			  struct snd_hwdep_dsp_status *status);
- 	int (*dsp_load)(struct snd_hwdep *hw,
- 			struct snd_hwdep_dsp_image *image);
--};
-+} __no_const;
- 
- struct snd_hwdep {
- 	struct snd_card *card;
-diff --git a/include/sound/info.h b/include/sound/info.h
-index 9ca1a49..aba1728 100644
---- a/include/sound/info.h
-+++ b/include/sound/info.h
-@@ -44,7 +44,7 @@ struct snd_info_entry_text {
- 		     struct snd_info_buffer *buffer);
- 	void (*write)(struct snd_info_entry *entry,
- 		      struct snd_info_buffer *buffer);
--};
-+} __no_const;
- 
- struct snd_info_entry_ops {
- 	int (*open)(struct snd_info_entry *entry,
-diff --git a/include/sound/pcm.h b/include/sound/pcm.h
-index 6268a41..de9b9d1 100644
---- a/include/sound/pcm.h
-+++ b/include/sound/pcm.h
-@@ -81,6 +81,7 @@ struct snd_pcm_ops {
- 	int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
- 	int (*ack)(struct snd_pcm_substream *substream);
- };
-+typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
- 
- /*
-  *
-diff --git a/include/sound/sb16_csp.h b/include/sound/sb16_csp.h
-index 7e95056..52df55a 100644
---- a/include/sound/sb16_csp.h
-+++ b/include/sound/sb16_csp.h
-@@ -146,7 +146,7 @@ struct snd_sb_csp_ops {
- 	int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
- 	int (*csp_stop) (struct snd_sb_csp * p);
- 	int (*csp_qsound_transfer) (struct snd_sb_csp * p);
--};
-+} __no_const;
- 
- /*
-  * CSP private data
 diff --git a/include/sound/soc.h b/include/sound/soc.h
-index 91244a0..11c542e 100644
+index 91244a0..89ca1a7 100644
 --- a/include/sound/soc.h
 +++ b/include/sound/soc.h
 @@ -769,7 +769,7 @@ struct snd_soc_codec_driver {
@@ -67506,41 +66722,10 @@ index 91244a0..11c542e 100644
  
  struct snd_soc_platform {
  	const char *name;
-@@ -1031,7 +1031,7 @@ struct snd_soc_pcm_runtime {
- 	struct snd_soc_dai_link *dai_link;
- 	struct mutex pcm_mutex;
- 	enum snd_soc_pcm_subclass pcm_subclass;
--	struct snd_pcm_ops ops;
-+	snd_pcm_ops_no_const ops;
- 
- 	unsigned int dev_registered:1;
- 
-diff --git a/include/sound/tea575x-tuner.h b/include/sound/tea575x-tuner.h
-index 098c4de..171054b 100644
---- a/include/sound/tea575x-tuner.h
-+++ b/include/sound/tea575x-tuner.h
-@@ -49,7 +49,7 @@ struct snd_tea575x_ops {
- 
- struct snd_tea575x {
- 	struct v4l2_device *v4l2_dev;
--	struct v4l2_file_operations fops;
-+	v4l2_file_operations_no_const fops;
- 	struct video_device vd;		/* video device */
- 	int radio_nr;			/* radio_nr */
- 	bool tea5759;			/* 5759 chip is present */
 diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
-index 5be8937..a8e46e9 100644
+index 5be8937..cefbdd5 100644
 --- a/include/target/target_core_base.h
 +++ b/include/target/target_core_base.h
-@@ -434,7 +434,7 @@ struct t10_reservation_ops {
- 	int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32);
- 	int (*t10_pr_register)(struct se_cmd *);
- 	int (*t10_pr_clear)(struct se_cmd *);
--};
-+} __no_const;
- 
- struct t10_reservation {
- 	/* Reservation effects all target ports */
 @@ -758,7 +758,7 @@ struct se_device {
  	spinlock_t		stats_lock;
  	/* Active commands on this virtual SE device */
@@ -68629,7 +67814,7 @@ index 40414e9..c920b72 100644
  		audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
  				 &status_set, sizeof(status_set));
 diff --git a/kernel/auditsc.c b/kernel/auditsc.c
-index 2f186ed..afb42c2 100644
+index 157e989..b28b365 100644
 --- a/kernel/auditsc.c
 +++ b/kernel/auditsc.c
 @@ -2352,7 +2352,7 @@ int auditsc_get_stamp(struct audit_context *ctx,
@@ -68747,10 +67932,10 @@ index 493d972..ea17248 100644
 +	return ns_capable_nolog(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
 +}
 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index f24f724..0612ec45 100644
+index ad99830..992d8a7 100644
 --- a/kernel/cgroup.c
 +++ b/kernel/cgroup.c
-@@ -5518,7 +5518,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
+@@ -5514,7 +5514,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
  		struct css_set *cg = link->cg;
  		struct task_struct *task;
  		int count = 0;
@@ -69268,7 +68453,7 @@ index dbccf83..8c66482 100644
  
  	/*
 diff --git a/kernel/exit.c b/kernel/exit.c
-index 346616c..a86ec83 100644
+index 346616c..f103b28 100644
 --- a/kernel/exit.c
 +++ b/kernel/exit.c
 @@ -182,6 +182,10 @@ void release_task(struct task_struct * p)
@@ -69291,16 +68476,17 @@ index 346616c..a86ec83 100644
  	recalc_sigpending();
  	spin_unlock_irq(&current->sighand->siglock);
  	return 0;
-@@ -430,6 +434,8 @@ void daemonize(const char *name, ...)
+@@ -430,6 +434,9 @@ void daemonize(const char *name, ...)
  	vsnprintf(current->comm, sizeof(current->comm), name, args);
  	va_end(args);
  
++	gr_put_exec_file(current);
 +	gr_set_kernel_label(current);
 +
  	/*
  	 * If we were started as result of loading a module, close all of the
  	 * user space pages.  We don't need them, and if we didn't close them
-@@ -812,6 +818,8 @@ void do_exit(long code)
+@@ -812,6 +819,8 @@ void do_exit(long code)
  	struct task_struct *tsk = current;
  	int group_dead;
  
@@ -69309,7 +68495,7 @@ index 346616c..a86ec83 100644
  	profile_task_exit(tsk);
  
  	WARN_ON(blk_needs_flush_plug(tsk));
-@@ -828,7 +836,6 @@ void do_exit(long code)
+@@ -828,7 +837,6 @@ void do_exit(long code)
  	 * mm_release()->clear_child_tid() from writing to a user-controlled
  	 * kernel address.
  	 */
@@ -69317,7 +68503,7 @@ index 346616c..a86ec83 100644
  
  	ptrace_event(PTRACE_EVENT_EXIT, code);
  
-@@ -887,6 +894,9 @@ void do_exit(long code)
+@@ -887,6 +895,9 @@ void do_exit(long code)
  	tsk->exit_code = code;
  	taskstats_exit(tsk, group_dead);
  
@@ -69327,7 +68513,7 @@ index 346616c..a86ec83 100644
  	exit_mm(tsk);
  
  	if (group_dead)
-@@ -1007,7 +1017,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
+@@ -1007,7 +1018,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
   * Take down every thread in the group.  This is called by fatal signals
   * as well as by sys_exit_group (below).
   */
@@ -69337,7 +68523,7 @@ index 346616c..a86ec83 100644
  {
  	struct signal_struct *sig = current->signal;
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 8b20ab7..58f2e45 100644
+index acc4cb6..b524cb5 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -318,7 +318,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -69586,7 +68772,7 @@ index 8b20ab7..58f2e45 100644
  	return 0;
  }
  
-@@ -1184,6 +1234,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1183,6 +1233,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
  	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
  #endif
  	retval = -EAGAIN;
@@ -69596,17 +68782,19 @@ index 8b20ab7..58f2e45 100644
  	if (atomic_read(&p->real_cred->user->processes) >=
  			task_rlimit(p, RLIMIT_NPROC)) {
  		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-@@ -1402,6 +1455,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- 	/* Need tasklist lock for parent etc handling! */
- 	write_lock_irq(&tasklist_lock);
+@@ -1422,6 +1475,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ 		goto bad_fork_free_pid;
+ 	}
  
-+	/* synchronizes with gr_set_acls() */
++	/* synchronizes with gr_set_acls()
++	   we need to call this past the point of no return for fork()
++	*/
 +	gr_copy_label(p);
 +
- 	/* CLONE_PARENT re-uses the old parent */
- 	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
- 		p->real_parent = current->real_parent;
-@@ -1512,6 +1568,8 @@ bad_fork_cleanup_count:
+ 	if (clone_flags & CLONE_THREAD) {
+ 		current->signal->nr_threads++;
+ 		atomic_inc(&current->signal->live);
+@@ -1505,6 +1563,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -69615,7 +68803,7 @@ index 8b20ab7..58f2e45 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1612,6 +1670,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1605,6 +1665,8 @@ long do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -69624,7 +68812,7 @@ index 8b20ab7..58f2e45 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1721,7 +1781,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1714,7 +1776,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -69633,7 +68821,7 @@ index 8b20ab7..58f2e45 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -1810,7 +1870,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1803,7 +1865,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			spin_lock(&fs->lock);
  			current->fs = new_fs;
@@ -71374,7 +70562,7 @@ index 87da817..30ddd13 100644
  
  		if (pm_wakeup_pending()) {
 diff --git a/kernel/printk.c b/kernel/printk.c
-index 2d607f4..7413773 100644
+index f8e0b5a..dda2a5c 100644
 --- a/kernel/printk.c
 +++ b/kernel/printk.c
 @@ -817,6 +817,11 @@ static int check_syslog_permissions(int type, bool from_file)
@@ -72209,7 +71397,7 @@ index 6b800a1..0c36227 100644
  	int this_cpu = smp_processor_id();
  	struct rq *this_rq = cpu_rq(this_cpu);
 diff --git a/kernel/signal.c b/kernel/signal.c
-index 0af8868..a00119d 100644
+index e4d4014..76cf5dd 100644
 --- a/kernel/signal.c
 +++ b/kernel/signal.c
 @@ -49,12 +49,12 @@ static struct kmem_cache *sigqueue_cachep;
@@ -73170,7 +72358,7 @@ index 51b7159..18137d6 100644
  
  	ftrace_graph_active++;
 diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
-index 4cb5e51..6010f39 100644
+index 4cb5e51..e7e05d9 100644
 --- a/kernel/trace/ring_buffer.c
 +++ b/kernel/trace/ring_buffer.c
 @@ -346,9 +346,9 @@ struct buffer_data_page {
@@ -73196,15 +72384,6 @@ index 4cb5e51..6010f39 100644
  	local_t				entries;
  	local_t				committing;
  	local_t				commits;
-@@ -490,7 +490,7 @@ struct ring_buffer {
- 	struct ring_buffer_per_cpu	**buffers;
- 
- #ifdef CONFIG_HOTPLUG_CPU
--	struct notifier_block		cpu_notify;
-+	notifier_block_no_const		cpu_notify;
- #endif
- 	u64				(*clock)(void);
- };
 @@ -860,8 +860,8 @@ static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer,
  	 *
  	 * We add a counter to the write field to denote this.
@@ -73575,7 +72754,7 @@ index fd3c8aa..5f324a6 100644
  	}
  	entry	= ring_buffer_event_data(event);
 diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
-index 123b189..97b81f5 100644
+index 123b189..4383774 100644
 --- a/kernel/trace/trace_output.c
 +++ b/kernel/trace/trace_output.c
 @@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s, const struct path *path)
@@ -73587,6 +72766,24 @@ index 123b189..97b81f5 100644
  		if (p) {
  			s->len = p - s->buffer;
  			return 1;
+@@ -825,13 +825,13 @@ int register_ftrace_event(struct trace_event *event)
+ 	}
+ 
+ 	if (event->funcs->trace == NULL)
+-		event->funcs->trace = trace_nop_print;
++		*(void **)&event->funcs->trace = trace_nop_print;
+ 	if (event->funcs->raw == NULL)
+-		event->funcs->raw = trace_nop_print;
++		*(void **)&event->funcs->raw = trace_nop_print;
+ 	if (event->funcs->hex == NULL)
+-		event->funcs->hex = trace_nop_print;
++		*(void **)&event->funcs->hex = trace_nop_print;
+ 	if (event->funcs->binary == NULL)
+-		event->funcs->binary = trace_nop_print;
++		*(void **)&event->funcs->binary = trace_nop_print;
+ 
+ 	key = event->type & (EVENT_HASHSIZE - 1);
+ 
 diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
 index 0c1b1657..95337e9 100644
 --- a/kernel/trace/trace_stack.c
@@ -74183,10 +73380,10 @@ index a0aaf0e..20325c3 100644
  	 * Make sure the vma is shared, that it supports prefaulting,
  	 * and that the remapped range is valid and fully within
 diff --git a/mm/highmem.c b/mm/highmem.c
-index 2da13a5..9568fec 100644
+index 09fc744..3936897 100644
 --- a/mm/highmem.c
 +++ b/mm/highmem.c
-@@ -137,9 +137,10 @@ static void flush_all_zero_pkmaps(void)
+@@ -138,9 +138,10 @@ static void flush_all_zero_pkmaps(void)
  		 * So no dangers, even with speculative execution.
  		 */
  		page = pte_page(pkmap_page_table[i]);
@@ -74198,7 +73395,7 @@ index 2da13a5..9568fec 100644
  		set_page_address(page, NULL);
  		need_flush = 1;
  	}
-@@ -198,9 +199,11 @@ start:
+@@ -199,9 +200,11 @@ start:
  		}
  	}
  	vaddr = PKMAP_ADDR(last_pkmap_nr);
@@ -74225,10 +73422,10 @@ index 40f17c3..c1cc011 100644
  	/* if an huge pmd materialized from under us just retry later */
  	if (unlikely(pmd_trans_huge(*pmd)))
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 59a0059..b3f3d86 100644
+index f198aca..a19a5a5 100644
 --- a/mm/hugetlb.c
 +++ b/mm/hugetlb.c
-@@ -2518,6 +2518,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2509,6 +2509,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
  	return 1;
  }
  
@@ -74256,7 +73453,7 @@ index 59a0059..b3f3d86 100644
  /*
   * Hugetlb_cow() should be called with page lock of the original hugepage held.
   * Called with hugetlb_instantiation_mutex held and pte_page locked so we
-@@ -2636,6 +2657,11 @@ retry_avoidcopy:
+@@ -2627,6 +2648,11 @@ retry_avoidcopy:
  				make_huge_pte(vma, new_page, 1));
  		page_remove_rmap(old_page);
  		hugepage_add_new_anon_rmap(new_page, vma, address);
@@ -74268,7 +73465,7 @@ index 59a0059..b3f3d86 100644
  		/* Make the old page be freed below */
  		new_page = old_page;
  	}
-@@ -2795,6 +2821,10 @@ retry:
+@@ -2786,6 +2812,10 @@ retry:
  				&& (vma->vm_flags & VM_SHARED)));
  	set_huge_pte_at(mm, address, ptep, new_pte);
  
@@ -74279,7 +73476,7 @@ index 59a0059..b3f3d86 100644
  	if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
  		/* Optimization, do the COW without a second fault */
  		ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
-@@ -2824,6 +2854,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2815,6 +2845,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	static DEFINE_MUTEX(hugetlb_instantiation_mutex);
  	struct hstate *h = hstate_vma(vma);
  
@@ -74290,7 +73487,7 @@ index 59a0059..b3f3d86 100644
  	address &= huge_page_mask(h);
  
  	ptep = huge_pte_offset(mm, address);
-@@ -2837,6 +2871,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2828,6 +2862,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  				VM_FAULT_SET_HINDEX(hstate_index(h));
  	}
  
@@ -74318,7 +73515,7 @@ index 59a0059..b3f3d86 100644
  	if (!ptep)
  		return VM_FAULT_OOM;
 diff --git a/mm/internal.h b/mm/internal.h
-index a4fa284..9a02499 100644
+index 3c5197d..08d0065 100644
 --- a/mm/internal.h
 +++ b/mm/internal.h
 @@ -95,6 +95,7 @@ extern void putback_lru_page(struct page *page);
@@ -74530,10 +73727,10 @@ index 8b20278..05dac18 100644
  	/* keep elevated page count for bad page */
  	return ret;
 diff --git a/mm/memory.c b/mm/memory.c
-index 221fc9f..d1d4db1 100644
+index f2973b2..fd020a7 100644
 --- a/mm/memory.c
 +++ b/mm/memory.c
-@@ -426,6 +426,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
+@@ -431,6 +431,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
  		free_pte_range(tlb, pmd, addr);
  	} while (pmd++, addr = next, addr != end);
  
@@ -74541,7 +73738,7 @@ index 221fc9f..d1d4db1 100644
  	start &= PUD_MASK;
  	if (start < floor)
  		return;
-@@ -440,6 +441,8 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
+@@ -445,6 +446,8 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
  	pmd = pmd_offset(pud, start);
  	pud_clear(pud);
  	pmd_free_tlb(tlb, pmd, start);
@@ -74550,7 +73747,7 @@ index 221fc9f..d1d4db1 100644
  }
  
  static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
-@@ -459,6 +462,7 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
+@@ -464,6 +467,7 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
  		free_pmd_range(tlb, pud, addr, next, floor, ceiling);
  	} while (pud++, addr = next, addr != end);
  
@@ -74558,7 +73755,7 @@ index 221fc9f..d1d4db1 100644
  	start &= PGDIR_MASK;
  	if (start < floor)
  		return;
-@@ -473,6 +477,8 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
+@@ -478,6 +482,8 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
  	pud = pud_offset(pgd, start);
  	pgd_clear(pgd);
  	pud_free_tlb(tlb, pud, start);
@@ -74567,7 +73764,7 @@ index 221fc9f..d1d4db1 100644
  }
  
  /*
-@@ -1621,12 +1627,6 @@ no_page_table:
+@@ -1626,12 +1632,6 @@ no_page_table:
  	return page;
  }
  
@@ -74580,7 +73777,7 @@ index 221fc9f..d1d4db1 100644
  /**
   * __get_user_pages() - pin user pages in memory
   * @tsk:	task_struct of target task
-@@ -1699,10 +1699,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+@@ -1704,10 +1704,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
  			(VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
  	i = 0;
  
@@ -74593,7 +73790,7 @@ index 221fc9f..d1d4db1 100644
  		if (!vma && in_gate_area(mm, start)) {
  			unsigned long pg = start & PAGE_MASK;
  			pgd_t *pgd;
-@@ -1750,7 +1750,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+@@ -1755,7 +1755,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
  			goto next_page;
  		}
  
@@ -74602,7 +73799,7 @@ index 221fc9f..d1d4db1 100644
  		    (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
  		    !(vm_flags & vma->vm_flags))
  			return i ? : -EFAULT;
-@@ -1777,11 +1777,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+@@ -1782,11 +1782,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
  				int ret;
  				unsigned int fault_flags = 0;
  
@@ -74614,7 +73811,7 @@ index 221fc9f..d1d4db1 100644
  				if (foll_flags & FOLL_WRITE)
  					fault_flags |= FAULT_FLAG_WRITE;
  				if (nonblocking)
-@@ -1855,7 +1850,7 @@ next_page:
+@@ -1860,7 +1855,7 @@ next_page:
  			start += PAGE_SIZE;
  			nr_pages--;
  		} while (nr_pages && start < vma->vm_end);
@@ -74623,7 +73820,7 @@ index 221fc9f..d1d4db1 100644
  	return i;
  }
  EXPORT_SYMBOL(__get_user_pages);
-@@ -2062,6 +2057,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
+@@ -2067,6 +2062,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
  	page_add_file_rmap(page);
  	set_pte_at(mm, addr, pte, mk_pte(page, prot));
  
@@ -74634,7 +73831,7 @@ index 221fc9f..d1d4db1 100644
  	retval = 0;
  	pte_unmap_unlock(pte, ptl);
  	return retval;
-@@ -2106,9 +2105,21 @@ int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
+@@ -2111,9 +2110,21 @@ int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
  	if (!page_count(page))
  		return -EINVAL;
  	if (!(vma->vm_flags & VM_MIXEDMAP)) {
@@ -74656,7 +73853,7 @@ index 221fc9f..d1d4db1 100644
  	}
  	return insert_page(vma, addr, page, vma->vm_page_prot);
  }
-@@ -2191,6 +2202,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
+@@ -2196,6 +2207,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
  			unsigned long pfn)
  {
  	BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
@@ -74664,7 +73861,7 @@ index 221fc9f..d1d4db1 100644
  
  	if (addr < vma->vm_start || addr >= vma->vm_end)
  		return -EFAULT;
-@@ -2391,7 +2403,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
+@@ -2396,7 +2408,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
  
  	BUG_ON(pud_huge(*pud));
  
@@ -74675,7 +73872,7 @@ index 221fc9f..d1d4db1 100644
  	if (!pmd)
  		return -ENOMEM;
  	do {
-@@ -2411,7 +2425,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
+@@ -2416,7 +2430,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
  	unsigned long next;
  	int err;
  
@@ -74686,7 +73883,7 @@ index 221fc9f..d1d4db1 100644
  	if (!pud)
  		return -ENOMEM;
  	do {
-@@ -2499,6 +2515,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
+@@ -2504,6 +2520,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
  		copy_user_highpage(dst, src, va, vma);
  }
  
@@ -74873,7 +74070,7 @@ index 221fc9f..d1d4db1 100644
  /*
   * This routine handles present pages, when users try to write
   * to a shared page. It is done by copying the page to a new address
-@@ -2715,6 +2911,12 @@ gotten:
+@@ -2720,6 +2916,12 @@ gotten:
  	 */
  	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -74886,7 +74083,7 @@ index 221fc9f..d1d4db1 100644
  		if (old_page) {
  			if (!PageAnon(old_page)) {
  				dec_mm_counter_fast(mm, MM_FILEPAGES);
-@@ -2766,6 +2968,10 @@ gotten:
+@@ -2771,6 +2973,10 @@ gotten:
  			page_remove_rmap(old_page);
  		}
  
@@ -74897,7 +74094,7 @@ index 221fc9f..d1d4db1 100644
  		/* Free the old page.. */
  		new_page = old_page;
  		ret |= VM_FAULT_WRITE;
-@@ -3046,6 +3252,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3051,6 +3257,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	swap_free(entry);
  	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
  		try_to_free_swap(page);
@@ -74909,7 +74106,7 @@ index 221fc9f..d1d4db1 100644
  	unlock_page(page);
  	if (swapcache) {
  		/*
-@@ -3069,6 +3280,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3074,6 +3285,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -74921,7 +74118,7 @@ index 221fc9f..d1d4db1 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  out:
-@@ -3088,40 +3304,6 @@ out_release:
+@@ -3093,40 +3309,6 @@ out_release:
  }
  
  /*
@@ -74962,7 +74159,7 @@ index 221fc9f..d1d4db1 100644
   * We enter with non-exclusive mmap_sem (to exclude vma changes,
   * but allow concurrent faults), and pte mapped but not yet locked.
   * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -3130,27 +3312,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3135,27 +3317,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  		unsigned long address, pte_t *page_table, pmd_t *pmd,
  		unsigned int flags)
  {
@@ -74995,7 +74192,7 @@ index 221fc9f..d1d4db1 100644
  	if (unlikely(anon_vma_prepare(vma)))
  		goto oom;
  	page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -3169,6 +3347,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3174,6 +3352,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	if (!pte_none(*page_table))
  		goto release;
  
@@ -75007,7 +74204,7 @@ index 221fc9f..d1d4db1 100644
  	inc_mm_counter_fast(mm, MM_ANONPAGES);
  	page_add_new_anon_rmap(page, vma, address);
  setpte:
-@@ -3176,6 +3359,12 @@ setpte:
+@@ -3181,6 +3364,12 @@ setpte:
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -75020,7 +74217,7 @@ index 221fc9f..d1d4db1 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  	return 0;
-@@ -3319,6 +3508,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3324,6 +3513,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	 */
  	/* Only go through if we didn't race with anybody else... */
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -75033,7 +74230,7 @@ index 221fc9f..d1d4db1 100644
  		flush_icache_page(vma, page);
  		entry = mk_pte(page, vma->vm_page_prot);
  		if (flags & FAULT_FLAG_WRITE)
-@@ -3338,6 +3533,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3343,6 +3538,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  
  		/* no need to invalidate: a not-present page won't be cached */
  		update_mmu_cache(vma, address, page_table);
@@ -75048,7 +74245,7 @@ index 221fc9f..d1d4db1 100644
  	} else {
  		if (cow_page)
  			mem_cgroup_uncharge_page(cow_page);
-@@ -3492,6 +3695,12 @@ int handle_pte_fault(struct mm_struct *mm,
+@@ -3497,6 +3700,12 @@ int handle_pte_fault(struct mm_struct *mm,
  		if (flags & FAULT_FLAG_WRITE)
  			flush_tlb_fix_spurious_fault(vma, address);
  	}
@@ -75061,7 +74258,7 @@ index 221fc9f..d1d4db1 100644
  unlock:
  	pte_unmap_unlock(pte, ptl);
  	return 0;
-@@ -3508,6 +3717,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3513,6 +3722,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	pmd_t *pmd;
  	pte_t *pte;
  
@@ -75072,7 +74269,7 @@ index 221fc9f..d1d4db1 100644
  	__set_current_state(TASK_RUNNING);
  
  	count_vm_event(PGFAULT);
-@@ -3519,6 +3732,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3524,6 +3737,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	if (unlikely(is_vm_hugetlb_page(vma)))
  		return hugetlb_fault(mm, vma, address, flags);
  
@@ -75107,7 +74304,7 @@ index 221fc9f..d1d4db1 100644
  retry:
  	pgd = pgd_offset(mm, address);
  	pud = pud_alloc(mm, pgd, address);
-@@ -3560,7 +3801,7 @@ retry:
+@@ -3565,7 +3806,7 @@ retry:
  	 * run pte_offset_map on the pmd, if an huge pmd could
  	 * materialize from under us from a different thread.
  	 */
@@ -75116,7 +74313,7 @@ index 221fc9f..d1d4db1 100644
  		return VM_FAULT_OOM;
  	/* if an huge pmd materialized from under us just retry later */
  	if (unlikely(pmd_trans_huge(*pmd)))
-@@ -3597,6 +3838,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3602,6 +3843,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -75140,7 +74337,7 @@ index 221fc9f..d1d4db1 100644
  #endif /* __PAGETABLE_PUD_FOLDED */
  
  #ifndef __PAGETABLE_PMD_FOLDED
-@@ -3627,6 +3885,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3632,6 +3890,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -75171,7 +74368,7 @@ index 221fc9f..d1d4db1 100644
  #endif /* __PAGETABLE_PMD_FOLDED */
  
  int make_pages_present(unsigned long addr, unsigned long end)
-@@ -3664,7 +3946,7 @@ static int __init gate_vma_init(void)
+@@ -3669,7 +3951,7 @@ static int __init gate_vma_init(void)
  	gate_vma.vm_start = FIXADDR_USER_START;
  	gate_vma.vm_end = FIXADDR_USER_END;
  	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -75181,7 +74378,7 @@ index 221fc9f..d1d4db1 100644
  	return 0;
  }
 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index 4ea600d..9429765 100644
+index 002c281..9429765 100644
 --- a/mm/mempolicy.c
 +++ b/mm/mempolicy.c
 @@ -655,6 +655,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
@@ -75260,128 +74457,6 @@ index 4ea600d..9429765 100644
  	err = do_migrate_pages(mm, old, new,
  		capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
  
-@@ -2372,8 +2406,7 @@ void numa_default_policy(void)
-  */
- 
- /*
-- * "local" is pseudo-policy:  MPOL_PREFERRED with MPOL_F_LOCAL flag
-- * Used only for mpol_parse_str() and mpol_to_str()
-+ * "local" is implemented internally by MPOL_PREFERRED with MPOL_F_LOCAL flag.
-  */
- #define MPOL_LOCAL MPOL_MAX
- static const char * const policy_modes[] =
-@@ -2388,28 +2421,21 @@ static const char * const policy_modes[] =
- 
- #ifdef CONFIG_TMPFS
- /**
-- * mpol_parse_str - parse string to mempolicy
-+ * mpol_parse_str - parse string to mempolicy, for tmpfs mpol mount option.
-  * @str:  string containing mempolicy to parse
-  * @mpol:  pointer to struct mempolicy pointer, returned on success.
-- * @no_context:  flag whether to "contextualize" the mempolicy
-+ * @unused:  redundant argument, to be removed later.
-  *
-  * Format of input:
-  *	<mode>[=<flags>][:<nodelist>]
-  *
-- * if @no_context is true, save the input nodemask in w.user_nodemask in
-- * the returned mempolicy.  This will be used to "clone" the mempolicy in
-- * a specific context [cpuset] at a later time.  Used to parse tmpfs mpol
-- * mount option.  Note that if 'static' or 'relative' mode flags were
-- * specified, the input nodemask will already have been saved.  Saving
-- * it again is redundant, but safe.
-- *
-  * On success, returns 0, else 1
-  */
--int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
-+int mpol_parse_str(char *str, struct mempolicy **mpol, int unused)
- {
- 	struct mempolicy *new = NULL;
- 	unsigned short mode;
--	unsigned short uninitialized_var(mode_flags);
-+	unsigned short mode_flags;
- 	nodemask_t nodes;
- 	char *nodelist = strchr(str, ':');
- 	char *flags = strchr(str, '=');
-@@ -2497,24 +2523,23 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
- 	if (IS_ERR(new))
- 		goto out;
- 
--	if (no_context) {
--		/* save for contextualization */
--		new->w.user_nodemask = nodes;
--	} else {
--		int ret;
--		NODEMASK_SCRATCH(scratch);
--		if (scratch) {
--			task_lock(current);
--			ret = mpol_set_nodemask(new, &nodes, scratch);
--			task_unlock(current);
--		} else
--			ret = -ENOMEM;
--		NODEMASK_SCRATCH_FREE(scratch);
--		if (ret) {
--			mpol_put(new);
--			goto out;
--		}
--	}
-+	/*
-+	 * Save nodes for mpol_to_str() to show the tmpfs mount options
-+	 * for /proc/mounts, /proc/pid/mounts and /proc/pid/mountinfo.
-+	 */
-+	if (mode != MPOL_PREFERRED)
-+		new->v.nodes = nodes;
-+	else if (nodelist)
-+		new->v.preferred_node = first_node(nodes);
-+	else
-+		new->flags |= MPOL_F_LOCAL;
-+
-+	/*
-+	 * Save nodes for contextualization: this will be used to "clone"
-+	 * the mempolicy in a specific context [cpuset] at a later time.
-+	 */
-+	new->w.user_nodemask = nodes;
-+
- 	err = 0;
- 
- out:
-@@ -2534,13 +2559,13 @@ out:
-  * @buffer:  to contain formatted mempolicy string
-  * @maxlen:  length of @buffer
-  * @pol:  pointer to mempolicy to be formatted
-- * @no_context:  "context free" mempolicy - use nodemask in w.user_nodemask
-+ * @unused:  redundant argument, to be removed later.
-  *
-  * Convert a mempolicy into a string.
-  * Returns the number of characters in buffer (if positive)
-  * or an error (negative)
-  */
--int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
-+int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int unused)
- {
- 	char *p = buffer;
- 	int l;
-@@ -2566,7 +2591,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
- 	case MPOL_PREFERRED:
- 		nodes_clear(nodes);
- 		if (flags & MPOL_F_LOCAL)
--			mode = MPOL_LOCAL;	/* pseudo-policy */
-+			mode = MPOL_LOCAL;
- 		else
- 			node_set(pol->v.preferred_node, nodes);
- 		break;
-@@ -2574,10 +2599,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
- 	case MPOL_BIND:
- 		/* Fall through */
- 	case MPOL_INTERLEAVE:
--		if (no_context)
--			nodes = pol->w.user_nodemask;
--		else
--			nodes = pol->v.nodes;
-+		nodes = pol->v.nodes;
- 		break;
- 
- 	default:
 diff --git a/mm/migrate.c b/mm/migrate.c
 index 77ed2d7..317d528 100644
 --- a/mm/migrate.c
@@ -77092,7 +76167,7 @@ index 45131b4..c521665 100644
  	new->vm_region = region;
  
 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 7e208f0..d96f232 100644
+index ceb4168..d7774f2 100644
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
 @@ -340,7 +340,7 @@ out:
@@ -77139,7 +76214,7 @@ index 7e208f0..d96f232 100644
  
  	if (order && (gfp_flags & __GFP_COMP))
  		prep_compound_page(page, order);
-@@ -3703,7 +3715,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn)
+@@ -3684,7 +3696,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn)
  	unsigned long pfn;
  
  	for (pfn = start_pfn; pfn < end_pfn; pfn++) {
@@ -78697,19 +77772,6 @@ index a86aff9..3a0d6f6 100644
  
  /*
   * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
-diff --git a/net/atm/mpc.h b/net/atm/mpc.h
-index 0919a88..a23d54e 100644
---- a/net/atm/mpc.h
-+++ b/net/atm/mpc.h
-@@ -33,7 +33,7 @@ struct mpoa_client {
- 	struct mpc_parameters parameters;  /* parameters for this client    */
- 
- 	const struct net_device_ops *old_ops;
--	struct net_device_ops new_ops;
-+	net_device_ops_no_const new_ops;
- };
- 
- 
 diff --git a/net/atm/proc.c b/net/atm/proc.c
 index 0d020de..011c7bb 100644
 --- a/net/atm/proc.c
@@ -78750,7 +77812,7 @@ index 0447d5d..3cf4728 100644
  #undef __HANDLE_ITEM
  }
 diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
-index b02b75d..0a9636e 100644
+index c6fcc76..1270d14 100644
 --- a/net/batman-adv/bat_iv_ogm.c
 +++ b/net/batman-adv/bat_iv_ogm.c
 @@ -62,7 +62,7 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface)
@@ -78946,7 +78008,7 @@ index 083f2bf..799f9448 100644
  			err = -EFAULT;
  			break;
 diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
-index b3226f3..8916f43 100644
+index 868a909..d044bc3 100644
 --- a/net/bluetooth/rfcomm/sock.c
 +++ b/net/bluetooth/rfcomm/sock.c
 @@ -667,7 +667,7 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
@@ -79093,21 +78155,8 @@ index ddac1ee..3ee0a78 100644
  	.notifier_call = can_notifier,
  };
  
-diff --git a/net/can/bcm.c b/net/can/bcm.c
-index 969b7cd..f69fccb 100644
---- a/net/can/bcm.c
-+++ b/net/can/bcm.c
-@@ -119,7 +119,7 @@ struct bcm_sock {
- 	struct sock sk;
- 	int bound;
- 	int ifindex;
--	struct notifier_block notifier;
-+	notifier_block_no_const notifier;
- 	struct list_head rx_ops;
- 	struct list_head tx_ops;
- 	unsigned long dropped_usr_msgs;
 diff --git a/net/can/gw.c b/net/can/gw.c
-index 1f5c978..30b397f 100644
+index 1f5c978..ef714c7 100644
 --- a/net/can/gw.c
 +++ b/net/can/gw.c
 @@ -67,7 +67,6 @@ MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");
@@ -79118,15 +78167,6 @@ index 1f5c978..30b397f 100644
  
  static struct kmem_cache *cgw_cache __read_mostly;
  
-@@ -96,7 +95,7 @@ struct cf_mod {
- 	struct {
- 		void (*xor)(struct can_frame *cf, struct cgw_csum_xor *xor);
- 		void (*crc8)(struct can_frame *cf, struct cgw_csum_crc8 *crc8);
--	} csumfunc;
-+	} __no_const csumfunc;
- };
- 
- 
 @@ -887,6 +886,10 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
  	return err;
  }
@@ -79146,19 +78186,6 @@ index 1f5c978..30b397f 100644
  	register_netdevice_notifier(&notifier);
  
  	if (__rtnl_register(PF_CAN, RTM_GETROUTE, NULL, cgw_dump_jobs, NULL)) {
-diff --git a/net/can/raw.c b/net/can/raw.c
-index 5b0e3e3..615c72b 100644
---- a/net/can/raw.c
-+++ b/net/can/raw.c
-@@ -79,7 +79,7 @@ struct raw_sock {
- 	struct sock sk;
- 	int bound;
- 	int ifindex;
--	struct notifier_block notifier;
-+	notifier_block_no_const notifier;
- 	int loopback;
- 	int recv_own_msgs;
- 	int fd_frames;
 diff --git a/net/compat.c b/net/compat.c
 index 79ae884..17c5c09 100644
 --- a/net/compat.c
@@ -79417,17 +78444,10 @@ index e5942bf..25998c3 100644
  }
  EXPORT_SYMBOL(dev_get_stats);
 diff --git a/net/core/flow.c b/net/core/flow.c
-index e318c7e..98aee7d 100644
+index e318c7e..168b1d0 100644
 --- a/net/core/flow.c
 +++ b/net/core/flow.c
-@@ -55,13 +55,13 @@ struct flow_flush_info {
- struct flow_cache {
- 	u32				hash_shift;
- 	struct flow_cache_percpu __percpu *percpu;
--	struct notifier_block		hotcpu_notifier;
-+	notifier_block_no_const		hotcpu_notifier;
- 	int				low_watermark;
- 	int				high_watermark;
+@@ -61,7 +61,7 @@ struct flow_cache {
  	struct timer_list		rnd_timer;
  };
  
@@ -79486,18 +78506,42 @@ index 7e7aeb0..2a998cb 100644
  
  	m->msg_iov = iov;
 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index fad649a..df5891e 100644
+index fad649a..f2fdac4 100644
 --- a/net/core/rtnetlink.c
 +++ b/net/core/rtnetlink.c
-@@ -58,7 +58,7 @@ struct rtnl_link {
- 	rtnl_doit_func		doit;
- 	rtnl_dumpit_func	dumpit;
- 	rtnl_calcit_func 	calcit;
--};
-+} __no_const;
+@@ -198,14 +198,16 @@ int __rtnl_register(int protocol, int msgtype,
+ 		rtnl_msg_handlers[protocol] = tab;
+ 	}
  
- static DEFINE_MUTEX(rtnl_mutex);
++	pax_open_kernel();
+ 	if (doit)
+-		tab[msgindex].doit = doit;
++		*(void **)&tab[msgindex].doit = doit;
  
+ 	if (dumpit)
+-		tab[msgindex].dumpit = dumpit;
++		*(void **)&tab[msgindex].dumpit = dumpit;
+ 
+ 	if (calcit)
+-		tab[msgindex].calcit = calcit;
++		*(void **)&tab[msgindex].calcit = calcit;
++	pax_close_kernel();
+ 
+ 	return 0;
+ }
+@@ -248,8 +250,10 @@ int rtnl_unregister(int protocol, int msgtype)
+ 	if (rtnl_msg_handlers[protocol] == NULL)
+ 		return -ENOENT;
+ 
+-	rtnl_msg_handlers[protocol][msgindex].doit = NULL;
+-	rtnl_msg_handlers[protocol][msgindex].dumpit = NULL;
++	pax_open_kernel();
++	*(void **)&rtnl_msg_handlers[protocol][msgindex].doit = NULL;
++	*(void **)&rtnl_msg_handlers[protocol][msgindex].dumpit = NULL;
++	pax_close_kernel();
+ 
+ 	return 0;
+ }
 diff --git a/net/core/scm.c b/net/core/scm.c
 index ab57084..0190c8f 100644
 --- a/net/core/scm.c
@@ -79689,6 +78733,22 @@ index a55eecc..dd8428c 100644
  		return -EFAULT;
  
  	*lenp = len;
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index 2a6abc1..c379ba7 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -822,9 +822,9 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+ 		if (!ifa) {
+ 			ret = -ENOBUFS;
+ 			ifa = inet_alloc_ifa();
++			if (!ifa)
++				break;
+ 			INIT_HLIST_NODE(&ifa->hash);
+-			if (!ifa)
+-				break;
+ 			if (colon)
+ 				memcpy(ifa->ifa_label, ifr.ifr_name, IFNAMSIZ);
+ 			else
 diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
 index 825c608..750ff29 100644
 --- a/net/ipv4/fib_frontend.c
@@ -80021,7 +79081,7 @@ index df25142..e92a82a 100644
  			 sizeof(net->ipv4.dev_addr_genid));
  	return 0;
 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 181fc82..f211869 100644
+index 181fc82..cc95f8c 100644
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
 @@ -4704,7 +4704,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
@@ -80052,7 +79112,23 @@ index 181fc82..f211869 100644
  		goto discard;
  
  	/* ts_recent update must be made after we are sure that the packet
-@@ -5930,7 +5933,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5836,6 +5839,7 @@ discard:
+ 	    tcp_paws_reject(&tp->rx_opt, 0))
+ 		goto discard_and_undo;
+ 
++#ifndef CONFIG_GRKERNSEC_NO_SIMULT_CONNECT
+ 	if (th->syn) {
+ 		/* We see SYN without ACK. It is attempt of
+ 		 * simultaneous connect with crossed SYNs.
+@@ -5886,6 +5890,7 @@ discard:
+ 		goto discard;
+ #endif
+ 	}
++#endif
+ 	/* "fifth, if neither of the SYN or RST bits is set then
+ 	 * drop the segment and return."
+ 	 */
+@@ -5930,7 +5935,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  			goto discard;
  
  		if (th->syn) {
@@ -80061,7 +79137,7 @@ index 181fc82..f211869 100644
  				goto discard;
  			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
  				return 1;
-@@ -5977,11 +5980,15 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5977,11 +5982,15 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  		if (tcp_check_req(sk, skb, req, NULL, true) == NULL)
  			goto discard;
  	}
@@ -80078,7 +79154,7 @@ index 181fc82..f211869 100644
  		int acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH) > 0;
  
  		switch (sk->sk_state) {
-@@ -6131,8 +6138,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -6131,8 +6140,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  			}
  			break;
  		}
@@ -80089,7 +79165,7 @@ index 181fc82..f211869 100644
  	/* ts_recent update must be made after we are sure that the packet
  	 * is in window.
 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index 0c4a643..e584990 100644
+index bc3cb46..815ccd6 100644
 --- a/net/ipv4/tcp_ipv4.c
 +++ b/net/ipv4/tcp_ipv4.c
 @@ -90,6 +90,10 @@ int sysctl_tcp_low_latency __read_mostly;
@@ -80103,7 +79179,7 @@ index 0c4a643..e584990 100644
  #ifdef CONFIG_TCP_MD5SIG
  static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
  			       __be32 daddr, __be32 saddr, const struct tcphdr *th);
-@@ -1901,6 +1905,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1899,6 +1903,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
  	return 0;
  
  reset:
@@ -80113,7 +79189,7 @@ index 0c4a643..e584990 100644
  	tcp_v4_send_reset(rsk, skb);
  discard:
  	kfree_skb(skb);
-@@ -2001,12 +2008,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
+@@ -1999,12 +2006,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
  	TCP_SKB_CB(skb)->sacked	 = 0;
  
  	sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -80136,7 +79212,7 @@ index 0c4a643..e584990 100644
  
  	if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
  		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
-@@ -2057,6 +2071,10 @@ no_tcp_socket:
+@@ -2055,6 +2069,10 @@ no_tcp_socket:
  bad_packet:
  		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
  	} else {
@@ -80507,7 +79583,7 @@ index d8e95c7..81422bc 100644
  
  static int raw6_seq_show(struct seq_file *seq, void *v)
 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 26175bf..fc3e4fb 100644
+index 73f2a6b..f8049a1 100644
 --- a/net/ipv6/tcp_ipv6.c
 +++ b/net/ipv6/tcp_ipv6.c
 @@ -106,6 +106,10 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
@@ -80521,7 +79597,7 @@ index 26175bf..fc3e4fb 100644
  static void tcp_v6_hash(struct sock *sk)
  {
  	if (sk->sk_state != TCP_CLOSE) {
-@@ -1524,6 +1528,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1525,6 +1529,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
  	return 0;
  
  reset:
@@ -80531,7 +79607,7 @@ index 26175bf..fc3e4fb 100644
  	tcp_v6_send_reset(sk, skb);
  discard:
  	if (opt_skb)
-@@ -1605,12 +1612,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
+@@ -1606,12 +1613,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
  	TCP_SKB_CB(skb)->sacked = 0;
  
  	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -80554,7 +79630,7 @@ index 26175bf..fc3e4fb 100644
  
  	if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
  		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
-@@ -1659,6 +1674,10 @@ no_tcp_socket:
+@@ -1660,6 +1675,10 @@ no_tcp_socket:
  bad_packet:
  		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
  	} else {
@@ -80751,7 +79827,7 @@ index 7371f67..9897314 100644
  
  		ieee80211_queue_work(&local->hw, &local->reconfig_filter);
 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index 156e583..076e28a 100644
+index 3da215c..497a6e3 100644
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
 @@ -28,6 +28,7 @@
@@ -80762,7 +79838,7 @@ index 156e583..076e28a 100644
  #include "key.h"
  #include "sta_info.h"
  #include "debug.h"
-@@ -848,7 +849,7 @@ struct ieee80211_local {
+@@ -852,7 +853,7 @@ struct ieee80211_local {
  	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
  	spinlock_t queue_stop_reason_lock;
  
@@ -80771,19 +79847,8 @@ index 156e583..076e28a 100644
  	int monitors, cooked_mntrs;
  	/* number of interfaces with corresponding FIF_ flags */
  	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
-@@ -1047,8 +1048,8 @@ struct ieee80211_local {
- 	struct work_struct dynamic_ps_enable_work;
- 	struct work_struct dynamic_ps_disable_work;
- 	struct timer_list dynamic_ps_timer;
--	struct notifier_block network_latency_notifier;
--	struct notifier_block ifa_notifier;
-+	notifier_block_no_const network_latency_notifier;
-+	notifier_block_no_const ifa_notifier;
- 
- 	/*
- 	 * The dynamic ps timeout configured from user space via WEXT -
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index 7de7717..3de8e97 100644
+index 0f5af91..4dba9e7 100644
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
 @@ -465,7 +465,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
@@ -80831,7 +79896,7 @@ index 7de7717..3de8e97 100644
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
-@@ -827,7 +827,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+@@ -818,7 +818,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
  
  	ieee80211_recalc_ps(local, -1);
  
@@ -80840,7 +79905,7 @@ index 7de7717..3de8e97 100644
  		if (local->ops->napi_poll)
  			napi_disable(&local->napi);
  		ieee80211_clear_tx_pending(local);
-@@ -859,7 +859,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+@@ -850,7 +850,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
  	}
  	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
  
@@ -81169,19 +80234,6 @@ index 9f199f2..719ad23 100644
  		goto nla_put_failure;
  
  	if (data_len) {
-diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
-index bd93e51..fcbbac4 100644
---- a/net/netfilter/xt_TEE.c
-+++ b/net/netfilter/xt_TEE.c
-@@ -31,7 +31,7 @@
- #endif
- 
- struct xt_tee_priv {
--	struct notifier_block	notifier;
-+	notifier_block_no_const	notifier;
- 	struct xt_tee_tginfo	*tginfo;
- 	int			oif;
- };
 diff --git a/net/netfilter/xt_gradm.c b/net/netfilter/xt_gradm.c
 new file mode 100644
 index 0000000..c566332
@@ -82182,7 +81234,7 @@ index d92c490..b4bc863 100644
  	set_fs(KERNEL_DS);
  	if (level == SOL_SOCKET)
 diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
-index 6357fcb..244c7db 100644
+index 7865b44..174662e 100644
 --- a/net/sunrpc/sched.c
 +++ b/net/sunrpc/sched.c
 @@ -240,9 +240,9 @@ static int rpc_wait_bit_killable(void *word)
@@ -82521,19 +81573,6 @@ index 5b5c876..3127bf7 100644
  	done_path_create(&path, dentry);
  	return err;
  }
-diff --git a/net/wireless/core.h b/net/wireless/core.h
-index a343be4..0c6e081 100644
---- a/net/wireless/core.h
-+++ b/net/wireless/core.h
-@@ -28,7 +28,7 @@ struct cfg80211_registered_device {
- 	struct mutex mtx;
- 
- 	/* rfkill support */
--	struct rfkill_ops rfkill_ops;
-+	rfkill_ops_no_const rfkill_ops;
- 	struct rfkill *rfkill;
- 	struct work_struct rfkill_sync;
- 
 diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
 index c8717c1..08539f5 100644
 --- a/net/wireless/wext-core.c
@@ -84652,19 +83691,6 @@ index d428ffe..751ef78 100644
  		break;
  	default:
  		return -EINVAL;
-diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c
-index 7bd5e33..1fcab12 100644
---- a/sound/isa/cmi8330.c
-+++ b/sound/isa/cmi8330.c
-@@ -172,7 +172,7 @@ struct snd_cmi8330 {
- 
- 	struct snd_pcm *pcm;
- 	struct snd_cmi8330_stream {
--		struct snd_pcm_ops ops;
-+		snd_pcm_ops_no_const ops;
- 		snd_pcm_open_callback_t open;
- 		void *private_data; /* sb or wss */
- 	} streams[2];
 diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c
 index b2b3c01..e1c1e1f 100644
 --- a/sound/oss/sb_audio.c
@@ -84716,80 +83742,6 @@ index 7d8803a..559f8d0 100644
  
                  list_add(&s->list, &cs4297a_devs);
  
-diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
-index 4f4e545..9b75d10 100644
---- a/sound/pci/hda/hda_codec.h
-+++ b/sound/pci/hda/hda_codec.h
-@@ -618,7 +618,7 @@ struct hda_bus_ops {
- 	/* notify power-up/down from codec to controller */
- 	void (*pm_notify)(struct hda_bus *bus, bool power_up);
- #endif
--};
-+} __no_const;
- 
- /* template to pass to the bus constructor */
- struct hda_bus_template {
-@@ -716,6 +716,7 @@ struct hda_codec_ops {
- #endif
- 	void (*reboot_notify)(struct hda_codec *codec);
- };
-+typedef struct hda_codec_ops __no_const hda_codec_ops_no_const;
- 
- /* record for amp information cache */
- struct hda_cache_head {
-@@ -746,7 +747,7 @@ struct hda_pcm_ops {
- 		       struct snd_pcm_substream *substream);
- 	int (*cleanup)(struct hda_pcm_stream *info, struct hda_codec *codec,
- 		       struct snd_pcm_substream *substream);
--};
-+} __no_const;
- 
- /* PCM information for each substream */
- struct hda_pcm_stream {
-@@ -805,7 +806,7 @@ struct hda_codec {
- 	const char *modelname;	/* model name for preset */
- 
- 	/* set by patch */
--	struct hda_codec_ops patch_ops;
-+	hda_codec_ops_no_const patch_ops;
- 
- 	/* PCM to create, set by patch_ops.build_pcms callback */
- 	unsigned int num_pcms;
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index f9d870e..c80188d 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -512,7 +512,7 @@ struct azx {
- 	struct work_struct irq_pending_work;
- 
- 	/* reboot notifier (for mysterious hangup problem at power-down) */
--	struct notifier_block reboot_notifier;
-+	notifier_block_no_const reboot_notifier;
- 
- 	/* card list (for power_save trigger) */
- 	struct list_head list;
-diff --git a/sound/pci/ice1712/ice1712.h b/sound/pci/ice1712/ice1712.h
-index d0e7d87..49ec1bb 100644
---- a/sound/pci/ice1712/ice1712.h
-+++ b/sound/pci/ice1712/ice1712.h
-@@ -269,7 +269,7 @@ struct snd_ak4xxx_private {
- 	unsigned int mask_flags;	/* total mask bits */
- 	struct snd_akm4xxx_ops {
- 		void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
--	} ops;
-+	} __no_const ops;
- };
- 
- struct snd_ice1712_spdif {
-@@ -285,7 +285,7 @@ struct snd_ice1712_spdif {
- 		int (*default_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
- 		void (*stream_get)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
- 		int (*stream_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
--	} ops;
-+	} __no_const ops;
- };
- 
- 
 diff --git a/sound/pci/ymfpci/ymfpci.h b/sound/pci/ymfpci/ymfpci.h
 index 4631a23..001ae57 100644
 --- a/sound/pci/ymfpci/ymfpci.h
@@ -84847,84 +83799,6 @@ index 3a6f03f..bc5c86c 100644
  	chip->card = card;
  	chip->pci = pci;
  	chip->irq = -1;
-diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
-index 5708a97..e8b503d 100644
---- a/sound/soc/codecs/tlv320aic3x.c
-+++ b/sound/soc/codecs/tlv320aic3x.c
-@@ -65,7 +65,7 @@ static LIST_HEAD(reset_list);
- struct aic3x_priv;
- 
- struct aic3x_disable_nb {
--	struct notifier_block nb;
-+	notifier_block_no_const nb;
- 	struct aic3x_priv *aic3x;
- };
- 
-diff --git a/sound/soc/codecs/wm8770.c b/sound/soc/codecs/wm8770.c
-index c7c0034..3102641 100644
---- a/sound/soc/codecs/wm8770.c
-+++ b/sound/soc/codecs/wm8770.c
-@@ -49,7 +49,7 @@ static const u16 wm8770_reg_defs[WM8770_CACHEREGNUM] = {
- struct wm8770_priv {
- 	enum snd_soc_control_type control_type;
- 	struct regulator_bulk_data supplies[WM8770_NUM_SUPPLIES];
--	struct notifier_block disable_nb[WM8770_NUM_SUPPLIES];
-+	notifier_block_no_const disable_nb[WM8770_NUM_SUPPLIES];
- 	struct snd_soc_codec *codec;
- 	int sysclk;
- };
-diff --git a/sound/soc/codecs/wm8804.c b/sound/soc/codecs/wm8804.c
-index c088020..5b99147 100644
---- a/sound/soc/codecs/wm8804.c
-+++ b/sound/soc/codecs/wm8804.c
-@@ -62,7 +62,7 @@ static const struct reg_default wm8804_reg_defaults[] = {
- struct wm8804_priv {
- 	struct regmap *regmap;
- 	struct regulator_bulk_data supplies[WM8804_NUM_SUPPLIES];
--	struct notifier_block disable_nb[WM8804_NUM_SUPPLIES];
-+	notifier_block_no_const disable_nb[WM8804_NUM_SUPPLIES];
- };
- 
- static int txsrc_get(struct snd_kcontrol *kcontrol,
-diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
-index ce67200..7f6104f 100644
---- a/sound/soc/codecs/wm8962.c
-+++ b/sound/soc/codecs/wm8962.c
-@@ -71,7 +71,7 @@ struct wm8962_priv {
- 	struct snd_soc_jack *jack;
- 
- 	struct regulator_bulk_data supplies[WM8962_NUM_SUPPLIES];
--	struct notifier_block disable_nb[WM8962_NUM_SUPPLIES];
-+	notifier_block_no_const disable_nb[WM8962_NUM_SUPPLIES];
- 
- #if defined(CONFIG_INPUT) || defined(CONFIG_INPUT_MODULE)
- 	struct input_dev *beep;
-diff --git a/sound/soc/codecs/wm8995.c b/sound/soc/codecs/wm8995.c
-index 28c89b0..806f4fe 100644
---- a/sound/soc/codecs/wm8995.c
-+++ b/sound/soc/codecs/wm8995.c
-@@ -384,7 +384,7 @@ struct wm8995_priv {
- 	int aifclk[2];
- 	struct fll_config fll[2], fll_suspend[2];
- 	struct regulator_bulk_data supplies[WM8995_NUM_SUPPLIES];
--	struct notifier_block disable_nb[WM8995_NUM_SUPPLIES];
-+	notifier_block_no_const disable_nb[WM8995_NUM_SUPPLIES];
- 	struct snd_soc_codec *codec;
- };
- 
-diff --git a/sound/soc/codecs/wm8996.c b/sound/soc/codecs/wm8996.c
-index 6dcb02c..f7de227 100644
---- a/sound/soc/codecs/wm8996.c
-+++ b/sound/soc/codecs/wm8996.c
-@@ -72,7 +72,7 @@ struct wm8996_priv {
- 	u16 hpout_pending;
- 
- 	struct regulator_bulk_data supplies[WM8996_NUM_SUPPLIES];
--	struct notifier_block disable_nb[WM8996_NUM_SUPPLIES];
-+	notifier_block_no_const disable_nb[WM8996_NUM_SUPPLIES];
- 	int bg_ena;
- 
- 	struct wm8996_pdata pdata;
 diff --git a/tools/gcc/.gitignore b/tools/gcc/.gitignore
 new file mode 100644
 index 0000000..50f2f2f
@@ -85314,13 +84188,13 @@ index 0000000..846aeb0
 +}
 diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
 new file mode 100644
-index 0000000..92ed719
+index 0000000..1742271
 --- /dev/null
 +++ b/tools/gcc/constify_plugin.c
-@@ -0,0 +1,331 @@
+@@ -0,0 +1,349 @@
 +/*
 + * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
-+ * Copyright 2011 by PaX Team <pageexec@freemail.hu>
++ * Copyright 2011-2013 by PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2, or (at your option) v3
 + *
 + * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
@@ -85358,10 +84232,16 @@ index 0000000..92ed719
 +int plugin_is_GPL_compatible;
 +
 +static struct plugin_info const_plugin_info = {
-+	.version	= "201205300030",
++	.version	= "201301150230",
 +	.help		= "no-constify\tturn off constification\n",
 +};
 +
++static tree get_field_type(tree field)
++{
++	return strip_array_types(TREE_TYPE(field));
++}
++
++static bool walk_struct(tree node);
 +static void deconstify_tree(tree node);
 +
 +static void deconstify_type(tree type)
@@ -85369,14 +84249,17 @@ index 0000000..92ed719
 +	tree field;
 +
 +	for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
-+		tree type = TREE_TYPE(field);
++		tree fieldtype = get_field_type(field);
 +
-+		if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
++		if (TREE_CODE(fieldtype) != RECORD_TYPE && TREE_CODE(fieldtype) != UNION_TYPE)
 +			continue;
-+		if (!TYPE_READONLY(type))
++		if (!TYPE_READONLY(fieldtype))
++			continue;
++		if (!walk_struct(fieldtype))
 +			continue;
 +
 +		deconstify_tree(field);
++		TREE_READONLY(field) = 0;
 +	}
 +	TYPE_READONLY(type) = 0;
 +	C_TYPE_FIELDS_READONLY(type) = 0;
@@ -85386,8 +84269,14 @@ index 0000000..92ed719
 +{
 +	tree old_type, new_type, field;
 +
++//	TREE_READONLY(node) = 0;
 +	old_type = TREE_TYPE(node);
++	while (TREE_CODE(old_type) == ARRAY_TYPE && TREE_CODE(TREE_TYPE(old_type)) != ARRAY_TYPE) {
++		node = old_type;
++		old_type = TREE_TYPE(old_type);
++	}
 +
++	gcc_assert(TREE_CODE(old_type) == RECORD_TYPE || TREE_CODE(old_type) == UNION_TYPE);
 +	gcc_assert(TYPE_READONLY(old_type) && (TYPE_QUALS(old_type) & TYPE_QUAL_CONST));
 +
 +	new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
@@ -85397,7 +84286,6 @@ index 0000000..92ed719
 +
 +	deconstify_type(new_type);
 +
-+	TREE_READONLY(node) = 0;
 +	TREE_TYPE(node) = new_type;
 +}
 +
@@ -85507,7 +84395,7 @@ index 0000000..92ed719
 +
 +static bool is_fptr(tree field)
 +{
-+	tree ptr = TREE_TYPE(field);
++	tree ptr = get_field_type(field);
 +
 +	if (TREE_CODE(ptr) != POINTER_TYPE)
 +		return false;
@@ -85522,6 +84410,9 @@ index 0000000..92ed719
 +	if (TYPE_FIELDS(node) == NULL_TREE)
 +		return false;
 +
++	if (lookup_attribute("do_const", TYPE_ATTRIBUTES(node)))
++		return true;
++
 +	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node))) {
 +		gcc_assert(!TYPE_READONLY(node));
 +		deconstify_type(node);
@@ -85529,7 +84420,7 @@ index 0000000..92ed719
 +	}
 +
 +	for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
-+		tree type = TREE_TYPE(field);
++		tree type = get_field_type(field);
 +		enum tree_code code = TREE_CODE(type);
 +
 +		if (node == type)
@@ -85555,30 +84446,13 @@ index 0000000..92ed719
 +
 +	if (walk_struct(type))
 +		constify_type(type);
++	else
++		deconstify_type(type);
 +}
 +
-+static unsigned int check_local_variables(void);
-+
-+struct gimple_opt_pass pass_local_variable = {
-+	{
-+		.type			= GIMPLE_PASS,
-+		.name			= "check_local_variables",
-+		.gate			= NULL,
-+		.execute		= check_local_variables,
-+		.sub			= NULL,
-+		.next			= NULL,
-+		.static_pass_number	= 0,
-+		.tv_id			= TV_NONE,
-+		.properties_required	= 0,
-+		.properties_provided	= 0,
-+		.properties_destroyed	= 0,
-+		.todo_flags_start	= 0,
-+		.todo_flags_finish	= 0
-+	}
-+};
-+
 +static unsigned int check_local_variables(void)
 +{
++	unsigned int ret = 0;
 +	tree var;
 +	referenced_var_iterator rvi;
 +
@@ -85606,12 +84480,30 @@ index 0000000..92ed719
 +
 +		if (walk_struct(type)) {
 +			error_at(DECL_SOURCE_LOCATION(var), "constified variable %qE cannot be local", var);
-+			return 1;
++			ret = 1;
 +		}
 +	}
-+	return 0;
++	return ret;
 +}
 +
++struct gimple_opt_pass pass_local_variable = {
++	{
++		.type			= GIMPLE_PASS,
++		.name			= "check_local_variables",
++		.gate			= NULL,
++		.execute		= check_local_variables,
++		.sub			= NULL,
++		.next			= NULL,
++		.static_pass_number	= 0,
++		.tv_id			= TV_NONE,
++		.properties_required	= 0,
++		.properties_provided	= 0,
++		.properties_destroyed	= 0,
++		.todo_flags_start	= 0,
++		.todo_flags_finish	= 0
++	}
++};
++
 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
 +{
 +	const char * const plugin_name = plugin_info->base_name;
@@ -85622,9 +84514,9 @@ index 0000000..92ed719
 +
 +	struct register_pass_info local_variable_pass_info = {
 +		.pass				= &pass_local_variable.pass,
-+		.reference_pass_name		= "*referenced_vars",
++		.reference_pass_name		= "ssa",
 +		.ref_pass_instance_number	= 1,
-+		.pos_op				= PASS_POS_INSERT_AFTER
++		.pos_op				= PASS_POS_INSERT_BEFORE
 +	};
 +
 +	if (!plugin_default_version_check(version, &gcc_version)) {
@@ -90382,10 +89274,10 @@ index 0000000..5921fd7
 +atyfb_setup_generic_49151 atyfb_setup_generic 3 49151 NULL
 diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
 new file mode 100644
-index 0000000..6387ddc
+index 0000000..792ee60
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin.c
-@@ -0,0 +1,1918 @@
+@@ -0,0 +1,1930 @@
 +/*
 + * Copyright 2011, 2012 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -90438,6 +89330,8 @@ index 0000000..6387ddc
 +	MARKED_NO, MARKED_YES, MARKED_NOT_INTENTIONAL
 +};
 +
++static unsigned int call_count = 0;
++
 +#define __unused __attribute__((__unused__))
 +#define NAME(node) IDENTIFIER_POINTER(DECL_NAME(node))
 +#define NAME_LEN(node) IDENTIFIER_LENGTH(DECL_NAME(node))
@@ -90465,10 +89359,8 @@ index 0000000..6387ddc
 +static tree get_size_overflow_type(gimple stmt, const_tree node);
 +static tree dup_assign(struct pointer_set_t *visited, gimple oldstmt, const_tree node, tree rhs1, tree rhs2, tree __unused rhs3);
 +
-+static unsigned int call_count=0;
-+
 +static struct plugin_info size_overflow_plugin_info = {
-+	.version	= "20121212beta",
++	.version	= "20130109beta",
 +	.help		= "no-size-overflow\tturn off size overflow checking\n",
 +};
 +
@@ -90755,7 +89647,7 @@ index 0000000..6387ddc
 +		  (code == POINTER_TYPE && TREE_CODE(TREE_TYPE(type)) == INTEGER_TYPE));
 +}
 +
-+static int find_arg_number(const_tree arg, tree func)
++static unsigned int find_arg_number(const_tree arg, tree func)
 +{
 +	tree var;
 +	unsigned int argnum = 1;
@@ -91018,8 +89910,8 @@ index 0000000..6387ddc
 +	basic_block first_bb;
 +
 +	first_bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
-+	if (dom_info_available_p(CDI_DOMINATORS))
-+		set_immediate_dominator(CDI_DOMINATORS, first_bb, ENTRY_BLOCK_PTR);
++	gcc_assert(dom_info_available_p(CDI_DOMINATORS));
++	set_immediate_dominator(CDI_DOMINATORS, first_bb, ENTRY_BLOCK_PTR);
 +	return first_bb;
 +}
 +
@@ -91165,6 +90057,10 @@ index 0000000..6387ddc
 +	if (rhs_mode == SImode && lhs_mode == DImode && (TYPE_UNSIGNED(rhs_type) || !TYPE_UNSIGNED(lhs_type)))
 +		return false;
 +
++	// skip lhs check on signed SI -> HI cast or signed SI -> QI cast
++	if (rhs_mode == SImode && !TYPE_UNSIGNED(rhs_type) && (lhs_mode == HImode || lhs_mode == QImode))
++		return false;
++
 +	return true;
 +}
 +
@@ -91209,21 +90105,37 @@ index 0000000..6387ddc
 +	return true;
 +}
 +
++static tree create_cast_assign(struct pointer_set_t *visited, gimple stmt)
++{
++	tree rhs1 = gimple_assign_rhs1(stmt);
++	tree lhs = gimple_get_lhs(stmt);
++	const_tree rhs1_type = TREE_TYPE(rhs1);
++	const_tree lhs_type = TREE_TYPE(lhs);
++
++	if (TYPE_UNSIGNED(rhs1_type) == TYPE_UNSIGNED(lhs_type))
++		return create_assign(visited, stmt, lhs, AFTER_STMT);
++
++	return create_assign(visited, stmt, rhs1, AFTER_STMT);
++}
++
 +static tree handle_unary_rhs(struct pointer_set_t *visited, gimple stmt)
 +{
-+	gimple def_stmt;
 +	tree size_overflow_type, lhs = gimple_get_lhs(stmt);
-+	tree new_rhs1, rhs1 = gimple_assign_rhs1(stmt);
++	tree new_rhs1 = NULL_TREE;
++	tree rhs1 = gimple_assign_rhs1(stmt);
 +	const_tree rhs1_type = TREE_TYPE(rhs1);
 +	const_tree lhs_type = TREE_TYPE(lhs);
 +
-+	new_rhs1 = expand(visited, rhs1);
++	if (gimple_plf(stmt, MY_STMT))
++		return lhs;
 +
-+	if (new_rhs1 == NULL_TREE || TREE_CODE(rhs1_type) == POINTER_TYPE)
++	if (TREE_CODE(rhs1_type) == POINTER_TYPE)
 +		return create_assign(visited, stmt, lhs, AFTER_STMT);
 +
-+	if (gimple_plf(stmt, MY_STMT))
-+		return lhs;
++	new_rhs1 = expand(visited, rhs1);
++
++	if (new_rhs1 == NULL_TREE)
++		return create_cast_assign(visited, stmt);
 +
 +	if (gimple_plf(stmt, NO_CAST_CHECK))
 +		return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
@@ -91238,18 +90150,14 @@ index 0000000..6387ddc
 +	if (!gimple_assign_cast_p(stmt) || check_undefined_integer_operation(stmt))
 +		return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
 +
++	if (TYPE_UNSIGNED(rhs1_type) != TYPE_UNSIGNED(lhs_type))
++		return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++
 +	size_overflow_type = get_size_overflow_type(stmt, rhs1);
 +	new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
 +
 +	check_size_overflow(stmt, size_overflow_type, new_rhs1, rhs1, BEFORE_STMT);
 +
-+	rhs1 = gimple_assign_rhs1(stmt);
-+	rhs1_type = TREE_TYPE(rhs1);
-+	if (TYPE_UNSIGNED(rhs1_type) != TYPE_UNSIGNED(lhs_type)) {
-+		def_stmt = get_def_stmt(new_rhs1);
-+		rhs1 = gimple_assign_rhs1(def_stmt);
-+		return create_assign(visited, stmt, rhs1, AFTER_STMT);
-+	}
 +	change_rhs1(stmt, new_rhs1);
 +
 +	if (!check_mode_type(stmt))
@@ -91398,10 +90306,9 @@ index 0000000..6387ddc
 +	make_edge(cond_bb, join_bb, EDGE_FALSE_VALUE);
 +	make_edge(bb_true, join_bb, EDGE_FALLTHRU);
 +
-+	if (dom_info_available_p(CDI_DOMINATORS)) {
-+		set_immediate_dominator(CDI_DOMINATORS, bb_true, cond_bb);
-+		set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
-+	}
++	gcc_assert(dom_info_available_p(CDI_DOMINATORS));
++	set_immediate_dominator(CDI_DOMINATORS, bb_true, cond_bb);
++	set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
 +
 +	if (current_loops != NULL) {
 +		gcc_assert(cond_bb->loop_father == join_bb->loop_father);
@@ -91426,9 +90333,11 @@ index 0000000..6387ddc
 +	gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == BOOLEAN_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE);
 +
 +	type_max = cast_a_tree(size_overflow_type, TYPE_MAX_VALUE(rhs_type));
-+	type_min = cast_a_tree(size_overflow_type, TYPE_MIN_VALUE(rhs_type));
++	// typemax (-1) < typemin (0)
++	if (TREE_OVERFLOW(type_max))
++		return;
 +
-+	gcc_assert(!TREE_OVERFLOW(type_max));
++	type_min = cast_a_tree(size_overflow_type, TYPE_MIN_VALUE(rhs_type));
 +
 +	cast_rhs_type = TREE_TYPE(cast_rhs);
 +	type_max_type = TREE_TYPE(type_max);
@@ -91528,7 +90437,6 @@ index 0000000..6387ddc
 +
 +	rhs1 = gimple_assign_rhs1(def_stmt);
 +	rhs1_def_stmt = get_def_stmt(rhs1);
-+	gcc_assert(gimple_code(rhs1_def_stmt) != GIMPLE_NOP);
 +	if (!gimple_assign_cast_p(rhs1_def_stmt))
 +		return rhs1;
 +
@@ -91722,19 +90630,19 @@ index 0000000..6387ddc
 +
 +	switch (TYPE_MODE(type)) {
 +	case QImode:
-+		new_type = (TYPE_UNSIGNED(type)) ? unsigned_intHI_type_node : intHI_type_node;
++		new_type = intHI_type_node;
 +		break;
 +	case HImode:
-+		new_type = (TYPE_UNSIGNED(type)) ? unsigned_intSI_type_node : intSI_type_node;
++		new_type = intSI_type_node;
 +		break;
 +	case SImode:
-+		new_type = (TYPE_UNSIGNED(type)) ? unsigned_intDI_type_node : intDI_type_node;
++		new_type = intDI_type_node;
 +		break;
 +	case DImode:
 +		if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode))
-+			new_type = (TYPE_UNSIGNED(type)) ? unsigned_intDI_type_node : intDI_type_node;
++			new_type = intDI_type_node;
 +		else
-+			new_type = (TYPE_UNSIGNED(type)) ? unsigned_intTI_type_node : intTI_type_node;
++			new_type = intTI_type_node;
 +		break;
 +	default:
 +		debug_tree((tree)node);
@@ -91793,10 +90701,6 @@ index 0000000..6387ddc
 +	if (gimple_plf(def_stmt, MY_STMT))
 +		return lhs;
 +
-+	// skip char type, except PHI (FIXME: only kernel)
-+	if (TYPE_MODE(TREE_TYPE(lhs)) == QImode && gimple_code(def_stmt) != GIMPLE_PHI)
-+		return create_assign(visited, def_stmt, lhs, AFTER_STMT);
-+
 +	if (pointer_set_contains(visited, def_stmt))
 +		return expand_visited(def_stmt);
 +
@@ -92636,10 +91540,10 @@ index 6789d78..4afd019e 100644
 +
  #endif
 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index be70035..739990f 100644
+index 6e8fa7e..37f02a5 100644
 --- a/virt/kvm/kvm_main.c
 +++ b/virt/kvm/kvm_main.c
-@@ -75,7 +75,7 @@ LIST_HEAD(vm_list);
+@@ -75,12 +75,17 @@ LIST_HEAD(vm_list);
  
  static cpumask_var_t cpus_hardware_enabled;
  static int kvm_usage_count = 0;
@@ -92648,7 +91552,18 @@ index be70035..739990f 100644
  
  struct kmem_cache *kvm_vcpu_cache;
  EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
-@@ -727,7 +727,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
+ 
+-static __read_mostly struct preempt_ops kvm_preempt_ops;
++static void kvm_sched_in(struct preempt_notifier *pn, int cpu);
++static void kvm_sched_out(struct preempt_notifier *pn, struct task_struct *next);
++static struct preempt_ops kvm_preempt_ops = {
++	.sched_in = kvm_sched_in,
++	.sched_out = kvm_sched_out,
++};
+ 
+ struct dentry *kvm_debugfs_dir;
+ 
+@@ -726,7 +731,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
  	/* We can read the guest memory with __xxx_user() later on. */
  	if (user_alloc &&
  	    ((mem->userspace_addr & (PAGE_SIZE - 1)) ||
@@ -92657,7 +91572,7 @@ index be70035..739990f 100644
  			(void __user *)(unsigned long)mem->userspace_addr,
  			mem->memory_size)))
  		goto out;
-@@ -2453,7 +2453,7 @@ static void hardware_enable_nolock(void *junk)
+@@ -2450,7 +2455,7 @@ static void hardware_enable_nolock(void *junk)
  
  	if (r) {
  		cpumask_clear_cpu(cpu, cpus_hardware_enabled);
@@ -92666,7 +91581,7 @@ index be70035..739990f 100644
  		printk(KERN_INFO "kvm: enabling virtualization on "
  				 "CPU%d failed\n", cpu);
  	}
-@@ -2507,10 +2507,10 @@ static int hardware_enable_all(void)
+@@ -2504,10 +2509,10 @@ static int hardware_enable_all(void)
  
  	kvm_usage_count++;
  	if (kvm_usage_count == 1) {
@@ -92679,7 +91594,7 @@ index be70035..739990f 100644
  			hardware_disable_all_nolock();
  			r = -EBUSY;
  		}
-@@ -2868,7 +2868,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
+@@ -2865,7 +2870,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
  	kvm_arch_vcpu_put(vcpu);
  }
  
@@ -92688,7 +91603,7 @@ index be70035..739990f 100644
  		  struct module *module)
  {
  	int r;
-@@ -2904,7 +2904,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2901,7 +2906,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  	if (!vcpu_align)
  		vcpu_align = __alignof__(struct kvm_vcpu);
  	kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
@@ -92697,7 +91612,7 @@ index be70035..739990f 100644
  	if (!kvm_vcpu_cache) {
  		r = -ENOMEM;
  		goto out_free_3;
-@@ -2914,9 +2914,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2911,9 +2916,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  	if (r)
  		goto out_free;
  
@@ -92712,3 +91627,13 @@ index be70035..739990f 100644
  
  	r = misc_register(&kvm_dev);
  	if (r) {
+@@ -2923,9 +2930,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+ 
+ 	register_syscore_ops(&kvm_syscore_ops);
+ 
+-	kvm_preempt_ops.sched_in = kvm_sched_in;
+-	kvm_preempt_ops.sched_out = kvm_sched_out;
+-
+ 	r = kvm_init_debug();
+ 	if (r) {
+ 		printk(KERN_ERR "kvm: create debugfs files failed\n");
diff --git a/3.7.1/4425_grsec_remove_EI_PAX.patch b/3.7.3/4425_grsec_remove_EI_PAX.patch
index 97e6951..97e6951 100644
--- a/3.7.1/4425_grsec_remove_EI_PAX.patch
+++ b/3.7.3/4425_grsec_remove_EI_PAX.patch
diff --git a/3.7.1/4430_grsec-remove-localversion-grsec.patch b/3.7.3/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.7.1/4430_grsec-remove-localversion-grsec.patch
+++ b/3.7.3/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.7.1/4435_grsec-mute-warnings.patch b/3.7.3/4435_grsec-mute-warnings.patch
index e1a7a3c..e1a7a3c 100644
--- a/3.7.1/4435_grsec-mute-warnings.patch
+++ b/3.7.3/4435_grsec-mute-warnings.patch
diff --git a/3.7.1/4440_grsec-remove-protected-paths.patch b/3.7.3/4440_grsec-remove-protected-paths.patch
index 637934a..637934a 100644
--- a/3.7.1/4440_grsec-remove-protected-paths.patch
+++ b/3.7.3/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.36/4450_grsec-kconfig-default-gids.patch b/3.7.3/4450_grsec-kconfig-default-gids.patch
index 5c5b013..e5d7e60 100644
--- a/3.2.36/4450_grsec-kconfig-default-gids.patch
+++ b/3.7.3/4450_grsec-kconfig-default-gids.patch
@@ -43,7 +43,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Setting this GID determines what group TPE restrictions will be
  	  *disabled* for.  If the sysctl option is enabled, a sysctl option
-@@ -843,7 +843,7 @@
+@@ -861,7 +861,7 @@
  config GRKERNSEC_SOCKET_ALL_GID
  	int "GID to deny all sockets for"
  	depends on GRKERNSEC_SOCKET_ALL
@@ -52,7 +52,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Here you can choose the GID to disable socket access for. Remember to
  	  add the users you want socket access disabled for to the GID
-@@ -864,7 +864,7 @@
+@@ -882,7 +882,7 @@
  config GRKERNSEC_SOCKET_CLIENT_GID
  	int "GID to deny client sockets for"
  	depends on GRKERNSEC_SOCKET_CLIENT
@@ -61,7 +61,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Here you can choose the GID to disable client socket access for.
  	  Remember to add the users you want client socket access disabled for to
-@@ -882,7 +882,7 @@
+@@ -900,7 +900,7 @@
  config GRKERNSEC_SOCKET_SERVER_GID
  	int "GID to deny server sockets for"
  	depends on GRKERNSEC_SOCKET_SERVER
diff --git a/3.7.1/4465_selinux-avc_audit-log-curr_ip.patch b/3.7.3/4465_selinux-avc_audit-log-curr_ip.patch
index 217480f..7670223 100644
--- a/3.7.1/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.7.3/4465_selinux-avc_audit-log-curr_ip.patch
@@ -28,7 +28,7 @@ Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
 diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
 --- a/grsecurity/Kconfig	2011-04-17 19:25:54.000000000 -0400
 +++ b/grsecurity/Kconfig	2011-04-17 19:32:53.000000000 -0400
-@@ -941,6 +941,27 @@
+@@ -959,6 +959,27 @@
  menu "Logging Options"
  depends on GRKERNSEC
  
diff --git a/3.7.1/4470_disable-compat_vdso.patch b/3.7.3/4470_disable-compat_vdso.patch
index d32044a..d32044a 100644
--- a/3.7.1/4470_disable-compat_vdso.patch
+++ b/3.7.3/4470_disable-compat_vdso.patch