diff -druNp --no-dereference linux-libre-3.18.80-gnu/arch/arm/boot/dts/imx53-qsb-common.dtsi linux-libre-3.18.81-gnu/arch/arm/boot/dts/imx53-qsb-common.dtsi
--- linux-libre-3.18.80-gnu/arch/arm/boot/dts/imx53-qsb-common.dtsi	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/arch/arm/boot/dts/imx53-qsb-common.dtsi	2017-11-15 04:04:14.000000000 -0500
@@ -215,16 +215,16 @@
 
 		pinctrl_fec: fecgrp {
 			fsl,pins = <
-				MX53_PAD_FEC_MDC__FEC_MDC		0x80000000
-				MX53_PAD_FEC_MDIO__FEC_MDIO		0x80000000
-				MX53_PAD_FEC_REF_CLK__FEC_TX_CLK	0x80000000
-				MX53_PAD_FEC_RX_ER__FEC_RX_ER		0x80000000
-				MX53_PAD_FEC_CRS_DV__FEC_RX_DV		0x80000000
-				MX53_PAD_FEC_RXD1__FEC_RDATA_1		0x80000000
-				MX53_PAD_FEC_RXD0__FEC_RDATA_0		0x80000000
-				MX53_PAD_FEC_TX_EN__FEC_TX_EN		0x80000000
-				MX53_PAD_FEC_TXD1__FEC_TDATA_1		0x80000000
-				MX53_PAD_FEC_TXD0__FEC_TDATA_0		0x80000000
+				MX53_PAD_FEC_MDC__FEC_MDC		0x4
+				MX53_PAD_FEC_MDIO__FEC_MDIO		0x1fc
+				MX53_PAD_FEC_REF_CLK__FEC_TX_CLK	0x180
+				MX53_PAD_FEC_RX_ER__FEC_RX_ER		0x180
+				MX53_PAD_FEC_CRS_DV__FEC_RX_DV		0x180
+				MX53_PAD_FEC_RXD1__FEC_RDATA_1		0x180
+				MX53_PAD_FEC_RXD0__FEC_RDATA_0		0x180
+				MX53_PAD_FEC_TX_EN__FEC_TX_EN		0x4
+				MX53_PAD_FEC_TXD1__FEC_TDATA_1		0x4
+				MX53_PAD_FEC_TXD0__FEC_TDATA_0		0x4
 			>;
 		};
 
diff -druNp --no-dereference linux-libre-3.18.80-gnu/arch/arm/configs/omap2plus_defconfig linux-libre-3.18.81-gnu/arch/arm/configs/omap2plus_defconfig
--- linux-libre-3.18.80-gnu/arch/arm/configs/omap2plus_defconfig	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/arch/arm/configs/omap2plus_defconfig	2017-11-15 04:04:14.000000000 -0500
@@ -169,6 +169,7 @@ CONFIG_INPUT_TWL4030_PWRBUTTON=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=32
+CONFIG_SERIAL_8250_RUNTIME_UARTS=6
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
diff -druNp --no-dereference linux-libre-3.18.80-gnu/arch/arm/kernel/traps.c linux-libre-3.18.81-gnu/arch/arm/kernel/traps.c
--- linux-libre-3.18.80-gnu/arch/arm/kernel/traps.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/arch/arm/kernel/traps.c	2017-11-15 04:04:14.000000000 -0500
@@ -132,30 +132,26 @@ static void dump_mem(const char *lvl, co
 	set_fs(fs);
 }
 
-static void dump_instr(const char *lvl, struct pt_regs *regs)
+static void __dump_instr(const char *lvl, struct pt_regs *regs)
 {
 	unsigned long addr = instruction_pointer(regs);
 	const int thumb = thumb_mode(regs);
 	const int width = thumb ? 4 : 8;
-	mm_segment_t fs;
 	char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
 	int i;
 
 	/*
-	 * We need to switch to kernel mode so that we can use __get_user
-	 * to safely read from kernel space.  Note that we now dump the
-	 * code first, just in case the backtrace kills us.
+	 * Note that we now dump the code first, just in case the backtrace
+	 * kills us.
 	 */
-	fs = get_fs();
-	set_fs(KERNEL_DS);
 
 	for (i = -4; i < 1 + !!thumb; i++) {
 		unsigned int val, bad;
 
 		if (thumb)
-			bad = __get_user(val, &((u16 *)addr)[i]);
+			bad = get_user(val, &((u16 *)addr)[i]);
 		else
-			bad = __get_user(val, &((u32 *)addr)[i]);
+			bad = get_user(val, &((u32 *)addr)[i]);
 
 		if (!bad)
 			p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ",
@@ -166,8 +162,20 @@ static void dump_instr(const char *lvl,
 		}
 	}
 	printk("%sCode: %s\n", lvl, str);
+}
 
-	set_fs(fs);
+static void dump_instr(const char *lvl, struct pt_regs *regs)
+{
+	mm_segment_t fs;
+
+	if (!user_mode(regs)) {
+		fs = get_fs();
+		set_fs(KERNEL_DS);
+		__dump_instr(lvl, regs);
+		set_fs(fs);
+	} else {
+		__dump_instr(lvl, regs);
+	}
 }
 
 #ifdef CONFIG_ARM_UNWIND
diff -druNp --no-dereference linux-libre-3.18.80-gnu/arch/mips/ar7/platform.c linux-libre-3.18.81-gnu/arch/mips/ar7/platform.c
--- linux-libre-3.18.80-gnu/arch/mips/ar7/platform.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/arch/mips/ar7/platform.c	2017-11-15 04:04:14.000000000 -0500
@@ -581,6 +581,7 @@ static int __init ar7_register_uarts(voi
 	uart_port.type		= PORT_AR7;
 	uart_port.uartclk	= clk_get_rate(bus_clk) / 2;
 	uart_port.iotype	= UPIO_MEM32;
+	uart_port.flags		= UPF_FIXED_TYPE;
 	uart_port.regshift	= 2;
 
 	uart_port.line		= 0;
diff -druNp --no-dereference linux-libre-3.18.80-gnu/arch/mips/include/asm/mips-cm.h linux-libre-3.18.81-gnu/arch/mips/include/asm/mips-cm.h
--- linux-libre-3.18.80-gnu/arch/mips/include/asm/mips-cm.h	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/arch/mips/include/asm/mips-cm.h	2017-11-15 04:04:14.000000000 -0500
@@ -173,8 +173,8 @@ BUILD_CM_Cx_R_(tcid_8_priority,	0x80)
 #define CM_GCR_BASE_GCRBASE_MSK			(_ULCAST_(0x1ffff) << 15)
 #define CM_GCR_BASE_CMDEFTGT_SHF		0
 #define CM_GCR_BASE_CMDEFTGT_MSK		(_ULCAST_(0x3) << 0)
-#define  CM_GCR_BASE_CMDEFTGT_DISABLED		0
-#define  CM_GCR_BASE_CMDEFTGT_MEM		1
+#define  CM_GCR_BASE_CMDEFTGT_MEM		0
+#define  CM_GCR_BASE_CMDEFTGT_RESERVED		1
 #define  CM_GCR_BASE_CMDEFTGT_IOCU0		2
 #define  CM_GCR_BASE_CMDEFTGT_IOCU1		3
 
diff -druNp --no-dereference linux-libre-3.18.80-gnu/arch/mips/mm/uasm-micromips.c linux-libre-3.18.81-gnu/arch/mips/mm/uasm-micromips.c
--- linux-libre-3.18.80-gnu/arch/mips/mm/uasm-micromips.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/arch/mips/mm/uasm-micromips.c	2017-11-15 04:04:14.000000000 -0500
@@ -83,7 +83,7 @@ static struct insn insn_table_MM[] = {
 	{ insn_jr, M(mm_pool32a_op, 0, 0, 0, mm_jalr_op, mm_pool32axf_op), RS },
 	{ insn_lb, M(mm_lb32_op, 0, 0, 0, 0, 0), RT | RS | SIMM },
 	{ insn_ld, 0, 0 },
-	{ insn_lh, M(mm_lh32_op, 0, 0, 0, 0, 0), RS | RS | SIMM },
+	{ insn_lh, M(mm_lh32_op, 0, 0, 0, 0, 0), RT | RS | SIMM },
 	{ insn_ll, M(mm_pool32c_op, 0, 0, (mm_ll_func << 1), 0, 0), RS | RT | SIMM },
 	{ insn_lld, 0, 0 },
 	{ insn_lui, M(mm_pool32i_op, mm_lui_op, 0, 0, 0, 0), RS | SIMM },
diff -druNp --no-dereference linux-libre-3.18.80-gnu/arch/sh/kernel/cpu/sh3/setup-sh770x.c linux-libre-3.18.81-gnu/arch/sh/kernel/cpu/sh3/setup-sh770x.c
--- linux-libre-3.18.80-gnu/arch/sh/kernel/cpu/sh3/setup-sh770x.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/arch/sh/kernel/cpu/sh3/setup-sh770x.c	2017-11-15 04:04:14.000000000 -0500
@@ -165,7 +165,6 @@ static struct plat_sci_port scif2_platfo
 	.scscr		= SCSCR_TE | SCSCR_RE,
 	.type		= PORT_IRDA,
 	.ops		= &sh770x_sci_port_ops,
-	.regshift	= 1,
 };
 
 static struct resource scif2_resources[] = {
diff -druNp --no-dereference linux-libre-3.18.80-gnu/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S linux-libre-3.18.81-gnu/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S
--- linux-libre-3.18.80-gnu/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S	2017-11-15 04:04:14.000000000 -0500
@@ -174,8 +174,8 @@ LABEL skip_ %I
 .endr
 
 	# Find min length
-	vmovdqa _lens+0*16(state), %xmm0
-	vmovdqa _lens+1*16(state), %xmm1
+	vmovdqu _lens+0*16(state), %xmm0
+	vmovdqu _lens+1*16(state), %xmm1
 
 	vpminud %xmm1, %xmm0, %xmm2     # xmm2 has {D,C,B,A}
 	vpalignr $8, %xmm2, %xmm3, %xmm3   # xmm3 has {x,x,D,C}
@@ -195,8 +195,8 @@ LABEL skip_ %I
 	vpsubd  %xmm2, %xmm0, %xmm0
 	vpsubd  %xmm2, %xmm1, %xmm1
 
-	vmovdqa %xmm0, _lens+0*16(state)
-	vmovdqa %xmm1, _lens+1*16(state)
+	vmovdqu %xmm0, _lens+0*16(state)
+	vmovdqu %xmm1, _lens+1*16(state)
 
 	# "state" and "args" are the same address, arg1
 	# len is arg2
@@ -260,8 +260,8 @@ ENTRY(sha1_mb_mgr_get_comp_job_avx2)
 	jc      .return_null
 
 	# Find min length
-	vmovdqa _lens(state), %xmm0
-	vmovdqa _lens+1*16(state), %xmm1
+	vmovdqu _lens(state), %xmm0
+	vmovdqu _lens+1*16(state), %xmm1
 
 	vpminud %xmm1, %xmm0, %xmm2        # xmm2 has {D,C,B,A}
 	vpalignr $8, %xmm2, %xmm3, %xmm3   # xmm3 has {x,x,D,C}
diff -druNp --no-dereference linux-libre-3.18.80-gnu/arch/x86/oprofile/op_model_ppro.c linux-libre-3.18.81-gnu/arch/x86/oprofile/op_model_ppro.c
--- linux-libre-3.18.80-gnu/arch/x86/oprofile/op_model_ppro.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/arch/x86/oprofile/op_model_ppro.c	2017-11-15 04:04:14.000000000 -0500
@@ -212,8 +212,8 @@ static void arch_perfmon_setup_counters(
 	eax.full = cpuid_eax(0xa);
 
 	/* Workaround for BIOS bugs in 6/15. Taken from perfmon2 */
-	if (eax.split.version_id == 0 && __this_cpu_read(cpu_info.x86) == 6 &&
-		__this_cpu_read(cpu_info.x86_model) == 15) {
+	if (eax.split.version_id == 0 && boot_cpu_data.x86 == 6 &&
+	    boot_cpu_data.x86_model == 15) {
 		eax.split.version_id = 2;
 		eax.split.num_counters = 2;
 		eax.split.bit_width = 40;
diff -druNp --no-dereference linux-libre-3.18.80-gnu/Documentation/devicetree/bindings/arm/davinci.txt linux-libre-3.18.81-gnu/Documentation/devicetree/bindings/arm/davinci.txt
--- linux-libre-3.18.80-gnu/Documentation/devicetree/bindings/arm/davinci.txt	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/Documentation/devicetree/bindings/arm/davinci.txt	2017-11-15 04:04:14.000000000 -0500
@@ -9,6 +9,10 @@ EnBW AM1808 based CMC board
 Required root node properties:
     - compatible = "enbw,cmc", "ti,da850;
 
+LEGO MINDSTORMS EV3 (AM1808 based)
+Required root node properties:
+    - compatible = "lego,ev3", "ti,da850";
+
 Generic DaVinci Boards
 ----------------------
 
diff -druNp --no-dereference linux-libre-3.18.80-gnu/Documentation/devicetree/bindings/vendor-prefixes.txt linux-libre-3.18.81-gnu/Documentation/devicetree/bindings/vendor-prefixes.txt
--- linux-libre-3.18.80-gnu/Documentation/devicetree/bindings/vendor-prefixes.txt	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/Documentation/devicetree/bindings/vendor-prefixes.txt	2017-11-15 04:04:14.000000000 -0500
@@ -83,6 +83,7 @@ karo	Ka-Ro electronics GmbH
 keymile	Keymile GmbH
 lacie	LaCie
 lantiq	Lantiq Semiconductor
+lego	LEGO Systems A/S
 lenovo	Lenovo Group Ltd.
 lg	LG Corporation
 linux	Linux-specific binding
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/block/rbd.c linux-libre-3.18.81-gnu/drivers/block/rbd.c
--- linux-libre-3.18.80-gnu/drivers/block/rbd.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/block/rbd.c	2017-11-15 04:04:14.000000000 -0500
@@ -2700,7 +2700,7 @@ static int rbd_img_obj_parent_read_full(
 	 * from the parent.
 	 */
 	page_count = (u32)calc_pages_for(0, length);
-	pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
+	pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
 	if (IS_ERR(pages)) {
 		result = PTR_ERR(pages);
 		pages = NULL;
@@ -2827,7 +2827,7 @@ static int rbd_img_obj_exists_submit(str
 	 */
 	size = sizeof (__le64) + sizeof (__le32) + sizeof (__le32);
 	page_count = (u32)calc_pages_for(0, size);
-	pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
+	pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
 	if (IS_ERR(pages))
 		return PTR_ERR(pages);
 
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/gpu/drm/drm_drv.c linux-libre-3.18.81-gnu/drivers/gpu/drm/drm_drv.c
--- linux-libre-3.18.80-gnu/drivers/gpu/drm/drm_drv.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/gpu/drm/drm_drv.c	2017-11-15 04:04:14.000000000 -0500
@@ -320,7 +320,7 @@ static int drm_minor_register(struct drm
 	ret = drm_debugfs_init(minor, minor->index, drm_debugfs_root);
 	if (ret) {
 		DRM_ERROR("DRM: Failed to initialize /sys/kernel/debug/dri.\n");
-		return ret;
+		goto err_debugfs;
 	}
 
 	ret = device_add(minor->kdev);
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/iio/trigger/iio-trig-interrupt.c linux-libre-3.18.81-gnu/drivers/iio/trigger/iio-trig-interrupt.c
--- linux-libre-3.18.80-gnu/drivers/iio/trigger/iio-trig-interrupt.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/iio/trigger/iio-trig-interrupt.c	2017-11-15 04:04:14.000000000 -0500
@@ -58,7 +58,7 @@ static int iio_interrupt_trigger_probe(s
 	trig_info = kzalloc(sizeof(*trig_info), GFP_KERNEL);
 	if (!trig_info) {
 		ret = -ENOMEM;
-		goto error_put_trigger;
+		goto error_free_trigger;
 	}
 	iio_trigger_set_drvdata(trig, trig_info);
 	trig_info->irq = irq;
@@ -83,8 +83,8 @@ error_release_irq:
 	free_irq(irq, trig);
 error_free_trig_info:
 	kfree(trig_info);
-error_put_trigger:
-	iio_trigger_put(trig);
+error_free_trigger:
+	iio_trigger_free(trig);
 error_ret:
 	return ret;
 }
@@ -99,7 +99,7 @@ static int iio_interrupt_trigger_remove(
 	iio_trigger_unregister(trig);
 	free_irq(trig_info->irq, trig);
 	kfree(trig_info);
-	iio_trigger_put(trig);
+	iio_trigger_free(trig);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/iio/trigger/iio-trig-sysfs.c linux-libre-3.18.81-gnu/drivers/iio/trigger/iio-trig-sysfs.c
--- linux-libre-3.18.80-gnu/drivers/iio/trigger/iio-trig-sysfs.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/iio/trigger/iio-trig-sysfs.c	2017-11-15 04:04:14.000000000 -0500
@@ -173,7 +173,7 @@ static int iio_sysfs_trigger_probe(int i
 	return 0;
 
 out2:
-	iio_trigger_put(t->trig);
+	iio_trigger_free(t->trig);
 free_t:
 	kfree(t);
 out1:
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c linux-libre-3.18.81-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c
--- linux-libre-3.18.80-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c	2017-11-15 04:04:14.000000000 -0500
@@ -1362,7 +1362,7 @@ static void ipoib_cm_tx_reap(struct work
 
 	while (!list_empty(&priv->cm.reap_list)) {
 		p = list_entry(priv->cm.reap_list.next, typeof(*p), list);
-		list_del(&p->list);
+		list_del_init(&p->list);
 		spin_unlock_irqrestore(&priv->lock, flags);
 		netif_tx_unlock_bh(dev);
 		ipoib_cm_tx_destroy(p);
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/input/keyboard/mpr121_touchkey.c linux-libre-3.18.81-gnu/drivers/input/keyboard/mpr121_touchkey.c
--- linux-libre-3.18.80-gnu/drivers/input/keyboard/mpr121_touchkey.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/input/keyboard/mpr121_touchkey.c	2017-11-15 04:04:14.000000000 -0500
@@ -87,7 +87,8 @@ static irqreturn_t mpr_touchkey_interrup
 	struct mpr121_touchkey *mpr121 = dev_id;
 	struct i2c_client *client = mpr121->client;
 	struct input_dev *input = mpr121->input_dev;
-	unsigned int key_num, key_val, pressed;
+	unsigned long bit_changed;
+	unsigned int key_num;
 	int reg;
 
 	reg = i2c_smbus_read_byte_data(client, ELE_TOUCH_STATUS_1_ADDR);
@@ -105,18 +106,22 @@ static irqreturn_t mpr_touchkey_interrup
 
 	reg &= TOUCH_STATUS_MASK;
 	/* use old press bit to figure out which bit changed */
-	key_num = ffs(reg ^ mpr121->statusbits) - 1;
-	pressed = reg & (1 << key_num);
+	bit_changed = reg ^ mpr121->statusbits;
 	mpr121->statusbits = reg;
+	for_each_set_bit(key_num, &bit_changed, mpr121->keycount) {
+		unsigned int key_val, pressed;
 
-	key_val = mpr121->keycodes[key_num];
+		pressed = reg & BIT(key_num);
+		key_val = mpr121->keycodes[key_num];
 
-	input_event(input, EV_MSC, MSC_SCAN, key_num);
-	input_report_key(input, key_val, pressed);
-	input_sync(input);
+		input_event(input, EV_MSC, MSC_SCAN, key_num);
+		input_report_key(input, key_val, pressed);
 
-	dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
-		pressed ? "pressed" : "released");
+		dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
+			pressed ? "pressed" : "released");
+
+	}
+	input_sync(input);
 
 out:
 	return IRQ_HANDLED;
@@ -230,6 +235,7 @@ static int mpr_touchkey_probe(struct i2c
 	input_dev->id.bustype = BUS_I2C;
 	input_dev->dev.parent = &client->dev;
 	input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
+	input_set_capability(input_dev, EV_MSC, MSC_SCAN);
 
 	input_dev->keycode = mpr121->keycodes;
 	input_dev->keycodesize = sizeof(mpr121->keycodes[0]);
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/net/can/c_can/c_can_pci.c linux-libre-3.18.81-gnu/drivers/net/can/c_can/c_can_pci.c
--- linux-libre-3.18.80-gnu/drivers/net/can/c_can/c_can_pci.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/net/can/c_can/c_can_pci.c	2017-11-15 04:04:14.000000000 -0500
@@ -177,7 +177,6 @@ static int c_can_pci_probe(struct pci_de
 		break;
 	case BOSCH_D_CAN:
 		priv->regs = reg_map_d_can;
-		priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
 		break;
 	default:
 		ret = -EINVAL;
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/net/can/c_can/c_can_platform.c linux-libre-3.18.81-gnu/drivers/net/can/c_can/c_can_platform.c
--- linux-libre-3.18.80-gnu/drivers/net/can/c_can/c_can_platform.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/net/can/c_can/c_can_platform.c	2017-11-15 04:04:14.000000000 -0500
@@ -257,7 +257,6 @@ static int c_can_plat_probe(struct platf
 		break;
 	case BOSCH_D_CAN:
 		priv->regs = reg_map_d_can;
-		priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
 		priv->read_reg = c_can_plat_read_reg_aligned_to_16bit;
 		priv->write_reg = c_can_plat_write_reg_aligned_to_16bit;
 		priv->read_reg32 = d_can_plat_read_reg32;
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/net/xen-netback/netback.c linux-libre-3.18.81-gnu/drivers/net/xen-netback/netback.c
--- linux-libre-3.18.80-gnu/drivers/net/xen-netback/netback.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/net/xen-netback/netback.c	2017-11-15 04:04:14.000000000 -0500
@@ -67,6 +67,7 @@ module_param(rx_drain_timeout_msecs, uin
 unsigned int rx_stall_timeout_msecs = 60000;
 module_param(rx_stall_timeout_msecs, uint, 0444);
 
+#define MAX_QUEUES_DEFAULT 8
 unsigned int xenvif_max_queues;
 module_param_named(max_queues, xenvif_max_queues, uint, 0644);
 MODULE_PARM_DESC(max_queues,
@@ -2189,11 +2190,12 @@ static int __init netback_init(void)
 	if (!xen_domain())
 		return -ENODEV;
 
-	/* Allow as many queues as there are CPUs if user has not
+	/* Allow as many queues as there are CPUs but max. 8 if user has not
 	 * specified a value.
 	 */
 	if (xenvif_max_queues == 0)
-		xenvif_max_queues = num_online_cpus();
+		xenvif_max_queues = min_t(unsigned int, MAX_QUEUES_DEFAULT,
+					  num_online_cpus());
 
 	if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) {
 		pr_info("fatal_skb_slots too small (%d), bump it to XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n",
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/staging/iio/trigger/iio-trig-bfin-timer.c linux-libre-3.18.81-gnu/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
--- linux-libre-3.18.80-gnu/drivers/staging/iio/trigger/iio-trig-bfin-timer.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/staging/iio/trigger/iio-trig-bfin-timer.c	2017-11-15 04:04:14.000000000 -0500
@@ -258,7 +258,7 @@ out_free_irq:
 out1:
 	iio_trigger_unregister(st->trig);
 out:
-	iio_trigger_put(st->trig);
+	iio_trigger_free(st->trig);
 	return ret;
 }
 
@@ -271,7 +271,7 @@ static int iio_bfin_tmr_trigger_remove(s
 		peripheral_free(st->t->pin);
 	free_irq(st->irq, st);
 	iio_trigger_unregister(st->trig);
-	iio_trigger_put(st->trig);
+	iio_trigger_free(st->trig);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/tty/serial/sh-sci.c linux-libre-3.18.81-gnu/drivers/tty/serial/sh-sci.c
--- linux-libre-3.18.80-gnu/drivers/tty/serial/sh-sci.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/tty/serial/sh-sci.c	2017-11-15 04:04:14.000000000 -0500
@@ -171,18 +171,17 @@ static struct plat_sci_reg sci_regmap[SC
 	},
 
 	/*
-	 * Common definitions for legacy IrDA ports, dependent on
-	 * regshift value.
+	 * Common definitions for legacy IrDA ports.
 	 */
 	[SCIx_IRDA_REGTYPE] = {
 		[SCSMR]		= { 0x00,  8 },
-		[SCBRR]		= { 0x01,  8 },
-		[SCSCR]		= { 0x02,  8 },
-		[SCxTDR]	= { 0x03,  8 },
-		[SCxSR]		= { 0x04,  8 },
-		[SCxRDR]	= { 0x05,  8 },
-		[SCFCR]		= { 0x06,  8 },
-		[SCFDR]		= { 0x07, 16 },
+		[SCBRR]		= { 0x02,  8 },
+		[SCSCR]		= { 0x04,  8 },
+		[SCxTDR]	= { 0x06,  8 },
+		[SCxSR]		= { 0x08, 16 },
+		[SCxRDR]	= { 0x0a,  8 },
+		[SCFCR]		= { 0x0c,  8 },
+		[SCFDR]		= { 0x0e, 16 },
 		[SCTFDR]	= sci_reg_invalid,
 		[SCRFDR]	= sci_reg_invalid,
 		[SCSPTR]	= sci_reg_invalid,
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/usb/core/hcd.c linux-libre-3.18.81-gnu/drivers/usb/core/hcd.c
--- linux-libre-3.18.80-gnu/drivers/usb/core/hcd.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/usb/core/hcd.c	2017-11-15 04:04:14.000000000 -0500
@@ -2927,6 +2927,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 	}
 
 	usb_put_invalidate_rhdev(hcd);
+	hcd->flags = 0;
 }
 EXPORT_SYMBOL_GPL(usb_remove_hcd);
 
diff -druNp --no-dereference linux-libre-3.18.80-gnu/drivers/video/fbdev/pmag-ba-fb.c linux-libre-3.18.81-gnu/drivers/video/fbdev/pmag-ba-fb.c
--- linux-libre-3.18.80-gnu/drivers/video/fbdev/pmag-ba-fb.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/drivers/video/fbdev/pmag-ba-fb.c	2017-11-15 04:04:14.000000000 -0500
@@ -129,7 +129,7 @@ static struct fb_ops pmagbafb_ops = {
 /*
  * Turn the hardware cursor off.
  */
-static void __init pmagbafb_erase_cursor(struct fb_info *info)
+static void pmagbafb_erase_cursor(struct fb_info *info)
 {
 	struct pmagbafb_par *par = info->par;
 
diff -druNp --no-dereference linux-libre-3.18.80-gnu/include/linux/phy.h linux-libre-3.18.81-gnu/include/linux/phy.h
--- linux-libre-3.18.80-gnu/include/linux/phy.h	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/include/linux/phy.h	2017-11-15 04:04:14.000000000 -0500
@@ -135,11 +135,7 @@ static inline const char *phy_modes(phy_
 /* Used when trying to connect to a specific phy (mii bus id:phy device id) */
 #define PHY_ID_FMT "%s:%02x"
 
-/*
- * Need to be a little smaller than phydev->dev.bus_id to leave room
- * for the ":%02x"
- */
-#define MII_BUS_ID_SIZE	(20 - 3)
+#define MII_BUS_ID_SIZE	61
 
 /* Or MII_ADDR_C45 into regnum for read/write on mii_bus to enable the 21 bit
    IEEE 802.3ae clause 45 addressing mode used by 10GIGE phy chips. */
@@ -573,7 +569,7 @@ struct phy_driver {
 /* A Structure for boards to register fixups with the PHY Lib */
 struct phy_fixup {
 	struct list_head list;
-	char bus_id[20];
+	char bus_id[MII_BUS_ID_SIZE + 3];
 	u32 phy_uid;
 	u32 phy_uid_mask;
 	int (*run)(struct phy_device *phydev);
diff -druNp --no-dereference linux-libre-3.18.80-gnu/include/sound/seq_kernel.h linux-libre-3.18.81-gnu/include/sound/seq_kernel.h
--- linux-libre-3.18.80-gnu/include/sound/seq_kernel.h	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/include/sound/seq_kernel.h	2017-11-15 04:04:14.000000000 -0500
@@ -55,7 +55,8 @@ typedef union snd_seq_timestamp snd_seq_
 #define SNDRV_SEQ_DEFAULT_CLIENT_EVENTS	200
 
 /* max delivery path length */
-#define SNDRV_SEQ_MAX_HOPS		10
+/* NOTE: this shouldn't be greater than MAX_LOCKDEP_SUBCLASSES */
+#define SNDRV_SEQ_MAX_HOPS		8
 
 /* max size of event size */
 #define SNDRV_SEQ_MAX_EVENT_LEN		0x3fffffff
diff -druNp --no-dereference linux-libre-3.18.80-gnu/lib/asn1_decoder.c linux-libre-3.18.81-gnu/lib/asn1_decoder.c
--- linux-libre-3.18.80-gnu/lib/asn1_decoder.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/lib/asn1_decoder.c	2017-11-15 04:04:14.000000000 -0500
@@ -220,7 +220,7 @@ next_op:
 		hdr = 2;
 
 		/* Extract a tag from the data */
-		if (unlikely(dp >= datalen - 1))
+		if (unlikely(datalen - dp < 2))
 			goto data_overrun_error;
 		tag = data[dp++];
 		if (unlikely((tag & 0x1f) == ASN1_LONG_TAG))
@@ -266,7 +266,7 @@ next_op:
 				int n = len - 0x80;
 				if (unlikely(n > 2))
 					goto length_too_long;
-				if (unlikely(dp >= datalen - n))
+				if (unlikely(n > datalen - dp))
 					goto data_overrun_error;
 				hdr += n;
 				for (len = 0; n > 0; n--) {
diff -druNp --no-dereference linux-libre-3.18.80-gnu/Makefile linux-libre-3.18.81-gnu/Makefile
--- linux-libre-3.18.80-gnu/Makefile	2017-11-08 10:36:58.000000000 -0500
+++ linux-libre-3.18.81-gnu/Makefile	2017-11-15 11:29:35.000000000 -0500
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 80
+SUBLEVEL = 81
 EXTRAVERSION =-gnu
 NAME = Diseased Newt
 
diff -druNp --no-dereference linux-libre-3.18.80-gnu/net/ipv4/ah4.c linux-libre-3.18.81-gnu/net/ipv4/ah4.c
--- linux-libre-3.18.80-gnu/net/ipv4/ah4.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/net/ipv4/ah4.c	2017-11-15 04:04:14.000000000 -0500
@@ -270,6 +270,9 @@ static void ah_input_done(struct crypto_
 	int ihl = ip_hdrlen(skb);
 	int ah_hlen = (ah->hdrlen + 2) << 2;
 
+	if (err)
+		goto out;
+
 	work_iph = AH_SKB_CB(skb)->tmp;
 	auth_data = ah_tmp_auth(work_iph, ihl);
 	icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
diff -druNp --no-dereference linux-libre-3.18.80-gnu/security/keys/trusted.c linux-libre-3.18.81-gnu/security/keys/trusted.c
--- linux-libre-3.18.80-gnu/security/keys/trusted.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/security/keys/trusted.c	2017-11-15 04:04:14.000000000 -0500
@@ -69,7 +69,7 @@ static int TSS_sha1(const unsigned char
 	}
 
 	ret = crypto_shash_digest(&sdesc->shash, data, datalen, digest);
-	kfree(sdesc);
+	kzfree(sdesc);
 	return ret;
 }
 
@@ -113,7 +113,7 @@ static int TSS_rawhmac(unsigned char *di
 	if (!ret)
 		ret = crypto_shash_final(&sdesc->shash, digest);
 out:
-	kfree(sdesc);
+	kzfree(sdesc);
 	return ret;
 }
 
@@ -164,7 +164,7 @@ static int TSS_authhmac(unsigned char *d
 				  paramdigest, TPM_NONCE_SIZE, h1,
 				  TPM_NONCE_SIZE, h2, 1, &c, 0, 0);
 out:
-	kfree(sdesc);
+	kzfree(sdesc);
 	return ret;
 }
 
@@ -245,7 +245,7 @@ static int TSS_checkhmac1(unsigned char
 	if (memcmp(testhmac, authdata, SHA1_DIGEST_SIZE))
 		ret = -EINVAL;
 out:
-	kfree(sdesc);
+	kzfree(sdesc);
 	return ret;
 }
 
@@ -346,7 +346,7 @@ static int TSS_checkhmac2(unsigned char
 	if (memcmp(testhmac2, authdata2, SHA1_DIGEST_SIZE))
 		ret = -EINVAL;
 out:
-	kfree(sdesc);
+	kzfree(sdesc);
 	return ret;
 }
 
@@ -563,7 +563,7 @@ static int tpm_seal(struct tpm_buf *tb,
 		*bloblen = storedsize;
 	}
 out:
-	kfree(td);
+	kzfree(td);
 	return ret;
 }
 
@@ -677,7 +677,7 @@ static int key_seal(struct trusted_key_p
 	if (ret < 0)
 		pr_info("trusted_key: srkseal failed (%d)\n", ret);
 
-	kfree(tb);
+	kzfree(tb);
 	return ret;
 }
 
@@ -702,7 +702,7 @@ static int key_unseal(struct trusted_key
 		/* pull migratable flag out of sealed key */
 		p->migratable = p->key[--p->key_len];
 
-	kfree(tb);
+	kzfree(tb);
 	return ret;
 }
 
@@ -961,12 +961,12 @@ static int trusted_instantiate(struct ke
 	if (!ret && options->pcrlock)
 		ret = pcrlock(options->pcrlock);
 out:
-	kfree(datablob);
-	kfree(options);
+	kzfree(datablob);
+	kzfree(options);
 	if (!ret)
 		rcu_assign_keypointer(key, payload);
 	else
-		kfree(payload);
+		kzfree(payload);
 	return ret;
 }
 
@@ -975,8 +975,7 @@ static void trusted_rcu_free(struct rcu_
 	struct trusted_key_payload *p;
 
 	p = container_of(rcu, struct trusted_key_payload, rcu);
-	memset(p->key, 0, p->key_len);
-	kfree(p);
+	kzfree(p);
 }
 
 /*
@@ -1018,9 +1017,10 @@ static int trusted_update(struct key *ke
 	ret = datablob_parse(datablob, new_p, new_o);
 	if (ret != Opt_update) {
 		ret = -EINVAL;
-		kfree(new_p);
+		kzfree(new_p);
 		goto out;
 	}
+
 	/* copy old key values, and reseal with new pcrs */
 	new_p->migratable = p->migratable;
 	new_p->key_len = p->key_len;
@@ -1031,22 +1031,22 @@ static int trusted_update(struct key *ke
 	ret = key_seal(new_p, new_o);
 	if (ret < 0) {
 		pr_info("trusted_key: key_seal failed (%d)\n", ret);
-		kfree(new_p);
+		kzfree(new_p);
 		goto out;
 	}
 	if (new_o->pcrlock) {
 		ret = pcrlock(new_o->pcrlock);
 		if (ret < 0) {
 			pr_info("trusted_key: pcrlock failed (%d)\n", ret);
-			kfree(new_p);
+			kzfree(new_p);
 			goto out;
 		}
 	}
 	rcu_assign_keypointer(key, new_p);
 	call_rcu(&p->rcu, trusted_rcu_free);
 out:
-	kfree(datablob);
-	kfree(new_o);
+	kzfree(datablob);
+	kzfree(new_o);
 	return ret;
 }
 
@@ -1065,34 +1065,30 @@ static long trusted_read(const struct ke
 	p = rcu_dereference_key(key);
 	if (!p)
 		return -EINVAL;
-	if (!buffer || buflen <= 0)
-		return 2 * p->blob_len;
-	ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
-	if (!ascii_buf)
-		return -ENOMEM;
 
-	bufp = ascii_buf;
-	for (i = 0; i < p->blob_len; i++)
-		bufp = hex_byte_pack(bufp, p->blob[i]);
-	if ((copy_to_user(buffer, ascii_buf, 2 * p->blob_len)) != 0) {
-		kfree(ascii_buf);
-		return -EFAULT;
+	if (buffer && buflen >= 2 * p->blob_len) {
+		ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
+		if (!ascii_buf)
+			return -ENOMEM;
+
+		bufp = ascii_buf;
+		for (i = 0; i < p->blob_len; i++)
+			bufp = hex_byte_pack(bufp, p->blob[i]);
+		if (copy_to_user(buffer, ascii_buf, 2 * p->blob_len) != 0) {
+			kzfree(ascii_buf);
+			return -EFAULT;
+		}
+		kzfree(ascii_buf);
 	}
-	kfree(ascii_buf);
 	return 2 * p->blob_len;
 }
 
 /*
- * trusted_destroy - before freeing the key, clear the decrypted data
+ * trusted_destroy - clear and free the key's payload
  */
 static void trusted_destroy(struct key *key)
 {
-	struct trusted_key_payload *p = key->payload.data;
-
-	if (!p)
-		return;
-	memset(p->key, 0, p->key_len);
-	kfree(key->payload.data);
+	kzfree(key->payload.data);
 }
 
 struct key_type key_type_trusted = {
diff -druNp --no-dereference linux-libre-3.18.80-gnu/sound/core/seq/oss/seq_oss_midi.c linux-libre-3.18.81-gnu/sound/core/seq/oss/seq_oss_midi.c
--- linux-libre-3.18.80-gnu/sound/core/seq/oss/seq_oss_midi.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/sound/core/seq/oss/seq_oss_midi.c	2017-11-15 04:04:14.000000000 -0500
@@ -615,9 +615,7 @@ send_midi_event(struct seq_oss_devinfo *
 	if (!dp->timer->running)
 		len = snd_seq_oss_timer_start(dp->timer);
 	if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
-		if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) == SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
-			snd_seq_oss_readq_puts(dp->readq, mdev->seq_device,
-					       ev->data.ext.ptr, ev->data.ext.len);
+		snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev);
 	} else {
 		len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev);
 		if (len > 0)
diff -druNp --no-dereference linux-libre-3.18.80-gnu/sound/core/seq/oss/seq_oss_readq.c linux-libre-3.18.81-gnu/sound/core/seq/oss/seq_oss_readq.c
--- linux-libre-3.18.80-gnu/sound/core/seq/oss/seq_oss_readq.c	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/sound/core/seq/oss/seq_oss_readq.c	2017-11-15 04:04:14.000000000 -0500
@@ -120,6 +120,35 @@ snd_seq_oss_readq_puts(struct seq_oss_re
 }
 
 /*
+ * put MIDI sysex bytes; the event buffer may be chained, thus it has
+ * to be expanded via snd_seq_dump_var_event().
+ */
+struct readq_sysex_ctx {
+	struct seq_oss_readq *readq;
+	int dev;
+};
+
+static int readq_dump_sysex(void *ptr, void *buf, int count)
+{
+	struct readq_sysex_ctx *ctx = ptr;
+
+	return snd_seq_oss_readq_puts(ctx->readq, ctx->dev, buf, count);
+}
+
+int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev,
+			    struct snd_seq_event *ev)
+{
+	struct readq_sysex_ctx ctx = {
+		.readq = q,
+		.dev = dev
+	};
+
+	if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
+		return 0;
+	return snd_seq_dump_var_event(ev, readq_dump_sysex, &ctx);
+}
+
+/*
  * copy an event to input queue:
  * return zero if enqueued
  */
diff -druNp --no-dereference linux-libre-3.18.80-gnu/sound/core/seq/oss/seq_oss_readq.h linux-libre-3.18.81-gnu/sound/core/seq/oss/seq_oss_readq.h
--- linux-libre-3.18.80-gnu/sound/core/seq/oss/seq_oss_readq.h	2017-11-08 04:03:50.000000000 -0500
+++ linux-libre-3.18.81-gnu/sound/core/seq/oss/seq_oss_readq.h	2017-11-15 04:04:14.000000000 -0500
@@ -44,6 +44,8 @@ void snd_seq_oss_readq_delete(struct seq
 void snd_seq_oss_readq_clear(struct seq_oss_readq *readq);
 unsigned int snd_seq_oss_readq_poll(struct seq_oss_readq *readq, struct file *file, poll_table *wait);
 int snd_seq_oss_readq_puts(struct seq_oss_readq *readq, int dev, unsigned char *data, int len);
+int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev,
+			    struct snd_seq_event *ev);
 int snd_seq_oss_readq_put_event(struct seq_oss_readq *readq, union evrec *ev);
 int snd_seq_oss_readq_put_timestamp(struct seq_oss_readq *readq, unsigned long curt, int seq_mode);
 int snd_seq_oss_readq_pick(struct seq_oss_readq *q, union evrec *rec);
