diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/arm/kvm/arm.c linux-libre-3.16.65-gnu/arch/arm/kvm/arm.c
--- linux-libre-3.16.64-gnu/arch/arm/kvm/arm.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/arm/kvm/arm.c	2019-04-04 11:14:13.000000000 -0400
@@ -59,7 +59,7 @@ static DEFINE_PER_CPU(struct kvm_vcpu *,
 /* The VMID used in the VTTBR */
 static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
 static u8 kvm_next_vmid;
-static DEFINE_RWLOCK(kvm_vmid_lock);
+static DEFINE_SPINLOCK(kvm_vmid_lock);
 
 static bool vgic_present;
 
@@ -376,7 +376,9 @@ void force_vm_exit(const cpumask_t *mask
  */
 static bool need_new_vmid_gen(struct kvm *kvm)
 {
-	return unlikely(kvm->arch.vmid_gen != atomic64_read(&kvm_vmid_gen));
+	u64 current_vmid_gen = atomic64_read(&kvm_vmid_gen);
+	smp_rmb(); /* Orders read of kvm_vmid_gen and kvm->arch.vmid */
+	return unlikely(ACCESS_ONCE(kvm->arch.vmid_gen) != current_vmid_gen);
 }
 
 /**
@@ -391,16 +393,11 @@ static void update_vttbr(struct kvm *kvm
 {
 	phys_addr_t pgd_phys;
 	u64 vmid;
-	bool new_gen;
-
-	read_lock(&kvm_vmid_lock);
-	new_gen = need_new_vmid_gen(kvm);
-	read_unlock(&kvm_vmid_lock);
 
-	if (!new_gen)
+	if (!need_new_vmid_gen(kvm))
 		return;
 
-	write_lock(&kvm_vmid_lock);
+	spin_lock(&kvm_vmid_lock);
 
 	/*
 	 * We need to re-check the vmid_gen here to ensure that if another vcpu
@@ -408,7 +405,7 @@ static void update_vttbr(struct kvm *kvm
 	 * use the same vmid.
 	 */
 	if (!need_new_vmid_gen(kvm)) {
-		write_unlock(&kvm_vmid_lock);
+		spin_unlock(&kvm_vmid_lock);
 		return;
 	}
 
@@ -431,7 +428,6 @@ static void update_vttbr(struct kvm *kvm
 		kvm_call_hyp(__kvm_flush_vm_context);
 	}
 
-	kvm->arch.vmid_gen = atomic64_read(&kvm_vmid_gen);
 	kvm->arch.vmid = kvm_next_vmid;
 	kvm_next_vmid++;
 
@@ -441,7 +437,10 @@ static void update_vttbr(struct kvm *kvm
 	vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK;
 	kvm->arch.vttbr = pgd_phys | vmid;
 
-	write_unlock(&kvm_vmid_lock);
+	smp_wmb();
+	ACCESS_ONCE(kvm->arch.vmid_gen) = atomic64_read(&kvm_vmid_gen);
+
+	spin_unlock(&kvm_vmid_lock);
 }
 
 static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/mips/bcm63xx/reset.c linux-libre-3.16.65-gnu/arch/mips/bcm63xx/reset.c
--- linux-libre-3.16.64-gnu/arch/mips/bcm63xx/reset.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/mips/bcm63xx/reset.c	2019-04-04 11:14:13.000000000 -0400
@@ -119,7 +119,7 @@
 #define BCM6368_RESET_DSL	0
 #define BCM6368_RESET_SAR	SOFTRESET_6368_SAR_MASK
 #define BCM6368_RESET_EPHY	SOFTRESET_6368_EPHY_MASK
-#define BCM6368_RESET_ENETSW	0
+#define BCM6368_RESET_ENETSW	SOFTRESET_6368_ENETSW_MASK
 #define BCM6368_RESET_PCM	SOFTRESET_6368_PCM_MASK
 #define BCM6368_RESET_MPI	SOFTRESET_6368_MPI_MASK
 #define BCM6368_RESET_PCIE	0
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c linux-libre-3.16.65-gnu/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
--- linux-libre-3.16.64-gnu/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c	2019-04-04 11:14:13.000000000 -0400
@@ -13,6 +13,7 @@
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include "../../../../include/linux/sizes.h"
 
 int main(int argc, char *argv[])
 {
@@ -45,11 +46,11 @@ int main(int argc, char *argv[])
 	vmlinuz_load_addr = vmlinux_load_addr + vmlinux_size;
 
 	/*
-	 * Align with 16 bytes: "greater than that used for any standard data
-	 * types by a MIPS compiler." -- See MIPS Run Linux (Second Edition).
+	 * Align with 64KB: KEXEC needs load sections to be aligned to PAGE_SIZE,
+	 * which may be as large as 64KB depending on the kernel configuration.
 	 */
 
-	vmlinuz_load_addr += (16 - vmlinux_size % 16);
+	vmlinuz_load_addr += (SZ_64K - vmlinux_size % SZ_64K);
 
 	printf("0x%llx\n", vmlinuz_load_addr);
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/mips/include/asm/cpu-info.h linux-libre-3.16.65-gnu/arch/mips/include/asm/cpu-info.h
--- linux-libre-3.16.64-gnu/arch/mips/include/asm/cpu-info.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/mips/include/asm/cpu-info.h	2019-04-04 11:14:13.000000000 -0400
@@ -39,7 +39,7 @@ struct cache_desc {
 #define MIPS_CACHE_PINDEX	0x00000020	/* Physically indexed cache */
 
 struct cpuinfo_mips {
-	unsigned long		asid_cache;
+	u64			asid_cache;
 
 	/*
 	 * Capability and feature descriptor structure for MIPS CPU
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/mips/include/asm/mmu_context.h linux-libre-3.16.65-gnu/arch/mips/include/asm/mmu_context.h
--- linux-libre-3.16.64-gnu/arch/mips/include/asm/mmu_context.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/mips/include/asm/mmu_context.h	2019-04-04 11:14:13.000000000 -0400
@@ -85,15 +85,15 @@ static inline void enter_lazy_tlb(struct
  *  All unused by hardware upper bits will be considered
  *  as a software asid extension.
  */
-#define ASID_VERSION_MASK  ((unsigned long)~(ASID_MASK|(ASID_MASK-1)))
-#define ASID_FIRST_VERSION ((unsigned long)(~ASID_VERSION_MASK) + 1)
+#define ASID_VERSION_MASK  (~(u64)(ASID_MASK | (ASID_MASK - 1)))
+#define ASID_FIRST_VERSION ((u64)(~ASID_VERSION_MASK) + 1)
 
 /* Normal, classic MIPS get_new_mmu_context */
 static inline void
 get_new_mmu_context(struct mm_struct *mm, unsigned long cpu)
 {
 	extern void kvm_local_flush_tlb_all(void);
-	unsigned long asid = asid_cache(cpu);
+	u64 asid = asid_cache(cpu);
 
 	if (! ((asid += ASID_INC) & ASID_MASK) ) {
 		if (cpu_has_vtag_icache)
@@ -103,8 +103,6 @@ get_new_mmu_context(struct mm_struct *mm
 #else
 		local_flush_tlb_all();	/* start new asid cycle */
 #endif
-		if (!asid)		/* fix version if needed */
-			asid = ASID_FIRST_VERSION;
 	}
 
 	cpu_context(cpu, mm) = asid_cache(cpu) = asid;
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/mips/include/asm/mmu.h linux-libre-3.16.65-gnu/arch/mips/include/asm/mmu.h
--- linux-libre-3.16.64-gnu/arch/mips/include/asm/mmu.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/mips/include/asm/mmu.h	2019-04-04 11:14:13.000000000 -0400
@@ -2,7 +2,7 @@
 #define __ASM_MMU_H
 
 typedef struct {
-	unsigned long asid[NR_CPUS];
+	u64 asid[NR_CPUS];
 	void *vdso;
 } mm_context_t;
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/mips/include/asm/pgtable-64.h linux-libre-3.16.65-gnu/arch/mips/include/asm/pgtable-64.h
--- linux-libre-3.16.64-gnu/arch/mips/include/asm/pgtable-64.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/mips/include/asm/pgtable-64.h	2019-04-04 11:14:13.000000000 -0400
@@ -189,6 +189,11 @@ static inline int pmd_bad(pmd_t pmd)
 
 static inline int pmd_present(pmd_t pmd)
 {
+#ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
+	if (unlikely(pmd_val(pmd) & _PAGE_HUGE))
+		return pmd_val(pmd) & _PAGE_PRESENT;
+#endif
+
 	return pmd_val(pmd) != (unsigned long) invalid_pte_table;
 }
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/mips/include/uapi/asm/inst.h linux-libre-3.16.65-gnu/arch/mips/include/uapi/asm/inst.h
--- linux-libre-3.16.64-gnu/arch/mips/include/uapi/asm/inst.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/mips/include/uapi/asm/inst.h	2019-04-04 11:14:13.000000000 -0400
@@ -262,8 +262,8 @@ enum mm_32a_minor_op {
 	mm_ext_op = 0x02c,
 	mm_pool32axf_op = 0x03c,
 	mm_srl32_op = 0x040,
+	mm_srlv32_op = 0x050,
 	mm_sra_op = 0x080,
-	mm_srlv32_op = 0x090,
 	mm_rotr_op = 0x0c0,
 	mm_lwxs_op = 0x118,
 	mm_addu32_op = 0x150,
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/mips/Kconfig linux-libre-3.16.65-gnu/arch/mips/Kconfig
--- linux-libre-3.16.64-gnu/arch/mips/Kconfig	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/mips/Kconfig	2019-04-04 11:14:13.000000000 -0400
@@ -633,6 +633,7 @@ config SIBYTE_LITTLESUR
 	select SYS_SUPPORTS_BIG_ENDIAN
 	select SYS_SUPPORTS_HIGHMEM
 	select SYS_SUPPORTS_LITTLE_ENDIAN
+	select ZONE_DMA32 if 64BIT
 
 config SIBYTE_SENTOSA
 	bool "Sibyte BCM91250E-Sentosa"
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/mips/mm/c-r3k.c linux-libre-3.16.65-gnu/arch/mips/mm/c-r3k.c
--- linux-libre-3.16.64-gnu/arch/mips/mm/c-r3k.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/mips/mm/c-r3k.c	2019-04-04 11:14:13.000000000 -0400
@@ -244,7 +244,7 @@ static void r3k_flush_cache_page(struct
 	pmd_t *pmdp;
 	pte_t *ptep;
 
-	pr_debug("cpage[%08lx,%08lx]\n",
+	pr_debug("cpage[%08llx,%08lx]\n",
 		 cpu_context(smp_processor_id(), mm), addr);
 
 	/* No ASID => no such page in the cache.  */
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/powerpc/configs/g5_defconfig linux-libre-3.16.65-gnu/arch/powerpc/configs/g5_defconfig
--- linux-libre-3.16.64-gnu/arch/powerpc/configs/g5_defconfig	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/powerpc/configs/g5_defconfig	2019-04-04 11:14:13.000000000 -0400
@@ -283,7 +283,6 @@ CONFIG_DEBUG_MUTEXES=y
 CONFIG_LATENCYTOP=y
 CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_BOOTX_TEXT=y
-CONFIG_PPC_EARLY_DEBUG=y
 CONFIG_PPC_EARLY_DEBUG_BOOTX=y
 CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_TEST=m
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/powerpc/configs/maple_defconfig linux-libre-3.16.65-gnu/arch/powerpc/configs/maple_defconfig
--- linux-libre-3.16.64-gnu/arch/powerpc/configs/maple_defconfig	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/powerpc/configs/maple_defconfig	2019-04-04 11:14:13.000000000 -0400
@@ -137,7 +137,6 @@ CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_XMON=y
 CONFIG_XMON_DEFAULT=y
 CONFIG_BOOTX_TEXT=y
-CONFIG_PPC_EARLY_DEBUG=y
 CONFIG_PPC_EARLY_DEBUG_BOOTX=y
 CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_PCBC=m
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/powerpc/configs/pmac32_defconfig linux-libre-3.16.65-gnu/arch/powerpc/configs/pmac32_defconfig
--- linux-libre-3.16.64-gnu/arch/powerpc/configs/pmac32_defconfig	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/powerpc/configs/pmac32_defconfig	2019-04-04 11:14:13.000000000 -0400
@@ -349,7 +349,6 @@ CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_XMON=y
 CONFIG_XMON_DEFAULT=y
 CONFIG_BOOTX_TEXT=y
-CONFIG_PPC_EARLY_DEBUG=y
 CONFIG_PPC_EARLY_DEBUG_BOOTX=y
 CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_PCBC=m
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/powerpc/configs/ppc64_defconfig linux-libre-3.16.65-gnu/arch/powerpc/configs/ppc64_defconfig
--- linux-libre-3.16.64-gnu/arch/powerpc/configs/ppc64_defconfig	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/powerpc/configs/ppc64_defconfig	2019-04-04 11:14:13.000000000 -0400
@@ -339,7 +339,6 @@ CONFIG_FTR_FIXUP_SELFTEST=y
 CONFIG_MSI_BITMAP_SELFTEST=y
 CONFIG_XMON=y
 CONFIG_BOOTX_TEXT=y
-CONFIG_PPC_EARLY_DEBUG=y
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_HMAC=y
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/powerpc/configs/ppc6xx_defconfig linux-libre-3.16.65-gnu/arch/powerpc/configs/ppc6xx_defconfig
--- linux-libre-3.16.64-gnu/arch/powerpc/configs/ppc6xx_defconfig	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/powerpc/configs/ppc6xx_defconfig	2019-04-04 11:14:13.000000000 -0400
@@ -1261,7 +1261,6 @@ CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_XMON=y
 CONFIG_BOOTX_TEXT=y
-CONFIG_PPC_EARLY_DEBUG=y
 CONFIG_PPC_EARLY_DEBUG_BOOTX=y
 CONFIG_KEYS=y
 CONFIG_KEYS_DEBUG_PROC_KEYS=y
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/powerpc/kernel/signal_32.c linux-libre-3.16.65-gnu/arch/powerpc/kernel/signal_32.c
--- linux-libre-3.16.64-gnu/arch/powerpc/kernel/signal_32.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/powerpc/kernel/signal_32.c	2019-04-04 11:14:13.000000000 -0400
@@ -882,7 +882,23 @@ static long restore_tm_user_regs(struct
 	/* If TM bits are set to the reserved value, it's an invalid context */
 	if (MSR_TM_RESV(msr_hi))
 		return 1;
-	/* Pull in the MSR TM bits from the user context */
+
+	/*
+	 * Disabling preemption, since it is unsafe to be preempted
+	 * with MSR[TS] set without recheckpointing.
+	 */
+	preempt_disable();
+
+	/*
+	 * CAUTION:
+	 * After regs->MSR[TS] being updated, make sure that get_user(),
+	 * put_user() or similar functions are *not* called. These
+	 * functions can generate page faults which will cause the process
+	 * to be de-scheduled with MSR[TS] set but without calling
+	 * tm_recheckpoint(). This can cause a bug.
+	 *
+	 * Pull in the MSR TM bits from the user context
+	 */
 	regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
 	/* Now, recheckpoint.  This loads up all of the checkpointed (older)
 	 * registers, including FP and V[S]Rs.  After recheckpointing, the
@@ -906,6 +922,8 @@ static long restore_tm_user_regs(struct
 	}
 #endif
 
+	preempt_enable();
+
 	return 0;
 }
 #endif
@@ -1228,11 +1246,11 @@ long sys_rt_sigreturn(int r3, int r4, in
 		     struct pt_regs *regs)
 {
 	struct rt_sigframe __user *rt_sf;
+	int tm_restore = 0;
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
 	struct ucontext __user *uc_transact;
 	unsigned long msr_hi;
 	unsigned long tmp;
-	int tm_restore = 0;
 #endif
 	/* Always make any pending restarted system calls return -EINTR */
 	current_thread_info()->restart_block.fn = do_no_restart_syscall;
@@ -1266,11 +1284,19 @@ long sys_rt_sigreturn(int r3, int r4, in
 				goto bad;
 		}
 	}
-	if (!tm_restore)
-		/* Fall through, for non-TM restore */
+	if (!tm_restore) {
+		/*
+		 * Unset regs->msr because ucontext MSR TS is not
+		 * set, and recheckpoint was not called. This avoid
+		 * hitting a TM Bad thing at RFID
+		 */
+		regs->msr &= ~MSR_TS_MASK;
+	}
+	/* Fall through, for non-TM restore */
 #endif
-	if (do_setcontext(&rt_sf->uc, regs, 1))
-		goto bad;
+	if (!tm_restore)
+		if (do_setcontext(&rt_sf->uc, regs, 1))
+			goto bad;
 
 	/*
 	 * It's not clear whether or why it is desirable to save the
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/powerpc/kernel/signal_64.c linux-libre-3.16.65-gnu/arch/powerpc/kernel/signal_64.c
--- linux-libre-3.16.64-gnu/arch/powerpc/kernel/signal_64.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/powerpc/kernel/signal_64.c	2019-04-04 11:14:13.000000000 -0400
@@ -431,9 +431,6 @@ static long restore_tm_sigcontexts(struc
 	if (MSR_TM_RESV(msr))
 		return -EINVAL;
 
-	/* pull in MSR TM from user context */
-	regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
-
 	/* pull in MSR LE from user context */
 	regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
 
@@ -532,6 +529,25 @@ static long restore_tm_sigcontexts(struc
 	tm_enable();
 	/* Make sure the transaction is marked as failed */
 	current->thread.tm_texasr |= TEXASR_FS;
+
+	/*
+	 * Disabling preemption, since it is unsafe to be preempted
+	 * with MSR[TS] set without recheckpointing.
+	 */
+	preempt_disable();
+
+	/* pull in MSR TM from user context */
+	regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
+
+	/*
+	 * CAUTION:
+	 * After regs->MSR[TS] being updated, make sure that get_user(),
+	 * put_user() or similar functions are *not* called. These
+	 * functions can generate page faults which will cause the process
+	 * to be de-scheduled with MSR[TS] set but without calling
+	 * tm_recheckpoint(). This can cause a bug.
+	 */
+
 	/* This loads the checkpointed FP/VEC state, if used */
 	tm_recheckpoint(&current->thread, msr);
 
@@ -547,6 +563,8 @@ static long restore_tm_sigcontexts(struc
 	}
 #endif
 
+	preempt_enable();
+
 	return err;
 }
 #endif
@@ -689,12 +707,25 @@ int sys_rt_sigreturn(unsigned long r3, u
 		if (restore_tm_sigcontexts(regs, &uc->uc_mcontext,
 					   &uc_transact->uc_mcontext))
 			goto badframe;
-	}
-	else
-	/* Fall through, for non-TM restore */
+	} else
 #endif
-	if (restore_sigcontext(regs, NULL, 1, &uc->uc_mcontext))
-		goto badframe;
+	{
+		/*
+		 * Fall through, for non-TM restore
+		 *
+		 * Unset MSR[TS] on the thread regs since MSR from user
+		 * context does not have MSR active, and recheckpoint was
+		 * not called since restore_tm_sigcontexts() was not called
+		 * also.
+		 *
+		 * If not unsetting it, the code can RFID to userspace with
+		 * MSR[TS] set, but without CPU in the proper state,
+		 * causing a TM bad thing.
+		 */
+		current->thread.regs->msr &= ~MSR_TS_MASK;
+		if (restore_sigcontext(regs, NULL, 1, &uc->uc_mcontext))
+			goto badframe;
+	}
 
 	if (restore_altstack(&uc->uc_stack))
 		goto badframe;
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/x86/include/asm/kvm_host.h linux-libre-3.16.65-gnu/arch/x86/include/asm/kvm_host.h
--- linux-libre-3.16.64-gnu/arch/x86/include/asm/kvm_host.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/x86/include/asm/kvm_host.h	2019-04-04 11:14:13.000000000 -0400
@@ -1041,7 +1041,7 @@ asmlinkage void kvm_spurious_fault(void)
 	"cmpb $0, kvm_rebooting \n\t"	      \
 	"jne 668b \n\t"      		      \
 	__ASM_SIZE(push) " $666b \n\t"	      \
-	"call kvm_spurious_fault \n\t"	      \
+	"jmp kvm_spurious_fault \n\t"	      \
 	".popsection \n\t" \
 	_ASM_EXTABLE(666b, 667b)
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/x86/kvm/vmx.c linux-libre-3.16.65-gnu/arch/x86/kvm/vmx.c
--- linux-libre-3.16.64-gnu/arch/x86/kvm/vmx.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/x86/kvm/vmx.c	2019-04-04 11:14:13.000000000 -0400
@@ -2077,9 +2077,6 @@ static void setup_msrs(struct vcpu_vmx *
 		index = __find_msr_index(vmx, MSR_CSTAR);
 		if (index >= 0)
 			move_msr_up(vmx, index, save_nmsrs++);
-		index = __find_msr_index(vmx, MSR_TSC_AUX);
-		if (index >= 0 && vmx->rdtscp_enabled)
-			move_msr_up(vmx, index, save_nmsrs++);
 		/*
 		 * MSR_STAR is only needed on long mode guests, and only
 		 * if efer.sce is enabled.
@@ -2092,6 +2089,9 @@ static void setup_msrs(struct vcpu_vmx *
 	index = __find_msr_index(vmx, MSR_EFER);
 	if (index >= 0 && update_transition_efer(vmx, index))
 		move_msr_up(vmx, index, save_nmsrs++);
+	index = __find_msr_index(vmx, MSR_TSC_AUX);
+	if (index >= 0 && vmx->rdtscp_enabled)
+		move_msr_up(vmx, index, save_nmsrs++);
 
 	vmx->save_nmsrs = save_nmsrs;
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/arch/x86/pci/broadcom_bus.c linux-libre-3.16.65-gnu/arch/x86/pci/broadcom_bus.c
--- linux-libre-3.16.64-gnu/arch/x86/pci/broadcom_bus.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/arch/x86/pci/broadcom_bus.c	2019-04-04 11:14:13.000000000 -0400
@@ -50,8 +50,8 @@ static void __init cnb20le_res(u8 bus, u
 	word1 = read_pci_config_16(bus, slot, func, 0xc0);
 	word2 = read_pci_config_16(bus, slot, func, 0xc2);
 	if (word1 != word2) {
-		res.start = (word1 << 16) | 0x0000;
-		res.end   = (word2 << 16) | 0xffff;
+		res.start = ((resource_size_t) word1 << 16) | 0x0000;
+		res.end   = ((resource_size_t) word2 << 16) | 0xffff;
 		res.flags = IORESOURCE_MEM;
 		update_res(info, res.start, res.end, res.flags, 0);
 	}
diff -druNp --no-dereference linux-libre-3.16.64-gnu/crypto/crypto_user.c linux-libre-3.16.65-gnu/crypto/crypto_user.c
--- linux-libre-3.16.64-gnu/crypto/crypto_user.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/crypto/crypto_user.c	2019-04-04 11:14:13.000000000 -0400
@@ -226,30 +226,33 @@ static int crypto_report(struct sk_buff
 
 static int crypto_dump_report(struct sk_buff *skb, struct netlink_callback *cb)
 {
-	struct crypto_alg *alg;
+	const size_t start_pos = cb->args[0];
+	size_t pos = 0;
 	struct crypto_dump_info info;
-	int err;
-
-	if (cb->args[0])
-		goto out;
-
-	cb->args[0] = 1;
+	struct crypto_alg *alg;
+	int res;
 
 	info.in_skb = cb->skb;
 	info.out_skb = skb;
 	info.nlmsg_seq = cb->nlh->nlmsg_seq;
 	info.nlmsg_flags = NLM_F_MULTI;
 
+	down_read(&crypto_alg_sem);
 	list_for_each_entry(alg, &crypto_alg_list, cra_list) {
-		err = crypto_report_alg(alg, &info);
-		if (err)
-			goto out_err;
+		if (pos >= start_pos) {
+			res = crypto_report_alg(alg, &info);
+			if (res == -EMSGSIZE)
+				break;
+			if (res)
+				goto out;
+		}
+		pos++;
 	}
-
+	cb->args[0] = pos;
+	res = skb->len;
 out:
-	return skb->len;
-out_err:
-	return err;
+	up_read(&crypto_alg_sem);
+	return res;
 }
 
 static int crypto_dump_report_done(struct netlink_callback *cb)
@@ -478,7 +481,7 @@ static int crypto_user_rcv_msg(struct sk
 	if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) &&
 	    (nlh->nlmsg_flags & NLM_F_DUMP))) {
 		struct crypto_alg *alg;
-		u16 dump_alloc = 0;
+		unsigned long dump_alloc = 0;
 
 		if (link->dump == NULL)
 			return -EINVAL;
@@ -486,16 +489,16 @@ static int crypto_user_rcv_msg(struct sk
 		down_read(&crypto_alg_sem);
 		list_for_each_entry(alg, &crypto_alg_list, cra_list)
 			dump_alloc += CRYPTO_REPORT_MAXSIZE;
+		up_read(&crypto_alg_sem);
 
 		{
 			struct netlink_dump_control c = {
 				.dump = link->dump,
 				.done = link->done,
-				.min_dump_alloc = dump_alloc,
+				.min_dump_alloc = min(dump_alloc, 65535UL),
 			};
 			err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
 		}
-		up_read(&crypto_alg_sem);
 
 		return err;
 	}
diff -druNp --no-dereference linux-libre-3.16.64-gnu/crypto/pcrypt.c linux-libre-3.16.65-gnu/crypto/pcrypt.c
--- linux-libre-3.16.64-gnu/crypto/pcrypt.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/crypto/pcrypt.c	2019-04-04 11:14:13.000000000 -0400
@@ -440,7 +440,7 @@ static int pcrypt_sysfs_add(struct padat
 	int ret;
 
 	pinst->kobj.kset = pcrypt_kset;
-	ret = kobject_add(&pinst->kobj, NULL, name);
+	ret = kobject_add(&pinst->kobj, NULL, "%s", name);
 	if (!ret)
 		kobject_uevent(&pinst->kobj, KOBJ_ADD);
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/Documentation/filesystems/proc.txt linux-libre-3.16.65-gnu/Documentation/filesystems/proc.txt
--- linux-libre-3.16.64-gnu/Documentation/filesystems/proc.txt	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/Documentation/filesystems/proc.txt	2019-04-04 11:14:13.000000000 -0400
@@ -429,7 +429,6 @@ manner. The codes are the following:
     ac  - area is accountable
     nr  - swap space is not reserved for the area
     ht  - area uses huge tlb pages
-    nl  - non-linear mapping
     ar  - architecture specific flag
     dd  - do not include area into core dump
     sd  - soft-dirty flag
diff -druNp --no-dereference linux-libre-3.16.64-gnu/Documentation/vm/page_migration linux-libre-3.16.65-gnu/Documentation/vm/page_migration
--- linux-libre-3.16.64-gnu/Documentation/vm/page_migration	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/Documentation/vm/page_migration	2019-04-04 11:14:13.000000000 -0400
@@ -99,12 +99,10 @@ Steps:
 4. The new page is prepped with some settings from the old page so that
    accesses to the new page will discover a page with the correct settings.
 
-5. All the page table references to the page are converted
-   to migration entries or dropped (nonlinear vmas).
-   This decrease the mapcount of a page. If the resulting
-   mapcount is not zero then we do not migrate the page.
-   All user space processes that attempt to access the page
-   will now wait on the page lock.
+5. All the page table references to the page are converted to migration
+   entries. This decreases the mapcount of a page. If the resulting
+   mapcount is not zero then we do not migrate the page. All user space
+   processes that attempt to access the page will now wait on the page lock.
 
 6. The radix tree lock is taken. This will cause all processes trying
    to access the page via the mapping to block on the radix tree spinlock.
diff -druNp --no-dereference linux-libre-3.16.64-gnu/Documentation/vm/unevictable-lru.txt linux-libre-3.16.65-gnu/Documentation/vm/unevictable-lru.txt
--- linux-libre-3.16.64-gnu/Documentation/vm/unevictable-lru.txt	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/Documentation/vm/unevictable-lru.txt	2019-04-04 11:14:13.000000000 -0400
@@ -523,83 +523,20 @@ map.
 
 try_to_unmap() is always called, by either vmscan for reclaim or for page
 migration, with the argument page locked and isolated from the LRU.  Separate
-functions handle anonymous and mapped file pages, as these types of pages have
-different reverse map mechanisms.
-
- (*) try_to_unmap_anon()
-
-     To unmap anonymous pages, each VMA in the list anchored in the anon_vma
-     must be visited - at least until a VM_LOCKED VMA is encountered.  If the
-     page is being unmapped for migration, VM_LOCKED VMAs do not stop the
-     process because mlocked pages are migratable.  However, for reclaim, if
-     the page is mapped into a VM_LOCKED VMA, the scan stops.
-
-     try_to_unmap_anon() attempts to acquire in read mode the mmap semaphore of
-     the mm_struct to which the VMA belongs.  If this is successful, it will
-     mlock the page via mlock_vma_page() - we wouldn't have gotten to
-     try_to_unmap_anon() if the page were already mlocked - and will return
-     SWAP_MLOCK, indicating that the page is unevictable.
-
-     If the mmap semaphore cannot be acquired, we are not sure whether the page
-     is really unevictable or not.  In this case, try_to_unmap_anon() will
-     return SWAP_AGAIN.
-
- (*) try_to_unmap_file() - linear mappings
-
-     Unmapping of a mapped file page works the same as for anonymous mappings,
-     except that the scan visits all VMAs that map the page's index/page offset
-     in the page's mapping's reverse map priority search tree.  It also visits
-     each VMA in the page's mapping's non-linear list, if the list is
-     non-empty.
-
-     As for anonymous pages, on encountering a VM_LOCKED VMA for a mapped file
-     page, try_to_unmap_file() will attempt to acquire the associated
-     mm_struct's mmap semaphore to mlock the page, returning SWAP_MLOCK if this
-     is successful, and SWAP_AGAIN, if not.
-
- (*) try_to_unmap_file() - non-linear mappings
-
-     If a page's mapping contains a non-empty non-linear mapping VMA list, then
-     try_to_un{map|lock}() must also visit each VMA in that list to determine
-     whether the page is mapped in a VM_LOCKED VMA.  Again, the scan must visit
-     all VMAs in the non-linear list to ensure that the pages is not/should not
-     be mlocked.
-
-     If a VM_LOCKED VMA is found in the list, the scan could terminate.
-     However, there is no easy way to determine whether the page is actually
-     mapped in a given VMA - either for unmapping or testing whether the
-     VM_LOCKED VMA actually pins the page.
-
-     try_to_unmap_file() handles non-linear mappings by scanning a certain
-     number of pages - a "cluster" - in each non-linear VMA associated with the
-     page's mapping, for each file mapped page that vmscan tries to unmap.  If
-     this happens to unmap the page we're trying to unmap, try_to_unmap() will
-     notice this on return (page_mapcount(page) will be 0) and return
-     SWAP_SUCCESS.  Otherwise, it will return SWAP_AGAIN, causing vmscan to
-     recirculate this page.  We take advantage of the cluster scan in
-     try_to_unmap_cluster() as follows:
-
-	For each non-linear VMA, try_to_unmap_cluster() attempts to acquire the
-	mmap semaphore of the associated mm_struct for read without blocking.
-
-	If this attempt is successful and the VMA is VM_LOCKED,
-	try_to_unmap_cluster() will retain the mmap semaphore for the scan;
-	otherwise it drops it here.
-
-	Then, for each page in the cluster, if we're holding the mmap semaphore
-	for a locked VMA, try_to_unmap_cluster() calls mlock_vma_page() to
-	mlock the page.  This call is a no-op if the page is already locked,
-	but will mlock any pages in the non-linear mapping that happen to be
-	unlocked.
+functions handle anonymous and mapped file and KSM pages, as these types of
+pages have different reverse map lookup mechanisms, with different locking.
+In each case, whether rmap_walk_anon() or rmap_walk_file() or rmap_walk_ksm(),
+it will call try_to_unmap_one() for every VMA which might contain the page.
 
-	If one of the pages so mlocked is the page passed in to try_to_unmap(),
-	try_to_unmap_cluster() will return SWAP_MLOCK, rather than the default
-	SWAP_AGAIN.  This will allow vmscan to cull the page, rather than
-	recirculating it on the inactive list.
+When trying to reclaim, if try_to_unmap_one() finds the page in a VM_LOCKED
+VMA, it will then mlock the page via mlock_vma_page() instead of unmapping it,
+and return SWAP_MLOCK to indicate that the page is unevictable: and the scan
+stops there.
 
-	Again, if try_to_unmap_cluster() cannot acquire the VMA's mmap sem, it
-	returns SWAP_AGAIN, indicating that the page is mapped by a VM_LOCKED
-	VMA, but couldn't be mlocked.
+mlock_vma_page() is called while holding the page table's lock (in addition
+to the page lock, and the rmap lock): to serialize against concurrent mlock or
+munlock or munmap system calls, mm teardown (munlock_vma_pages_all), reclaim,
+holepunching, and truncation of file pages and their anonymous COWed pages.
 
 
 try_to_munlock() REVERSE MAP SCAN
@@ -615,29 +552,15 @@ all PTEs from the page.  For this purpos
 introduced a variant of try_to_unmap() called try_to_munlock().
 
 try_to_munlock() calls the same functions as try_to_unmap() for anonymous and
-mapped file pages with an additional argument specifying unlock versus unmap
+mapped file and KSM pages with a flag argument specifying unlock versus unmap
 processing.  Again, these functions walk the respective reverse maps looking
-for VM_LOCKED VMAs.  When such a VMA is found for anonymous pages and file
-pages mapped in linear VMAs, as in the try_to_unmap() case, the functions
-attempt to acquire the associated mmap semaphore, mlock the page via
-mlock_vma_page() and return SWAP_MLOCK.  This effectively undoes the
-pre-clearing of the page's PG_mlocked done by munlock_vma_page.
-
-If try_to_unmap() is unable to acquire a VM_LOCKED VMA's associated mmap
-semaphore, it will return SWAP_AGAIN.  This will allow shrink_page_list() to
-recycle the page on the inactive list and hope that it has better luck with the
-page next time.
-
-For file pages mapped into non-linear VMAs, the try_to_munlock() logic works
-slightly differently.  On encountering a VM_LOCKED non-linear VMA that might
-map the page, try_to_munlock() returns SWAP_AGAIN without actually mlocking the
-page.  munlock_vma_page() will just leave the page unlocked and let vmscan deal
-with it - the usual fallback position.
+for VM_LOCKED VMAs.  When such a VMA is found, as in the try_to_unmap() case,
+the functions mlock the page via mlock_vma_page() and return SWAP_MLOCK.  This
+undoes the pre-clearing of the page's PG_mlocked done by munlock_vma_page.
 
 Note that try_to_munlock()'s reverse map walk must visit every VMA in a page's
 reverse map to determine that a page is NOT mapped into any VM_LOCKED VMA.
-However, the scan can terminate when it encounters a VM_LOCKED VMA and can
-successfully acquire the VMA's mmap semaphore for read and mlock the page.
+However, the scan can terminate when it encounters a VM_LOCKED VMA.
 Although try_to_munlock() might be called a great many times when munlocking a
 large region or tearing down a large address space that has been mlocked via
 mlockall(), overall this is a fairly rare event.
@@ -665,11 +588,6 @@ Some examples of these unevictable pages
  (3) mlocked pages that could not be isolated from the LRU and moved to the
      unevictable list in mlock_vma_page().
 
- (4) Pages mapped into multiple VM_LOCKED VMAs, but try_to_munlock() couldn't
-     acquire the VMA's mmap semaphore to test the flags and set PageMlocked.
-     munlock_vma_page() was forced to let the page back on to the normal LRU
-     list for vmscan to handle.
-
 shrink_inactive_list() also diverts any unevictable pages that it finds on the
 inactive lists to the appropriate zone's unevictable list.
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/ata/sata_rcar.c linux-libre-3.16.65-gnu/drivers/ata/sata_rcar.c
--- linux-libre-3.16.64-gnu/drivers/ata/sata_rcar.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/ata/sata_rcar.c	2019-04-04 11:14:13.000000000 -0400
@@ -874,7 +874,9 @@ static int sata_rcar_probe(struct platfo
 	int ret = 0;
 
 	irq = platform_get_irq(pdev, 0);
-	if (irq <= 0)
+	if (irq < 0)
+		return irq;
+	if (!irq)
 		return -EINVAL;
 
 	priv = devm_kzalloc(&pdev->dev, sizeof(struct sata_rcar_priv),
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/block/swim3.c linux-libre-3.16.65-gnu/drivers/block/swim3.c
--- linux-libre-3.16.64-gnu/drivers/block/swim3.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/block/swim3.c	2019-04-04 11:14:13.000000000 -0400
@@ -1027,7 +1027,11 @@ static void floppy_release(struct gendis
 	struct swim3 __iomem *sw = fs->swim3;
 
 	mutex_lock(&swim3_mutex);
-	if (fs->ref_count > 0 && --fs->ref_count == 0) {
+	if (fs->ref_count > 0)
+		--fs->ref_count;
+	else if (fs->ref_count == -1)
+		fs->ref_count = 0;
+	if (fs->ref_count == 0) {
 		swim3_action(fs, MOTOR_OFF);
 		out_8(&sw->control_bic, 0xff);
 		swim3_select(fs, RELAX);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/gpu/drm/i915/intel_ringbuffer.c linux-libre-3.16.65-gnu/drivers/gpu/drm/i915/intel_ringbuffer.c
--- linux-libre-3.16.64-gnu/drivers/gpu/drm/i915/intel_ringbuffer.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/gpu/drm/i915/intel_ringbuffer.c	2019-04-04 11:14:13.000000000 -0400
@@ -103,6 +103,7 @@ gen4_render_ring_flush(struct intel_engi
 	struct drm_device *dev = ring->dev;
 	u32 cmd;
 	int ret;
+	int i;
 
 	/*
 	 * read/write caches:
@@ -142,12 +143,47 @@ gen4_render_ring_flush(struct intel_engi
 	    (IS_G4X(dev) || IS_GEN5(dev)))
 		cmd |= MI_INVALIDATE_ISP;
 
-	ret = intel_ring_begin(ring, 2);
+	i = 2;
+	if (invalidate_domains & I915_GEM_DOMAIN_INSTRUCTION)
+		i += 20;
+
+	ret = intel_ring_begin(ring, i);
 	if (ret)
 		return ret;
 
 	intel_ring_emit(ring, cmd);
-	intel_ring_emit(ring, MI_NOOP);
+
+	/*
+	 * A random delay to let the CS invalidate take effect? Without this
+	 * delay, the GPU relocation path fails as the CS does not see
+	 * the updated contents. Just as important, if we apply the flushes
+	 * to the EMIT_FLUSH branch (i.e. immediately after the relocation
+	 * write and before the invalidate on the next batch), the relocations
+	 * still fail. This implies that is a delay following invalidation
+	 * that is required to reset the caches as opposed to a delay to
+	 * ensure the memory is written.
+	 */
+	if (invalidate_domains & I915_GEM_DOMAIN_INSTRUCTION) {
+		intel_ring_emit(ring, GFX_OP_PIPE_CONTROL(4) |
+				PIPE_CONTROL_QW_WRITE);
+		intel_ring_emit(ring, ring->scratch.gtt_offset |
+				PIPE_CONTROL_GLOBAL_GTT);
+		intel_ring_emit(ring, 0);
+		intel_ring_emit(ring, 0);
+
+		for (i = 0; i < 12; i++)
+			intel_ring_emit(ring, MI_FLUSH);
+
+		intel_ring_emit(ring, GFX_OP_PIPE_CONTROL(4) |
+				PIPE_CONTROL_QW_WRITE);
+		intel_ring_emit(ring, ring->scratch.gtt_offset |
+				PIPE_CONTROL_GLOBAL_GTT);
+		intel_ring_emit(ring, 0);
+		intel_ring_emit(ring, 0);
+	}
+
+	intel_ring_emit(ring, cmd);
+
 	intel_ring_advance(ring);
 
 	return 0;
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/gpu/drm/rcar-du/rcar_du_drv.c linux-libre-3.16.65-gnu/drivers/gpu/drm/rcar-du/rcar_du_drv.c
--- linux-libre-3.16.64-gnu/drivers/gpu/drm/rcar-du/rcar_du_drv.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/gpu/drm/rcar-du/rcar_du_drv.c	2019-04-04 11:14:13.000000000 -0400
@@ -89,7 +89,7 @@ static int rcar_du_load(struct drm_devic
 	}
 
 	/* vblank handling */
-	ret = drm_vblank_init(dev, (1 << rcdu->num_crtcs) - 1);
+	ret = drm_vblank_init(dev, rcdu->num_crtcs);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "failed to initialize vblank\n");
 		goto done;
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/infiniband/hw/qib/qib_sdma.c linux-libre-3.16.65-gnu/drivers/infiniband/hw/qib/qib_sdma.c
--- linux-libre-3.16.64-gnu/drivers/infiniband/hw/qib/qib_sdma.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/infiniband/hw/qib/qib_sdma.c	2019-04-04 11:14:13.000000000 -0400
@@ -597,8 +597,10 @@ retry:
 		dw = (len + 3) >> 2;
 		addr = dma_map_single(&ppd->dd->pcidev->dev, sge->vaddr,
 				      dw << 2, DMA_TO_DEVICE);
-		if (dma_mapping_error(&ppd->dd->pcidev->dev, addr))
+		if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) {
+			ret = -ENOMEM;
 			goto unmap;
+		}
 		sdmadesc[0] = 0;
 		make_sdma_desc(ppd, sdmadesc, (u64) addr, dw, dwoffset);
 		/* SDmaUseLargeBuf has to be set in every descriptor */
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/input/keyboard/nomadik-ske-keypad.c linux-libre-3.16.65-gnu/drivers/input/keyboard/nomadik-ske-keypad.c
--- linux-libre-3.16.64-gnu/drivers/input/keyboard/nomadik-ske-keypad.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/input/keyboard/nomadik-ske-keypad.c	2019-04-04 11:14:13.000000000 -0400
@@ -100,7 +100,7 @@ static int __init ske_keypad_chip_init(s
 	while ((readl(keypad->reg_base + SKE_RIS) != 0x00000000) && timeout--)
 		cpu_relax();
 
-	if (!timeout)
+	if (timeout == -1)
 		return -EINVAL;
 
 	/*
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/misc/altera-stapl/altera.c linux-libre-3.16.65-gnu/drivers/misc/altera-stapl/altera.c
--- linux-libre-3.16.64-gnu/drivers/misc/altera-stapl/altera.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/misc/altera-stapl/altera.c	2019-04-04 11:14:13.000000000 -0400
@@ -2176,8 +2176,7 @@ static int altera_get_note(u8 *p, s32 pr
 			key_ptr = &p[note_strings +
 					get_unaligned_be32(
 					&p[note_table + (8 * i)])];
-			if ((strnicmp(key, key_ptr, strlen(key_ptr)) == 0) &&
-						(key != NULL)) {
+			if (key && !strncasecmp(key, key_ptr, strlen(key_ptr))) {
 				status = 0;
 
 				value_ptr = &p[note_strings +
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/misc/genwqe/card_utils.c linux-libre-3.16.65-gnu/drivers/misc/genwqe/card_utils.c
--- linux-libre-3.16.64-gnu/drivers/misc/genwqe/card_utils.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/misc/genwqe/card_utils.c	2019-04-04 11:14:13.000000000 -0400
@@ -206,7 +206,7 @@ u32 genwqe_crc32(u8 *buff, size_t len, u
 void *__genwqe_alloc_consistent(struct genwqe_dev *cd, size_t size,
 			       dma_addr_t *dma_handle)
 {
-	if (get_order(size) > MAX_ORDER)
+	if (get_order(size) >= MAX_ORDER)
 		return NULL;
 
 	return pci_alloc_consistent(cd->pci_dev, size, dma_handle);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/misc/vexpress-syscfg.c linux-libre-3.16.65-gnu/drivers/misc/vexpress-syscfg.c
--- linux-libre-3.16.64-gnu/drivers/misc/vexpress-syscfg.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/misc/vexpress-syscfg.c	2019-04-04 11:14:13.000000000 -0400
@@ -61,7 +61,7 @@ static int vexpress_syscfg_exec(struct v
 	int tries;
 	long timeout;
 
-	if (WARN_ON(index > func->num_templates))
+	if (WARN_ON(index >= func->num_templates))
 		return -EINVAL;
 
 	command = readl(syscfg->base + SYS_CFGCTRL);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/net/ethernet/ibm/ibmveth.c linux-libre-3.16.65-gnu/drivers/net/ethernet/ibm/ibmveth.c
--- linux-libre-3.16.64-gnu/drivers/net/ethernet/ibm/ibmveth.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/net/ethernet/ibm/ibmveth.c	2019-04-04 11:14:13.000000000 -0400
@@ -1059,11 +1059,15 @@ out:
 
 map_failed_frags:
 	last = i+1;
-	for (i = 0; i < last; i++)
+	for (i = 1; i < last; i++)
 		dma_unmap_page(&adapter->vdev->dev, descs[i].fields.address,
 			       descs[i].fields.flags_len & IBMVETH_BUF_LEN_MASK,
 			       DMA_TO_DEVICE);
 
+	dma_unmap_single(&adapter->vdev->dev,
+			 descs[0].fields.address,
+			 descs[0].fields.flags_len & IBMVETH_BUF_LEN_MASK,
+			 DMA_TO_DEVICE);
 map_failed:
 	if (!firmware_has_feature(FW_FEATURE_CMO))
 		netdev_err(netdev, "tx: unable to map xmit buffer\n");
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/net/ethernet/intel/igb/igb_main.c linux-libre-3.16.65-gnu/drivers/net/ethernet/intel/igb/igb_main.c
--- linux-libre-3.16.64-gnu/drivers/net/ethernet/intel/igb/igb_main.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/net/ethernet/intel/igb/igb_main.c	2019-04-04 11:14:13.000000000 -0400
@@ -7419,9 +7419,11 @@ static int __igb_shutdown(struct pci_dev
 	igb_clear_interrupt_scheme(adapter);
 
 #ifdef CONFIG_PM
-	retval = pci_save_state(pdev);
-	if (retval)
-		return retval;
+	if (!runtime) {
+		retval = pci_save_state(pdev);
+		if (retval)
+			return retval;
+	}
 #endif
 
 	status = rd32(E1000_STATUS);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/net/ethernet/mellanox/mlx5/core/main.c linux-libre-3.16.65-gnu/drivers/net/ethernet/mellanox/mlx5/core/main.c
--- linux-libre-3.16.64-gnu/drivers/net/ethernet/mellanox/mlx5/core/main.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/net/ethernet/mellanox/mlx5/core/main.c	2019-04-04 11:14:13.000000000 -0400
@@ -313,9 +313,9 @@ int mlx5_dev_init(struct mlx5_core_dev *
 	INIT_LIST_HEAD(&priv->pgdir_list);
 	spin_lock_init(&priv->mkey_lock);
 
-	priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root);
-	if (!priv->dbg_root)
-		return -ENOMEM;
+	if (mlx5_debugfs_root)
+		priv->dbg_root =
+			debugfs_create_dir(pci_name(pdev), mlx5_debugfs_root);
 
 	err = pci_enable_device(pdev);
 	if (err) {
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/net/hamradio/6pack.c linux-libre-3.16.65-gnu/drivers/net/hamradio/6pack.c
--- linux-libre-3.16.64-gnu/drivers/net/hamradio/6pack.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/net/hamradio/6pack.c	2019-04-04 11:14:13.000000000 -0400
@@ -551,12 +551,7 @@ static void resync_tnc(unsigned long cha
 
 
 	/* Start resync timer again -- the TNC might be still absent */
-
-	del_timer(&sp->resync_t);
-	sp->resync_t.data	= (unsigned long) sp;
-	sp->resync_t.function	= resync_tnc;
-	sp->resync_t.expires	= jiffies + SIXP_RESYNC_TIMEOUT;
-	add_timer(&sp->resync_t);
+	mod_timer(&sp->resync_t, jiffies + SIXP_RESYNC_TIMEOUT);
 }
 
 static inline int tnc_init(struct sixpack *sp)
@@ -567,11 +562,7 @@ static inline int tnc_init(struct sixpac
 
 	sp->tty->ops->write(sp->tty, &inbyte, 1);
 
-	del_timer(&sp->resync_t);
-	sp->resync_t.data = (unsigned long) sp;
-	sp->resync_t.function = resync_tnc;
-	sp->resync_t.expires = jiffies + SIXP_RESYNC_TIMEOUT;
-	add_timer(&sp->resync_t);
+	mod_timer(&sp->resync_t, jiffies + SIXP_RESYNC_TIMEOUT);
 
 	return 0;
 }
@@ -654,6 +645,8 @@ static int sixpack_open(struct tty_struc
 	sp->tx_t.data = (unsigned long) sp;
 
 	init_timer(&sp->resync_t);
+	sp->resync_t.function = resync_tnc;
+	sp->resync_t.data = (unsigned long) sp;
 
 	spin_unlock_bh(&sp->lock);
 
@@ -947,13 +940,8 @@ static void decode_prio_command(struct s
         /* if the state byte has been received, the TNC is present,
            so the resync timer can be reset. */
 
-	if (sp->tnc_state == TNC_IN_SYNC) {
-		del_timer(&sp->resync_t);
-		sp->resync_t.data	= (unsigned long) sp;
-		sp->resync_t.function	= resync_tnc;
-		sp->resync_t.expires	= jiffies + SIXP_INIT_RESYNC_TIMEOUT;
-		add_timer(&sp->resync_t);
-	}
+	if (sp->tnc_state == TNC_IN_SYNC)
+		mod_timer(&sp->resync_t, jiffies + SIXP_INIT_RESYNC_TIMEOUT);
 
 	sp->status1 = cmd & SIXP_PRIO_DATA_MASK;
 }
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/net/vmxnet3/vmxnet3_drv.c linux-libre-3.16.65-gnu/drivers/net/vmxnet3/vmxnet3_drv.c
--- linux-libre-3.16.64-gnu/drivers/net/vmxnet3/vmxnet3_drv.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/net/vmxnet3/vmxnet3_drv.c	2019-04-04 11:14:13.000000000 -0400
@@ -1308,9 +1308,9 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx
 				goto rcd_done;
 			}
 			new_dma_addr = dma_map_page(&adapter->pdev->dev,
-						rbi->page,
-						0, PAGE_SIZE,
-						PCI_DMA_FROMDEVICE);
+						    new_page,
+						    0, PAGE_SIZE,
+						    PCI_DMA_FROMDEVICE);
 			if (dma_mapping_error(&adapter->pdev->dev,
 					      new_dma_addr)) {
 				put_page(new_page);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/net/vmxnet3/vmxnet3_int.h linux-libre-3.16.65-gnu/drivers/net/vmxnet3/vmxnet3_int.h
--- linux-libre-3.16.64-gnu/drivers/net/vmxnet3/vmxnet3_int.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/net/vmxnet3/vmxnet3_int.h	2019-04-04 11:14:13.000000000 -0400
@@ -69,12 +69,12 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.2.2.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.2.3.0-k"
 
 /* Each byte of this 32-bit integer encodes a version number in
  * VMXNET3_DRIVER_VERSION_STRING.
  */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01020200
+#define VMXNET3_DRIVER_VERSION_NUM      0x01020300
 
 #if defined(CONFIG_PCI_MSI)
 	/* RSS only makes sense if MSI-X is supported. */
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/net/wireless/airo.c linux-libre-3.16.65-gnu/drivers/net/wireless/airo.c
--- linux-libre-3.16.64-gnu/drivers/net/wireless/airo.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/net/wireless/airo.c	2019-04-04 11:14:13.000000000 -0400
@@ -5469,7 +5469,7 @@ static int proc_BSSList_open( struct ino
            we have to add a spin lock... */
 	rc = readBSSListRid(ai, doLoseSync, &BSSList_rid);
 	while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) {
-		ptr += sprintf(ptr, "%pM %*s rssi = %d",
+		ptr += sprintf(ptr, "%pM %.*s rssi = %d",
 			       BSSList_rid.bssid,
 				(int)BSSList_rid.ssidLen,
 				BSSList_rid.ssid,
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/net/wireless/ath/ath6kl/cfg80211.c linux-libre-3.16.65-gnu/drivers/net/wireless/ath/ath6kl/cfg80211.c
--- linux-libre-3.16.64-gnu/drivers/net/wireless/ath/ath6kl/cfg80211.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/net/wireless/ath/ath6kl/cfg80211.c	2019-04-04 11:14:13.000000000 -0400
@@ -930,7 +930,7 @@ static int ath6kl_set_probed_ssids(struc
 		else
 			ssid_list[i].flag = ANY_SSID_FLAG;
 
-		if (n_match_ssid == 0)
+		if (ar->wiphy->max_match_sets != 0 && n_match_ssid == 0)
 			ssid_list[i].flag |= MATCH_SSID_FLAG;
 	}
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/net/wireless/b43/phy_common.c linux-libre-3.16.65-gnu/drivers/net/wireless/b43/phy_common.c
--- linux-libre-3.16.64-gnu/drivers/net/wireless/b43/phy_common.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/net/wireless/b43/phy_common.c	2019-04-04 11:14:13.000000000 -0400
@@ -596,7 +596,7 @@ struct b43_c32 b43_cordic(int theta)
 	u8 i;
 	s32 tmp;
 	s8 signx = 1;
-	u32 angle = 0;
+	s32 angle = 0;
 	struct b43_c32 ret = { .i = 39797, .q = 0, };
 
 	while (theta > (180 << 16))
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7740.c linux-libre-3.16.65-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
--- linux-libre-3.16.64-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7740.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7740.c	2019-04-04 11:14:13.000000000 -0400
@@ -1987,7 +1987,7 @@ static const unsigned int gether_gmii_pi
 	 */
 	185, 186, 187, 188, 189, 190, 191, 192, 174, 161, 204,
 	171, 170, 169, 168, 167, 166, 173, 172, 176, 184, 183, 203,
-	205, 163, 206, 207,
+	205, 163, 206, 207, 158,
 };
 static const unsigned int gether_gmii_mux[] = {
 	ET_ERXD0_MARK, ET_ERXD1_MARK, ET_ERXD2_MARK, ET_ERXD3_MARK,
@@ -2159,6 +2159,7 @@ static const unsigned int lcd0_data24_1_
 	LCD0_D0_MARK, LCD0_D1_MARK, LCD0_D2_MARK, LCD0_D3_MARK,
 	LCD0_D4_MARK, LCD0_D5_MARK, LCD0_D6_MARK, LCD0_D7_MARK,
 	LCD0_D8_MARK, LCD0_D9_MARK, LCD0_D10_MARK, LCD0_D11_MARK,
+	LCD0_D12_MARK, LCD0_D13_MARK, LCD0_D14_MARK, LCD0_D15_MARK,
 	LCD0_D16_MARK, LCD0_D17_MARK, LCD0_D18_PORT163_MARK,
 	LCD0_D19_PORT162_MARK, LCD0_D20_PORT161_MARK, LCD0_D21_PORT158_MARK,
 	LCD0_D22_PORT160_MARK, LCD0_D23_PORT159_MARK,
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7791.c linux-libre-3.16.65-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
--- linux-libre-3.16.64-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7791.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7791.c	2019-04-04 11:14:13.000000000 -0400
@@ -2656,8 +2656,7 @@ static const unsigned int qspi_data4_b_p
 	RCAR_GP_PIN(6, 4),
 };
 static const unsigned int qspi_data4_b_mux[] = {
-	SPCLK_B_MARK, MOSI_IO0_B_MARK, MISO_IO1_B_MARK,
-	IO2_B_MARK, IO3_B_MARK, SSL_B_MARK,
+	MOSI_IO0_B_MARK, MISO_IO1_B_MARK, IO2_B_MARK, IO3_B_MARK,
 };
 /* - SCIF0 ------------------------------------------------------------------ */
 static const unsigned int scif0_data_pins[] = {
@@ -3786,17 +3785,14 @@ static const unsigned int vin1_b_data18_
 };
 static const unsigned int vin1_b_data18_mux[] = {
 	/* B */
-	VI1_DATA0_B_MARK, VI1_DATA1_B_MARK,
 	VI1_DATA2_B_MARK, VI1_DATA3_B_MARK,
 	VI1_DATA4_B_MARK, VI1_DATA5_B_MARK,
 	VI1_DATA6_B_MARK, VI1_DATA7_B_MARK,
 	/* G */
-	VI1_G0_B_MARK, VI1_G1_B_MARK,
 	VI1_G2_B_MARK, VI1_G3_B_MARK,
 	VI1_G4_B_MARK, VI1_G5_B_MARK,
 	VI1_G6_B_MARK, VI1_G7_B_MARK,
 	/* R */
-	VI1_R0_B_MARK, VI1_R1_B_MARK,
 	VI1_R2_B_MARK, VI1_R3_B_MARK,
 	VI1_R4_B_MARK, VI1_R5_B_MARK,
 	VI1_R6_B_MARK, VI1_R7_B_MARK,
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/pinctrl/sh-pfc/pfc-sh7264.c linux-libre-3.16.65-gnu/drivers/pinctrl/sh-pfc/pfc-sh7264.c
--- linux-libre-3.16.64-gnu/drivers/pinctrl/sh-pfc/pfc-sh7264.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/pinctrl/sh-pfc/pfc-sh7264.c	2019-04-04 11:14:13.000000000 -0400
@@ -1716,6 +1716,9 @@ static const struct pinmux_cfg_reg pinmu
 	},
 
 	{ PINMUX_CFG_REG("PFCR3", 0xfffe38a8, 16, 4) {
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 		PF12MD_000, PF12MD_001, 0, PF12MD_011,
 		PF12MD_100, PF12MD_101, 0, 0,
 		0, 0, 0, 0, 0, 0, 0, 0 }
@@ -1759,8 +1762,10 @@ static const struct pinmux_cfg_reg pinmu
 		0, 0, 0, 0, 0, 0, 0, 0,
 		PF1MD_000, PF1MD_001, PF1MD_010, PF1MD_011,
 		PF1MD_100, PF1MD_101, 0, 0,
-		0, 0, 0, 0, 0, 0, 0, 0
-	 }
+		0, 0, 0, 0, 0, 0, 0, 0,
+		PF0MD_000, PF0MD_001, PF0MD_010, PF0MD_011,
+		PF0MD_100, PF0MD_101, 0, 0,
+		0, 0, 0, 0, 0, 0, 0, 0 }
 	},
 
 	{ PINMUX_CFG_REG("PFIOR0", 0xfffe38b2, 16, 1) {
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/pinctrl/sh-pfc/pfc-sh7269.c linux-libre-3.16.65-gnu/drivers/pinctrl/sh-pfc/pfc-sh7269.c
--- linux-libre-3.16.64-gnu/drivers/pinctrl/sh-pfc/pfc-sh7269.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/pinctrl/sh-pfc/pfc-sh7269.c	2019-04-04 11:14:13.000000000 -0400
@@ -2119,7 +2119,7 @@ static const struct pinmux_cfg_reg pinmu
 	},
 
 	{ PINMUX_CFG_REG("PCIOR0", 0xfffe3852, 16, 1) {
-		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 		PC8_IN, PC8_OUT,
 		PC7_IN, PC7_OUT,
 		PC6_IN, PC6_OUT,
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/pinctrl/sh-pfc/pfc-sh73a0.c linux-libre-3.16.65-gnu/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
--- linux-libre-3.16.64-gnu/drivers/pinctrl/sh-pfc/pfc-sh73a0.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/pinctrl/sh-pfc/pfc-sh73a0.c	2019-04-04 11:14:13.000000000 -0400
@@ -2676,6 +2676,7 @@ static const unsigned int tpu4_to2_mux[]
 };
 static const unsigned int tpu4_to3_pins[] = {
 	/* TO */
+	PIN_NUMBER(6, 26),
 };
 static const unsigned int tpu4_to3_mux[] = {
 	TPU4TO3_MARK,
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/pinctrl/sh-pfc/pfc-sh7734.c linux-libre-3.16.65-gnu/drivers/pinctrl/sh-pfc/pfc-sh7734.c
--- linux-libre-3.16.64-gnu/drivers/pinctrl/sh-pfc/pfc-sh7734.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/pinctrl/sh-pfc/pfc-sh7734.c	2019-04-04 11:14:13.000000000 -0400
@@ -2218,31 +2218,31 @@ static const struct pinmux_cfg_reg pinmu
 	    /* IP10_22 [1] */
 		FN_CAN_CLK_A, FN_RX4_D,
 	    /* IP10_21_19 [3] */
-		FN_AUDIO_CLKOUT, FN_TX1_E, FN_HRTS0_C, FN_FSE_B,
-		FN_LCD_M_DISP_B, 0, 0, 0,
+		FN_AUDIO_CLKOUT, FN_TX1_E, 0, FN_HRTS0_C, FN_FSE_B,
+		FN_LCD_M_DISP_B, 0, 0,
 	    /* IP10_18_16 [3] */
-		FN_AUDIO_CLKC, FN_SCK1_E, FN_HCTS0_C, FN_FRB_B,
-		FN_LCD_VEPWC_B, 0, 0, 0,
+		FN_AUDIO_CLKC, FN_SCK1_E, 0, FN_HCTS0_C, FN_FRB_B,
+		FN_LCD_VEPWC_B, 0, 0,
 	    /* IP10_15 [1] */
 		FN_AUDIO_CLKB_A, FN_LCD_CLK_B,
 	    /* IP10_14_12 [3] */
 		FN_AUDIO_CLKA_A, FN_VI1_CLK_B, FN_SCK1_D, FN_IECLK_B,
 		FN_LCD_FLM_B, 0, 0, 0,
 	    /* IP10_11_9 [3] */
-		FN_SSI_SDATA3, FN_VI1_7_B, FN_HTX0_C, FN_FWE_B,
-		FN_LCD_CL2_B, 0, 0, 0,
+		FN_SSI_SDATA3, FN_VI1_7_B, 0, FN_HTX0_C, FN_FWE_B,
+		FN_LCD_CL2_B, 0, 0,
 	    /* IP10_8_6 [3] */
-		FN_SSI_SDATA2, FN_VI1_6_B, FN_HRX0_C, FN_FRE_B,
-		FN_LCD_CL1_B, 0, 0, 0,
+		FN_SSI_SDATA2, FN_VI1_6_B, 0, FN_HRX0_C, FN_FRE_B,
+		FN_LCD_CL1_B, 0, 0,
 	    /* IP10_5_3 [3] */
 		FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
-		FN_LCD_DON_B, 0, 0, 0,
+		FN_LCD_DON_B, 0, 0,
 	    /* IP10_2_0 [3] */
 		FN_SSI_SCK23, FN_VI1_4_B, FN_RX1_D, FN_FCLE_B,
 		FN_LCD_DATA15_B, 0, 0, 0 }
 	},
 	{ PINMUX_CFG_REG_VAR("IPSR11", 0xFFFC0048, 32,
-			3, 1, 2, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
+			3, 1, 2, 3, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
 	    /* IP11_31_29 [3] */
 	    0, 0, 0, 0, 0, 0, 0, 0,
 	    /* IP11_28 [1] */
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/power/olpc_battery.c linux-libre-3.16.65-gnu/drivers/power/olpc_battery.c
--- linux-libre-3.16.64-gnu/drivers/power/olpc_battery.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/power/olpc_battery.c	2019-04-04 11:14:13.000000000 -0400
@@ -425,14 +425,14 @@ static int olpc_bat_get_property(struct
 		if (ret)
 			return ret;
 
-		val->intval = (s16)be16_to_cpu(ec_word) * 100 / 256;
+		val->intval = (s16)be16_to_cpu(ec_word) * 10 / 256;
 		break;
 	case POWER_SUPPLY_PROP_TEMP_AMBIENT:
 		ret = olpc_ec_cmd(EC_AMB_TEMP, NULL, 0, (void *)&ec_word, 2);
 		if (ret)
 			return ret;
 
-		val->intval = (int)be16_to_cpu(ec_word) * 100 / 256;
+		val->intval = (int)be16_to_cpu(ec_word) * 10 / 256;
 		break;
 	case POWER_SUPPLY_PROP_CHARGE_COUNTER:
 		ret = olpc_ec_cmd(EC_BAT_ACR, NULL, 0, (void *)&ec_word, 2);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/s390/scsi/zfcp_aux.c linux-libre-3.16.65-gnu/drivers/s390/scsi/zfcp_aux.c
--- linux-libre-3.16.64-gnu/drivers/s390/scsi/zfcp_aux.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/s390/scsi/zfcp_aux.c	2019-04-04 11:14:13.000000000 -0400
@@ -275,16 +275,16 @@ static void zfcp_free_low_mem_buffers(st
  */
 int zfcp_status_read_refill(struct zfcp_adapter *adapter)
 {
-	while (atomic_read(&adapter->stat_miss) > 0)
+	while (atomic_add_unless(&adapter->stat_miss, -1, 0))
 		if (zfcp_fsf_status_read(adapter->qdio)) {
+			atomic_inc(&adapter->stat_miss); /* undo add -1 */
 			if (atomic_read(&adapter->stat_miss) >=
 			    adapter->stat_read_buf_num) {
 				zfcp_erp_adapter_reopen(adapter, 0, "axsref1");
 				return 1;
 			}
 			break;
-		} else
-			atomic_dec(&adapter->stat_miss);
+		}
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/scsi/megaraid/megaraid_sas_base.c linux-libre-3.16.65-gnu/drivers/scsi/megaraid/megaraid_sas_base.c
--- linux-libre-3.16.64-gnu/drivers/scsi/megaraid/megaraid_sas_base.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/scsi/megaraid/megaraid_sas_base.c	2019-04-04 11:14:13.000000000 -0400
@@ -4592,7 +4592,7 @@ megasas_set_dma_mask(struct pci_dev *pde
 	 * All our contollers are capable of performing 64-bit DMA
 	 */
 	if (IS_DMA64) {
-		if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) != 0) {
+		if (pci_set_dma_mask(pdev, DMA_BIT_MASK(63)) != 0) {
 
 			if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0)
 				goto fail_set_dma_mask;
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/tty/serial/imx.c linux-libre-3.16.65-gnu/drivers/tty/serial/imx.c
--- linux-libre-3.16.64-gnu/drivers/tty/serial/imx.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/tty/serial/imx.c	2019-04-04 11:14:13.000000000 -0400
@@ -1777,7 +1777,7 @@ imx_console_setup(struct console *co, ch
 
 	retval = clk_prepare(sport->clk_per);
 	if (retval)
-		clk_disable_unprepare(sport->clk_ipg);
+		clk_unprepare(sport->clk_ipg);
 
 error_console:
 	return retval;
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/tty/tty_ldsem.c linux-libre-3.16.65-gnu/drivers/tty/tty_ldsem.c
--- linux-libre-3.16.64-gnu/drivers/tty/tty_ldsem.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/tty/tty_ldsem.c	2019-04-04 11:14:13.000000000 -0400
@@ -306,6 +306,16 @@ down_write_failed(struct ld_semaphore *s
 	if (!locked)
 		ldsem_atomic_update(-LDSEM_WAIT_BIAS, sem);
 	list_del(&waiter.list);
+
+	/*
+	 * In case of timeout, wake up every reader who gave the right of way
+	 * to writer. Prevent separation readers into two groups:
+	 * one that helds semaphore and another that sleeps.
+	 * (in case of no contention with a writer)
+	 */
+	if (!locked && list_empty(&sem->write_wait))
+		__ldsem_wake_readers(sem);
+
 	raw_spin_unlock_irq(&sem->wait_lock);
 
 	__set_task_state(tsk, TASK_RUNNING);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/usb/class/cdc-acm.c linux-libre-3.16.65-gnu/drivers/usb/class/cdc-acm.c
--- linux-libre-3.16.64-gnu/drivers/usb/class/cdc-acm.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/usb/class/cdc-acm.c	2019-04-04 11:14:13.000000000 -0400
@@ -499,6 +499,13 @@ static int acm_tty_install(struct tty_dr
 	if (retval)
 		goto error_init_termios;
 
+	/*
+	 * Suppress initial echoing for some devices which might send data
+	 * immediately after acm driver has been installed.
+	 */
+	if (acm->quirks & DISABLE_ECHO)
+		tty->termios.c_lflag &= ~ECHO;
+
 	tty->driver_data = acm;
 
 	return 0;
@@ -1690,6 +1697,9 @@ static const struct usb_device_id acm_id
 	{ USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */
 	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
 	},
+	{ USB_DEVICE(0x0e8d, 0x2000), /* MediaTek Inc Preloader */
+	.driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */
+	},
 	{ USB_DEVICE(0x0e8d, 0x3329), /* MediaTek Inc GPS */
 	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
 	},
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/usb/class/cdc-acm.h linux-libre-3.16.65-gnu/drivers/usb/class/cdc-acm.h
--- linux-libre-3.16.64-gnu/drivers/usb/class/cdc-acm.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/usb/class/cdc-acm.h	2019-04-04 11:14:13.000000000 -0400
@@ -135,3 +135,4 @@ struct acm {
 #define QUIRK_CONTROL_LINE_STATE	BIT(6)
 #define CLEAR_HALT_CONDITIONS		BIT(7)
 #define SEND_ZERO_PACKET		BIT(8)
+#define DISABLE_ECHO			BIT(9)
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/usb/host/r8a66597-hcd.c linux-libre-3.16.65-gnu/drivers/usb/host/r8a66597-hcd.c
--- linux-libre-3.16.64-gnu/drivers/usb/host/r8a66597-hcd.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/usb/host/r8a66597-hcd.c	2019-04-04 11:14:13.000000000 -0400
@@ -1990,6 +1990,8 @@ static int r8a66597_urb_dequeue(struct u
 
 static void r8a66597_endpoint_disable(struct usb_hcd *hcd,
 				      struct usb_host_endpoint *hep)
+__acquires(r8a66597->lock)
+__releases(r8a66597->lock)
 {
 	struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
 	struct r8a66597_pipe *pipe = (struct r8a66597_pipe *)hep->hcpriv;
@@ -2002,13 +2004,14 @@ static void r8a66597_endpoint_disable(st
 		return;
 	pipenum = pipe->info.pipenum;
 
+	spin_lock_irqsave(&r8a66597->lock, flags);
 	if (pipenum == 0) {
 		kfree(hep->hcpriv);
 		hep->hcpriv = NULL;
+		spin_unlock_irqrestore(&r8a66597->lock, flags);
 		return;
 	}
 
-	spin_lock_irqsave(&r8a66597->lock, flags);
 	pipe_stop(r8a66597, pipe);
 	pipe_irq_disable(r8a66597, pipenum);
 	disable_irq_empty(r8a66597, pipenum);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/usb/serial/pl2303.c linux-libre-3.16.65-gnu/drivers/usb/serial/pl2303.c
--- linux-libre-3.16.64-gnu/drivers/usb/serial/pl2303.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/usb/serial/pl2303.c	2019-04-04 11:14:13.000000000 -0400
@@ -85,9 +85,14 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
 	{ USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
+	{ USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) },
 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
+	{ USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) },
 	{ USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
 	{ USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) },
+	{ USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) },
+	{ USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) },
+	{ USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) },
 	{ USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
 	{ USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/usb/serial/pl2303.h linux-libre-3.16.65-gnu/drivers/usb/serial/pl2303.h
--- linux-libre-3.16.64-gnu/drivers/usb/serial/pl2303.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/usb/serial/pl2303.h	2019-04-04 11:14:13.000000000 -0400
@@ -122,10 +122,15 @@
 
 /* Hewlett-Packard POS Pole Displays */
 #define HP_VENDOR_ID		0x03f0
+#define HP_LM920_PRODUCT_ID	0x026b
+#define HP_TD620_PRODUCT_ID	0x0956
 #define HP_LD960_PRODUCT_ID	0x0b39
 #define HP_LCM220_PRODUCT_ID	0x3139
 #define HP_LCM960_PRODUCT_ID	0x3239
 #define HP_LD220_PRODUCT_ID	0x3524
+#define HP_LD220TA_PRODUCT_ID	0x4349
+#define HP_LD960TA_PRODUCT_ID	0x4439
+#define HP_LM940_PRODUCT_ID	0x5039
 
 /* Cressi Edy (diving computer) PC interface */
 #define CRESSI_VENDOR_ID	0x04b8
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/video/console/fbcon.c linux-libre-3.16.65-gnu/drivers/video/console/fbcon.c
--- linux-libre-3.16.64-gnu/drivers/video/console/fbcon.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/video/console/fbcon.c	2019-04-04 11:14:13.000000000 -0400
@@ -3019,7 +3019,7 @@ static int fbcon_fb_unbind(int idx)
 	for (i = first_fb_vc; i <= last_fb_vc; i++) {
 		if (con2fb_map[i] != idx &&
 		    con2fb_map[i] != -1) {
-			new_idx = i;
+			new_idx = con2fb_map[i];
 			break;
 		}
 	}
diff -druNp --no-dereference linux-libre-3.16.64-gnu/drivers/video/fbdev/core/fbmem.c linux-libre-3.16.65-gnu/drivers/video/fbdev/core/fbmem.c
--- linux-libre-3.16.64-gnu/drivers/video/fbdev/core/fbmem.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/drivers/video/fbdev/core/fbmem.c	2019-04-04 11:14:13.000000000 -0400
@@ -433,7 +433,9 @@ static void fb_do_show_logo(struct fb_in
 			image->dx += image->width + 8;
 		}
 	} else if (rotate == FB_ROTATE_UD) {
-		for (x = 0; x < num; x++) {
+		u32 dx = image->dx;
+
+		for (x = 0; x < num && image->dx <= dx; x++) {
 			info->fbops->fb_imageblit(info, image);
 			image->dx -= image->width + 8;
 		}
@@ -445,7 +447,9 @@ static void fb_do_show_logo(struct fb_in
 			image->dy += image->height + 8;
 		}
 	} else if (rotate == FB_ROTATE_CCW) {
-		for (x = 0; x < num; x++) {
+		u32 dy = image->dy;
+
+		for (x = 0; x < num && image->dy <= dy; x++) {
 			info->fbops->fb_imageblit(info, image);
 			image->dy -= image->height + 8;
 		}
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/btrfs/btrfs_inode.h linux-libre-3.16.65-gnu/fs/btrfs/btrfs_inode.h
--- linux-libre-3.16.64-gnu/fs/btrfs/btrfs_inode.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/btrfs/btrfs_inode.h	2019-04-04 11:14:13.000000000 -0400
@@ -144,6 +144,12 @@ struct btrfs_inode {
 	u64 last_unlink_trans;
 
 	/*
+	 * Track the transaction id of the last transaction used to create a
+	 * hard link for the inode. This is used by the log tree (fsync).
+	 */
+	u64 last_link_trans;
+
+	/*
 	 * Number of bytes outstanding that are going to need csums.  This is
 	 * used in ENOSPC accounting.
 	 */
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/btrfs/delayed-inode.c linux-libre-3.16.65-gnu/fs/btrfs/delayed-inode.c
--- linux-libre-3.16.64-gnu/fs/btrfs/delayed-inode.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/btrfs/delayed-inode.c	2019-04-04 11:14:13.000000000 -0400
@@ -1801,6 +1801,8 @@ int btrfs_fill_inode(struct inode *inode
 	set_nlink(inode, btrfs_stack_inode_nlink(inode_item));
 	inode_set_bytes(inode, btrfs_stack_inode_nbytes(inode_item));
 	BTRFS_I(inode)->generation = btrfs_stack_inode_generation(inode_item);
+        BTRFS_I(inode)->last_trans = btrfs_stack_inode_transid(inode_item);
+
 	inode->i_version = btrfs_stack_inode_sequence(inode_item);
 	inode->i_rdev = 0;
 	*rdev = btrfs_stack_inode_rdev(inode_item);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/btrfs/dev-replace.c linux-libre-3.16.65-gnu/fs/btrfs/dev-replace.c
--- linux-libre-3.16.64-gnu/fs/btrfs/dev-replace.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/btrfs/dev-replace.c	2019-04-04 11:14:13.000000000 -0400
@@ -782,6 +782,8 @@ int btrfs_resume_dev_replace_async(struc
 		btrfs_info(fs_info, "cannot continue dev_replace, tgtdev is missing");
 		btrfs_info(fs_info,
 			"you may cancel the operation after 'mount -o degraded'");
+		dev_replace->replace_state =
+					BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED;
 		btrfs_dev_replace_unlock(dev_replace);
 		return 0;
 	}
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/btrfs/inode.c linux-libre-3.16.65-gnu/fs/btrfs/inode.c
--- linux-libre-3.16.64-gnu/fs/btrfs/inode.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/btrfs/inode.c	2019-04-04 11:14:13.000000000 -0400
@@ -3511,25 +3511,72 @@ static void btrfs_read_locked_inode(stru
 	BTRFS_I(inode)->generation = btrfs_inode_generation(leaf, inode_item);
 	BTRFS_I(inode)->last_trans = btrfs_inode_transid(leaf, inode_item);
 
+	inode->i_version = btrfs_inode_sequence(leaf, inode_item);
+	inode->i_generation = BTRFS_I(inode)->generation;
+	inode->i_rdev = 0;
+	rdev = btrfs_inode_rdev(leaf, inode_item);
+
+	BTRFS_I(inode)->index_cnt = (u64)-1;
+	BTRFS_I(inode)->flags = btrfs_inode_flags(leaf, inode_item);
+
+cache_index:
 	/*
 	 * If we were modified in the current generation and evicted from memory
 	 * and then re-read we need to do a full sync since we don't have any
 	 * idea about which extents were modified before we were evicted from
 	 * cache.
+	 *
+	 * This is required for both inode re-read from disk and delayed inode
+	 * in delayed_nodes_tree.
 	 */
 	if (BTRFS_I(inode)->last_trans == root->fs_info->generation)
 		set_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
 			&BTRFS_I(inode)->runtime_flags);
 
-	inode->i_version = btrfs_inode_sequence(leaf, inode_item);
-	inode->i_generation = BTRFS_I(inode)->generation;
-	inode->i_rdev = 0;
-	rdev = btrfs_inode_rdev(leaf, inode_item);
-
-	BTRFS_I(inode)->index_cnt = (u64)-1;
-	BTRFS_I(inode)->flags = btrfs_inode_flags(leaf, inode_item);
+	/*
+	 * We don't persist the id of the transaction where an unlink operation
+	 * against the inode was last made. So here we assume the inode might
+	 * have been evicted, and therefore the exact value of last_unlink_trans
+	 * lost, and set it to last_trans to avoid metadata inconsistencies
+	 * between the inode and its parent if the inode is fsync'ed and the log
+	 * replayed. For example, in the scenario:
+	 *
+	 * touch mydir/foo
+	 * ln mydir/foo mydir/bar
+	 * sync
+	 * unlink mydir/bar
+	 * echo 2 > /proc/sys/vm/drop_caches   # evicts inode
+	 * xfs_io -c fsync mydir/foo
+	 * <power failure>
+	 * mount fs, triggers fsync log replay
+	 *
+	 * We must make sure that when we fsync our inode foo we also log its
+	 * parent inode, otherwise after log replay the parent still has the
+	 * dentry with the "bar" name but our inode foo has a link count of 1
+	 * and doesn't have an inode ref with the name "bar" anymore.
+	 *
+	 * Setting last_unlink_trans to last_trans is a pessimistic approach,
+	 * but it guarantees correctness at the expense of ocassional full
+	 * transaction commits on fsync if our inode is a directory, or if our
+	 * inode is not a directory, logging its parent unnecessarily.
+	 */
+	BTRFS_I(inode)->last_unlink_trans = BTRFS_I(inode)->last_trans;
+	/*
+	 * Similar reasoning for last_link_trans, needs to be set otherwise
+	 * for a case like the following:
+	 *
+	 * mkdir A
+	 * touch foo
+	 * ln foo A/bar
+	 * echo 2 > /proc/sys/vm/drop_caches
+	 * fsync foo
+	 * <power failure>
+	 *
+	 * Would result in link bar and directory A not existing after the power
+	 * failure.
+	 */
+	BTRFS_I(inode)->last_link_trans = BTRFS_I(inode)->last_trans;
 
-cache_index:
 	path->slots[0]++;
 	if (inode->i_nlink != 1 ||
 	    path->slots[0] >= btrfs_header_nritems(leaf))
@@ -6151,6 +6198,7 @@ static int btrfs_link(struct dentry *old
 			if (err)
 				goto fail;
 		}
+		BTRFS_I(inode)->last_link_trans = trans->transid;
 		d_instantiate(dentry, inode);
 		btrfs_log_new_name(trans, inode, NULL, parent);
 	}
@@ -8218,6 +8266,7 @@ struct inode *btrfs_alloc_inode(struct s
 	ei->index_cnt = (u64)-1;
 	ei->dir_index = 0;
 	ei->last_unlink_trans = 0;
+	ei->last_link_trans = 0;
 	ei->last_log_commit = 0;
 
 	spin_lock_init(&ei->lock);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/btrfs/tree-log.c linux-libre-3.16.65-gnu/fs/btrfs/tree-log.c
--- linux-libre-3.16.64-gnu/fs/btrfs/tree-log.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/btrfs/tree-log.c	2019-04-04 11:14:13.000000000 -0400
@@ -4430,6 +4430,22 @@ static int btrfs_log_inode_parent(struct
 		goto end_trans;
 	}
 
+	/*
+	 * If a new hard link was added to the inode in the current transaction
+	 * and its link count is now greater than 1, we need to fallback to a
+	 * transaction commit, otherwise we can end up not logging all its new
+	 * parents for all the hard links. Here just from the dentry used to
+	 * fsync, we can not visit the ancestor inodes for all the other hard
+	 * links to figure out if any is new, so we fallback to a transaction
+	 * commit (instead of adding a lot of complexity of scanning a btree,
+	 * since this scenario is not a common use case).
+	 */
+	if (inode->i_nlink > 1 &&
+	    BTRFS_I(inode)->last_link_trans > last_committed) {
+		ret = -EMLINK;
+		goto end_trans;
+	}
+
 	inode_only = LOG_INODE_EXISTS;
 	while (1) {
 		if (!parent || !parent->d_inode || sb != parent->d_inode->i_sb)
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/ceph/caps.c linux-libre-3.16.65-gnu/fs/ceph/caps.c
--- linux-libre-3.16.64-gnu/fs/ceph/caps.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/ceph/caps.c	2019-04-04 11:14:13.000000000 -0400
@@ -2830,7 +2830,6 @@ retry:
 			tcap->cap_id = t_cap_id;
 			tcap->seq = t_seq - 1;
 			tcap->issue_seq = t_seq - 1;
-			tcap->mseq = t_mseq;
 			tcap->issued |= issued;
 			tcap->implemented |= issued;
 			if (cap == ci->i_auth_cap)
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/cifs/sess.c linux-libre-3.16.65-gnu/fs/cifs/sess.c
--- linux-libre-3.16.64-gnu/fs/cifs/sess.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/cifs/sess.c	2019-04-04 11:14:13.000000000 -0400
@@ -343,13 +343,12 @@ void build_ntlmssp_negotiate_blob(unsign
 	/* BB is NTLMV2 session security format easier to use here? */
 	flags = NTLMSSP_NEGOTIATE_56 |	NTLMSSP_REQUEST_TARGET |
 		NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
-		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC;
-	if (ses->server->sign) {
+		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
+		NTLMSSP_NEGOTIATE_SEAL;
+	if (ses->server->sign)
 		flags |= NTLMSSP_NEGOTIATE_SIGN;
-		if (!ses->server->session_estab ||
-				ses->ntlmssp->sesskey_per_smbsess)
-			flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
-	}
+	if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
+		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
 
 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
 
@@ -412,13 +411,12 @@ int build_ntlmssp_auth_blob(unsigned cha
 	flags = NTLMSSP_NEGOTIATE_56 |
 		NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO |
 		NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
-		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC;
-	if (ses->server->sign) {
+		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
+		NTLMSSP_NEGOTIATE_SEAL;
+	if (ses->server->sign)
 		flags |= NTLMSSP_NEGOTIATE_SIGN;
-		if (!ses->server->session_estab ||
-				ses->ntlmssp->sesskey_per_smbsess)
-			flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
-	}
+	if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
+		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
 
 	tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/cifs/smb2maperror.c linux-libre-3.16.65-gnu/fs/cifs/smb2maperror.c
--- linux-libre-3.16.64-gnu/fs/cifs/smb2maperror.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/cifs/smb2maperror.c	2019-04-04 11:14:13.000000000 -0400
@@ -377,8 +377,8 @@ static const struct status_to_posix_erro
 	{STATUS_NONEXISTENT_EA_ENTRY, -EIO, "STATUS_NONEXISTENT_EA_ENTRY"},
 	{STATUS_NO_EAS_ON_FILE, -ENODATA, "STATUS_NO_EAS_ON_FILE"},
 	{STATUS_EA_CORRUPT_ERROR, -EIO, "STATUS_EA_CORRUPT_ERROR"},
-	{STATUS_FILE_LOCK_CONFLICT, -EIO, "STATUS_FILE_LOCK_CONFLICT"},
-	{STATUS_LOCK_NOT_GRANTED, -EIO, "STATUS_LOCK_NOT_GRANTED"},
+	{STATUS_FILE_LOCK_CONFLICT, -EACCES, "STATUS_FILE_LOCK_CONFLICT"},
+	{STATUS_LOCK_NOT_GRANTED, -EACCES, "STATUS_LOCK_NOT_GRANTED"},
 	{STATUS_DELETE_PENDING, -ENOENT, "STATUS_DELETE_PENDING"},
 	{STATUS_CTL_FILE_NOT_SUPPORTED, -ENOSYS,
 	"STATUS_CTL_FILE_NOT_SUPPORTED"},
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/cifs/smb2pdu.c linux-libre-3.16.65-gnu/fs/cifs/smb2pdu.c
--- linux-libre-3.16.64-gnu/fs/cifs/smb2pdu.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/cifs/smb2pdu.c	2019-04-04 11:14:13.000000000 -0400
@@ -608,7 +608,6 @@ SMB2_sess_setup(const unsigned int xid,
 	 */
 	kfree(ses->auth_key.response);
 	ses->auth_key.response = NULL;
-	ses->auth_key.len = 0;
 
 	/*
 	 * If memory allocation is successful, caller of this function
@@ -765,11 +764,8 @@ ssetup_exit:
 
 	if (!rc) {
 		mutex_lock(&server->srv_mutex);
-		if (server->sign && server->ops->generate_signingkey) {
+		if (server->ops->generate_signingkey) {
 			rc = server->ops->generate_signingkey(ses);
-			kfree(ses->auth_key.response);
-			ses->auth_key.response = NULL;
-			ses->auth_key.len = 0;
 			if (rc) {
 				cifs_dbg(FYI,
 					"SMB3 session key generation failed\n");
@@ -791,11 +787,6 @@ ssetup_exit:
 	}
 
 keygen_exit:
-	if (!server->sign) {
-		kfree(ses->auth_key.response);
-		ses->auth_key.response = NULL;
-		ses->auth_key.len = 0;
-	}
 	kfree(ses->ntlmssp);
 
 	return rc;
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/dlm/lock.c linux-libre-3.16.65-gnu/fs/dlm/lock.c
--- linux-libre-3.16.64-gnu/fs/dlm/lock.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/dlm/lock.c	2019-04-04 11:14:13.000000000 -0400
@@ -1210,6 +1210,7 @@ static int create_lkb(struct dlm_ls *ls,
 
 	if (rv < 0) {
 		log_error(ls, "create_lkb idr error %d", rv);
+		dlm_free_lkb(lkb);
 		return rv;
 	}
 
@@ -4177,6 +4178,7 @@ static int receive_convert(struct dlm_ls
 			  (unsigned long long)lkb->lkb_recover_seq,
 			  ms->m_header.h_nodeid, ms->m_lkid);
 		error = -ENOENT;
+		dlm_put_lkb(lkb);
 		goto fail;
 	}
 
@@ -4230,6 +4232,7 @@ static int receive_unlock(struct dlm_ls
 			  lkb->lkb_id, lkb->lkb_remid,
 			  ms->m_header.h_nodeid, ms->m_lkid);
 		error = -ENOENT;
+		dlm_put_lkb(lkb);
 		goto fail;
 	}
 
@@ -5792,20 +5795,20 @@ int dlm_user_request(struct dlm_ls *ls,
 			goto out;
 		}
 	}
-
-	/* After ua is attached to lkb it will be freed by dlm_free_lkb().
-	   When DLM_IFL_USER is set, the dlm knows that this is a userspace
-	   lock and that lkb_astparam is the dlm_user_args structure. */
-
 	error = set_lock_args(mode, &ua->lksb, flags, namelen, timeout_cs,
 			      fake_astfn, ua, fake_bastfn, &args);
-	lkb->lkb_flags |= DLM_IFL_USER;
-
 	if (error) {
+		kfree(ua->lksb.sb_lvbptr);
+		ua->lksb.sb_lvbptr = NULL;
+		kfree(ua);
 		__put_lkb(ls, lkb);
 		goto out;
 	}
 
+	/* After ua is attached to lkb it will be freed by dlm_free_lkb().
+	   When DLM_IFL_USER is set, the dlm knows that this is a userspace
+	   lock and that lkb_astparam is the dlm_user_args structure. */
+	lkb->lkb_flags |= DLM_IFL_USER;
 	error = request_lock(ls, lkb, name, namelen, &args);
 
 	switch (error) {
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/dlm/lockspace.c linux-libre-3.16.65-gnu/fs/dlm/lockspace.c
--- linux-libre-3.16.64-gnu/fs/dlm/lockspace.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/dlm/lockspace.c	2019-04-04 11:14:13.000000000 -0400
@@ -673,11 +673,11 @@ static int new_lockspace(const char *nam
 	kfree(ls->ls_recover_buf);
  out_lkbidr:
 	idr_destroy(&ls->ls_lkbidr);
+ out_rsbtbl:
 	for (i = 0; i < DLM_REMOVE_NAMES_MAX; i++) {
 		if (ls->ls_remove_names[i])
 			kfree(ls->ls_remove_names[i]);
 	}
- out_rsbtbl:
 	vfree(ls->ls_rsbtbl);
  out_lsfree:
 	if (do_unreg)
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/ext4/ext4.h linux-libre-3.16.65-gnu/fs/ext4/ext4.h
--- linux-libre-3.16.64-gnu/fs/ext4/ext4.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/ext4/ext4.h	2019-04-04 11:14:13.000000000 -0400
@@ -2165,8 +2165,19 @@ int do_journal_get_write_access(handle_t
 #define FALL_BACK_TO_NONDELALLOC 1
 #define CONVERT_INLINE_DATA	 2
 
-extern struct inode *ext4_iget(struct super_block *, unsigned long);
-extern struct inode *ext4_iget_normal(struct super_block *, unsigned long);
+typedef enum {
+	EXT4_IGET_NORMAL =	0,
+	EXT4_IGET_SPECIAL =	0x0001, /* OK to iget a system inode */
+	EXT4_IGET_HANDLE = 	0x0002	/* Inode # is from a handle */
+} ext4_iget_flags;
+
+extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
+				 ext4_iget_flags flags, const char *function,
+				 unsigned int line);
+
+#define ext4_iget(sb, ino, flags) \
+	__ext4_iget((sb), (ino), (flags), __func__, __LINE__)
+
 extern int  ext4_write_inode(struct inode *, struct writeback_control *);
 extern int  ext4_setattr(struct dentry *, struct iattr *);
 extern int  ext4_getattr(struct vfsmount *mnt, struct dentry *dentry,
@@ -2701,7 +2712,7 @@ extern struct buffer_head *ext4_get_firs
 					int *retval);
 extern int ext4_inline_data_fiemap(struct inode *inode,
 				   struct fiemap_extent_info *fieinfo,
-				   int *has_inline);
+				   int *has_inline, __u64 start, __u64 len);
 extern void ext4_inline_data_truncate(struct inode *inode, int *has_inline);
 
 extern int ext4_convert_inline_data(struct inode *inode);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/ext4/extents.c linux-libre-3.16.65-gnu/fs/ext4/extents.c
--- linux-libre-3.16.64-gnu/fs/ext4/extents.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/ext4/extents.c	2019-04-04 11:14:13.000000000 -0400
@@ -5153,7 +5153,8 @@ int ext4_fiemap(struct inode *inode, str
 	if (ext4_has_inline_data(inode)) {
 		int has_inline = 1;
 
-		error = ext4_inline_data_fiemap(inode, fieinfo, &has_inline);
+		error = ext4_inline_data_fiemap(inode, fieinfo, &has_inline,
+						start, len);
 
 		if (has_inline)
 			return error;
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/ext4/ialloc.c linux-libre-3.16.65-gnu/fs/ext4/ialloc.c
--- linux-libre-3.16.64-gnu/fs/ext4/ialloc.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/ext4/ialloc.c	2019-04-04 11:14:13.000000000 -0400
@@ -1094,7 +1094,7 @@ struct inode *ext4_orphan_get(struct sup
 	if (!ext4_test_bit(bit, bitmap_bh->b_data))
 		goto bad_orphan;
 
-	inode = ext4_iget(sb, ino);
+	inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL);
 	if (IS_ERR(inode)) {
 		err = PTR_ERR(inode);
 		ext4_error(sb, "couldn't read orphan inode %lu (err %d)",
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/ext4/inline.c linux-libre-3.16.65-gnu/fs/ext4/inline.c
--- linux-libre-3.16.64-gnu/fs/ext4/inline.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/ext4/inline.c	2019-04-04 11:14:13.000000000 -0400
@@ -704,8 +704,11 @@ int ext4_try_to_write_inline_data(struct
 
 	if (!PageUptodate(page)) {
 		ret = ext4_read_inline_page(inode, page);
-		if (ret < 0)
+		if (ret < 0) {
+			unlock_page(page);
+			put_page(page);
 			goto out_up_read;
+		}
 	}
 
 	ret = 1;
@@ -1813,11 +1816,12 @@ int ext4_destroy_inline_data(handle_t *h
 
 int ext4_inline_data_fiemap(struct inode *inode,
 			    struct fiemap_extent_info *fieinfo,
-			    int *has_inline)
+			    int *has_inline, __u64 start, __u64 len)
 {
 	__u64 physical = 0;
-	__u64 length;
-	__u32 flags = FIEMAP_EXTENT_DATA_INLINE | FIEMAP_EXTENT_LAST;
+	__u64 inline_len;
+	__u32 flags = FIEMAP_EXTENT_DATA_INLINE | FIEMAP_EXTENT_NOT_ALIGNED |
+		FIEMAP_EXTENT_LAST;
 	int error = 0;
 	struct ext4_iloc iloc;
 
@@ -1826,6 +1830,13 @@ int ext4_inline_data_fiemap(struct inode
 		*has_inline = 0;
 		goto out;
 	}
+	inline_len = min_t(size_t, ext4_get_inline_size(inode),
+			   i_size_read(inode));
+	if (start >= inline_len)
+		goto out;
+	if (start + len < inline_len)
+		inline_len = start + len;
+	inline_len -= start;
 
 	error = ext4_get_inode_loc(inode, &iloc);
 	if (error)
@@ -1834,14 +1845,13 @@ int ext4_inline_data_fiemap(struct inode
 	physical = (__u64)iloc.bh->b_blocknr << inode->i_sb->s_blocksize_bits;
 	physical += (char *)ext4_raw_inode(&iloc) - iloc.bh->b_data;
 	physical += offsetof(struct ext4_inode, i_block);
-	length = i_size_read(inode);
 
-	if (physical)
-		error = fiemap_fill_next_extent(fieinfo, 0, physical,
-						length, flags);
 	brelse(iloc.bh);
 out:
 	up_read(&EXT4_I(inode)->xattr_sem);
+	if (physical)
+		error = fiemap_fill_next_extent(fieinfo, start, physical,
+						inline_len, flags);
 	return (error < 0 ? error : 0);
 }
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/ext4/inode.c linux-libre-3.16.65-gnu/fs/ext4/inode.c
--- linux-libre-3.16.64-gnu/fs/ext4/inode.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/ext4/inode.c	2019-04-04 11:14:13.000000000 -0400
@@ -2579,7 +2579,8 @@ static int ext4_writepages(struct addres
 		 * We may need to convert up to one extent per block in
 		 * the page and we may dirty the inode.
 		 */
-		rsv_blocks = 1 + (PAGE_CACHE_SIZE >> inode->i_blkbits);
+		rsv_blocks = 1 + ext4_chunk_trans_blocks(inode,
+					PAGE_CACHE_SIZE >> inode->i_blkbits);
 	}
 
 	/*
@@ -4174,7 +4175,9 @@ static inline int ext4_iget_extra_inode(
 	return 0;
 }
 
-struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
+struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
+			  ext4_iget_flags flags, const char *function,
+			  unsigned int line)
 {
 	struct ext4_iloc iloc;
 	struct ext4_inode *raw_inode;
@@ -4187,6 +4190,18 @@ struct inode *ext4_iget(struct super_blo
 	uid_t i_uid;
 	gid_t i_gid;
 
+	if ((!(flags & EXT4_IGET_SPECIAL) &&
+	     (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) ||
+	    (ino < EXT4_ROOT_INO) ||
+	    (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) {
+		if (flags & EXT4_IGET_HANDLE)
+			return ERR_PTR(-ESTALE);
+		__ext4_error(sb, function, line,
+			     "inode #%lu: comm %s: iget: illegal inode #",
+			     ino, current->comm);
+		return ERR_PTR(-EIO);
+	}
+
 	inode = iget_locked(sb, ino);
 	if (!inode)
 		return ERR_PTR(-ENOMEM);
@@ -4202,18 +4217,27 @@ struct inode *ext4_iget(struct super_blo
 	raw_inode = ext4_raw_inode(&iloc);
 
 	if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) {
-		EXT4_ERROR_INODE(inode, "root inode unallocated");
+		ext4_error_inode(inode, function, line, 0,
+				 "iget: root inode unallocated");
 		ret = -EIO;
 		goto bad_inode;
 	}
 
+	if ((flags & EXT4_IGET_HANDLE) &&
+	    (raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) {
+		ret = -ESTALE;
+		goto bad_inode;
+	}
+
 	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
 		ei->i_extra_isize = le16_to_cpu(raw_inode->i_extra_isize);
 		if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize >
 		    EXT4_INODE_SIZE(inode->i_sb)) {
-			EXT4_ERROR_INODE(inode, "bad extra_isize (%u != %u)",
-				EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize,
-				EXT4_INODE_SIZE(inode->i_sb));
+			ext4_error_inode(inode, function, line, 0,
+					 "iget: bad extra_isize %u "
+					 "(inode size %u)",
+					 ei->i_extra_isize,
+					 EXT4_INODE_SIZE(inode->i_sb));
 			ret = -EIO;
 			goto bad_inode;
 		}
@@ -4233,7 +4257,8 @@ struct inode *ext4_iget(struct super_blo
 	}
 
 	if (!ext4_inode_csum_verify(inode, raw_inode, ei)) {
-		EXT4_ERROR_INODE(inode, "checksum invalid");
+		ext4_error_inode(inode, function, line, 0,
+				 "iget: checksum invalid");
 		ret = -EIO;
 		goto bad_inode;
 	}
@@ -4281,7 +4306,8 @@ struct inode *ext4_iget(struct super_blo
 			((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32;
 	inode->i_size = ext4_isize(raw_inode);
 	if ((size = i_size_read(inode)) < 0) {
-		EXT4_ERROR_INODE(inode, "bad i_size value: %lld", size);
+		ext4_error_inode(inode, function, line, 0,
+				 "iget: bad i_size value: %lld", size);
 		ret = -EIO;
 		goto bad_inode;
 	}
@@ -4354,7 +4380,8 @@ struct inode *ext4_iget(struct super_blo
 	ret = 0;
 	if (ei->i_file_acl &&
 	    !ext4_data_block_valid(EXT4_SB(sb), ei->i_file_acl, 1)) {
-		EXT4_ERROR_INODE(inode, "bad extended attribute block %llu",
+		ext4_error_inode(inode, function, line, 0,
+				 "iget: bad extended attribute block %llu",
 				 ei->i_file_acl);
 		ret = -EIO;
 		goto bad_inode;
@@ -4404,7 +4431,8 @@ struct inode *ext4_iget(struct super_blo
 		make_bad_inode(inode);
 	} else {
 		ret = -EIO;
-		EXT4_ERROR_INODE(inode, "bogus i_mode (%o)", inode->i_mode);
+		ext4_error_inode(inode, function, line, 0,
+				 "iget: bogus i_mode (%o)", inode->i_mode);
 		goto bad_inode;
 	}
 	brelse(iloc.bh);
@@ -4418,13 +4446,6 @@ bad_inode:
 	return ERR_PTR(ret);
 }
 
-struct inode *ext4_iget_normal(struct super_block *sb, unsigned long ino)
-{
-	if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)
-		return ERR_PTR(-EIO);
-	return ext4_iget(sb, ino);
-}
-
 static int ext4_inode_blocks_set(handle_t *handle,
 				struct ext4_inode *raw_inode,
 				struct ext4_inode_info *ei)
@@ -4638,7 +4659,8 @@ int ext4_write_inode(struct inode *inode
 {
 	int err;
 
-	if (WARN_ON_ONCE(current->flags & PF_MEMALLOC))
+	if (WARN_ON_ONCE(current->flags & PF_MEMALLOC) ||
+	    (inode->i_sb->s_flags & MS_RDONLY))
 		return 0;
 
 	if (EXT4_SB(inode->i_sb)->s_journal) {
@@ -4656,7 +4678,8 @@ int ext4_write_inode(struct inode *inode
 		if (wbc->sync_mode != WB_SYNC_ALL || wbc->for_sync)
 			return 0;
 
-		err = ext4_force_commit(inode->i_sb);
+		err = jbd2_complete_transaction(EXT4_SB(inode->i_sb)->s_journal,
+						EXT4_I(inode)->i_sync_tid);
 	} else {
 		struct ext4_iloc iloc;
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/ext4/ioctl.c linux-libre-3.16.65-gnu/fs/ext4/ioctl.c
--- linux-libre-3.16.64-gnu/fs/ext4/ioctl.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/ext4/ioctl.c	2019-04-04 11:14:13.000000000 -0400
@@ -127,7 +127,7 @@ static long swap_inode_boot_loader(struc
 	    !inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
-	inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO);
+	inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO, EXT4_IGET_SPECIAL);
 	if (IS_ERR(inode_bl))
 		return PTR_ERR(inode_bl);
 	ei_bl = EXT4_I(inode_bl);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/ext4/namei.c linux-libre-3.16.65-gnu/fs/ext4/namei.c
--- linux-libre-3.16.64-gnu/fs/ext4/namei.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/ext4/namei.c	2019-04-04 11:14:13.000000000 -0400
@@ -1439,7 +1439,7 @@ static struct dentry *ext4_lookup(struct
 					 dentry);
 			return ERR_PTR(-EIO);
 		}
-		inode = ext4_iget_normal(dir->i_sb, ino);
+		inode = ext4_iget(dir->i_sb, ino, EXT4_IGET_NORMAL);
 		if (inode == ERR_PTR(-ESTALE)) {
 			EXT4_ERROR_INODE(dir,
 					 "deleted inode referenced: %u",
@@ -1472,7 +1472,7 @@ struct dentry *ext4_get_parent(struct de
 		return ERR_PTR(-EIO);
 	}
 
-	return d_obtain_alias(ext4_iget_normal(child->d_inode->i_sb, ino));
+	return d_obtain_alias(ext4_iget(child->d_inode->i_sb, ino, EXT4_IGET_NORMAL));
 }
 
 /*
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/ext4/resize.c linux-libre-3.16.65-gnu/fs/ext4/resize.c
--- linux-libre-3.16.64-gnu/fs/ext4/resize.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/ext4/resize.c	2019-04-04 11:14:13.000000000 -0400
@@ -1609,7 +1609,7 @@ int ext4_group_add(struct super_block *s
 				     "No reserved GDT blocks, can't resize");
 			return -EPERM;
 		}
-		inode = ext4_iget(sb, EXT4_RESIZE_INO);
+		inode = ext4_iget(sb, EXT4_RESIZE_INO, EXT4_IGET_SPECIAL);
 		if (IS_ERR(inode)) {
 			ext4_warning(sb, "Error opening resize inode");
 			return PTR_ERR(inode);
@@ -1936,7 +1936,8 @@ retry:
 		}
 
 		if (!resize_inode)
-			resize_inode = ext4_iget(sb, EXT4_RESIZE_INO);
+			resize_inode = ext4_iget(sb, EXT4_RESIZE_INO,
+						 EXT4_IGET_SPECIAL);
 		if (IS_ERR(resize_inode)) {
 			ext4_warning(sb, "Error opening resize inode");
 			return PTR_ERR(resize_inode);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/ext4/super.c linux-libre-3.16.65-gnu/fs/ext4/super.c
--- linux-libre-3.16.64-gnu/fs/ext4/super.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/ext4/super.c	2019-04-04 11:14:13.000000000 -0400
@@ -1013,20 +1013,11 @@ static struct inode *ext4_nfs_get_inode(
 {
 	struct inode *inode;
 
-	if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)
-		return ERR_PTR(-ESTALE);
-	if (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))
-		return ERR_PTR(-ESTALE);
-
-	/* iget isn't really right if the inode is currently unallocated!!
-	 *
-	 * ext4_read_inode will return a bad_inode if the inode had been
-	 * deleted, so we should be safe.
-	 *
+	/*
 	 * Currently we don't know the generation for parent directory, so
 	 * a generation of 0 means "accept any"
 	 */
-	inode = ext4_iget_normal(sb, ino);
+	inode = ext4_iget(sb, ino, EXT4_IGET_HANDLE);
 	if (IS_ERR(inode))
 		return ERR_CAST(inode);
 	if (generation && inode->i_generation != generation) {
@@ -1051,6 +1042,16 @@ static struct dentry *ext4_fh_to_parent(
 				    ext4_nfs_get_inode);
 }
 
+static int ext4_nfs_commit_metadata(struct inode *inode)
+{
+	struct writeback_control wbc = {
+		.sync_mode = WB_SYNC_ALL
+	};
+
+	trace_ext4_nfs_commit_metadata(inode);
+	return ext4_write_inode(inode, &wbc);
+}
+
 /*
  * Try to release metadata pages (indirect blocks, directories) which are
  * mapped via the block device.  Since these pages could have journal heads
@@ -1171,6 +1172,7 @@ static const struct export_operations ex
 	.fh_to_dentry = ext4_fh_to_dentry,
 	.fh_to_parent = ext4_fh_to_parent,
 	.get_parent = ext4_get_parent,
+	.commit_metadata = ext4_nfs_commit_metadata,
 };
 
 enum {
@@ -4221,7 +4223,7 @@ no_journal:
 	 * so we can safely mount the rest of the filesystem now.
 	 */
 
-	root = ext4_iget(sb, EXT4_ROOT_INO);
+	root = ext4_iget(sb, EXT4_ROOT_INO, EXT4_IGET_SPECIAL);
 	if (IS_ERR(root)) {
 		ext4_msg(sb, KERN_ERR, "get root inode failed");
 		ret = PTR_ERR(root);
@@ -4456,7 +4458,7 @@ static journal_t *ext4_get_journal(struc
 	 * things happen if we iget() an unused inode, as the subsequent
 	 * iput() will try to delete it. */
 
-	journal_inode = ext4_iget(sb, journal_inum);
+	journal_inode = ext4_iget(sb, journal_inum, EXT4_IGET_SPECIAL);
 	if (IS_ERR(journal_inode)) {
 		ext4_msg(sb, KERN_ERR, "no journal found");
 		return NULL;
@@ -4710,7 +4712,7 @@ static int ext4_commit_super(struct supe
 	BUFFER_TRACE(sbh, "marking dirty");
 	ext4_superblock_csum_set(sb);
 	lock_buffer(sbh);
-	if (buffer_write_io_error(sbh)) {
+	if (buffer_write_io_error(sbh) || !buffer_uptodate(sbh)) {
 		/*
 		 * Oh, dear.  A previous attempt to write the
 		 * superblock failed.  This could happen because the
@@ -5396,7 +5398,7 @@ static int ext4_quota_enable(struct supe
 	if (!qf_inums[type])
 		return -EPERM;
 
-	qf_inode = ext4_iget(sb, qf_inums[type]);
+	qf_inode = ext4_iget(sb, qf_inums[type], EXT4_IGET_SPECIAL);
 	if (IS_ERR(qf_inode)) {
 		ext4_error(sb, "Bad quota inode # %lu", qf_inums[type]);
 		return PTR_ERR(qf_inode);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/ext4/xattr.c linux-libre-3.16.65-gnu/fs/ext4/xattr.c
--- linux-libre-3.16.64-gnu/fs/ext4/xattr.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/ext4/xattr.c	2019-04-04 11:14:13.000000000 -0400
@@ -1340,7 +1340,7 @@ retry:
 	end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
 	min_offs = end - base;
 	last = entry;
-	total_ino = sizeof(struct ext4_xattr_ibody_header);
+	total_ino = sizeof(struct ext4_xattr_ibody_header) + sizeof(u32);
 
 	error = xattr_check_inode(inode, header, end);
 	if (error)
diff -druNp --no-dereference linux-libre-3.16.64-gnu/fs/f2fs/node.c linux-libre-3.16.65-gnu/fs/f2fs/node.c
--- linux-libre-3.16.64-gnu/fs/f2fs/node.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/fs/f2fs/node.c	2019-04-04 11:14:13.000000000 -0400
@@ -509,6 +509,7 @@ static void truncate_node(struct dnode_o
 {
 	struct f2fs_sb_info *sbi = F2FS_SB(dn->inode->i_sb);
 	struct node_info ni;
+	pgoff_t index;
 
 	get_node_info(sbi, dn->nid, &ni);
 	if (dn->inode->i_blocks == 0) {
@@ -532,10 +533,11 @@ invalidate:
 	clear_node_page_dirty(dn->node_page);
 	F2FS_SET_SB_DIRT(sbi);
 
+	index = dn->node_page->index;
 	f2fs_put_page(dn->node_page, 1);
 
 	invalidate_mapping_pages(NODE_MAPPING(sbi),
-			dn->node_page->index, dn->node_page->index);
+			index, index);
 
 	dn->node_page = NULL;
 	trace_f2fs_truncate_node(dn->inode, dn->nid, ni.blk_addr);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/include/linux/gpio/consumer.h linux-libre-3.16.65-gnu/include/linux/gpio/consumer.h
--- linux-libre-3.16.64-gnu/include/linux/gpio/consumer.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/include/linux/gpio/consumer.h	2019-04-04 11:14:13.000000000 -0400
@@ -245,7 +245,7 @@ static inline int gpiod_to_irq(const str
 
 static inline struct gpio_desc *gpio_to_desc(unsigned gpio)
 {
-	return ERR_PTR(-EINVAL);
+	return NULL;
 }
 static inline int desc_to_gpio(const struct gpio_desc *desc)
 {
diff -druNp --no-dereference linux-libre-3.16.64-gnu/include/linux/hugetlb.h linux-libre-3.16.65-gnu/include/linux/hugetlb.h
--- linux-libre-3.16.64-gnu/include/linux/hugetlb.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/include/linux/hugetlb.h	2019-04-04 11:14:13.000000000 -0400
@@ -97,6 +97,8 @@ pte_t *huge_pte_alloc(struct mm_struct *
 			unsigned long addr, unsigned long sz);
 pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr);
 int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep);
+void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
+				unsigned long *start, unsigned long *end);
 struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
 			      int write);
 struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
@@ -124,6 +126,18 @@ static inline unsigned long hugetlb_tota
 	return 0;
 }
 
+static inline int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr,
+						pte_t *ptep)
+{
+	return 0;
+}
+
+static inline void adjust_range_if_pmd_sharing_possible(
+				struct vm_area_struct *vma,
+				unsigned long *start, unsigned long *end)
+{
+}
+
 #define follow_hugetlb_page(m,v,p,vs,a,b,i,w)	({ BUG(); 0; })
 #define follow_huge_addr(mm, addr, write)	ERR_PTR(-EINVAL)
 #define copy_hugetlb_page_range(src, dst, vma)	({ BUG(); 0; })
diff -druNp --no-dereference linux-libre-3.16.64-gnu/include/linux/mm.h linux-libre-3.16.65-gnu/include/linux/mm.h
--- linux-libre-3.16.64-gnu/include/linux/mm.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/include/linux/mm.h	2019-04-04 11:14:13.000000000 -0400
@@ -1947,6 +1947,12 @@ static inline struct vm_area_struct *fin
 	return vma;
 }
 
+static inline bool range_in_vma(struct vm_area_struct *vma,
+				unsigned long start, unsigned long end)
+{
+	return (vma && vma->vm_start <= start && end <= vma->vm_end);
+}
+
 #ifdef CONFIG_MMU
 pgprot_t vm_get_page_prot(unsigned long vm_flags);
 #else
diff -druNp --no-dereference linux-libre-3.16.64-gnu/include/trace/events/ext4.h linux-libre-3.16.65-gnu/include/trace/events/ext4.h
--- linux-libre-3.16.64-gnu/include/trace/events/ext4.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/include/trace/events/ext4.h	2019-04-04 11:14:13.000000000 -0400
@@ -195,6 +195,26 @@ TRACE_EVENT(ext4_drop_inode,
 		  (unsigned long) __entry->ino, __entry->drop)
 );
 
+TRACE_EVENT(ext4_nfs_commit_metadata,
+	TP_PROTO(struct inode *inode),
+
+	TP_ARGS(inode),
+
+	TP_STRUCT__entry(
+		__field(	dev_t,	dev			)
+		__field(	ino_t,	ino			)
+	),
+
+	TP_fast_assign(
+		__entry->dev	= inode->i_sb->s_dev;
+		__entry->ino	= inode->i_ino;
+	),
+
+	TP_printk("dev %d,%d ino %lu",
+		  MAJOR(__entry->dev), MINOR(__entry->dev),
+		  (unsigned long) __entry->ino)
+);
+
 TRACE_EVENT(ext4_mark_inode_dirty,
 	TP_PROTO(struct inode *inode, unsigned long IP),
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/kernel/panic.c linux-libre-3.16.65-gnu/kernel/panic.c
--- linux-libre-3.16.64-gnu/kernel/panic.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/kernel/panic.c	2019-04-04 11:14:13.000000000 -0400
@@ -13,6 +13,7 @@
 #include <linux/kmsg_dump.h>
 #include <linux/kallsyms.h>
 #include <linux/notifier.h>
+#include <linux/vt_kern.h>
 #include <linux/module.h>
 #include <linux/random.h>
 #include <linux/ftrace.h>
@@ -178,7 +179,10 @@ void panic(const char *fmt, ...)
 	 */
 	crash_kexec(NULL);
 
-	bust_spinlocks(0);
+#ifdef CONFIG_VT
+	unblank_screen();
+#endif
+	console_unblank();
 
 	/*
 	 * We may have ended up stopping the CPU holding the lock (in
diff -druNp --no-dereference linux-libre-3.16.64-gnu/lib/string.c linux-libre-3.16.65-gnu/lib/string.c
--- linux-libre-3.16.64-gnu/lib/string.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/lib/string.c	2019-04-04 11:14:13.000000000 -0400
@@ -31,14 +31,14 @@
 #include <asm/word-at-a-time.h>
 #include <asm/page.h>
 
-#ifndef __HAVE_ARCH_STRNICMP
+#ifndef __HAVE_ARCH_STRNCASECMP
 /**
- * strnicmp - Case insensitive, length-limited string comparison
+ * strncasecmp - Case insensitive, length-limited string comparison
  * @s1: One string
  * @s2: The other string
  * @len: the maximum number of characters to compare
  */
-int strnicmp(const char *s1, const char *s2, size_t len)
+int strncasecmp(const char *s1, const char *s2, size_t len)
 {
 	/* Yes, Virginia, it had better be unsigned */
 	unsigned char c1, c2;
@@ -60,6 +60,13 @@ int strnicmp(const char *s1, const char
 	} while (--len);
 	return (int)c1 - (int)c2;
 }
+EXPORT_SYMBOL(strncasecmp);
+#endif
+#ifndef __HAVE_ARCH_STRNICMP
+int strnicmp(const char *s1, const char *s2, size_t len)
+{
+	return strncasecmp(s1, s2, len);
+}
 EXPORT_SYMBOL(strnicmp);
 #endif
 
@@ -77,20 +84,6 @@ int strcasecmp(const char *s1, const cha
 EXPORT_SYMBOL(strcasecmp);
 #endif
 
-#ifndef __HAVE_ARCH_STRNCASECMP
-int strncasecmp(const char *s1, const char *s2, size_t n)
-{
-	int c1, c2;
-
-	do {
-		c1 = tolower(*s1++);
-		c2 = tolower(*s2++);
-	} while ((--n > 0) && c1 == c2 && c1 != 0);
-	return c1 - c2;
-}
-EXPORT_SYMBOL(strncasecmp);
-#endif
-
 #ifndef __HAVE_ARCH_STRCPY
 /**
  * strcpy - Copy a %NUL terminated string
diff -druNp --no-dereference linux-libre-3.16.64-gnu/Makefile linux-libre-3.16.65-gnu/Makefile
--- linux-libre-3.16.64-gnu/Makefile	2019-03-26 03:09:18.000000000 -0400
+++ linux-libre-3.16.65-gnu/Makefile	2019-04-04 14:04:11.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 16
-SUBLEVEL = 64
+SUBLEVEL = 65
 EXTRAVERSION =-gnu
 NAME = Museum of Fishiegoodies
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/mm/hugetlb.c linux-libre-3.16.65-gnu/mm/hugetlb.c
--- linux-libre-3.16.64-gnu/mm/hugetlb.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/mm/hugetlb.c	2019-04-04 11:14:13.000000000 -0400
@@ -3657,13 +3657,41 @@ static int vma_shareable(struct vm_area_
 	/*
 	 * check on proper vm_flags and page table alignment
 	 */
-	if (vma->vm_flags & VM_MAYSHARE &&
-	    vma->vm_start <= base && end <= vma->vm_end)
+	if (vma->vm_flags & VM_MAYSHARE && range_in_vma(vma, base, end))
 		return 1;
 	return 0;
 }
 
 /*
+ * Determine if start,end range within vma could be mapped by shared pmd.
+ * If yes, adjust start and end to cover range associated with possible
+ * shared pmd mappings.
+ */
+void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
+				unsigned long *start, unsigned long *end)
+{
+	unsigned long check_addr = *start;
+
+	if (!(vma->vm_flags & VM_MAYSHARE))
+		return;
+
+	for (check_addr = *start; check_addr < *end; check_addr += PUD_SIZE) {
+		unsigned long a_start = check_addr & PUD_MASK;
+		unsigned long a_end = a_start + PUD_SIZE;
+
+		/*
+		 * If sharing is possible, adjust start/end if necessary.
+		 */
+		if (range_in_vma(vma, a_start, a_end)) {
+			if (a_start < *start)
+				*start = a_start;
+			if (a_end > *end)
+				*end = a_end;
+		}
+	}
+}
+
+/*
  * Search for a shareable pmd page for hugetlb. In any case calls pmd_alloc()
  * and returns the corresponding pte. While this is not necessary for the
  * !shared pmd case because we can allocate the pmd later as well, it makes the
@@ -3751,6 +3779,11 @@ pte_t *huge_pmd_share(struct mm_struct *
 {
 	return NULL;
 }
+
+void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
+				unsigned long *start, unsigned long *end)
+{
+}
 #define want_pmd_share()	(0)
 #endif /* CONFIG_ARCH_WANT_HUGE_PMD_SHARE */
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/mm/memory_hotplug.c linux-libre-3.16.65-gnu/mm/memory_hotplug.c
--- linux-libre-3.16.64-gnu/mm/memory_hotplug.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/mm/memory_hotplug.c	2019-04-04 11:14:13.000000000 -0400
@@ -32,6 +32,7 @@
 #include <linux/hugetlb.h>
 #include <linux/memblock.h>
 #include <linux/bootmem.h>
+#include <linux/rmap.h>
 
 #include <asm/tlbflush.h>
 
@@ -1393,6 +1394,21 @@ do_migrate_range(unsigned long start_pfn
 			continue;
 		}
 
+		/*
+		 * HWPoison pages have elevated reference counts so the migration would
+		 * fail on them. It also doesn't make any sense to migrate them in the
+		 * first place. Still try to unmap such a page in case it is still mapped
+		 * (e.g. current hwpoison implementation doesn't unmap KSM pages but keep
+		 * the unmap as the catch all safety net).
+		 */
+		if (PageHWPoison(page)) {
+			if (WARN_ON(PageLRU(page)))
+				isolate_lru_page(page);
+			if (page_mapped(page))
+				try_to_unmap(page, TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS);
+			continue;
+		}
+
 		if (!get_page_unless_zero(page))
 			continue;
 		/*
@@ -1880,34 +1896,6 @@ static int check_cpu_on_node(pg_data_t *
 	return 0;
 }
 
-static void unmap_cpu_on_node(pg_data_t *pgdat)
-{
-#ifdef CONFIG_ACPI_NUMA
-	int cpu;
-
-	for_each_possible_cpu(cpu)
-		if (cpu_to_node(cpu) == pgdat->node_id)
-			numa_clear_node(cpu);
-#endif
-}
-
-static int check_and_unmap_cpu_on_node(pg_data_t *pgdat)
-{
-	int ret;
-
-	ret = check_cpu_on_node(pgdat);
-	if (ret)
-		return ret;
-
-	/*
-	 * the node will be offlined when we come here, so we can clear
-	 * the cpu_to_node() now.
-	 */
-
-	unmap_cpu_on_node(pgdat);
-	return 0;
-}
-
 /**
  * try_offline_node
  *
@@ -1941,7 +1929,7 @@ void try_offline_node(int nid)
 		return;
 	}
 
-	if (check_and_unmap_cpu_on_node(pgdat))
+	if (check_cpu_on_node(pgdat))
 		return;
 
 	/*
diff -druNp --no-dereference linux-libre-3.16.64-gnu/mm/rmap.c linux-libre-3.16.65-gnu/mm/rmap.c
--- linux-libre-3.16.64-gnu/mm/rmap.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/mm/rmap.c	2019-04-04 11:14:13.000000000 -0400
@@ -1195,8 +1195,41 @@ static int try_to_unmap_one(struct page
 	pte_t pteval;
 	spinlock_t *ptl;
 	int ret = SWAP_AGAIN;
+	unsigned long sh_address;
+	bool pmd_sharing_possible = false;
+	unsigned long spmd_start, spmd_end;
 	enum ttu_flags flags = (enum ttu_flags)arg;
 
+	/* munlock has nothing to gain from examining un-locked vmas */
+	if ((flags & TTU_MUNLOCK) && !(vma->vm_flags & VM_LOCKED))
+		goto out;
+
+	/*
+	 * Only use the range_start/end mmu notifiers if huge pmd sharing
+	 * is possible.  In the normal case, mmu_notifier_invalidate_page
+	 * is sufficient as we only unmap a page.  However, if we unshare
+	 * a pmd, we will unmap a PUD_SIZE range.
+	 */
+	if (PageHuge(page)) {
+		spmd_start = address;
+		spmd_end = spmd_start + vma_mmu_pagesize(vma);
+
+		/*
+		 * Check if pmd sharing is possible.  If possible, we could
+		 * unmap a PUD_SIZE range.  spmd_start/spmd_end will be
+		 * modified if sharing is possible.
+		 */
+		adjust_range_if_pmd_sharing_possible(vma, &spmd_start,
+								&spmd_end);
+		if (spmd_end - spmd_start != vma_mmu_pagesize(vma)) {
+			sh_address = address;
+
+			pmd_sharing_possible = true;
+			mmu_notifier_invalidate_range_start(vma->vm_mm,
+							spmd_start, spmd_end);
+		}
+	}
+
 	pte = page_check_address(page, mm, address, &ptl, 0);
 	if (!pte)
 		goto out;
@@ -1207,9 +1240,12 @@ static int try_to_unmap_one(struct page
 	 * skipped over this mm) then we should reactivate it.
 	 */
 	if (!(flags & TTU_IGNORE_MLOCK)) {
-		if (vma->vm_flags & VM_LOCKED)
-			goto out_mlock;
-
+		if (vma->vm_flags & VM_LOCKED) {
+			/* Holding pte lock, we do *not* need mmap_sem here */
+			mlock_vma_page(page);
+			ret = SWAP_MLOCK;
+			goto out_unmap;
+		}
 		if (flags & TTU_MUNLOCK)
 			goto out_unmap;
 	}
@@ -1220,6 +1256,30 @@ static int try_to_unmap_one(struct page
 		}
   	}
 
+	/*
+	 * Call huge_pmd_unshare to potentially unshare a huge pmd.  Pass
+	 * sh_address as it will be modified if unsharing is successful.
+	 */
+	if (PageHuge(page) && huge_pmd_unshare(mm, &sh_address, pte)) {
+		/*
+		 * huge_pmd_unshare unmapped an entire PMD page.  There is
+		 * no way of knowing exactly which PMDs may be cached for
+		 * this mm, so flush them all.  spmd_start/spmd_end cover
+		 * this PUD_SIZE range.
+		 */
+		flush_cache_range(vma, spmd_start, spmd_end);
+		flush_tlb_range(vma, spmd_start, spmd_end);
+
+		/*
+		 * The ref count of the PMD page was dropped which is part
+		 * of the way map counting is done for shared PMDs.  When
+		 * there is no other sharing, huge_pmd_unshare returns false
+		 * and we will unmap the actual page and drop map count
+		 * to zero.
+		 */
+		goto out_unmap;
+	}
+
 	/* Nuke the page table entry. */
 	flush_cache_page(vma, address, page_to_pfn(page));
 	pteval = ptep_clear_flush(vma, address, pte);
@@ -1299,30 +1359,12 @@ static int try_to_unmap_one(struct page
 
 out_unmap:
 	pte_unmap_unlock(pte, ptl);
-	if (ret != SWAP_FAIL && !(flags & TTU_MUNLOCK))
+	if (ret != SWAP_FAIL && ret != SWAP_MLOCK && !(flags & TTU_MUNLOCK))
 		mmu_notifier_invalidate_page(mm, address);
 out:
-	return ret;
-
-out_mlock:
-	pte_unmap_unlock(pte, ptl);
-
-
-	/*
-	 * We need mmap_sem locking, Otherwise VM_LOCKED check makes
-	 * unstable result and race. Plus, We can't wait here because
-	 * we now hold anon_vma->rwsem or mapping->i_mmap_mutex.
-	 * if trylock failed, the page remain in evictable lru and later
-	 * vmscan could retry to move the page to unevictable lru if the
-	 * page is actually mlocked.
-	 */
-	if (down_read_trylock(&vma->vm_mm->mmap_sem)) {
-		if (vma->vm_flags & VM_LOCKED) {
-			mlock_vma_page(page);
-			ret = SWAP_MLOCK;
-		}
-		up_read(&vma->vm_mm->mmap_sem);
-	}
+	if (pmd_sharing_possible)
+		mmu_notifier_invalidate_range_end(vma->vm_mm,
+							spmd_start, spmd_end);
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/net/9p/client.c linux-libre-3.16.65-gnu/net/9p/client.c
--- linux-libre-3.16.64-gnu/net/9p/client.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/net/9p/client.c	2019-04-04 11:14:13.000000000 -0400
@@ -155,6 +155,12 @@ static int parse_opts(char *opts, struct
 				ret = r;
 				continue;
 			}
+			if (option < 4096) {
+				p9_debug(P9_DEBUG_ERROR,
+					 "msize should be at least 4k\n");
+				ret = -EINVAL;
+				continue;
+			}
 			clnt->msize = option;
 			break;
 		case Opt_trans:
@@ -980,10 +986,18 @@ static int p9_client_version(struct p9_c
 	else if (!strncmp(version, "9P2000", 6))
 		c->proto_version = p9_proto_legacy;
 	else {
+		p9_debug(P9_DEBUG_ERROR,
+			 "server returned an unknown version: %s\n", version);
 		err = -EREMOTEIO;
 		goto error;
 	}
 
+	if (msize < 4096) {
+		p9_debug(P9_DEBUG_ERROR,
+			 "server returned a msize < 4096: %d\n", msize);
+		err = -EREMOTEIO;
+		goto error;
+	}
 	if (msize < c->msize)
 		c->msize = msize;
 
@@ -1048,6 +1062,13 @@ struct p9_client *p9_client_create(const
 	if (clnt->msize > clnt->trans_mod->maxsize)
 		clnt->msize = clnt->trans_mod->maxsize;
 
+	if (clnt->msize < 4096) {
+		p9_debug(P9_DEBUG_ERROR,
+			 "Please specify a msize of at least 4k\n");
+		err = -EINVAL;
+		goto close_trans;
+	}
+
 	err = p9_client_version(clnt);
 	if (err)
 		goto close_trans;
diff -druNp --no-dereference linux-libre-3.16.64-gnu/net/sunrpc/auth_gss/svcauth_gss.c linux-libre-3.16.65-gnu/net/sunrpc/auth_gss/svcauth_gss.c
--- linux-libre-3.16.64-gnu/net/sunrpc/auth_gss/svcauth_gss.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/net/sunrpc/auth_gss/svcauth_gss.c	2019-04-04 11:14:13.000000000 -0400
@@ -1103,7 +1103,7 @@ static int svcauth_gss_legacy_init(struc
 	struct kvec *resv = &rqstp->rq_res.head[0];
 	struct rsi *rsip, rsikey;
 	int ret;
-	struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
+	struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
 
 	memset(&rsikey, 0, sizeof(rsikey));
 	ret = gss_read_verf(gc, argv, authp,
@@ -1214,7 +1214,7 @@ static int svcauth_gss_proxy_init(struct
 	uint64_t handle;
 	int status;
 	int ret;
-	struct net *net = rqstp->rq_xprt->xpt_net;
+	struct net *net = SVC_NET(rqstp);
 	struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 
 	memset(&ud, 0, sizeof(ud));
@@ -1404,7 +1404,7 @@ svcauth_gss_accept(struct svc_rqst *rqst
 	__be32		*rpcstart;
 	__be32		*reject_stat = resv->iov_base + resv->iov_len;
 	int		ret;
-	struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
+	struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
 
 	dprintk("RPC:       svcauth_gss: argv->iov_len = %zd\n",
 			argv->iov_len);
@@ -1692,7 +1692,7 @@ svcauth_gss_release(struct svc_rqst *rqs
 	struct rpc_gss_wire_cred *gc = &gsd->clcred;
 	struct xdr_buf *resbuf = &rqstp->rq_res;
 	int stat = -EINVAL;
-	struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
+	struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
 
 	if (gc->gc_proc != RPC_GSS_PROC_DATA)
 		goto out;
diff -druNp --no-dereference linux-libre-3.16.64-gnu/net/sunrpc/cache.c linux-libre-3.16.65-gnu/net/sunrpc/cache.c
--- linux-libre-3.16.64-gnu/net/sunrpc/cache.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/net/sunrpc/cache.c	2019-04-04 11:14:13.000000000 -0400
@@ -50,6 +50,10 @@ static void cache_init(struct cache_head
 	h->last_refresh = now;
 }
 
+static void cache_fresh_locked(struct cache_head *head, time_t expiry);
+static void cache_fresh_unlocked(struct cache_head *head,
+				struct cache_detail *detail);
+
 struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
 				       struct cache_head *key, int hash)
 {
@@ -94,6 +98,7 @@ struct cache_head *sunrpc_cache_lookup(s
 				*hp = tmp->next;
 				tmp->next = NULL;
 				detail->entries --;
+				cache_fresh_locked(tmp, 0);
 				freeme = tmp;
 				break;
 			}
@@ -109,8 +114,10 @@ struct cache_head *sunrpc_cache_lookup(s
 	cache_get(new);
 	write_unlock(&detail->hash_lock);
 
-	if (freeme)
+	if (freeme) {
+		cache_fresh_unlocked(freeme, detail);
 		cache_put(freeme, detail);
+	}
 	return new;
 }
 EXPORT_SYMBOL_GPL(sunrpc_cache_lookup);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/sound/core/pcm.c linux-libre-3.16.65-gnu/sound/core/pcm.c
--- linux-libre-3.16.64-gnu/sound/core/pcm.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/sound/core/pcm.c	2019-04-04 11:14:13.000000000 -0400
@@ -25,6 +25,7 @@
 #include <linux/time.h>
 #include <linux/mutex.h>
 #include <linux/device.h>
+#include <linux/nospec.h>
 #include <sound/core.h>
 #include <sound/minors.h>
 #include <sound/pcm.h>
@@ -126,6 +127,7 @@ static int snd_pcm_control_ioctl(struct
 				return -EFAULT;
 			if (stream < 0 || stream > 1)
 				return -EINVAL;
+			stream = array_index_nospec(stream, 2);
 			if (get_user(subdevice, &info->subdevice))
 				return -EFAULT;
 			mutex_lock(&register_mutex);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/sound/pci/emu10k1/emufx.c linux-libre-3.16.65-gnu/sound/pci/emu10k1/emufx.c
--- linux-libre-3.16.64-gnu/sound/pci/emu10k1/emufx.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/sound/pci/emu10k1/emufx.c	2019-04-04 11:14:13.000000000 -0400
@@ -36,6 +36,7 @@
 #include <linux/init.h>
 #include <linux/mutex.h>
 #include <linux/moduleparam.h>
+#include <linux/nospec.h>
 
 #include <sound/core.h>
 #include <sound/tlv.h>
@@ -1001,6 +1002,8 @@ static int snd_emu10k1_ipcm_poke(struct
 
 	if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT)
 		return -EINVAL;
+	ipcm->substream = array_index_nospec(ipcm->substream,
+					     EMU10K1_FX8010_PCM_COUNT);
 	if (ipcm->channels > 32)
 		return -EINVAL;
 	pcm = &emu->fx8010.pcm[ipcm->substream];
@@ -1047,6 +1050,8 @@ static int snd_emu10k1_ipcm_peek(struct
 
 	if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT)
 		return -EINVAL;
+	ipcm->substream = array_index_nospec(ipcm->substream,
+					     EMU10K1_FX8010_PCM_COUNT);
 	pcm = &emu->fx8010.pcm[ipcm->substream];
 	mutex_lock(&emu->fx8010.lock);
 	spin_lock_irq(&emu->reg_lock);
diff -druNp --no-dereference linux-libre-3.16.64-gnu/sound/pci/hda/hda_tegra.c linux-libre-3.16.65-gnu/sound/pci/hda/hda_tegra.c
--- linux-libre-3.16.64-gnu/sound/pci/hda/hda_tegra.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/sound/pci/hda/hda_tegra.c	2019-04-04 11:14:13.000000000 -0400
@@ -261,6 +261,7 @@ static int hda_tegra_suspend(struct devi
 		snd_hda_suspend(chip->bus);
 
 	azx_stop_chip(chip);
+	synchronize_irq(chip->irq);
 	azx_enter_link_reset(chip);
 	hda_tegra_disable_clocks(hda);
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/sound/pci/rme9652/hdsp.c linux-libre-3.16.65-gnu/sound/pci/rme9652/hdsp.c
--- linux-libre-3.16.64-gnu/sound/pci/rme9652/hdsp.c	2019-03-26 03:32:32.000000000 -0400
+++ linux-libre-3.16.65-gnu/sound/pci/rme9652/hdsp.c	2019-04-04 14:19:46.000000000 -0400
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/math64.h>
 #include <linux/vmalloc.h>
+#include <linux/nospec.h>
 
 #include <sound/core.h>
 #include <sound/control.h>
@@ -4125,15 +4126,16 @@ static int snd_hdsp_channel_info(struct
 				    struct snd_pcm_channel_info *info)
 {
 	struct hdsp *hdsp = snd_pcm_substream_chip(substream);
-	int mapped_channel;
+	unsigned int channel = info->channel;
 
-	if (snd_BUG_ON(info->channel >= hdsp->max_channels))
+	if (snd_BUG_ON(channel >= hdsp->max_channels))
 		return -EINVAL;
+	channel = array_index_nospec(channel, hdsp->max_channels);
 
-	if ((mapped_channel = hdsp->channel_map[info->channel]) < 0)
+	if (hdsp->channel_map[channel] < 0)
 		return -EINVAL;
 
-	info->offset = mapped_channel * HDSP_CHANNEL_BUFFER_BYTES;
+	info->offset = hdsp->channel_map[channel] * HDSP_CHANNEL_BUFFER_BYTES;
 	info->first = 0;
 	info->step = 32;
 	return 0;
diff -druNp --no-dereference linux-libre-3.16.64-gnu/sound/synth/emux/emux_hwdep.c linux-libre-3.16.65-gnu/sound/synth/emux/emux_hwdep.c
--- linux-libre-3.16.64-gnu/sound/synth/emux/emux_hwdep.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/sound/synth/emux/emux_hwdep.c	2019-04-04 11:14:13.000000000 -0400
@@ -22,9 +22,9 @@
 #include <sound/core.h>
 #include <sound/hwdep.h>
 #include <asm/uaccess.h>
+#include <linux/nospec.h>
 #include "emux_voice.h"
 
-
 #define TMP_CLIENT_ID	0x1001
 
 /*
@@ -66,13 +66,16 @@ snd_emux_hwdep_misc_mode(struct snd_emux
 		return -EFAULT;
 	if (info.mode < 0 || info.mode >= EMUX_MD_END)
 		return -EINVAL;
+	info.mode = array_index_nospec(info.mode, EMUX_MD_END);
 
 	if (info.port < 0) {
 		for (i = 0; i < emu->num_ports; i++)
 			emu->portptrs[i]->ctrls[info.mode] = info.value;
 	} else {
-		if (info.port < emu->num_ports)
+		if (info.port < emu->num_ports) {
+			info.port = array_index_nospec(info.port, emu->num_ports);
 			emu->portptrs[info.port]->ctrls[info.mode] = info.value;
+		}
 	}
 	return 0;
 }
diff -druNp --no-dereference linux-libre-3.16.64-gnu/tools/lib/lockdep/include/liblockdep/rwlock.h linux-libre-3.16.65-gnu/tools/lib/lockdep/include/liblockdep/rwlock.h
--- linux-libre-3.16.64-gnu/tools/lib/lockdep/include/liblockdep/rwlock.h	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/tools/lib/lockdep/include/liblockdep/rwlock.h	2019-04-04 11:14:13.000000000 -0400
@@ -59,10 +59,10 @@ static inline int liblockdep_pthread_rwl
 	return pthread_rwlock_tryrdlock(&lock->rwlock) == 0 ? 1 : 0;
 }
 
-static inline int liblockdep_pthread_rwlock_trywlock(liblockdep_pthread_rwlock_t *lock)
+static inline int liblockdep_pthread_rwlock_trywrlock(liblockdep_pthread_rwlock_t *lock)
 {
 	lock_acquire(&lock->dep_map, 0, 1, 0, 1, NULL, (unsigned long)_RET_IP_);
-	return pthread_rwlock_trywlock(&lock->rwlock) == 0 ? 1 : 0;
+	return pthread_rwlock_trywrlock(&lock->rwlock) == 0 ? 1 : 0;
 }
 
 static inline int liblockdep_rwlock_destroy(liblockdep_pthread_rwlock_t *lock)
@@ -78,7 +78,7 @@ static inline int liblockdep_rwlock_dest
 #define pthread_rwlock_unlock		liblockdep_pthread_rwlock_unlock
 #define pthread_rwlock_wrlock		liblockdep_pthread_rwlock_wrlock
 #define pthread_rwlock_tryrdlock	liblockdep_pthread_rwlock_tryrdlock
-#define pthread_rwlock_trywlock		liblockdep_pthread_rwlock_trywlock
+#define pthread_rwlock_trywrlock	liblockdep_pthread_rwlock_trywrlock
 #define pthread_rwlock_destroy		liblockdep_rwlock_destroy
 
 #endif
diff -druNp --no-dereference linux-libre-3.16.64-gnu/tools/perf/builtin-help.c linux-libre-3.16.65-gnu/tools/perf/builtin-help.c
--- linux-libre-3.16.64-gnu/tools/perf/builtin-help.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/tools/perf/builtin-help.c	2019-04-04 11:14:13.000000000 -0400
@@ -166,7 +166,7 @@ static void add_man_viewer(const char *n
 	while (*p)
 		p = &((*p)->next);
 	*p = zalloc(sizeof(**p) + len + 1);
-	strncpy((*p)->name, name, len);
+	strcpy((*p)->name, name);
 }
 
 static int supported_man_viewer(const char *name, size_t len)
diff -druNp --no-dereference linux-libre-3.16.64-gnu/tools/perf/ui/tui/helpline.c linux-libre-3.16.65-gnu/tools/perf/ui/tui/helpline.c
--- linux-libre-3.16.64-gnu/tools/perf/ui/tui/helpline.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/tools/perf/ui/tui/helpline.c	2019-04-04 11:14:13.000000000 -0400
@@ -22,7 +22,7 @@ static void tui_helpline__push(const cha
 	SLsmg_set_color(0);
 	SLsmg_write_nstring((char *)msg, SLtt_Screen_Cols);
 	SLsmg_refresh();
-	strncpy(ui_helpline__current, msg, sz)[sz - 1] = '\0';
+	strlcpy(ui_helpline__current, msg, sz);
 }
 
 static int tui_helpline__show(const char *format, va_list ap)
diff -druNp --no-dereference linux-libre-3.16.64-gnu/tools/perf/util/parse-events.c linux-libre-3.16.65-gnu/tools/perf/util/parse-events.c
--- linux-libre-3.16.64-gnu/tools/perf/util/parse-events.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/tools/perf/util/parse-events.c	2019-04-04 11:14:13.000000000 -0400
@@ -1217,7 +1217,7 @@ static void print_symbol_events(const ch
 		if (strlen(syms->alias))
 			snprintf(name, MAX_NAME_LEN, "%s OR %s", syms->symbol, syms->alias);
 		else
-			strncpy(name, syms->symbol, MAX_NAME_LEN);
+			strlcpy(name, syms->symbol, MAX_NAME_LEN);
 
 		printf("  %-50s [%s]\n", name, event_type_descriptors[type]);
 
diff -druNp --no-dereference linux-libre-3.16.64-gnu/tools/perf/util/pmu.c linux-libre-3.16.65-gnu/tools/perf/util/pmu.c
--- linux-libre-3.16.64-gnu/tools/perf/util/pmu.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/tools/perf/util/pmu.c	2019-04-04 11:14:13.000000000 -0400
@@ -107,7 +107,7 @@ static int perf_pmu__parse_scale(struct
 	char path[PATH_MAX];
 	const char *lc;
 
-	snprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
+	scnprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
 
 	fd = open(path, O_RDONLY);
 	if (fd == -1)
@@ -150,7 +150,7 @@ static int perf_pmu__parse_unit(struct p
 	ssize_t sret;
 	int fd;
 
-	snprintf(path, PATH_MAX, "%s/%s.unit", dir, name);
+	scnprintf(path, PATH_MAX, "%s/%s.unit", dir, name);
 
 	fd = open(path, O_RDONLY);
 	if (fd == -1)
diff -druNp --no-dereference linux-libre-3.16.64-gnu/tools/perf/util/svghelper.c linux-libre-3.16.65-gnu/tools/perf/util/svghelper.c
--- linux-libre-3.16.64-gnu/tools/perf/util/svghelper.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/tools/perf/util/svghelper.c	2019-04-04 11:14:13.000000000 -0400
@@ -257,7 +257,7 @@ static char *cpu_model(void)
 	if (file) {
 		while (fgets(buf, 255, file)) {
 			if (strstr(buf, "model name")) {
-				strncpy(cpu_m, &buf[13], 255);
+				strlcpy(cpu_m, &buf[13], 255);
 				break;
 			}
 		}
diff -druNp --no-dereference linux-libre-3.16.64-gnu/virt/kvm/kvm_main.c linux-libre-3.16.65-gnu/virt/kvm/kvm_main.c
--- linux-libre-3.16.64-gnu/virt/kvm/kvm_main.c	2019-03-25 13:32:37.000000000 -0400
+++ linux-libre-3.16.65-gnu/virt/kvm/kvm_main.c	2019-04-04 11:14:13.000000000 -0400
@@ -1555,31 +1555,33 @@ int kvm_gfn_to_hva_cache_init(struct kvm
 	gfn_t end_gfn = (gpa + len - 1) >> PAGE_SHIFT;
 	gfn_t nr_pages_needed = end_gfn - start_gfn + 1;
 	gfn_t nr_pages_avail;
+	int r = start_gfn <= end_gfn ? 0 : -EINVAL;
 
 	ghc->gpa = gpa;
 	ghc->generation = slots->generation;
 	ghc->len = len;
-	ghc->memslot = gfn_to_memslot(kvm, start_gfn);
-	ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, NULL);
-	if (!kvm_is_error_hva(ghc->hva) && nr_pages_needed <= 1) {
+	ghc->hva = KVM_HVA_ERR_BAD;
+
+	/*
+	 * If the requested region crosses two memslots, we still
+	 * verify that the entire region is valid here.
+	 */
+	while (!r && start_gfn <= end_gfn) {
+		ghc->memslot = gfn_to_memslot(kvm, start_gfn);
+		ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn,
+					   &nr_pages_avail);
+		if (kvm_is_error_hva(ghc->hva))
+			r = -EFAULT;
+		start_gfn += nr_pages_avail;
+	}
+
+	/* Use the slow path for cross page reads and writes. */
+	if (!r && nr_pages_needed == 1)
 		ghc->hva += offset;
-	} else {
-		/*
-		 * If the requested region crosses two memslots, we still
-		 * verify that the entire region is valid here.
-		 */
-		while (start_gfn <= end_gfn) {
-			ghc->memslot = gfn_to_memslot(kvm, start_gfn);
-			ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn,
-						   &nr_pages_avail);
-			if (kvm_is_error_hva(ghc->hva))
-				return -EFAULT;
-			start_gfn += nr_pages_avail;
-		}
-		/* Use the slow path for cross page reads and writes. */
+	else
 		ghc->memslot = NULL;
-	}
-	return 0;
+
+	return r;
 }
 EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
 
