diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/arm/boot/dts/am33xx-clocks.dtsi linux-libre-3.19.3-gnu/arch/arm/boot/dts/am33xx-clocks.dtsi
--- linux-libre-3.19.2-gnu/arch/arm/boot/dts/am33xx-clocks.dtsi	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/arm/boot/dts/am33xx-clocks.dtsi	2015-03-26 09:00:21.000000000 -0400
@@ -99,7 +99,7 @@
 	ehrpwm0_tbclk: ehrpwm0_tbclk@44e10664 {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <0>;
 		reg = <0x0664>;
 	};
@@ -107,7 +107,7 @@
 	ehrpwm1_tbclk: ehrpwm1_tbclk@44e10664 {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <1>;
 		reg = <0x0664>;
 	};
@@ -115,7 +115,7 @@
 	ehrpwm2_tbclk: ehrpwm2_tbclk@44e10664 {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <2>;
 		reg = <0x0664>;
 	};
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/arm/boot/dts/am43xx-clocks.dtsi linux-libre-3.19.3-gnu/arch/arm/boot/dts/am43xx-clocks.dtsi
--- linux-libre-3.19.2-gnu/arch/arm/boot/dts/am43xx-clocks.dtsi	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/arm/boot/dts/am43xx-clocks.dtsi	2015-03-26 09:00:21.000000000 -0400
@@ -107,7 +107,7 @@
 	ehrpwm0_tbclk: ehrpwm0_tbclk {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <0>;
 		reg = <0x0664>;
 	};
@@ -115,7 +115,7 @@
 	ehrpwm1_tbclk: ehrpwm1_tbclk {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <1>;
 		reg = <0x0664>;
 	};
@@ -123,7 +123,7 @@
 	ehrpwm2_tbclk: ehrpwm2_tbclk {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <2>;
 		reg = <0x0664>;
 	};
@@ -131,7 +131,7 @@
 	ehrpwm3_tbclk: ehrpwm3_tbclk {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <4>;
 		reg = <0x0664>;
 	};
@@ -139,7 +139,7 @@
 	ehrpwm4_tbclk: ehrpwm4_tbclk {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <5>;
 		reg = <0x0664>;
 	};
@@ -147,7 +147,7 @@
 	ehrpwm5_tbclk: ehrpwm5_tbclk {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-		clocks = <&dpll_per_m2_ck>;
+		clocks = <&l4ls_gclk>;
 		ti,bit-shift = <6>;
 		reg = <0x0664>;
 	};
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/arm/boot/dts/dra7xx-clocks.dtsi linux-libre-3.19.3-gnu/arch/arm/boot/dts/dra7xx-clocks.dtsi
--- linux-libre-3.19.2-gnu/arch/arm/boot/dts/dra7xx-clocks.dtsi	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/arm/boot/dts/dra7xx-clocks.dtsi	2015-03-26 09:00:21.000000000 -0400
@@ -243,10 +243,18 @@
 		ti,invert-autoidle-bit;
 	};
 
+	dpll_core_byp_mux: dpll_core_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		ti,bit-shift = <23>;
+		reg = <0x012c>;
+	};
+
 	dpll_core_ck: dpll_core_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-core-clock";
-		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		clocks = <&sys_clkin1>, <&dpll_core_byp_mux>;
 		reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
 	};
 
@@ -309,10 +317,18 @@
 		clock-div = <1>;
 	};
 
+	dpll_dsp_byp_mux: dpll_dsp_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
+		ti,bit-shift = <23>;
+		reg = <0x0240>;
+	};
+
 	dpll_dsp_ck: dpll_dsp_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
+		clocks = <&sys_clkin1>, <&dpll_dsp_byp_mux>;
 		reg = <0x0234>, <0x0238>, <0x0240>, <0x023c>;
 	};
 
@@ -335,10 +351,18 @@
 		clock-div = <1>;
 	};
 
+	dpll_iva_byp_mux: dpll_iva_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
+		ti,bit-shift = <23>;
+		reg = <0x01ac>;
+	};
+
 	dpll_iva_ck: dpll_iva_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
+		clocks = <&sys_clkin1>, <&dpll_iva_byp_mux>;
 		reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
 	};
 
@@ -361,10 +385,18 @@
 		clock-div = <1>;
 	};
 
+	dpll_gpu_byp_mux: dpll_gpu_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		ti,bit-shift = <23>;
+		reg = <0x02e4>;
+	};
+
 	dpll_gpu_ck: dpll_gpu_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		clocks = <&sys_clkin1>, <&dpll_gpu_byp_mux>;
 		reg = <0x02d8>, <0x02dc>, <0x02e4>, <0x02e0>;
 	};
 
@@ -398,10 +430,18 @@
 		clock-div = <1>;
 	};
 
+	dpll_ddr_byp_mux: dpll_ddr_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		ti,bit-shift = <23>;
+		reg = <0x021c>;
+	};
+
 	dpll_ddr_ck: dpll_ddr_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		clocks = <&sys_clkin1>, <&dpll_ddr_byp_mux>;
 		reg = <0x0210>, <0x0214>, <0x021c>, <0x0218>;
 	};
 
@@ -416,10 +456,18 @@
 		ti,invert-autoidle-bit;
 	};
 
+	dpll_gmac_byp_mux: dpll_gmac_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		ti,bit-shift = <23>;
+		reg = <0x02b4>;
+	};
+
 	dpll_gmac_ck: dpll_gmac_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+		clocks = <&sys_clkin1>, <&dpll_gmac_byp_mux>;
 		reg = <0x02a8>, <0x02ac>, <0x02b4>, <0x02b0>;
 	};
 
@@ -482,10 +530,18 @@
 		clock-div = <1>;
 	};
 
+	dpll_eve_byp_mux: dpll_eve_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
+		ti,bit-shift = <23>;
+		reg = <0x0290>;
+	};
+
 	dpll_eve_ck: dpll_eve_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
+		clocks = <&sys_clkin1>, <&dpll_eve_byp_mux>;
 		reg = <0x0284>, <0x0288>, <0x0290>, <0x028c>;
 	};
 
@@ -1249,10 +1305,18 @@
 		clock-div = <1>;
 	};
 
+	dpll_per_byp_mux: dpll_per_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
+		ti,bit-shift = <23>;
+		reg = <0x014c>;
+	};
+
 	dpll_per_ck: dpll_per_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-clock";
-		clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
+		clocks = <&sys_clkin1>, <&dpll_per_byp_mux>;
 		reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
 	};
 
@@ -1275,10 +1339,18 @@
 		clock-div = <1>;
 	};
 
+	dpll_usb_byp_mux: dpll_usb_byp_mux {
+		#clock-cells = <0>;
+		compatible = "ti,mux-clock";
+		clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
+		ti,bit-shift = <23>;
+		reg = <0x018c>;
+	};
+
 	dpll_usb_ck: dpll_usb_ck {
 		#clock-cells = <0>;
 		compatible = "ti,omap4-dpll-j-type-clock";
-		clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
+		clocks = <&sys_clkin1>, <&dpll_usb_byp_mux>;
 		reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
 	};
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/arm/boot/dts/imx6qdl-sabresd.dtsi linux-libre-3.19.3-gnu/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
--- linux-libre-3.19.2-gnu/arch/arm/boot/dts/imx6qdl-sabresd.dtsi	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/arm/boot/dts/imx6qdl-sabresd.dtsi	2015-03-26 09:00:21.000000000 -0400
@@ -35,6 +35,7 @@
 			regulator-max-microvolt = <5000000>;
 			gpio = <&gpio3 22 0>;
 			enable-active-high;
+			vin-supply = <&swbst_reg>;
 		};
 
 		reg_usb_h1_vbus: regulator@1 {
@@ -45,6 +46,7 @@
 			regulator-max-microvolt = <5000000>;
 			gpio = <&gpio1 29 0>;
 			enable-active-high;
+			vin-supply = <&swbst_reg>;
 		};
 
 		reg_audio: regulator@2 {
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/arm/boot/dts/imx6sl-evk.dts linux-libre-3.19.3-gnu/arch/arm/boot/dts/imx6sl-evk.dts
--- linux-libre-3.19.2-gnu/arch/arm/boot/dts/imx6sl-evk.dts	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/arm/boot/dts/imx6sl-evk.dts	2015-03-26 09:00:21.000000000 -0400
@@ -52,6 +52,7 @@
 			regulator-max-microvolt = <5000000>;
 			gpio = <&gpio4 0 0>;
 			enable-active-high;
+			vin-supply = <&swbst_reg>;
 		};
 
 		reg_usb_otg2_vbus: regulator@1 {
@@ -62,6 +63,7 @@
 			regulator-max-microvolt = <5000000>;
 			gpio = <&gpio4 2 0>;
 			enable-active-high;
+			vin-supply = <&swbst_reg>;
 		};
 
 		reg_aud3v: regulator@2 {
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/arm/crypto/aesbs-core.S_shipped linux-libre-3.19.3-gnu/arch/arm/crypto/aesbs-core.S_shipped
--- linux-libre-3.19.2-gnu/arch/arm/crypto/aesbs-core.S_shipped	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/arm/crypto/aesbs-core.S_shipped	2015-03-26 09:00:21.000000000 -0400
@@ -58,14 +58,18 @@
 # define VFP_ABI_FRAME	0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__	7
+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_MAX_ARCH__ 7
 #endif
 
 #ifdef __thumb__
 # define adrl adr
 #endif
 
-#if __ARM_ARCH__>=7
+#if __ARM_MAX_ARCH__>=7
+.arch	armv7-a
+.fpu	neon
+
 .text
 .syntax	unified 	@ ARMv7-capable assembler is expected to handle this
 #ifdef __thumb2__
@@ -74,8 +78,6 @@
 .code   32
 #endif
 
-.fpu	neon
-
 .type	_bsaes_decrypt8,%function
 .align	4
 _bsaes_decrypt8:
@@ -2095,9 +2097,11 @@ bsaes_xts_decrypt:
 	vld1.8	{q8}, [r0]			@ initial tweak
 	adr	r2, .Lxts_magic
 
+#ifndef	XTS_CHAIN_TWEAK
 	tst	r9, #0xf			@ if not multiple of 16
 	it	ne				@ Thumb2 thing, sanity check in ARM
 	subne	r9, #0x10			@ subtract another 16 bytes
+#endif
 	subs	r9, #0x80
 
 	blo	.Lxts_dec_short
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/arm/crypto/bsaes-armv7.pl linux-libre-3.19.3-gnu/arch/arm/crypto/bsaes-armv7.pl
--- linux-libre-3.19.2-gnu/arch/arm/crypto/bsaes-armv7.pl	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/arm/crypto/bsaes-armv7.pl	2015-03-26 09:00:21.000000000 -0400
@@ -701,14 +701,18 @@ $code.=<<___;
 # define VFP_ABI_FRAME	0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__	7
+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_MAX_ARCH__ 7
 #endif
 
 #ifdef __thumb__
 # define adrl adr
 #endif
 
-#if __ARM_ARCH__>=7
+#if __ARM_MAX_ARCH__>=7
+.arch	armv7-a
+.fpu	neon
+
 .text
 .syntax	unified 	@ ARMv7-capable assembler is expected to handle this
 #ifdef __thumb2__
@@ -717,8 +721,6 @@ $code.=<<___;
 .code   32
 #endif
 
-.fpu	neon
-
 .type	_bsaes_decrypt8,%function
 .align	4
 _bsaes_decrypt8:
@@ -2076,9 +2078,11 @@ bsaes_xts_decrypt:
 	vld1.8	{@XMM[8]}, [r0]			@ initial tweak
 	adr	$magic, .Lxts_magic
 
+#ifndef	XTS_CHAIN_TWEAK
 	tst	$len, #0xf			@ if not multiple of 16
 	it	ne				@ Thumb2 thing, sanity check in ARM
 	subne	$len, #0x10			@ subtract another 16 bytes
+#endif
 	subs	$len, #0x80
 
 	blo	.Lxts_dec_short
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/arm/mach-at91/pm.h linux-libre-3.19.3-gnu/arch/arm/mach-at91/pm.h
--- linux-libre-3.19.2-gnu/arch/arm/mach-at91/pm.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/arm/mach-at91/pm.h	2015-03-26 09:00:21.000000000 -0400
@@ -44,7 +44,7 @@ static inline void at91rm9200_standby(vo
 		"    mcr    p15, 0, %0, c7, c0, 4\n\t"
 		"    str    %5, [%1, %2]"
 		:
-		: "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR),
+		: "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR),
 		  "r" (1), "r" (AT91RM9200_SDRAMC_SRR),
 		  "r" (lpr));
 }
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/arm/mach-exynos/platsmp.c linux-libre-3.19.3-gnu/arch/arm/mach-exynos/platsmp.c
--- linux-libre-3.19.2-gnu/arch/arm/mach-exynos/platsmp.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/arm/mach-exynos/platsmp.c	2015-03-26 09:00:21.000000000 -0400
@@ -126,8 +126,7 @@ static inline void platform_do_lowpower(
  */
 void exynos_cpu_power_down(int cpu)
 {
-	if (cpu == 0 && (of_machine_is_compatible("samsung,exynos5420") ||
-		of_machine_is_compatible("samsung,exynos5800"))) {
+	if (cpu == 0 && (soc_is_exynos5420() || soc_is_exynos5800())) {
 		/*
 		 * Bypass power down for CPU0 during suspend. Check for
 		 * the SYS_PWR_REG value to decide if we are suspending
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/arm64/include/asm/tlbflush.h linux-libre-3.19.3-gnu/arch/arm64/include/asm/tlbflush.h
--- linux-libre-3.19.2-gnu/arch/arm64/include/asm/tlbflush.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/arm64/include/asm/tlbflush.h	2015-03-26 09:00:21.000000000 -0400
@@ -149,6 +149,19 @@ static inline void flush_tlb_kernel_rang
 }
 
 /*
+ * Used to invalidate the TLB (walk caches) corresponding to intermediate page
+ * table levels (pgd/pud/pmd).
+ */
+static inline void __flush_tlb_pgtable(struct mm_struct *mm,
+				       unsigned long uaddr)
+{
+	unsigned long addr = uaddr >> 12 | ((unsigned long)ASID(mm) << 48);
+
+	dsb(ishst);
+	asm("tlbi	vae1is, %0" : : "r" (addr));
+	dsb(ish);
+}
+/*
  * On AArch64, the cache coherency is handled via the set_pte_at() function.
  */
 static inline void update_mmu_cache(struct vm_area_struct *vma,
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/arm64/include/asm/tlb.h linux-libre-3.19.3-gnu/arch/arm64/include/asm/tlb.h
--- linux-libre-3.19.2-gnu/arch/arm64/include/asm/tlb.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/arm64/include/asm/tlb.h	2015-03-26 09:00:21.000000000 -0400
@@ -48,6 +48,7 @@ static inline void tlb_flush(struct mmu_
 static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
 				  unsigned long addr)
 {
+	__flush_tlb_pgtable(tlb->mm, addr);
 	pgtable_page_dtor(pte);
 	tlb_remove_entry(tlb, pte);
 }
@@ -56,6 +57,7 @@ static inline void __pte_free_tlb(struct
 static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
 				  unsigned long addr)
 {
+	__flush_tlb_pgtable(tlb->mm, addr);
 	tlb_remove_entry(tlb, virt_to_page(pmdp));
 }
 #endif
@@ -64,6 +66,7 @@ static inline void __pmd_free_tlb(struct
 static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pudp,
 				  unsigned long addr)
 {
+	__flush_tlb_pgtable(tlb->mm, addr);
 	tlb_remove_entry(tlb, virt_to_page(pudp));
 }
 #endif
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/arm64/mm/dma-mapping.c linux-libre-3.19.3-gnu/arch/arm64/mm/dma-mapping.c
--- linux-libre-3.19.2-gnu/arch/arm64/mm/dma-mapping.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/arm64/mm/dma-mapping.c	2015-03-26 09:00:21.000000000 -0400
@@ -51,7 +51,7 @@ static int __init early_coherent_pool(ch
 }
 early_param("coherent_pool", early_coherent_pool);
 
-static void *__alloc_from_pool(size_t size, struct page **ret_page)
+static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)
 {
 	unsigned long val;
 	void *ptr = NULL;
@@ -67,6 +67,8 @@ static void *__alloc_from_pool(size_t si
 
 		*ret_page = phys_to_page(phys);
 		ptr = (void *)val;
+		if (flags & __GFP_ZERO)
+			memset(ptr, 0, size);
 	}
 
 	return ptr;
@@ -101,6 +103,7 @@ static void *__dma_alloc_coherent(struct
 		flags |= GFP_DMA;
 	if (IS_ENABLED(CONFIG_DMA_CMA) && (flags & __GFP_WAIT)) {
 		struct page *page;
+		void *addr;
 
 		size = PAGE_ALIGN(size);
 		page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
@@ -109,7 +112,10 @@ static void *__dma_alloc_coherent(struct
 			return NULL;
 
 		*dma_handle = phys_to_dma(dev, page_to_phys(page));
-		return page_address(page);
+		addr = page_address(page);
+		if (flags & __GFP_ZERO)
+			memset(addr, 0, size);
+		return addr;
 	} else {
 		return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
 	}
@@ -145,7 +151,7 @@ static void *__dma_alloc_noncoherent(str
 
 	if (!(flags & __GFP_WAIT)) {
 		struct page *page = NULL;
-		void *addr = __alloc_from_pool(size, &page);
+		void *addr = __alloc_from_pool(size, &page, flags);
 
 		if (addr)
 			*dma_handle = phys_to_dma(dev, page_to_phys(page));
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/powerpc/include/asm/iommu.h linux-libre-3.19.3-gnu/arch/powerpc/include/asm/iommu.h
--- linux-libre-3.19.2-gnu/arch/powerpc/include/asm/iommu.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/powerpc/include/asm/iommu.h	2015-03-26 09:00:21.000000000 -0400
@@ -113,6 +113,7 @@ extern void iommu_register_group(struct
 				 int pci_domain_number, unsigned long pe_num);
 extern int iommu_add_device(struct device *dev);
 extern void iommu_del_device(struct device *dev);
+extern int __init tce_iommu_bus_notifier_init(void);
 #else
 static inline void iommu_register_group(struct iommu_table *tbl,
 					int pci_domain_number,
@@ -128,6 +129,11 @@ static inline int iommu_add_device(struc
 static inline void iommu_del_device(struct device *dev)
 {
 }
+
+static inline int __init tce_iommu_bus_notifier_init(void)
+{
+        return 0;
+}
 #endif /* !CONFIG_IOMMU_API */
 
 static inline void set_iommu_table_base_and_group(struct device *dev,
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/powerpc/kernel/iommu.c linux-libre-3.19.3-gnu/arch/powerpc/kernel/iommu.c
--- linux-libre-3.19.2-gnu/arch/powerpc/kernel/iommu.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/powerpc/kernel/iommu.c	2015-03-26 09:00:21.000000000 -0400
@@ -1175,4 +1175,30 @@ void iommu_del_device(struct device *dev
 }
 EXPORT_SYMBOL_GPL(iommu_del_device);
 
+static int tce_iommu_bus_notifier(struct notifier_block *nb,
+                unsigned long action, void *data)
+{
+        struct device *dev = data;
+
+        switch (action) {
+        case BUS_NOTIFY_ADD_DEVICE:
+                return iommu_add_device(dev);
+        case BUS_NOTIFY_DEL_DEVICE:
+                if (dev->iommu_group)
+                        iommu_del_device(dev);
+                return 0;
+        default:
+                return 0;
+        }
+}
+
+static struct notifier_block tce_iommu_bus_nb = {
+        .notifier_call = tce_iommu_bus_notifier,
+};
+
+int __init tce_iommu_bus_notifier_init(void)
+{
+        bus_register_notifier(&pci_bus_type, &tce_iommu_bus_nb);
+        return 0;
+}
 #endif /* CONFIG_IOMMU_API */
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/powerpc/kernel/smp.c linux-libre-3.19.3-gnu/arch/powerpc/kernel/smp.c
--- linux-libre-3.19.2-gnu/arch/powerpc/kernel/smp.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/powerpc/kernel/smp.c	2015-03-26 09:00:21.000000000 -0400
@@ -555,8 +555,8 @@ int __cpu_up(unsigned int cpu, struct ta
 	if (smp_ops->give_timebase)
 		smp_ops->give_timebase();
 
-	/* Wait until cpu puts itself in the online map */
-	while (!cpu_online(cpu))
+	/* Wait until cpu puts itself in the online & active maps */
+	while (!cpu_online(cpu) || !cpu_active(cpu))
 		cpu_relax();
 
 	return 0;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/powerpc/platforms/powernv/pci.c linux-libre-3.19.3-gnu/arch/powerpc/platforms/powernv/pci.c
--- linux-libre-3.19.2-gnu/arch/powerpc/platforms/powernv/pci.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/powerpc/platforms/powernv/pci.c	2015-03-26 09:00:21.000000000 -0400
@@ -866,30 +866,4 @@ void __init pnv_pci_init(void)
 #endif
 }
 
-static int tce_iommu_bus_notifier(struct notifier_block *nb,
-		unsigned long action, void *data)
-{
-	struct device *dev = data;
-
-	switch (action) {
-	case BUS_NOTIFY_ADD_DEVICE:
-		return iommu_add_device(dev);
-	case BUS_NOTIFY_DEL_DEVICE:
-		if (dev->iommu_group)
-			iommu_del_device(dev);
-		return 0;
-	default:
-		return 0;
-	}
-}
-
-static struct notifier_block tce_iommu_bus_nb = {
-	.notifier_call = tce_iommu_bus_notifier,
-};
-
-static int __init tce_iommu_bus_notifier_init(void)
-{
-	bus_register_notifier(&pci_bus_type, &tce_iommu_bus_nb);
-	return 0;
-}
 machine_subsys_initcall_sync(powernv, tce_iommu_bus_notifier_init);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/powerpc/platforms/pseries/iommu.c linux-libre-3.19.3-gnu/arch/powerpc/platforms/pseries/iommu.c
--- linux-libre-3.19.2-gnu/arch/powerpc/platforms/pseries/iommu.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/powerpc/platforms/pseries/iommu.c	2015-03-26 09:00:21.000000000 -0400
@@ -1340,3 +1340,5 @@ static int __init disable_multitce(char
 }
 
 __setup("multitce=", disable_multitce);
+
+machine_subsys_initcall_sync(pseries, tce_iommu_bus_notifier_init);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/s390/kvm/kvm-s390.c linux-libre-3.19.3-gnu/arch/s390/kvm/kvm-s390.c
--- linux-libre-3.19.2-gnu/arch/s390/kvm/kvm-s390.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/s390/kvm/kvm-s390.c	2015-03-26 09:00:21.000000000 -0400
@@ -159,7 +159,6 @@ int kvm_vm_ioctl_check_extension(struct
 	case KVM_CAP_ONE_REG:
 	case KVM_CAP_ENABLE_CAP:
 	case KVM_CAP_S390_CSS_SUPPORT:
-	case KVM_CAP_IRQFD:
 	case KVM_CAP_IOEVENTFD:
 	case KVM_CAP_DEVICE_CTRL:
 	case KVM_CAP_ENABLE_CAP_VM:
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/s390/pci/pci_mmio.c linux-libre-3.19.3-gnu/arch/s390/pci/pci_mmio.c
--- linux-libre-3.19.2-gnu/arch/s390/pci/pci_mmio.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/s390/pci/pci_mmio.c	2015-03-26 09:00:21.000000000 -0400
@@ -64,8 +64,7 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, uns
 	if (copy_from_user(buf, user_buffer, length))
 		goto out;
 
-	memcpy_toio(io_addr, buf, length);
-	ret = 0;
+	ret = zpci_memcpy_toio(io_addr, buf, length);
 out:
 	if (buf != local_buf)
 		kfree(buf);
@@ -98,16 +97,16 @@ SYSCALL_DEFINE3(s390_pci_mmio_read, unsi
 		goto out;
 	io_addr = (void *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK));
 
-	ret = -EFAULT;
-	if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE)
+	if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE) {
+		ret = -EFAULT;
 		goto out;
-
-	memcpy_fromio(buf, io_addr, length);
-
-	if (copy_to_user(user_buffer, buf, length))
+	}
+	ret = zpci_memcpy_fromio(buf, io_addr, length);
+	if (ret)
 		goto out;
+	if (copy_to_user(user_buffer, buf, length))
+		ret = -EFAULT;
 
-	ret = 0;
 out:
 	if (buf != local_buf)
 		kfree(buf);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/sparc/kernel/perf_event.c linux-libre-3.19.3-gnu/arch/sparc/kernel/perf_event.c
--- linux-libre-3.19.2-gnu/arch/sparc/kernel/perf_event.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/sparc/kernel/perf_event.c	2015-03-26 09:00:21.000000000 -0400
@@ -960,6 +960,8 @@ out:
 	cpuc->pcr[0] |= cpuc->event[0]->hw.config_base;
 }
 
+static void sparc_pmu_start(struct perf_event *event, int flags);
+
 /* On this PMU each PIC has it's own PCR control register.  */
 static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
 {
@@ -972,20 +974,13 @@ static void calculate_multiple_pcrs(stru
 		struct perf_event *cp = cpuc->event[i];
 		struct hw_perf_event *hwc = &cp->hw;
 		int idx = hwc->idx;
-		u64 enc;
 
 		if (cpuc->current_idx[i] != PIC_NO_INDEX)
 			continue;
 
-		sparc_perf_event_set_period(cp, hwc, idx);
 		cpuc->current_idx[i] = idx;
 
-		enc = perf_event_get_enc(cpuc->events[i]);
-		cpuc->pcr[idx] &= ~mask_for_index(idx);
-		if (hwc->state & PERF_HES_STOPPED)
-			cpuc->pcr[idx] |= nop_for_index(idx);
-		else
-			cpuc->pcr[idx] |= event_encoding(enc, idx);
+		sparc_pmu_start(cp, PERF_EF_RELOAD);
 	}
 out:
 	for (i = 0; i < cpuc->n_events; i++) {
@@ -1101,7 +1096,6 @@ static void sparc_pmu_del(struct perf_ev
 	int i;
 
 	local_irq_save(flags);
-	perf_pmu_disable(event->pmu);
 
 	for (i = 0; i < cpuc->n_events; i++) {
 		if (event == cpuc->event[i]) {
@@ -1127,7 +1121,6 @@ static void sparc_pmu_del(struct perf_ev
 		}
 	}
 
-	perf_pmu_enable(event->pmu);
 	local_irq_restore(flags);
 }
 
@@ -1361,7 +1354,6 @@ static int sparc_pmu_add(struct perf_eve
 	unsigned long flags;
 
 	local_irq_save(flags);
-	perf_pmu_disable(event->pmu);
 
 	n0 = cpuc->n_events;
 	if (n0 >= sparc_pmu->max_hw_events)
@@ -1394,7 +1386,6 @@ nocheck:
 
 	ret = 0;
 out:
-	perf_pmu_enable(event->pmu);
 	local_irq_restore(flags);
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/sparc/kernel/process_64.c linux-libre-3.19.3-gnu/arch/sparc/kernel/process_64.c
--- linux-libre-3.19.2-gnu/arch/sparc/kernel/process_64.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/sparc/kernel/process_64.c	2015-03-26 09:00:21.000000000 -0400
@@ -287,6 +287,8 @@ void arch_trigger_all_cpu_backtrace(bool
 			printk("             TPC[%lx] O7[%lx] I7[%lx] RPC[%lx]\n",
 			       gp->tpc, gp->o7, gp->i7, gp->rpc);
 		}
+
+		touch_nmi_watchdog();
 	}
 
 	memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
@@ -362,6 +364,8 @@ static void pmu_snapshot_all_cpus(void)
 		       (cpu == this_cpu ? '*' : ' '), cpu,
 		       pp->pcr[0], pp->pcr[1], pp->pcr[2], pp->pcr[3],
 		       pp->pic[0], pp->pic[1], pp->pic[2], pp->pic[3]);
+
+		touch_nmi_watchdog();
 	}
 
 	memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/sparc/kernel/sys_sparc_64.c linux-libre-3.19.3-gnu/arch/sparc/kernel/sys_sparc_64.c
--- linux-libre-3.19.2-gnu/arch/sparc/kernel/sys_sparc_64.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/sparc/kernel/sys_sparc_64.c	2015-03-26 09:00:21.000000000 -0400
@@ -333,7 +333,7 @@ SYSCALL_DEFINE6(sparc_ipc, unsigned int,
 	long err;
 
 	/* No need for backward compatibility. We can start fresh... */
-	if (call <= SEMCTL) {
+	if (call <= SEMTIMEDOP) {
 		switch (call) {
 		case SEMOP:
 			err = sys_semtimedop(first, ptr,
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/sparc/lib/memmove.S linux-libre-3.19.3-gnu/arch/sparc/lib/memmove.S
--- linux-libre-3.19.2-gnu/arch/sparc/lib/memmove.S	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/sparc/lib/memmove.S	2015-03-26 09:00:21.000000000 -0400
@@ -8,9 +8,11 @@
 
 	.text
 ENTRY(memmove) /* o0=dst o1=src o2=len */
-	mov		%o0, %g1
+	brz,pn		%o2, 99f
+	 mov		%o0, %g1
+
 	cmp		%o0, %o1
-	bleu,pt		%xcc, memcpy
+	bleu,pt		%xcc, 2f
 	 add		%o1, %o2, %g7
 	cmp		%g7, %o0
 	bleu,pt		%xcc, memcpy
@@ -24,7 +26,34 @@ ENTRY(memmove) /* o0=dst o1=src o2=len *
 	stb		%g7, [%o0]
 	bne,pt		%icc, 1b
 	 sub		%o0, 1, %o0
-
+99:
 	retl
 	 mov		%g1, %o0
+
+	/* We can't just call memcpy for these memmove cases.  On some
+	 * chips the memcpy uses cache initializing stores and when dst
+	 * and src are close enough, those can clobber the source data
+	 * before we've loaded it in.
+	 */
+2:	or		%o0, %o1, %g7
+	or		%o2, %g7, %g7
+	andcc		%g7, 0x7, %g0
+	bne,pn		%xcc, 4f
+	 nop
+
+3:	ldx		[%o1], %g7
+	add		%o1, 8, %o1
+	subcc		%o2, 8, %o2
+	add		%o0, 8, %o0
+	bne,pt		%icc, 3b
+	 stx		%g7, [%o0 - 0x8]
+	ba,a,pt		%xcc, 99b
+
+4:	ldub		[%o1], %g7
+	add		%o1, 1, %o1
+	subcc		%o2, 1, %o2
+	add		%o0, 1, %o0
+	bne,pt		%icc, 4b
+	 stb		%g7, [%o0 - 0x1]
+	ba,a,pt		%xcc, 99b
 ENDPROC(memmove)
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/x86/crypto/aesni-intel_glue.c linux-libre-3.19.3-gnu/arch/x86/crypto/aesni-intel_glue.c
--- linux-libre-3.19.2-gnu/arch/x86/crypto/aesni-intel_glue.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/x86/crypto/aesni-intel_glue.c	2015-03-26 09:00:21.000000000 -0400
@@ -1133,7 +1133,7 @@ static int __driver_rfc4106_decrypt(stru
 		src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
 		if (!src)
 			return -ENOMEM;
-		assoc = (src + req->cryptlen + auth_tag_len);
+		assoc = (src + req->cryptlen);
 		scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
 		scatterwalk_map_and_copy(assoc, req->assoc, 0,
 			req->assoclen, 0);
@@ -1158,7 +1158,7 @@ static int __driver_rfc4106_decrypt(stru
 		scatterwalk_done(&src_sg_walk, 0, 0);
 		scatterwalk_done(&assoc_sg_walk, 0, 0);
 	} else {
-		scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
+		scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
 		kfree(src);
 	}
 	return retval;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/x86/include/asm/fpu-internal.h linux-libre-3.19.3-gnu/arch/x86/include/asm/fpu-internal.h
--- linux-libre-3.19.2-gnu/arch/x86/include/asm/fpu-internal.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/x86/include/asm/fpu-internal.h	2015-03-26 09:00:21.000000000 -0400
@@ -368,7 +368,7 @@ static inline void drop_fpu(struct task_
 	preempt_disable();
 	tsk->thread.fpu_counter = 0;
 	__drop_fpu(tsk);
-	clear_used_math();
+	clear_stopped_child_used_math(tsk);
 	preempt_enable();
 }
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/x86/kernel/apic/apic_numachip.c linux-libre-3.19.3-gnu/arch/x86/kernel/apic/apic_numachip.c
--- linux-libre-3.19.2-gnu/arch/x86/kernel/apic/apic_numachip.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/x86/kernel/apic/apic_numachip.c	2015-03-26 09:00:21.000000000 -0400
@@ -37,10 +37,12 @@ static const struct apic apic_numachip;
 static unsigned int get_apic_id(unsigned long x)
 {
 	unsigned long value;
-	unsigned int id;
+	unsigned int id = (x >> 24) & 0xff;
 
-	rdmsrl(MSR_FAM10H_NODE_ID, value);
-	id = ((x >> 24) & 0xffU) | ((value << 2) & 0xff00U);
+	if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
+		rdmsrl(MSR_FAM10H_NODE_ID, value);
+		id |= (value << 2) & 0xff00;
+	}
 
 	return id;
 }
@@ -155,10 +157,18 @@ static int __init numachip_probe(void)
 
 static void fixup_cpu_id(struct cpuinfo_x86 *c, int node)
 {
-	if (c->phys_proc_id != node) {
-		c->phys_proc_id = node;
-		per_cpu(cpu_llc_id, smp_processor_id()) = node;
+	u64 val;
+	u32 nodes = 1;
+
+	this_cpu_write(cpu_llc_id, node);
+
+	/* Account for nodes per socket in multi-core-module processors */
+	if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
+		rdmsrl(MSR_FAM10H_NODE_ID, val);
+		nodes = ((val >> 3) & 7) + 1;
 	}
+
+	c->phys_proc_id = node / nodes;
 }
 
 static int __init numachip_system_init(void)
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/x86/kernel/traps.c linux-libre-3.19.3-gnu/arch/x86/kernel/traps.c
--- linux-libre-3.19.2-gnu/arch/x86/kernel/traps.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/x86/kernel/traps.c	2015-03-26 09:00:21.000000000 -0400
@@ -300,7 +300,7 @@ dotraplinkage void do_bounds(struct pt_r
 		goto exit;
 	conditional_sti(regs);
 
-	if (!user_mode(regs))
+	if (!user_mode_vm(regs))
 		die("bounds", regs, error_code);
 
 	if (!cpu_feature_enabled(X86_FEATURE_MPX)) {
@@ -566,7 +566,7 @@ dotraplinkage void do_debug(struct pt_re
 	 * then it's very likely the result of an icebp/int01 trap.
 	 * User wants a sigtrap for that.
 	 */
-	if (!dr6 && user_mode(regs))
+	if (!dr6 && user_mode_vm(regs))
 		user_icebp = 1;
 
 	/* Catch kmemcheck conditions first of all! */
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/x86/kernel/xsave.c linux-libre-3.19.3-gnu/arch/x86/kernel/xsave.c
--- linux-libre-3.19.2-gnu/arch/x86/kernel/xsave.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/x86/kernel/xsave.c	2015-03-26 09:00:21.000000000 -0400
@@ -378,7 +378,7 @@ int __restore_xstate_sig(void __user *bu
 		 * thread's fpu state, reconstruct fxstate from the fsave
 		 * header. Sanitize the copied state etc.
 		 */
-		struct xsave_struct *xsave = &tsk->thread.fpu.state->xsave;
+		struct fpu *fpu = &tsk->thread.fpu;
 		struct user_i387_ia32_struct env;
 		int err = 0;
 
@@ -392,14 +392,15 @@ int __restore_xstate_sig(void __user *bu
 		 */
 		drop_fpu(tsk);
 
-		if (__copy_from_user(xsave, buf_fx, state_size) ||
+		if (__copy_from_user(&fpu->state->xsave, buf_fx, state_size) ||
 		    __copy_from_user(&env, buf, sizeof(env))) {
+			fpu_finit(fpu);
 			err = -1;
 		} else {
 			sanitize_restored_xstate(tsk, &env, xstate_bv, fx_only);
-			set_used_math();
 		}
 
+		set_used_math();
 		if (use_eager_fpu()) {
 			preempt_disable();
 			math_state_restore();
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/x86/kvm/x86.c linux-libre-3.19.3-gnu/arch/x86/kvm/x86.c
--- linux-libre-3.19.2-gnu/arch/x86/kvm/x86.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/x86/kvm/x86.c	2015-03-26 09:00:21.000000000 -0400
@@ -2716,7 +2716,6 @@ int kvm_vm_ioctl_check_extension(struct
 	case KVM_CAP_USER_NMI:
 	case KVM_CAP_REINJECT_CONTROL:
 	case KVM_CAP_IRQ_INJECT_STATUS:
-	case KVM_CAP_IRQFD:
 	case KVM_CAP_IOEVENTFD:
 	case KVM_CAP_IOEVENTFD_NO_LENGTH:
 	case KVM_CAP_PIT2:
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/x86/vdso/vdso32/sigreturn.S linux-libre-3.19.3-gnu/arch/x86/vdso/vdso32/sigreturn.S
--- linux-libre-3.19.2-gnu/arch/x86/vdso/vdso32/sigreturn.S	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/x86/vdso/vdso32/sigreturn.S	2015-03-26 09:00:21.000000000 -0400
@@ -17,6 +17,7 @@
 	.text
 	.globl __kernel_sigreturn
 	.type __kernel_sigreturn,@function
+	nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
 	ALIGN
 __kernel_sigreturn:
 .LSTART_sigreturn:
diff -druNp --no-dereference linux-libre-3.19.2-gnu/arch/x86/xen/p2m.c linux-libre-3.19.3-gnu/arch/x86/xen/p2m.c
--- linux-libre-3.19.2-gnu/arch/x86/xen/p2m.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/arch/x86/xen/p2m.c	2015-03-26 09:00:21.000000000 -0400
@@ -567,7 +567,7 @@ static bool alloc_p2m(unsigned long pfn)
 		if (p2m_pfn == PFN_DOWN(__pa(p2m_missing)))
 			p2m_init(p2m);
 		else
-			p2m_init_identity(p2m, pfn);
+			p2m_init_identity(p2m, pfn & ~(P2M_PER_PAGE - 1));
 
 		spin_lock_irqsave(&p2m_update_lock, flags);
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/char/tpm/tpm_i2c_stm_st33.c linux-libre-3.19.3-gnu/drivers/char/tpm/tpm_i2c_stm_st33.c
--- linux-libre-3.19.2-gnu/drivers/char/tpm/tpm_i2c_stm_st33.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/char/tpm/tpm_i2c_stm_st33.c	2015-03-26 09:00:21.000000000 -0400
@@ -397,7 +397,7 @@ static int wait_for_stat(struct tpm_chip
  */
 static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
 {
-	int size = 0, burstcnt, len;
+	int size = 0, burstcnt, len, ret;
 	struct i2c_client *client;
 
 	client = (struct i2c_client *)TPM_VPRIV(chip);
@@ -406,13 +406,15 @@ static int recv_data(struct tpm_chip *ch
 	       wait_for_stat(chip,
 			     TPM_STS_DATA_AVAIL | TPM_STS_VALID,
 			     chip->vendor.timeout_c,
-			     &chip->vendor.read_queue)
-	       == 0) {
+			     &chip->vendor.read_queue) == 0) {
 		burstcnt = get_burstcount(chip);
 		if (burstcnt < 0)
 			return burstcnt;
 		len = min_t(int, burstcnt, count - size);
-		I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
+		ret = I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
+		if (ret < 0)
+			return ret;
+
 		size += len;
 	}
 	return size;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/char/tpm/tpm_ibmvtpm.c linux-libre-3.19.3-gnu/drivers/char/tpm/tpm_ibmvtpm.c
--- linux-libre-3.19.2-gnu/drivers/char/tpm/tpm_ibmvtpm.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/char/tpm/tpm_ibmvtpm.c	2015-03-26 09:00:21.000000000 -0400
@@ -124,7 +124,7 @@ static int tpm_ibmvtpm_send(struct tpm_c
 {
 	struct ibmvtpm_dev *ibmvtpm;
 	struct ibmvtpm_crq crq;
-	u64 *word = (u64 *) &crq;
+	__be64 *word = (__be64 *)&crq;
 	int rc;
 
 	ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
@@ -145,11 +145,11 @@ static int tpm_ibmvtpm_send(struct tpm_c
 	memcpy((void *)ibmvtpm->rtce_buf, (void *)buf, count);
 	crq.valid = (u8)IBMVTPM_VALID_CMD;
 	crq.msg = (u8)VTPM_TPM_COMMAND;
-	crq.len = (u16)count;
-	crq.data = ibmvtpm->rtce_dma_handle;
+	crq.len = cpu_to_be16(count);
+	crq.data = cpu_to_be32(ibmvtpm->rtce_dma_handle);
 
-	rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]),
-			      cpu_to_be64(word[1]));
+	rc = ibmvtpm_send_crq(ibmvtpm->vdev, be64_to_cpu(word[0]),
+			      be64_to_cpu(word[1]));
 	if (rc != H_SUCCESS) {
 		dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
 		rc = 0;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/char/tpm/tpm_ibmvtpm.h linux-libre-3.19.3-gnu/drivers/char/tpm/tpm_ibmvtpm.h
--- linux-libre-3.19.2-gnu/drivers/char/tpm/tpm_ibmvtpm.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/char/tpm/tpm_ibmvtpm.h	2015-03-26 09:00:21.000000000 -0400
@@ -22,9 +22,9 @@
 struct ibmvtpm_crq {
 	u8 valid;
 	u8 msg;
-	u16 len;
-	u32 data;
-	u64 reserved;
+	__be16 len;
+	__be32 data;
+	__be64 reserved;
 } __attribute__((packed, aligned(8)));
 
 struct ibmvtpm_crq_queue {
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/char/virtio_console.c linux-libre-3.19.3-gnu/drivers/char/virtio_console.c
--- linux-libre-3.19.2-gnu/drivers/char/virtio_console.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/char/virtio_console.c	2015-03-26 09:00:21.000000000 -0400
@@ -142,6 +142,7 @@ struct ports_device {
 	 * notification
 	 */
 	struct work_struct control_work;
+	struct work_struct config_work;
 
 	struct list_head ports;
 
@@ -1837,10 +1838,21 @@ static void config_intr(struct virtio_de
 
 	portdev = vdev->priv;
 
+	if (!use_multiport(portdev))
+		schedule_work(&portdev->config_work);
+}
+
+static void config_work_handler(struct work_struct *work)
+{
+	struct ports_device *portdev;
+
+	portdev = container_of(work, struct ports_device, control_work);
 	if (!use_multiport(portdev)) {
+		struct virtio_device *vdev;
 		struct port *port;
 		u16 rows, cols;
 
+		vdev = portdev->vdev;
 		virtio_cread(vdev, struct virtio_console_config, cols, &cols);
 		virtio_cread(vdev, struct virtio_console_config, rows, &rows);
 
@@ -2031,12 +2043,14 @@ static int virtcons_probe(struct virtio_
 
 	virtio_device_ready(portdev->vdev);
 
+	INIT_WORK(&portdev->config_work, &config_work_handler);
+	INIT_WORK(&portdev->control_work, &control_work_handler);
+
 	if (multiport) {
 		unsigned int nr_added_bufs;
 
 		spin_lock_init(&portdev->c_ivq_lock);
 		spin_lock_init(&portdev->c_ovq_lock);
-		INIT_WORK(&portdev->control_work, &control_work_handler);
 
 		nr_added_bufs = fill_queue(portdev->c_ivq,
 					   &portdev->c_ivq_lock);
@@ -2104,6 +2118,8 @@ static void virtcons_remove(struct virti
 	/* Finish up work that's lined up */
 	if (use_multiport(portdev))
 		cancel_work_sync(&portdev->control_work);
+	else
+		cancel_work_sync(&portdev->config_work);
 
 	list_for_each_entry_safe(port, port2, &portdev->ports, list)
 		unplug_port(port);
@@ -2155,6 +2171,7 @@ static int virtcons_freeze(struct virtio
 
 	virtqueue_disable_cb(portdev->c_ivq);
 	cancel_work_sync(&portdev->control_work);
+	cancel_work_sync(&portdev->config_work);
 	/*
 	 * Once more: if control_work_handler() was running, it would
 	 * enable the cb as the last step.
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/drm_crtc.c linux-libre-3.19.3-gnu/drivers/gpu/drm/drm_crtc.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/drm_crtc.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/drm_crtc.c	2015-03-26 09:00:21.000000000 -0400
@@ -42,9 +42,10 @@
 #include "drm_crtc_internal.h"
 #include "drm_internal.h"
 
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-							struct drm_mode_fb_cmd2 *r,
-							struct drm_file *file_priv);
+static struct drm_framebuffer *
+internal_framebuffer_create(struct drm_device *dev,
+			    struct drm_mode_fb_cmd2 *r,
+			    struct drm_file *file_priv);
 
 /* Avoid boilerplate.  I'm tired of typing. */
 #define DRM_ENUM_NAME_FN(fnname, list)				\
@@ -2817,13 +2818,11 @@ static int drm_mode_cursor_universal(str
 	 */
 	if (req->flags & DRM_MODE_CURSOR_BO) {
 		if (req->handle) {
-			fb = add_framebuffer_internal(dev, &fbreq, file_priv);
+			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
 			if (IS_ERR(fb)) {
 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
 				return PTR_ERR(fb);
 			}
-
-			drm_framebuffer_reference(fb);
 		} else {
 			fb = NULL;
 		}
@@ -3175,9 +3174,10 @@ static int framebuffer_check(const struc
 	return 0;
 }
 
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-							struct drm_mode_fb_cmd2 *r,
-							struct drm_file *file_priv)
+static struct drm_framebuffer *
+internal_framebuffer_create(struct drm_device *dev,
+			    struct drm_mode_fb_cmd2 *r,
+			    struct drm_file *file_priv)
 {
 	struct drm_mode_config *config = &dev->mode_config;
 	struct drm_framebuffer *fb;
@@ -3209,12 +3209,6 @@ static struct drm_framebuffer *add_frame
 		return fb;
 	}
 
-	mutex_lock(&file_priv->fbs_lock);
-	r->fb_id = fb->base.id;
-	list_add(&fb->filp_head, &file_priv->fbs);
-	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
-	mutex_unlock(&file_priv->fbs_lock);
-
 	return fb;
 }
 
@@ -3236,15 +3230,24 @@ static struct drm_framebuffer *add_frame
 int drm_mode_addfb2(struct drm_device *dev,
 		    void *data, struct drm_file *file_priv)
 {
+	struct drm_mode_fb_cmd2 *r = data;
 	struct drm_framebuffer *fb;
 
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
 
-	fb = add_framebuffer_internal(dev, data, file_priv);
+	fb = internal_framebuffer_create(dev, r, file_priv);
 	if (IS_ERR(fb))
 		return PTR_ERR(fb);
 
+	/* Transfer ownership to the filp for reaping on close */
+
+	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
+	mutex_lock(&file_priv->fbs_lock);
+	r->fb_id = fb->base.id;
+	list_add(&fb->filp_head, &file_priv->fbs);
+	mutex_unlock(&file_priv->fbs_lock);
+
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/i915/i915_drv.c linux-libre-3.19.3-gnu/drivers/gpu/drm/i915/i915_drv.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/i915/i915_drv.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/i915/i915_drv.c	2015-03-26 09:00:21.000000000 -0400
@@ -622,7 +622,7 @@ static int i915_drm_suspend(struct drm_d
 	return 0;
 }
 
-static int i915_drm_suspend_late(struct drm_device *drm_dev)
+static int i915_drm_suspend_late(struct drm_device *drm_dev, bool hibernation)
 {
 	struct drm_i915_private *dev_priv = drm_dev->dev_private;
 	int ret;
@@ -636,7 +636,17 @@ static int i915_drm_suspend_late(struct
 	}
 
 	pci_disable_device(drm_dev->pdev);
-	pci_set_power_state(drm_dev->pdev, PCI_D3hot);
+	/*
+	 * During hibernation on some GEN4 platforms the BIOS may try to access
+	 * the device even though it's already in D3 and hang the machine. So
+	 * leave the device in D0 on those platforms and hope the BIOS will
+	 * power down the device properly. Platforms where this was seen:
+	 * Lenovo Thinkpad X301, X61s
+	 */
+	if (!(hibernation &&
+	      drm_dev->pdev->subsystem_vendor == PCI_VENDOR_ID_LENOVO &&
+	      INTEL_INFO(dev_priv)->gen == 4))
+		pci_set_power_state(drm_dev->pdev, PCI_D3hot);
 
 	return 0;
 }
@@ -662,7 +672,7 @@ int i915_suspend_legacy(struct drm_devic
 	if (error)
 		return error;
 
-	return i915_drm_suspend_late(dev);
+	return i915_drm_suspend_late(dev, false);
 }
 
 static int i915_drm_resume(struct drm_device *dev)
@@ -934,8 +944,7 @@ static int i915_pm_suspend(struct device
 
 static int i915_pm_suspend_late(struct device *dev)
 {
-	struct pci_dev *pdev = to_pci_dev(dev);
-	struct drm_device *drm_dev = pci_get_drvdata(pdev);
+	struct drm_device *drm_dev = dev_to_i915(dev)->dev;
 
 	/*
 	 * We have a suspedn ordering issue with the snd-hda driver also
@@ -949,13 +958,22 @@ static int i915_pm_suspend_late(struct d
 	if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
 		return 0;
 
-	return i915_drm_suspend_late(drm_dev);
+	return i915_drm_suspend_late(drm_dev, false);
+}
+
+static int i915_pm_poweroff_late(struct device *dev)
+{
+	struct drm_device *drm_dev = dev_to_i915(dev)->dev;
+
+	if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+		return 0;
+
+	return i915_drm_suspend_late(drm_dev, true);
 }
 
 static int i915_pm_resume_early(struct device *dev)
 {
-	struct pci_dev *pdev = to_pci_dev(dev);
-	struct drm_device *drm_dev = pci_get_drvdata(pdev);
+	struct drm_device *drm_dev = dev_to_i915(dev)->dev;
 
 	if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
 		return 0;
@@ -965,8 +983,7 @@ static int i915_pm_resume_early(struct d
 
 static int i915_pm_resume(struct device *dev)
 {
-	struct pci_dev *pdev = to_pci_dev(dev);
-	struct drm_device *drm_dev = pci_get_drvdata(pdev);
+	struct drm_device *drm_dev = dev_to_i915(dev)->dev;
 
 	if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
 		return 0;
@@ -1517,7 +1534,7 @@ static const struct dev_pm_ops i915_pm_o
 	.thaw_early = i915_pm_resume_early,
 	.thaw = i915_pm_resume,
 	.poweroff = i915_pm_suspend,
-	.poweroff_late = i915_pm_suspend_late,
+	.poweroff_late = i915_pm_poweroff_late,
 	.restore_early = i915_pm_resume_early,
 	.restore = i915_pm_resume,
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/i915/i915_drv.h linux-libre-3.19.3-gnu/drivers/gpu/drm/i915/i915_drv.h
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/i915/i915_drv.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/i915/i915_drv.h	2015-03-26 09:00:21.000000000 -0400
@@ -1781,6 +1781,11 @@ static inline struct drm_i915_private *t
 	return dev->dev_private;
 }
 
+static inline struct drm_i915_private *dev_to_i915(struct device *dev)
+{
+	return to_i915(dev_get_drvdata(dev));
+}
+
 /* Iterate over initialised rings */
 #define for_each_ring(ring__, dev_priv__, i__) \
 	for ((i__) = 0; (i__) < I915_NUM_RINGS; (i__)++) \
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/i915/intel_display.c linux-libre-3.19.3-gnu/drivers/gpu/drm/i915/intel_display.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/i915/intel_display.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/i915/intel_display.c	2015-03-26 09:00:21.000000000 -0400
@@ -9702,7 +9702,7 @@ void intel_check_page_flip(struct drm_de
 	struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
 
-	WARN_ON(!in_irq());
+	WARN_ON(!in_interrupt());
 
 	if (crtc == NULL)
 		return;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/atombios_crtc.c linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/atombios_crtc.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/atombios_crtc.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/atombios_crtc.c	2015-03-26 09:00:21.000000000 -0400
@@ -1405,6 +1405,9 @@ static int dce4_crtc_do_set_base(struct
 	       (x << 16) | y);
 	viewport_w = crtc->mode.hdisplay;
 	viewport_h = (crtc->mode.vdisplay + 1) & ~1;
+	if ((rdev->family >= CHIP_BONAIRE) &&
+	    (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE))
+		viewport_h *= 2;
 	WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
 	       (viewport_w << 16) | viewport_h);
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/cik.c linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/cik.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/cik.c	2015-03-18 21:49:12.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/cik.c	2015-03-26 14:59:54.000000000 -0400
@@ -7447,6 +7447,9 @@ int cik_irq_set(struct radeon_device *rd
 	WREG32(DC_HPD5_INT_CONTROL, hpd5);
 	WREG32(DC_HPD6_INT_CONTROL, hpd6);
 
+	/* posting read */
+	RREG32(SRBM_STATUS);
+
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/evergreen.c linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/evergreen.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/evergreen.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/evergreen.c	2015-03-26 09:00:21.000000000 -0400
@@ -4589,6 +4589,9 @@ int evergreen_irq_set(struct radeon_devi
 	WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5);
 	WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6);
 
+	/* posting read */
+	RREG32(SRBM_STATUS);
+
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/r100.c linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/r100.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/r100.c	2015-03-18 21:48:49.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/r100.c	2015-03-26 14:59:27.000000000 -0400
@@ -722,6 +722,10 @@ int r100_irq_set(struct radeon_device *r
 		tmp |= RADEON_FP2_DETECT_MASK;
 	}
 	WREG32(RADEON_GEN_INT_CNTL, tmp);
+
+	/* read back to post the write */
+	RREG32(RADEON_GEN_INT_CNTL);
+
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/r600.c linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/r600.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/r600.c	2015-03-18 21:48:53.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/r600.c	2015-03-26 14:59:33.000000000 -0400
@@ -3735,6 +3735,9 @@ int r600_irq_set(struct radeon_device *r
 		WREG32(RV770_CG_THERMAL_INT, thermal_int);
 	}
 
+	/* posting read */
+	RREG32(R_000E50_SRBM_STATUS);
+
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/radeon_cs.c linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/radeon_cs.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/radeon_cs.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/radeon_cs.c	2015-03-26 09:00:21.000000000 -0400
@@ -256,11 +256,13 @@ int radeon_cs_parser_init(struct radeon_
 	u32 ring = RADEON_CS_RING_GFX;
 	s32 priority = 0;
 
+	INIT_LIST_HEAD(&p->validated);
+
 	if (!cs->num_chunks) {
 		return 0;
 	}
+
 	/* get chunks */
-	INIT_LIST_HEAD(&p->validated);
 	p->idx = 0;
 	p->ib.sa_bo = NULL;
 	p->const_ib.sa_bo = NULL;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/radeon_fence.c linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/radeon_fence.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/radeon_fence.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/radeon_fence.c	2015-03-26 09:00:21.000000000 -0400
@@ -1030,37 +1030,59 @@ static inline bool radeon_test_signaled(
 	return test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags);
 }
 
+struct radeon_wait_cb {
+	struct fence_cb base;
+	struct task_struct *task;
+};
+
+static void
+radeon_fence_wait_cb(struct fence *fence, struct fence_cb *cb)
+{
+	struct radeon_wait_cb *wait =
+		container_of(cb, struct radeon_wait_cb, base);
+
+	wake_up_process(wait->task);
+}
+
 static signed long radeon_fence_default_wait(struct fence *f, bool intr,
 					     signed long t)
 {
 	struct radeon_fence *fence = to_radeon_fence(f);
 	struct radeon_device *rdev = fence->rdev;
-	bool signaled;
+	struct radeon_wait_cb cb;
 
-	fence_enable_sw_signaling(&fence->base);
+	cb.task = current;
 
-	/*
-	 * This function has to return -EDEADLK, but cannot hold
-	 * exclusive_lock during the wait because some callers
-	 * may already hold it. This means checking needs_reset without
-	 * lock, and not fiddling with any gpu internals.
-	 *
-	 * The callback installed with fence_enable_sw_signaling will
-	 * run before our wait_event_*timeout call, so we will see
-	 * both the signaled fence and the changes to needs_reset.
-	 */
+	if (fence_add_callback(f, &cb.base, radeon_fence_wait_cb))
+		return t;
 
-	if (intr)
-		t = wait_event_interruptible_timeout(rdev->fence_queue,
-			((signaled = radeon_test_signaled(fence)) ||
-			 rdev->needs_reset), t);
-	else
-		t = wait_event_timeout(rdev->fence_queue,
-			((signaled = radeon_test_signaled(fence)) ||
-			 rdev->needs_reset), t);
+	while (t > 0) {
+		if (intr)
+			set_current_state(TASK_INTERRUPTIBLE);
+		else
+			set_current_state(TASK_UNINTERRUPTIBLE);
+
+		/*
+		 * radeon_test_signaled must be called after
+		 * set_current_state to prevent a race with wake_up_process
+		 */
+		if (radeon_test_signaled(fence))
+			break;
+
+		if (rdev->needs_reset) {
+			t = -EDEADLK;
+			break;
+		}
+
+		t = schedule_timeout(t);
+
+		if (t > 0 && intr && signal_pending(current))
+			t = -ERESTARTSYS;
+	}
+
+	__set_current_state(TASK_RUNNING);
+	fence_remove_callback(f, &cb.base);
 
-	if (t > 0 && !signaled)
-		return -EDEADLK;
 	return t;
 }
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/radeon_kfd.c linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/radeon_kfd.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/radeon_kfd.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/radeon_kfd.c	2015-03-26 09:00:21.000000000 -0400
@@ -152,7 +152,7 @@ void radeon_kfd_device_init(struct radeo
 			.compute_vmid_bitmap = 0xFF00,
 
 			.first_compute_pipe = 1,
-			.compute_pipe_count = 8 - 1,
+			.compute_pipe_count = 4 - 1,
 		};
 
 		radeon_doorbell_get_kfd_info(rdev,
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/radeon_object.c linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/radeon_object.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/radeon_object.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/radeon_object.c	2015-03-26 09:00:21.000000000 -0400
@@ -173,17 +173,6 @@ void radeon_ttm_placement_from_domain(st
 		else
 			rbo->placements[i].lpfn = 0;
 	}
-
-	/*
-	 * Use two-ended allocation depending on the buffer size to
-	 * improve fragmentation quality.
-	 * 512kb was measured as the most optimal number.
-	 */
-	if (rbo->tbo.mem.size > 512 * 1024) {
-		for (i = 0; i < c; i++) {
-			rbo->placements[i].flags |= TTM_PL_FLAG_TOPDOWN;
-		}
-	}
 }
 
 int radeon_bo_create(struct radeon_device *rdev,
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/rs600.c linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/rs600.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/rs600.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/rs600.c	2015-03-26 09:00:21.000000000 -0400
@@ -693,6 +693,10 @@ int rs600_irq_set(struct radeon_device *
 	WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
 	if (ASIC_IS_DCE2(rdev))
 		WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0);
+
+	/* posting read */
+	RREG32(R_000040_GEN_INT_CNTL);
+
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/si.c linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/si.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/radeon/si.c	2015-03-18 21:49:05.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/radeon/si.c	2015-03-26 14:59:46.000000000 -0400
@@ -6125,6 +6125,9 @@ int si_irq_set(struct radeon_device *rde
 
 	WREG32(CG_THERMAL_INT, thermal_int);
 
+	/* posting read */
+	RREG32(SRBM_STATUS);
+
 	return 0;
 }
 
@@ -7045,8 +7048,7 @@ int si_set_uvd_clocks(struct radeon_devi
 	WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
 
 	if (!vclk || !dclk) {
-		/* keep the Bypass mode, put PLL to sleep */
-		WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
+		/* keep the Bypass mode */
 		return 0;
 	}
 
@@ -7062,8 +7064,7 @@ int si_set_uvd_clocks(struct radeon_devi
 	/* set VCO_MODE to 1 */
 	WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
 
-	/* toggle UPLL_SLEEP to 1 then back to 0 */
-	WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
+	/* disable sleep mode */
 	WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
 
 	/* deassert UPLL_RESET */
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c linux-libre-3.19.3-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c	2015-03-26 09:00:21.000000000 -0400
@@ -725,32 +725,6 @@ static int vmw_driver_load(struct drm_de
 		goto out_err1;
 	}
 
-	ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-			     (dev_priv->vram_size >> PAGE_SHIFT));
-	if (unlikely(ret != 0)) {
-		DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-		goto out_err2;
-	}
-
-	dev_priv->has_gmr = true;
-	if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-	    refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-					 VMW_PL_GMR) != 0) {
-		DRM_INFO("No GMR memory available. "
-			 "Graphics memory resources are very limited.\n");
-		dev_priv->has_gmr = false;
-	}
-
-	if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-		dev_priv->has_mob = true;
-		if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-				   VMW_PL_MOB) != 0) {
-			DRM_INFO("No MOB memory available. "
-				 "3D will be disabled.\n");
-			dev_priv->has_mob = false;
-		}
-	}
-
 	dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
 					       dev_priv->mmio_size);
 
@@ -813,6 +787,33 @@ static int vmw_driver_load(struct drm_de
 		goto out_no_fman;
 	}
 
+
+	ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
+			     (dev_priv->vram_size >> PAGE_SHIFT));
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Failed initializing memory manager for VRAM.\n");
+		goto out_no_vram;
+	}
+
+	dev_priv->has_gmr = true;
+	if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
+	    refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
+					 VMW_PL_GMR) != 0) {
+		DRM_INFO("No GMR memory available. "
+			 "Graphics memory resources are very limited.\n");
+		dev_priv->has_gmr = false;
+	}
+
+	if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
+		dev_priv->has_mob = true;
+		if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
+				   VMW_PL_MOB) != 0) {
+			DRM_INFO("No MOB memory available. "
+				 "3D will be disabled.\n");
+			dev_priv->has_mob = false;
+		}
+	}
+
 	vmw_kms_save_vga(dev_priv);
 
 	/* Start kms and overlay systems, needs fifo. */
@@ -838,6 +839,12 @@ out_no_fifo:
 	vmw_kms_close(dev_priv);
 out_no_kms:
 	vmw_kms_restore_vga(dev_priv);
+	if (dev_priv->has_mob)
+		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+	if (dev_priv->has_gmr)
+		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+out_no_vram:
 	vmw_fence_manager_takedown(dev_priv->fman);
 out_no_fman:
 	if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
@@ -853,12 +860,6 @@ out_err4:
 	iounmap(dev_priv->mmio_virt);
 out_err3:
 	arch_phys_wc_del(dev_priv->mmio_mtrr);
-	if (dev_priv->has_mob)
-		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-	if (dev_priv->has_gmr)
-		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-out_err2:
 	(void)ttm_bo_device_release(&dev_priv->bdev);
 out_err1:
 	vmw_ttm_global_release(dev_priv);
@@ -887,6 +888,13 @@ static int vmw_driver_unload(struct drm_
 	}
 	vmw_kms_close(dev_priv);
 	vmw_overlay_close(dev_priv);
+
+	if (dev_priv->has_mob)
+		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+	if (dev_priv->has_gmr)
+		(void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+
 	vmw_fence_manager_takedown(dev_priv->fman);
 	if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
 		drm_irq_uninstall(dev_priv->dev);
@@ -898,11 +906,6 @@ static int vmw_driver_unload(struct drm_
 	ttm_object_device_release(&dev_priv->tdev);
 	iounmap(dev_priv->mmio_virt);
 	arch_phys_wc_del(dev_priv->mmio_mtrr);
-	if (dev_priv->has_mob)
-		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-	if (dev_priv->has_gmr)
-		(void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
 	(void)ttm_bo_device_release(&dev_priv->bdev);
 	vmw_ttm_global_release(dev_priv);
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c linux-libre-3.19.3-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c	2015-03-26 09:00:21.000000000 -0400
@@ -2780,13 +2780,11 @@ int vmw_execbuf_ioctl(struct drm_device
 				  NULL, arg->command_size, arg->throttle_us,
 				  (void __user *)(unsigned long)arg->fence_rep,
 				  NULL);
-
+	ttm_read_unlock(&dev_priv->reservation_sem);
 	if (unlikely(ret != 0))
-		goto out_unlock;
+		return ret;
 
 	vmw_kms_cursor_post_execbuf(dev_priv);
 
-out_unlock:
-	ttm_read_unlock(&dev_priv->reservation_sem);
-	return ret;
+	return 0;
 }
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c linux-libre-3.19.3-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
--- linux-libre-3.19.2-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c	2015-03-26 09:00:21.000000000 -0400
@@ -2033,23 +2033,17 @@ int vmw_kms_update_layout_ioctl(struct d
 	int i;
 	struct drm_mode_config *mode_config = &dev->mode_config;
 
-	ret = ttm_read_lock(&dev_priv->reservation_sem, true);
-	if (unlikely(ret != 0))
-		return ret;
-
 	if (!arg->num_outputs) {
 		struct drm_vmw_rect def_rect = {0, 0, 800, 600};
 		vmw_du_update_layout(dev_priv, 1, &def_rect);
-		goto out_unlock;
+		return 0;
 	}
 
 	rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
 	rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
 			GFP_KERNEL);
-	if (unlikely(!rects)) {
-		ret = -ENOMEM;
-		goto out_unlock;
-	}
+	if (unlikely(!rects))
+		return -ENOMEM;
 
 	user_rects = (void __user *)(unsigned long)arg->rects;
 	ret = copy_from_user(rects, user_rects, rects_size);
@@ -2074,7 +2068,5 @@ int vmw_kms_update_layout_ioctl(struct d
 
 out_free:
 	kfree(rects);
-out_unlock:
-	ttm_read_unlock(&dev_priv->reservation_sem);
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/i2c/i2c-core.c linux-libre-3.19.3-gnu/drivers/i2c/i2c-core.c
--- linux-libre-3.19.2-gnu/drivers/i2c/i2c-core.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/i2c/i2c-core.c	2015-03-26 09:00:21.000000000 -0400
@@ -679,9 +679,6 @@ static int i2c_device_remove(struct devi
 		status = driver->remove(client);
 	}
 
-	if (dev->of_node)
-		irq_dispose_mapping(client->irq);
-
 	dev_pm_domain_detach(&client->dev, true);
 	return status;
 }
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/irqchip/irq-armada-370-xp.c linux-libre-3.19.3-gnu/drivers/irqchip/irq-armada-370-xp.c
--- linux-libre-3.19.2-gnu/drivers/irqchip/irq-armada-370-xp.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/irqchip/irq-armada-370-xp.c	2015-03-26 09:00:21.000000000 -0400
@@ -69,6 +69,7 @@ static void __iomem *per_cpu_int_base;
 static void __iomem *main_int_base;
 static struct irq_domain *armada_370_xp_mpic_domain;
 static u32 doorbell_mask_reg;
+static int parent_irq;
 #ifdef CONFIG_PCI_MSI
 static struct irq_domain *armada_370_xp_msi_domain;
 static DECLARE_BITMAP(msi_used, PCI_MSI_DOORBELL_NR);
@@ -356,6 +357,7 @@ static int armada_xp_mpic_secondary_init
 {
 	if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
 		armada_xp_mpic_smp_cpu_init();
+
 	return NOTIFY_OK;
 }
 
@@ -364,6 +366,20 @@ static struct notifier_block armada_370_
 	.priority = 100,
 };
 
+static int mpic_cascaded_secondary_init(struct notifier_block *nfb,
+					unsigned long action, void *hcpu)
+{
+	if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
+		enable_percpu_irq(parent_irq, IRQ_TYPE_NONE);
+
+	return NOTIFY_OK;
+}
+
+static struct notifier_block mpic_cascaded_cpu_notifier = {
+	.notifier_call = mpic_cascaded_secondary_init,
+	.priority = 100,
+};
+
 #endif /* CONFIG_SMP */
 
 static struct irq_domain_ops armada_370_xp_mpic_irq_ops = {
@@ -539,7 +555,7 @@ static int __init armada_370_xp_mpic_of_
 					     struct device_node *parent)
 {
 	struct resource main_int_res, per_cpu_int_res;
-	int parent_irq, nr_irqs, i;
+	int nr_irqs, i;
 	u32 control;
 
 	BUG_ON(of_address_to_resource(node, 0, &main_int_res));
@@ -587,6 +603,9 @@ static int __init armada_370_xp_mpic_of_
 		register_cpu_notifier(&armada_370_xp_mpic_cpu_notifier);
 #endif
 	} else {
+#ifdef CONFIG_SMP
+		register_cpu_notifier(&mpic_cascaded_cpu_notifier);
+#endif
 		irq_set_chained_handler(parent_irq,
 					armada_370_xp_mpic_handle_cascade_irq);
 	}
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/mtd/nand/pxa3xx_nand.c linux-libre-3.19.3-gnu/drivers/mtd/nand/pxa3xx_nand.c
--- linux-libre-3.19.2-gnu/drivers/mtd/nand/pxa3xx_nand.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/mtd/nand/pxa3xx_nand.c	2015-03-26 09:00:21.000000000 -0400
@@ -480,6 +480,42 @@ static void disable_int(struct pxa3xx_na
 	nand_writel(info, NDCR, ndcr | int_mask);
 }
 
+static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len)
+{
+	if (info->ecc_bch) {
+		int timeout;
+
+		/*
+		 * According to the datasheet, when reading from NDDB
+		 * with BCH enabled, after each 32 bytes reads, we
+		 * have to make sure that the NDSR.RDDREQ bit is set.
+		 *
+		 * Drain the FIFO 8 32 bits reads at a time, and skip
+		 * the polling on the last read.
+		 */
+		while (len > 8) {
+			__raw_readsl(info->mmio_base + NDDB, data, 8);
+
+			for (timeout = 0;
+			     !(nand_readl(info, NDSR) & NDSR_RDDREQ);
+			     timeout++) {
+				if (timeout >= 5) {
+					dev_err(&info->pdev->dev,
+						"Timeout on RDDREQ while draining the FIFO\n");
+					return;
+				}
+
+				mdelay(1);
+			}
+
+			data += 32;
+			len -= 8;
+		}
+	}
+
+	__raw_readsl(info->mmio_base + NDDB, data, len);
+}
+
 static void handle_data_pio(struct pxa3xx_nand_info *info)
 {
 	unsigned int do_bytes = min(info->data_size, info->chunk_size);
@@ -496,14 +532,14 @@ static void handle_data_pio(struct pxa3x
 				      DIV_ROUND_UP(info->oob_size, 4));
 		break;
 	case STATE_PIO_READING:
-		__raw_readsl(info->mmio_base + NDDB,
-			     info->data_buff + info->data_buff_pos,
-			     DIV_ROUND_UP(do_bytes, 4));
+		drain_fifo(info,
+			   info->data_buff + info->data_buff_pos,
+			   DIV_ROUND_UP(do_bytes, 4));
 
 		if (info->oob_size > 0)
-			__raw_readsl(info->mmio_base + NDDB,
-				     info->oob_buff + info->oob_buff_pos,
-				     DIV_ROUND_UP(info->oob_size, 4));
+			drain_fifo(info,
+				   info->oob_buff + info->oob_buff_pos,
+				   DIV_ROUND_UP(info->oob_size, 4));
 		break;
 	default:
 		dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__,
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/net/can/dev.c linux-libre-3.19.3-gnu/drivers/net/can/dev.c
--- linux-libre-3.19.2-gnu/drivers/net/can/dev.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/net/can/dev.c	2015-03-26 09:00:21.000000000 -0400
@@ -578,6 +578,10 @@ struct sk_buff *alloc_can_skb(struct net
 	skb->pkt_type = PACKET_BROADCAST;
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 
+	skb_reset_mac_header(skb);
+	skb_reset_network_header(skb);
+	skb_reset_transport_header(skb);
+
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
 
@@ -602,6 +606,10 @@ struct sk_buff *alloc_canfd_skb(struct n
 	skb->pkt_type = PACKET_BROADCAST;
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 
+	skb_reset_mac_header(skb);
+	skb_reset_network_header(skb);
+	skb_reset_transport_header(skb);
+
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/net/can/usb/kvaser_usb.c linux-libre-3.19.3-gnu/drivers/net/can/usb/kvaser_usb.c
--- linux-libre-3.19.2-gnu/drivers/net/can/usb/kvaser_usb.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/net/can/usb/kvaser_usb.c	2015-03-26 09:00:21.000000000 -0400
@@ -12,6 +12,7 @@
  * Copyright (C) 2012 Olivier Sobrie <olivier@sobrie.be>
  */
 
+#include <linux/kernel.h>
 #include <linux/completion.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
@@ -403,8 +404,15 @@ static int kvaser_usb_wait_msg(const str
 		while (pos <= actual_len - MSG_HEADER_LEN) {
 			tmp = buf + pos;
 
-			if (!tmp->len)
-				break;
+			/* Handle messages crossing the USB endpoint max packet
+			 * size boundary. Check kvaser_usb_read_bulk_callback()
+			 * for further details.
+			 */
+			if (tmp->len == 0) {
+				pos = round_up(pos,
+					       dev->bulk_in->wMaxPacketSize);
+				continue;
+			}
 
 			if (pos + tmp->len > actual_len) {
 				dev_err(dev->udev->dev.parent,
@@ -980,8 +988,19 @@ static void kvaser_usb_read_bulk_callbac
 	while (pos <= urb->actual_length - MSG_HEADER_LEN) {
 		msg = urb->transfer_buffer + pos;
 
-		if (!msg->len)
-			break;
+		/* The Kvaser firmware can only read and write messages that
+		 * does not cross the USB's endpoint wMaxPacketSize boundary.
+		 * If a follow-up command crosses such boundary, firmware puts
+		 * a placeholder zero-length command in its place then aligns
+		 * the real command to the next max packet size.
+		 *
+		 * Handle such cases or we're going to miss a significant
+		 * number of events in case of a heavy rx load on the bus.
+		 */
+		if (msg->len == 0) {
+			pos = round_up(pos, dev->bulk_in->wMaxPacketSize);
+			continue;
+		}
 
 		if (pos + msg->len > urb->actual_length) {
 			dev_err(dev->udev->dev.parent, "Format error\n");
@@ -989,7 +1008,6 @@ static void kvaser_usb_read_bulk_callbac
 		}
 
 		kvaser_usb_handle_message(dev, msg);
-
 		pos += msg->len;
 	}
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c linux-libre-3.19.3-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
--- linux-libre-3.19.2-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c	2015-03-18 21:55:00.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c	2015-03-26 15:07:15.000000000 -0400
@@ -12716,6 +12716,9 @@ static int bnx2x_init_dev(struct bnx2x *
 	pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
 			       PCICFG_VENDOR_ID_OFFSET);
 
+	/* Set PCIe reset type to fundamental for EEH recovery */
+	pdev->needs_freset = 1;
+
 	/* AER (Advanced Error reporting) configuration */
 	rc = pci_enable_pcie_error_reporting(pdev);
 	if (!rc)
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/net/ethernet/freescale/fec_main.c linux-libre-3.19.3-gnu/drivers/net/ethernet/freescale/fec_main.c
--- linux-libre-3.19.2-gnu/drivers/net/ethernet/freescale/fec_main.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/net/ethernet/freescale/fec_main.c	2015-03-26 09:00:21.000000000 -0400
@@ -1448,8 +1448,7 @@ fec_enet_rx_queue(struct net_device *nde
 
 			vlan_packet_rcvd = true;
 
-			skb_copy_to_linear_data_offset(skb, VLAN_HLEN,
-						       data, (2 * ETH_ALEN));
+			memmove(skb->data + VLAN_HLEN, data, ETH_ALEN * 2);
 			skb_pull(skb, VLAN_HLEN);
 		}
 
@@ -1566,7 +1565,7 @@ fec_enet_interrupt(int irq, void *dev_id
 	writel(int_events, fep->hwp + FEC_IEVENT);
 	fec_enet_collect_events(fep, int_events);
 
-	if (fep->work_tx || fep->work_rx) {
+	if ((fep->work_tx || fep->work_rx) && fep->link) {
 		ret = IRQ_HANDLED;
 
 		if (napi_schedule_prep(&fep->napi)) {
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h linux-libre-3.19.3-gnu/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
--- linux-libre-3.19.2-gnu/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h	2015-03-26 09:00:21.000000000 -0400
@@ -451,7 +451,7 @@ struct mlx4_en_port_stats {
 	unsigned long rx_chksum_none;
 	unsigned long rx_chksum_complete;
 	unsigned long tx_chksum_offload;
-#define NUM_PORT_STATS		9
+#define NUM_PORT_STATS		10
 };
 
 struct mlx4_en_perf_stats {
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/net/usb/cx82310_eth.c linux-libre-3.19.3-gnu/drivers/net/usb/cx82310_eth.c
--- linux-libre-3.19.2-gnu/drivers/net/usb/cx82310_eth.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/net/usb/cx82310_eth.c	2015-03-26 09:00:21.000000000 -0400
@@ -300,9 +300,18 @@ static const struct driver_info	cx82310_
 	.tx_fixup	= cx82310_tx_fixup,
 };
 
+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
+	.match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+		       USB_DEVICE_ID_MATCH_DEV_INFO, \
+	.idVendor = (vend), \
+	.idProduct = (prod), \
+	.bDeviceClass = (cl), \
+	.bDeviceSubClass = (sc), \
+	.bDeviceProtocol = (pr)
+
 static const struct usb_device_id products[] = {
 	{
-		USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0),
+		USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
 		.driver_info = (unsigned long) &cx82310_info
 	},
 	{ },
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/net/virtio_net.c linux-libre-3.19.3-gnu/drivers/net/virtio_net.c
--- linux-libre-3.19.2-gnu/drivers/net/virtio_net.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/net/virtio_net.c	2015-03-26 09:00:21.000000000 -0400
@@ -1444,8 +1444,10 @@ static void virtnet_free_queues(struct v
 {
 	int i;
 
-	for (i = 0; i < vi->max_queue_pairs; i++)
+	for (i = 0; i < vi->max_queue_pairs; i++) {
+		napi_hash_del(&vi->rq[i].napi);
 		netif_napi_del(&vi->rq[i].napi);
+	}
 
 	kfree(vi->rq);
 	kfree(vi->sq);
@@ -1936,11 +1938,8 @@ static int virtnet_freeze(struct virtio_
 	cancel_delayed_work_sync(&vi->refill);
 
 	if (netif_running(vi->dev)) {
-		for (i = 0; i < vi->max_queue_pairs; i++) {
+		for (i = 0; i < vi->max_queue_pairs; i++)
 			napi_disable(&vi->rq[i].napi);
-			napi_hash_del(&vi->rq[i].napi);
-			netif_napi_del(&vi->rq[i].napi);
-		}
 	}
 
 	remove_vq_common(vi);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/net/wireless/b43/main.c linux-libre-3.19.3-gnu/drivers/net/wireless/b43/main.c
--- linux-libre-3.19.2-gnu/drivers/net/wireless/b43/main.c	2015-03-18 21:57:00.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/net/wireless/b43/main.c	2015-03-26 15:09:46.000000000 -0400
@@ -5318,6 +5318,7 @@ static void b43_supported_bands(struct b
 	case 0x432a: /* BCM4321 */
 	case 0x432d: /* BCM4322 */
 	case 0x4352: /* BCM43222 */
+	case 0x435a: /* BCM43228 */
 	case 0x4333: /* BCM4331 */
 	case 0x43a2: /* BCM4360 */
 	case 0x43b3: /* BCM4352 */
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/of/base.c linux-libre-3.19.3-gnu/drivers/of/base.c
--- linux-libre-3.19.2-gnu/drivers/of/base.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/of/base.c	2015-03-26 09:00:21.000000000 -0400
@@ -714,16 +714,12 @@ static struct device_node *__of_find_nod
 						const char *path)
 {
 	struct device_node *child;
-	int len = strchrnul(path, '/') - path;
-	int term;
+	int len;
 
+	len = strcspn(path, "/:");
 	if (!len)
 		return NULL;
 
-	term = strchrnul(path, ':') - path;
-	if (term < len)
-		len = term;
-
 	__for_each_child_of_node(parent, child) {
 		const char *name = strrchr(child->full_name, '/');
 		if (WARN(!name, "malformed device_node %s\n", child->full_name))
@@ -768,8 +764,12 @@ struct device_node *of_find_node_opts_by
 
 	/* The path could begin with an alias */
 	if (*path != '/') {
-		char *p = strchrnul(path, '/');
-		int len = separator ? separator - path : p - path;
+		int len;
+		const char *p = separator;
+
+		if (!p)
+			p = strchrnul(path, '/');
+		len = p - path;
 
 		/* of_aliases must not be NULL */
 		if (!of_aliases)
@@ -794,6 +794,8 @@ struct device_node *of_find_node_opts_by
 		path++; /* Increment past '/' delimiter */
 		np = __of_find_node_by_path(np, path);
 		path = strchrnul(path, '/');
+		if (separator && separator < path)
+			break;
 	}
 	raw_spin_unlock_irqrestore(&devtree_lock, flags);
 	return np;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/pci/pci-sysfs.c linux-libre-3.19.3-gnu/drivers/pci/pci-sysfs.c
--- linux-libre-3.19.2-gnu/drivers/pci/pci-sysfs.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/pci/pci-sysfs.c	2015-03-26 09:00:21.000000000 -0400
@@ -521,7 +521,8 @@ static ssize_t driver_override_store(str
 	struct pci_dev *pdev = to_pci_dev(dev);
 	char *driver_override, *old = pdev->driver_override, *cp;
 
-	if (count > PATH_MAX)
+	/* We need to keep extra room for a newline */
+	if (count >= (PAGE_SIZE - 1))
 		return -EINVAL;
 
 	driver_override = kstrndup(buf, count, GFP_KERNEL);
@@ -549,7 +550,7 @@ static ssize_t driver_override_show(stru
 {
 	struct pci_dev *pdev = to_pci_dev(dev);
 
-	return sprintf(buf, "%s\n", pdev->driver_override);
+	return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
 }
 static DEVICE_ATTR_RW(driver_override);
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/regulator/core.c linux-libre-3.19.3-gnu/drivers/regulator/core.c
--- linux-libre-3.19.2-gnu/drivers/regulator/core.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/regulator/core.c	2015-03-26 09:00:21.000000000 -0400
@@ -1843,10 +1843,12 @@ static int _regulator_do_enable(struct r
 	}
 
 	if (rdev->ena_pin) {
-		ret = regulator_ena_gpio_ctrl(rdev, true);
-		if (ret < 0)
-			return ret;
-		rdev->ena_gpio_state = 1;
+		if (!rdev->ena_gpio_state) {
+			ret = regulator_ena_gpio_ctrl(rdev, true);
+			if (ret < 0)
+				return ret;
+			rdev->ena_gpio_state = 1;
+		}
 	} else if (rdev->desc->ops->enable) {
 		ret = rdev->desc->ops->enable(rdev);
 		if (ret < 0)
@@ -1943,10 +1945,12 @@ static int _regulator_do_disable(struct
 	trace_regulator_disable(rdev_get_name(rdev));
 
 	if (rdev->ena_pin) {
-		ret = regulator_ena_gpio_ctrl(rdev, false);
-		if (ret < 0)
-			return ret;
-		rdev->ena_gpio_state = 0;
+		if (rdev->ena_gpio_state) {
+			ret = regulator_ena_gpio_ctrl(rdev, false);
+			if (ret < 0)
+				return ret;
+			rdev->ena_gpio_state = 0;
+		}
 
 	} else if (rdev->desc->ops->disable) {
 		ret = rdev->desc->ops->disable(rdev);
@@ -3678,12 +3682,6 @@ regulator_register(const struct regulato
 				 config->ena_gpio, ret);
 			goto wash;
 		}
-
-		if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH)
-			rdev->ena_gpio_state = 1;
-
-		if (config->ena_gpio_invert)
-			rdev->ena_gpio_state = !rdev->ena_gpio_state;
 	}
 
 	/* set regulator constraints */
@@ -3856,9 +3854,11 @@ int regulator_suspend_finish(void)
 	list_for_each_entry(rdev, &regulator_list, list) {
 		mutex_lock(&rdev->mutex);
 		if (rdev->use_count > 0  || rdev->constraints->always_on) {
-			error = _regulator_do_enable(rdev);
-			if (error)
-				ret = error;
+			if (!_regulator_is_enabled(rdev)) {
+				error = _regulator_do_enable(rdev);
+				if (error)
+					ret = error;
+			}
 		} else {
 			if (!have_full_constraints())
 				goto unlock;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/regulator/rk808-regulator.c linux-libre-3.19.3-gnu/drivers/regulator/rk808-regulator.c
--- linux-libre-3.19.2-gnu/drivers/regulator/rk808-regulator.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/regulator/rk808-regulator.c	2015-03-26 09:00:21.000000000 -0400
@@ -235,6 +235,7 @@ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(0),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG2",
@@ -249,6 +250,7 @@ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(1),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG3",
@@ -263,6 +265,7 @@ static const struct regulator_desc rk808
 		.vsel_mask = RK808_BUCK4_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(2),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG4",
@@ -277,6 +280,7 @@ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(3),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG5",
@@ -291,6 +295,7 @@ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(4),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG6",
@@ -305,6 +310,7 @@ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(5),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG7",
@@ -319,6 +325,7 @@ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(6),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "LDO_REG8",
@@ -333,6 +340,7 @@ static const struct regulator_desc rk808
 		.vsel_mask = RK808_LDO_VSEL_MASK,
 		.enable_reg = RK808_LDO_EN_REG,
 		.enable_mask = BIT(7),
+		.enable_time = 400,
 		.owner = THIS_MODULE,
 	}, {
 		.name = "SWITCH_REG1",
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/rtc/rtc-s3c.c linux-libre-3.19.3-gnu/drivers/rtc/rtc-s3c.c
--- linux-libre-3.19.2-gnu/drivers/rtc/rtc-s3c.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/rtc/rtc-s3c.c	2015-03-26 09:00:21.000000000 -0400
@@ -849,6 +849,7 @@ static struct s3c_rtc_data const s3c2443
 
 static struct s3c_rtc_data const s3c6410_rtc_data = {
 	.max_user_freq		= 32768,
+	.needs_src_clk		= true,
 	.irq_handler		= s3c6410_rtc_irq,
 	.set_freq		= s3c6410_rtc_setfreq,
 	.enable_tick		= s3c6410_rtc_enable_tick,
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/scsi/libsas/sas_discover.c linux-libre-3.19.3-gnu/drivers/scsi/libsas/sas_discover.c
--- linux-libre-3.19.2-gnu/drivers/scsi/libsas/sas_discover.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/scsi/libsas/sas_discover.c	2015-03-26 09:00:21.000000000 -0400
@@ -500,6 +500,7 @@ static void sas_revalidate_domain(struct
 	struct sas_discovery_event *ev = to_sas_discovery_event(work);
 	struct asd_sas_port *port = ev->port;
 	struct sas_ha_struct *ha = port->ha;
+	struct domain_device *ddev = port->port_dev;
 
 	/* prevent revalidation from finding sata links in recovery */
 	mutex_lock(&ha->disco_mutex);
@@ -514,8 +515,9 @@ static void sas_revalidate_domain(struct
 	SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
 		    task_pid_nr(current));
 
-	if (port->port_dev)
-		res = sas_ex_revalidate_domain(port->port_dev);
+	if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
+		     ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
+		res = sas_ex_revalidate_domain(ddev);
 
 	SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
 		    port->id, task_pid_nr(current), res);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/spi/spi-atmel.c linux-libre-3.19.3-gnu/drivers/spi/spi-atmel.c
--- linux-libre-3.19.2-gnu/drivers/spi/spi-atmel.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/spi/spi-atmel.c	2015-03-26 09:00:21.000000000 -0400
@@ -764,17 +764,17 @@ static void atmel_spi_pdc_next_xfer(stru
 			(unsigned long long)xfer->rx_dma);
 	}
 
-	/* REVISIT: We're waiting for ENDRX before we start the next
+	/* REVISIT: We're waiting for RXBUFF before we start the next
 	 * transfer because we need to handle some difficult timing
-	 * issues otherwise. If we wait for ENDTX in one transfer and
-	 * then starts waiting for ENDRX in the next, it's difficult
-	 * to tell the difference between the ENDRX interrupt we're
-	 * actually waiting for and the ENDRX interrupt of the
+	 * issues otherwise. If we wait for TXBUFE in one transfer and
+	 * then starts waiting for RXBUFF in the next, it's difficult
+	 * to tell the difference between the RXBUFF interrupt we're
+	 * actually waiting for and the RXBUFF interrupt of the
 	 * previous transfer.
 	 *
 	 * It should be doable, though. Just not now...
 	 */
-	spi_writel(as, IER, SPI_BIT(ENDRX) | SPI_BIT(OVRES));
+	spi_writel(as, IER, SPI_BIT(RXBUFF) | SPI_BIT(OVRES));
 	spi_writel(as, PTCR, SPI_BIT(TXTEN) | SPI_BIT(RXTEN));
 }
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/spi/spi-dw-mid.c linux-libre-3.19.3-gnu/drivers/spi/spi-dw-mid.c
--- linux-libre-3.19.2-gnu/drivers/spi/spi-dw-mid.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/spi/spi-dw-mid.c	2015-03-26 09:00:21.000000000 -0400
@@ -139,6 +139,9 @@ static struct dma_async_tx_descriptor *d
 				1,
 				DMA_MEM_TO_DEV,
 				DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+	if (!txdesc)
+		return NULL;
+
 	txdesc->callback = dw_spi_dma_tx_done;
 	txdesc->callback_param = dws;
 
@@ -184,6 +187,9 @@ static struct dma_async_tx_descriptor *d
 				1,
 				DMA_DEV_TO_MEM,
 				DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+	if (!rxdesc)
+		return NULL;
+
 	rxdesc->callback = dw_spi_dma_rx_done;
 	rxdesc->callback_param = dws;
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/spi/spi-pl022.c linux-libre-3.19.3-gnu/drivers/spi/spi-pl022.c
--- linux-libre-3.19.2-gnu/drivers/spi/spi-pl022.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/spi/spi-pl022.c	2015-03-26 09:00:21.000000000 -0400
@@ -534,12 +534,12 @@ static void giveback(struct pl022 *pl022
 	pl022->cur_msg = NULL;
 	pl022->cur_transfer = NULL;
 	pl022->cur_chip = NULL;
-	spi_finalize_current_message(pl022->master);
 
 	/* disable the SPI/SSP operation */
 	writew((readw(SSP_CR1(pl022->virtbase)) &
 		(~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase));
 
+	spi_finalize_current_message(pl022->master);
 }
 
 /**
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/target/iscsi/iscsi_target.c linux-libre-3.19.3-gnu/drivers/target/iscsi/iscsi_target.c
--- linux-libre-3.19.2-gnu/drivers/target/iscsi/iscsi_target.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/target/iscsi/iscsi_target.c	2015-03-26 09:00:21.000000000 -0400
@@ -4221,11 +4221,17 @@ int iscsit_close_connection(
 	pr_debug("Closing iSCSI connection CID %hu on SID:"
 		" %u\n", conn->cid, sess->sid);
 	/*
-	 * Always up conn_logout_comp just in case the RX Thread is sleeping
-	 * and the logout response never got sent because the connection
-	 * failed.
+	 * Always up conn_logout_comp for the traditional TCP case just in case
+	 * the RX Thread in iscsi_target_rx_opcode() is sleeping and the logout
+	 * response never got sent because the connection failed.
+	 *
+	 * However for iser-target, isert_wait4logout() is using conn_logout_comp
+	 * to signal logout response TX interrupt completion.  Go ahead and skip
+	 * this for iser since isert_rx_opcode() does not wait on logout failure,
+	 * and to avoid iscsi_conn pointer dereference in iser-target code.
 	 */
-	complete(&conn->conn_logout_comp);
+	if (conn->conn_transport->transport_type == ISCSI_TCP)
+		complete(&conn->conn_logout_comp);
 
 	iscsi_release_thread_set(conn);
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/target/target_core_device.c linux-libre-3.19.3-gnu/drivers/target/target_core_device.c
--- linux-libre-3.19.2-gnu/drivers/target/target_core_device.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/target/target_core_device.c	2015-03-26 09:00:21.000000000 -0400
@@ -1534,8 +1534,6 @@ int target_configure_device(struct se_de
 	ret = dev->transport->configure_device(dev);
 	if (ret)
 		goto out;
-	dev->dev_flags |= DF_CONFIGURED;
-
 	/*
 	 * XXX: there is not much point to have two different values here..
 	 */
@@ -1597,6 +1595,8 @@ int target_configure_device(struct se_de
 	list_add_tail(&dev->g_dev_node, &g_device_list);
 	mutex_unlock(&g_device_mutex);
 
+	dev->dev_flags |= DF_CONFIGURED;
+
 	return 0;
 
 out_free_alua:
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/target/target_core_pscsi.c linux-libre-3.19.3-gnu/drivers/target/target_core_pscsi.c
--- linux-libre-3.19.2-gnu/drivers/target/target_core_pscsi.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/target/target_core_pscsi.c	2015-03-26 09:00:21.000000000 -0400
@@ -1121,7 +1121,7 @@ static u32 pscsi_get_device_type(struct
 	struct pscsi_dev_virt *pdv = PSCSI_DEV(dev);
 	struct scsi_device *sd = pdv->pdv_sd;
 
-	return sd->type;
+	return (sd) ? sd->type : TYPE_NO_LUN;
 }
 
 static sector_t pscsi_get_blocks(struct se_device *dev)
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/target/target_core_transport.c linux-libre-3.19.3-gnu/drivers/target/target_core_transport.c
--- linux-libre-3.19.2-gnu/drivers/target/target_core_transport.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/target/target_core_transport.c	2015-03-26 09:00:21.000000000 -0400
@@ -2389,6 +2389,10 @@ int target_get_sess_cmd(struct se_sessio
 	list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list);
 out:
 	spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+
+	if (ret && ack_kref)
+		target_put_sess_cmd(se_sess, se_cmd);
+
 	return ret;
 }
 EXPORT_SYMBOL(target_get_sess_cmd);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/tty/serial/8250/8250_dw.c linux-libre-3.19.3-gnu/drivers/tty/serial/8250/8250_dw.c
--- linux-libre-3.19.2-gnu/drivers/tty/serial/8250/8250_dw.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/tty/serial/8250/8250_dw.c	2015-03-26 09:00:21.000000000 -0400
@@ -111,7 +111,10 @@ static void dw8250_serial_out(struct uar
 			dw8250_force_idle(p);
 			writeb(value, p->membase + (UART_LCR << p->regshift));
 		}
-		dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+		/*
+		 * FIXME: this deadlocks if port->lock is already held
+		 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+		 */
 	}
 }
 
@@ -155,7 +158,10 @@ static void dw8250_serial_outq(struct ua
 			__raw_writeq(value & 0xff,
 				     p->membase + (UART_LCR << p->regshift));
 		}
-		dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+		/*
+		 * FIXME: this deadlocks if port->lock is already held
+		 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+		 */
 	}
 }
 #endif /* CONFIG_64BIT */
@@ -179,7 +185,10 @@ static void dw8250_serial_out32(struct u
 			dw8250_force_idle(p);
 			writel(value, p->membase + (UART_LCR << p->regshift));
 		}
-		dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+		/*
+		 * FIXME: this deadlocks if port->lock is already held
+		 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+		 */
 	}
 }
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/tty/serial/8250/8250_pci.c linux-libre-3.19.3-gnu/drivers/tty/serial/8250/8250_pci.c
--- linux-libre-3.19.2-gnu/drivers/tty/serial/8250/8250_pci.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/tty/serial/8250/8250_pci.c	2015-03-26 09:00:21.000000000 -0400
@@ -69,7 +69,7 @@ static void moan_device(const char *str,
 	       "Please send the output of lspci -vv, this\n"
 	       "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
 	       "manufacturer and name of serial board or\n"
-	       "modem board to rmk+serial@arm.linux.org.uk.\n",
+	       "modem board to <linux-serial@vger.kernel.org>.\n",
 	       pci_name(dev), str, dev->vendor, dev->device,
 	       dev->subsystem_vendor, dev->subsystem_device);
 }
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/usb/gadget/legacy/inode.c linux-libre-3.19.3-gnu/drivers/usb/gadget/legacy/inode.c
--- linux-libre-3.19.2-gnu/drivers/usb/gadget/legacy/inode.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/usb/gadget/legacy/inode.c	2015-03-26 09:00:21.000000000 -0400
@@ -566,7 +566,6 @@ static ssize_t ep_copy_to_user(struct ki
 		if (total == 0)
 			break;
 	}
-
 	return len;
 }
 
@@ -585,6 +584,7 @@ static void ep_user_copy_worker(struct w
 	aio_complete(iocb, ret, ret);
 
 	kfree(priv->buf);
+	kfree(priv->iv);
 	kfree(priv);
 }
 
@@ -605,6 +605,7 @@ static void ep_aio_complete(struct usb_e
 	 */
 	if (priv->iv == NULL || unlikely(req->actual == 0)) {
 		kfree(req->buf);
+		kfree(priv->iv);
 		kfree(priv);
 		iocb->private = NULL;
 		/* aio_complete() reports bytes-transferred _and_ faults */
@@ -640,7 +641,7 @@ ep_aio_rwtail(
 	struct usb_request	*req;
 	ssize_t			value;
 
-	priv = kmalloc(sizeof *priv, GFP_KERNEL);
+	priv = kzalloc(sizeof *priv, GFP_KERNEL);
 	if (!priv) {
 		value = -ENOMEM;
 fail:
@@ -649,7 +650,14 @@ fail:
 	}
 	iocb->private = priv;
 	priv->iocb = iocb;
-	priv->iv = iv;
+	if (iv) {
+		priv->iv = kmemdup(iv, nr_segs * sizeof(struct iovec),
+				   GFP_KERNEL);
+		if (!priv->iv) {
+			kfree(priv);
+			goto fail;
+		}
+	}
 	priv->nr_segs = nr_segs;
 	INIT_WORK(&priv->work, ep_user_copy_worker);
 
@@ -689,6 +697,7 @@ fail:
 	mutex_unlock(&epdata->lock);
 
 	if (unlikely(value)) {
+		kfree(priv->iv);
 		kfree(priv);
 		put_ep(epdata);
 	} else
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/xen/events/events_base.c linux-libre-3.19.3-gnu/drivers/xen/events/events_base.c
--- linux-libre-3.19.2-gnu/drivers/xen/events/events_base.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/xen/events/events_base.c	2015-03-26 09:00:21.000000000 -0400
@@ -526,20 +526,26 @@ static unsigned int __startup_pirq(unsig
 	pirq_query_unmask(irq);
 
 	rc = set_evtchn_to_irq(evtchn, irq);
-	if (rc != 0) {
-		pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
-		       irq, rc);
-		xen_evtchn_close(evtchn);
-		return 0;
-	}
+	if (rc)
+		goto err;
+
 	bind_evtchn_to_cpu(evtchn, 0);
 	info->evtchn = evtchn;
 
+	rc = xen_evtchn_port_setup(info);
+	if (rc)
+		goto err;
+
 out:
 	unmask_evtchn(evtchn);
 	eoi_pirq(irq_get_irq_data(irq));
 
 	return 0;
+
+err:
+	pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
+	xen_evtchn_close(evtchn);
+	return 0;
 }
 
 static unsigned int startup_pirq(struct irq_data *data)
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/xen/xen-pciback/conf_space.c linux-libre-3.19.3-gnu/drivers/xen/xen-pciback/conf_space.c
--- linux-libre-3.19.2-gnu/drivers/xen/xen-pciback/conf_space.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/xen/xen-pciback/conf_space.c	2015-03-26 09:00:21.000000000 -0400
@@ -16,7 +16,7 @@
 #include "conf_space.h"
 #include "conf_space_quirks.h"
 
-static bool permissive;
+bool permissive;
 module_param(permissive, bool, 0644);
 
 /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/xen/xen-pciback/conf_space.h linux-libre-3.19.3-gnu/drivers/xen/xen-pciback/conf_space.h
--- linux-libre-3.19.2-gnu/drivers/xen/xen-pciback/conf_space.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/xen/xen-pciback/conf_space.h	2015-03-26 09:00:21.000000000 -0400
@@ -64,6 +64,8 @@ struct config_field_entry {
 	void *data;
 };
 
+extern bool permissive;
+
 #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
 
 /* Add fields to a device - the add_fields macro expects to get a pointer to
diff -druNp --no-dereference linux-libre-3.19.2-gnu/drivers/xen/xen-pciback/conf_space_header.c linux-libre-3.19.3-gnu/drivers/xen/xen-pciback/conf_space_header.c
--- linux-libre-3.19.2-gnu/drivers/xen/xen-pciback/conf_space_header.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/drivers/xen/xen-pciback/conf_space_header.c	2015-03-26 09:00:21.000000000 -0400
@@ -11,6 +11,10 @@
 #include "pciback.h"
 #include "conf_space.h"
 
+struct pci_cmd_info {
+	u16 val;
+};
+
 struct pci_bar_info {
 	u32 val;
 	u32 len_val;
@@ -20,22 +24,36 @@ struct pci_bar_info {
 #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
 #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
 
-static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+/* Bits guests are allowed to control in permissive mode. */
+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
+			   PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
+			   PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
+
+static void *command_init(struct pci_dev *dev, int offset)
 {
-	int i;
-	int ret;
+	struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
+	int err;
 
-	ret = xen_pcibk_read_config_word(dev, offset, value, data);
-	if (!pci_is_enabled(dev))
-		return ret;
+	if (!cmd)
+		return ERR_PTR(-ENOMEM);
 
-	for (i = 0; i < PCI_ROM_RESOURCE; i++) {
-		if (dev->resource[i].flags & IORESOURCE_IO)
-			*value |= PCI_COMMAND_IO;
-		if (dev->resource[i].flags & IORESOURCE_MEM)
-			*value |= PCI_COMMAND_MEMORY;
+	err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
+	if (err) {
+		kfree(cmd);
+		return ERR_PTR(err);
 	}
 
+	return cmd;
+}
+
+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+{
+	int ret = pci_read_config_word(dev, offset, value);
+	const struct pci_cmd_info *cmd = data;
+
+	*value &= PCI_COMMAND_GUEST;
+	*value |= cmd->val & ~PCI_COMMAND_GUEST;
+
 	return ret;
 }
 
@@ -43,6 +61,8 @@ static int command_write(struct pci_dev
 {
 	struct xen_pcibk_dev_data *dev_data;
 	int err;
+	u16 val;
+	struct pci_cmd_info *cmd = data;
 
 	dev_data = pci_get_drvdata(dev);
 	if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
@@ -83,6 +103,19 @@ static int command_write(struct pci_dev
 		}
 	}
 
+	cmd->val = value;
+
+	if (!permissive && (!dev_data || !dev_data->permissive))
+		return 0;
+
+	/* Only allow the guest to control certain bits. */
+	err = pci_read_config_word(dev, offset, &val);
+	if (err || val == value)
+		return err;
+
+	value &= PCI_COMMAND_GUEST;
+	value |= val & ~PCI_COMMAND_GUEST;
+
 	return pci_write_config_word(dev, offset, value);
 }
 
@@ -282,6 +315,8 @@ static const struct config_field header_
 	{
 	 .offset    = PCI_COMMAND,
 	 .size      = 2,
+	 .init      = command_init,
+	 .release   = bar_release,
 	 .u.w.read  = command_read,
 	 .u.w.write = command_write,
 	},
diff -druNp --no-dereference linux-libre-3.19.2-gnu/fs/fuse/dev.c linux-libre-3.19.3-gnu/fs/fuse/dev.c
--- linux-libre-3.19.2-gnu/fs/fuse/dev.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/fs/fuse/dev.c	2015-03-26 09:00:21.000000000 -0400
@@ -890,8 +890,8 @@ static int fuse_try_move_page(struct fus
 
 	newpage = buf->page;
 
-	if (WARN_ON(!PageUptodate(newpage)))
-		return -EIO;
+	if (!PageUptodate(newpage))
+		SetPageUptodate(newpage);
 
 	ClearPageMappedToDisk(newpage);
 
@@ -1797,6 +1797,9 @@ copy_finish:
 static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
 		       unsigned int size, struct fuse_copy_state *cs)
 {
+	/* Don't try to move pages (yet) */
+	cs->move_pages = 0;
+
 	switch (code) {
 	case FUSE_NOTIFY_POLL:
 		return fuse_notify_poll(fc, size, cs);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/fs/nilfs2/segment.c linux-libre-3.19.3-gnu/fs/nilfs2/segment.c
--- linux-libre-3.19.2-gnu/fs/nilfs2/segment.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/fs/nilfs2/segment.c	2015-03-26 09:00:21.000000000 -0400
@@ -1907,6 +1907,7 @@ static void nilfs_segctor_drop_written_f
 					     struct the_nilfs *nilfs)
 {
 	struct nilfs_inode_info *ii, *n;
+	int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE);
 	int defer_iput = false;
 
 	spin_lock(&nilfs->ns_inode_lock);
@@ -1919,10 +1920,10 @@ static void nilfs_segctor_drop_written_f
 		brelse(ii->i_bh);
 		ii->i_bh = NULL;
 		list_del_init(&ii->i_dirty);
-		if (!ii->vfs_inode.i_nlink) {
+		if (!ii->vfs_inode.i_nlink || during_mount) {
 			/*
-			 * Defer calling iput() to avoid a deadlock
-			 * over I_SYNC flag for inodes with i_nlink == 0
+			 * Defer calling iput() to avoid deadlocks if
+			 * i_nlink == 0 or mount is not yet finished.
 			 */
 			list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
 			defer_iput = true;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/fs/proc/task_mmu.c linux-libre-3.19.3-gnu/fs/proc/task_mmu.c
--- linux-libre-3.19.2-gnu/fs/proc/task_mmu.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/fs/proc/task_mmu.c	2015-03-26 09:00:21.000000000 -0400
@@ -1326,6 +1326,9 @@ out:
 
 static int pagemap_open(struct inode *inode, struct file *file)
 {
+	/* do not disclose physical addresses: attack vector */
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
 	pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about "
 			"to stop being page-shift some time soon. See the "
 			"linux/Documentation/vm/pagemap.txt for details.\n");
diff -druNp --no-dereference linux-libre-3.19.2-gnu/include/linux/serial_core.h linux-libre-3.19.3-gnu/include/linux/serial_core.h
--- linux-libre-3.19.2-gnu/include/linux/serial_core.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/include/linux/serial_core.h	2015-03-26 09:00:21.000000000 -0400
@@ -146,9 +146,9 @@ struct uart_port {
 #define UPIO_HUB6		(1)			/* Hub6 ISA card */
 #define UPIO_MEM		(2)			/* 8b MMIO access */
 #define UPIO_MEM32		(3)			/* 32b little endian */
-#define UPIO_MEM32BE		(4)			/* 32b big endian */
-#define UPIO_AU			(5)			/* Au1x00 and RT288x type IO */
-#define UPIO_TSI		(6)			/* Tsi108/109 type IO */
+#define UPIO_AU			(4)			/* Au1x00 and RT288x type IO */
+#define UPIO_TSI		(5)			/* Tsi108/109 type IO */
+#define UPIO_MEM32BE		(6)			/* 32b big endian */
 
 	unsigned int		read_status_mask;	/* driver specific */
 	unsigned int		ignore_status_mask;	/* driver specific */
diff -druNp --no-dereference linux-libre-3.19.2-gnu/include/linux/workqueue.h linux-libre-3.19.3-gnu/include/linux/workqueue.h
--- linux-libre-3.19.2-gnu/include/linux/workqueue.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/include/linux/workqueue.h	2015-03-26 09:00:21.000000000 -0400
@@ -70,7 +70,8 @@ enum {
 	/* data contains off-queue information when !WORK_STRUCT_PWQ */
 	WORK_OFFQ_FLAG_BASE	= WORK_STRUCT_COLOR_SHIFT,
 
-	WORK_OFFQ_CANCELING	= (1 << WORK_OFFQ_FLAG_BASE),
+	__WORK_OFFQ_CANCELING	= WORK_OFFQ_FLAG_BASE,
+	WORK_OFFQ_CANCELING	= (1 << __WORK_OFFQ_CANCELING),
 
 	/*
 	 * When a work item is off queue, its high bits point to the last
diff -druNp --no-dereference linux-libre-3.19.2-gnu/kernel/cpuset.c linux-libre-3.19.3-gnu/kernel/cpuset.c
--- linux-libre-3.19.2-gnu/kernel/cpuset.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/kernel/cpuset.c	2015-03-26 09:00:21.000000000 -0400
@@ -548,9 +548,6 @@ static void update_domain_attr_tree(stru
 
 	rcu_read_lock();
 	cpuset_for_each_descendant_pre(cp, pos_css, root_cs) {
-		if (cp == root_cs)
-			continue;
-
 		/* skip the whole subtree if @cp doesn't have any CPU */
 		if (cpumask_empty(cp->cpus_allowed)) {
 			pos_css = css_rightmost_descendant(pos_css);
@@ -873,7 +870,7 @@ static void update_cpumasks_hier(struct
 		 * If it becomes empty, inherit the effective mask of the
 		 * parent, which is guaranteed to have some CPUs.
 		 */
-		if (cpumask_empty(new_cpus))
+		if (cgroup_on_dfl(cp->css.cgroup) && cpumask_empty(new_cpus))
 			cpumask_copy(new_cpus, parent->effective_cpus);
 
 		/* Skip the whole subtree if the cpumask remains the same. */
@@ -1129,7 +1126,7 @@ static void update_nodemasks_hier(struct
 		 * If it becomes empty, inherit the effective mask of the
 		 * parent, which is guaranteed to have some MEMs.
 		 */
-		if (nodes_empty(*new_mems))
+		if (cgroup_on_dfl(cp->css.cgroup) && nodes_empty(*new_mems))
 			*new_mems = parent->effective_mems;
 
 		/* Skip the whole subtree if the nodemask remains the same. */
@@ -1992,7 +1989,9 @@ static int cpuset_css_online(struct cgro
 
 	spin_lock_irq(&callback_lock);
 	cs->mems_allowed = parent->mems_allowed;
+	cs->effective_mems = parent->mems_allowed;
 	cpumask_copy(cs->cpus_allowed, parent->cpus_allowed);
+	cpumask_copy(cs->effective_cpus, parent->cpus_allowed);
 	spin_unlock_irq(&callback_lock);
 out_unlock:
 	mutex_unlock(&cpuset_mutex);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/kernel/printk/console_cmdline.h linux-libre-3.19.3-gnu/kernel/printk/console_cmdline.h
--- linux-libre-3.19.2-gnu/kernel/printk/console_cmdline.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/kernel/printk/console_cmdline.h	2015-03-26 09:00:21.000000000 -0400
@@ -3,7 +3,7 @@
 
 struct console_cmdline
 {
-	char	name[8];			/* Name of the driver	    */
+	char	name[16];			/* Name of the driver	    */
 	int	index;				/* Minor dev. to use	    */
 	char	*options;			/* Options for the driver   */
 #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
diff -druNp --no-dereference linux-libre-3.19.2-gnu/kernel/printk/printk.c linux-libre-3.19.3-gnu/kernel/printk/printk.c
--- linux-libre-3.19.2-gnu/kernel/printk/printk.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/kernel/printk/printk.c	2015-03-26 09:00:21.000000000 -0400
@@ -2464,6 +2464,7 @@ void register_console(struct console *ne
 	for (i = 0, c = console_cmdline;
 	     i < MAX_CMDLINECONSOLES && c->name[0];
 	     i++, c++) {
+		BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name));
 		if (strcmp(c->name, newcon->name) != 0)
 			continue;
 		if (newcon->index >= 0 &&
diff -druNp --no-dereference linux-libre-3.19.2-gnu/kernel/trace/ftrace.c linux-libre-3.19.3-gnu/kernel/trace/ftrace.c
--- linux-libre-3.19.2-gnu/kernel/trace/ftrace.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/kernel/trace/ftrace.c	2015-03-26 09:00:21.000000000 -0400
@@ -1059,6 +1059,12 @@ static __init void ftrace_profile_debugf
 
 static struct pid * const ftrace_swapper_pid = &init_struct_pid;
 
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+static int ftrace_graph_active;
+#else
+# define ftrace_graph_active 0
+#endif
+
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 static struct ftrace_ops *removed_ops;
@@ -2041,8 +2047,12 @@ static int ftrace_check_record(struct dy
 		if (!ftrace_rec_count(rec))
 			rec->flags = 0;
 		else
-			/* Just disable the record (keep REGS state) */
-			rec->flags &= ~FTRACE_FL_ENABLED;
+			/*
+			 * Just disable the record, but keep the ops TRAMP
+			 * and REGS states. The _EN flags must be disabled though.
+			 */
+			rec->flags &= ~(FTRACE_FL_ENABLED | FTRACE_FL_TRAMP_EN |
+					FTRACE_FL_REGS_EN);
 	}
 
 	return FTRACE_UPDATE_MAKE_NOP;
@@ -2688,24 +2698,36 @@ static int ftrace_shutdown(struct ftrace
 
 static void ftrace_startup_sysctl(void)
 {
+	int command;
+
 	if (unlikely(ftrace_disabled))
 		return;
 
 	/* Force update next time */
 	saved_ftrace_func = NULL;
 	/* ftrace_start_up is true if we want ftrace running */
-	if (ftrace_start_up)
-		ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+	if (ftrace_start_up) {
+		command = FTRACE_UPDATE_CALLS;
+		if (ftrace_graph_active)
+			command |= FTRACE_START_FUNC_RET;
+		ftrace_startup_enable(command);
+	}
 }
 
 static void ftrace_shutdown_sysctl(void)
 {
+	int command;
+
 	if (unlikely(ftrace_disabled))
 		return;
 
 	/* ftrace_start_up is true if ftrace is running */
-	if (ftrace_start_up)
-		ftrace_run_update_code(FTRACE_DISABLE_CALLS);
+	if (ftrace_start_up) {
+		command = FTRACE_DISABLE_CALLS;
+		if (ftrace_graph_active)
+			command |= FTRACE_STOP_FUNC_RET;
+		ftrace_run_update_code(command);
+	}
 }
 
 static cycle_t		ftrace_update_time;
@@ -5558,12 +5580,12 @@ ftrace_enable_sysctl(struct ctl_table *t
 
 	if (ftrace_enabled) {
 
-		ftrace_startup_sysctl();
-
 		/* we are starting ftrace again */
 		if (ftrace_ops_list != &ftrace_list_end)
 			update_ftrace_function();
 
+		ftrace_startup_sysctl();
+
 	} else {
 		/* stopping ftrace calls (just send to ftrace_stub) */
 		ftrace_trace_function = ftrace_stub;
@@ -5590,8 +5612,6 @@ static struct ftrace_ops graph_ops = {
 	ASSIGN_OPS_HASH(graph_ops, &global_ops.local_hash)
 };
 
-static int ftrace_graph_active;
-
 int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
 {
 	return 0;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/kernel/workqueue.c linux-libre-3.19.3-gnu/kernel/workqueue.c
--- linux-libre-3.19.2-gnu/kernel/workqueue.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/kernel/workqueue.c	2015-03-26 09:00:21.000000000 -0400
@@ -2728,19 +2728,57 @@ bool flush_work(struct work_struct *work
 }
 EXPORT_SYMBOL_GPL(flush_work);
 
+struct cwt_wait {
+	wait_queue_t		wait;
+	struct work_struct	*work;
+};
+
+static int cwt_wakefn(wait_queue_t *wait, unsigned mode, int sync, void *key)
+{
+	struct cwt_wait *cwait = container_of(wait, struct cwt_wait, wait);
+
+	if (cwait->work != key)
+		return 0;
+	return autoremove_wake_function(wait, mode, sync, key);
+}
+
 static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
 {
+	static DECLARE_WAIT_QUEUE_HEAD(cancel_waitq);
 	unsigned long flags;
 	int ret;
 
 	do {
 		ret = try_to_grab_pending(work, is_dwork, &flags);
 		/*
-		 * If someone else is canceling, wait for the same event it
-		 * would be waiting for before retrying.
+		 * If someone else is already canceling, wait for it to
+		 * finish.  flush_work() doesn't work for PREEMPT_NONE
+		 * because we may get scheduled between @work's completion
+		 * and the other canceling task resuming and clearing
+		 * CANCELING - flush_work() will return false immediately
+		 * as @work is no longer busy, try_to_grab_pending() will
+		 * return -ENOENT as @work is still being canceled and the
+		 * other canceling task won't be able to clear CANCELING as
+		 * we're hogging the CPU.
+		 *
+		 * Let's wait for completion using a waitqueue.  As this
+		 * may lead to the thundering herd problem, use a custom
+		 * wake function which matches @work along with exclusive
+		 * wait and wakeup.
 		 */
-		if (unlikely(ret == -ENOENT))
-			flush_work(work);
+		if (unlikely(ret == -ENOENT)) {
+			struct cwt_wait cwait;
+
+			init_wait(&cwait.wait);
+			cwait.wait.func = cwt_wakefn;
+			cwait.work = work;
+
+			prepare_to_wait_exclusive(&cancel_waitq, &cwait.wait,
+						  TASK_UNINTERRUPTIBLE);
+			if (work_is_canceling(work))
+				schedule();
+			finish_wait(&cancel_waitq, &cwait.wait);
+		}
 	} while (unlikely(ret < 0));
 
 	/* tell other tasks trying to grab @work to back off */
@@ -2749,6 +2787,16 @@ static bool __cancel_work_timer(struct w
 
 	flush_work(work);
 	clear_work_data(work);
+
+	/*
+	 * Paired with prepare_to_wait() above so that either
+	 * waitqueue_active() is visible here or !work_is_canceling() is
+	 * visible there.
+	 */
+	smp_mb();
+	if (waitqueue_active(&cancel_waitq))
+		__wake_up(&cancel_waitq, TASK_NORMAL, 1, work);
+
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/lib/lz4/lz4_decompress.c linux-libre-3.19.3-gnu/lib/lz4/lz4_decompress.c
--- linux-libre-3.19.2-gnu/lib/lz4/lz4_decompress.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/lib/lz4/lz4_decompress.c	2015-03-26 09:00:21.000000000 -0400
@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *so
 			/* Error: request to write beyond destination buffer */
 			if (cpy > oend)
 				goto _output_error;
+			if ((ref + COPYLENGTH) > oend ||
+					(op + COPYLENGTH) > oend)
+				goto _output_error;
 			LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
 			while (op < cpy)
 				*op++ = *ref++;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/lib/seq_buf.c linux-libre-3.19.3-gnu/lib/seq_buf.c
--- linux-libre-3.19.2-gnu/lib/seq_buf.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/lib/seq_buf.c	2015-03-26 09:00:21.000000000 -0400
@@ -61,7 +61,7 @@ int seq_buf_vprintf(struct seq_buf *s, c
 
 	if (s->len < s->size) {
 		len = vsnprintf(s->buffer + s->len, s->size - s->len, fmt, args);
-		if (seq_buf_can_fit(s, len)) {
+		if (s->len + len < s->size) {
 			s->len += len;
 			return 0;
 		}
@@ -154,7 +154,7 @@ int seq_buf_bprintf(struct seq_buf *s, c
 
 	if (s->len < s->size) {
 		ret = bstr_printf(s->buffer + s->len, len, fmt, binary);
-		if (seq_buf_can_fit(s, ret)) {
+		if (s->len + ret < s->size) {
 			s->len += ret;
 			return 0;
 		}
diff -druNp --no-dereference linux-libre-3.19.2-gnu/Makefile linux-libre-3.19.3-gnu/Makefile
--- linux-libre-3.19.2-gnu/Makefile	2015-03-18 21:46:39.000000000 -0400
+++ linux-libre-3.19.3-gnu/Makefile	2015-03-26 14:56:28.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 19
-SUBLEVEL = 2
+SUBLEVEL = 3
 EXTRAVERSION = -gnu
 NAME = Diseased Newt
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/mm/cma.c linux-libre-3.19.3-gnu/mm/cma.c
--- linux-libre-3.19.2-gnu/mm/cma.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/mm/cma.c	2015-03-26 09:00:21.000000000 -0400
@@ -64,15 +64,17 @@ static unsigned long cma_bitmap_aligned_
 	return (1UL << (align_order - cma->order_per_bit)) - 1;
 }
 
+/*
+ * Find a PFN aligned to the specified order and return an offset represented in
+ * order_per_bits.
+ */
 static unsigned long cma_bitmap_aligned_offset(struct cma *cma, int align_order)
 {
-	unsigned int alignment;
-
 	if (align_order <= cma->order_per_bit)
 		return 0;
-	alignment = 1UL << (align_order - cma->order_per_bit);
-	return ALIGN(cma->base_pfn, alignment) -
-		(cma->base_pfn >> cma->order_per_bit);
+
+	return (ALIGN(cma->base_pfn, (1UL << align_order))
+		- cma->base_pfn) >> cma->order_per_bit;
 }
 
 static unsigned long cma_bitmap_maxno(struct cma *cma)
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/caif/caif_socket.c linux-libre-3.19.3-gnu/net/caif/caif_socket.c
--- linux-libre-3.19.2-gnu/net/caif/caif_socket.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/caif/caif_socket.c	2015-03-26 09:00:21.000000000 -0400
@@ -281,7 +281,7 @@ static int caif_seqpkt_recvmsg(struct ki
 	int copylen;
 
 	ret = -EOPNOTSUPP;
-	if (m->msg_flags&MSG_OOB)
+	if (flags & MSG_OOB)
 		goto read_error;
 
 	skb = skb_recv_datagram(sk, flags, 0 , &ret);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/can/af_can.c linux-libre-3.19.3-gnu/net/can/af_can.c
--- linux-libre-3.19.2-gnu/net/can/af_can.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/can/af_can.c	2015-03-26 09:00:21.000000000 -0400
@@ -259,6 +259,9 @@ int can_send(struct sk_buff *skb, int lo
 		goto inval_skb;
 	}
 
+	skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+	skb_reset_mac_header(skb);
 	skb_reset_network_header(skb);
 	skb_reset_transport_header(skb);
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/compat.c linux-libre-3.19.3-gnu/net/compat.c
--- linux-libre-3.19.2-gnu/net/compat.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/compat.c	2015-03-26 09:00:21.000000000 -0400
@@ -49,6 +49,13 @@ ssize_t get_compat_msghdr(struct msghdr
 	    __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
 	    __get_user(kmsg->msg_flags, &umsg->msg_flags))
 		return -EFAULT;
+
+	if (!uaddr)
+		kmsg->msg_namelen = 0;
+
+	if (kmsg->msg_namelen < 0)
+		return -EINVAL;
+
 	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
 		kmsg->msg_namelen = sizeof(struct sockaddr_storage);
 	kmsg->msg_control = compat_ptr(tmp3);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/core/sysctl_net_core.c linux-libre-3.19.3-gnu/net/core/sysctl_net_core.c
--- linux-libre-3.19.2-gnu/net/core/sysctl_net_core.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/core/sysctl_net_core.c	2015-03-26 09:00:21.000000000 -0400
@@ -25,6 +25,8 @@
 static int zero = 0;
 static int one = 1;
 static int ushort_max = USHRT_MAX;
+static int min_sndbuf = SOCK_MIN_SNDBUF;
+static int min_rcvbuf = SOCK_MIN_RCVBUF;
 
 static int net_msg_warn;	/* Unused, but still a sysctl */
 
@@ -237,7 +239,7 @@ static struct ctl_table net_core_table[]
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_minmax,
-		.extra1		= &one,
+		.extra1		= &min_sndbuf,
 	},
 	{
 		.procname	= "rmem_max",
@@ -245,7 +247,7 @@ static struct ctl_table net_core_table[]
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_minmax,
-		.extra1		= &one,
+		.extra1		= &min_rcvbuf,
 	},
 	{
 		.procname	= "wmem_default",
@@ -253,7 +255,7 @@ static struct ctl_table net_core_table[]
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_minmax,
-		.extra1		= &one,
+		.extra1		= &min_sndbuf,
 	},
 	{
 		.procname	= "rmem_default",
@@ -261,7 +263,7 @@ static struct ctl_table net_core_table[]
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_minmax,
-		.extra1		= &one,
+		.extra1		= &min_rcvbuf,
 	},
 	{
 		.procname	= "dev_weight",
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/ipv4/inet_diag.c linux-libre-3.19.3-gnu/net/ipv4/inet_diag.c
--- linux-libre-3.19.2-gnu/net/ipv4/inet_diag.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/ipv4/inet_diag.c	2015-03-26 09:00:21.000000000 -0400
@@ -71,6 +71,20 @@ static inline void inet_diag_unlock_hand
 	mutex_unlock(&inet_diag_table_mutex);
 }
 
+static size_t inet_sk_attr_size(void)
+{
+	return	  nla_total_size(sizeof(struct tcp_info))
+		+ nla_total_size(1) /* INET_DIAG_SHUTDOWN */
+		+ nla_total_size(1) /* INET_DIAG_TOS */
+		+ nla_total_size(1) /* INET_DIAG_TCLASS */
+		+ nla_total_size(sizeof(struct inet_diag_meminfo))
+		+ nla_total_size(sizeof(struct inet_diag_msg))
+		+ nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
+		+ nla_total_size(TCP_CA_NAME_MAX)
+		+ nla_total_size(sizeof(struct tcpvegas_info))
+		+ 64;
+}
+
 int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
 			      struct sk_buff *skb, struct inet_diag_req_v2 *req,
 			      struct user_namespace *user_ns,		      	
@@ -324,9 +338,7 @@ int inet_diag_dump_one_icsk(struct inet_
 	if (err)
 		goto out;
 
-	rep = nlmsg_new(sizeof(struct inet_diag_msg) +
-			sizeof(struct inet_diag_meminfo) +
-			sizeof(struct tcp_info) + 64, GFP_KERNEL);
+	rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
 	if (!rep) {
 		err = -ENOMEM;
 		goto out;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/ipv4/tcp_cong.c linux-libre-3.19.3-gnu/net/ipv4/tcp_cong.c
--- linux-libre-3.19.2-gnu/net/ipv4/tcp_cong.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/ipv4/tcp_cong.c	2015-03-26 09:00:21.000000000 -0400
@@ -309,6 +309,12 @@ EXPORT_SYMBOL_GPL(tcp_slow_start);
  */
 void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked)
 {
+	/* If credits accumulated at a higher w, apply them gently now. */
+	if (tp->snd_cwnd_cnt >= w) {
+		tp->snd_cwnd_cnt = 0;
+		tp->snd_cwnd++;
+	}
+
 	tp->snd_cwnd_cnt += acked;
 	if (tp->snd_cwnd_cnt >= w) {
 		u32 delta = tp->snd_cwnd_cnt / w;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/ipv4/tcp_cubic.c linux-libre-3.19.3-gnu/net/ipv4/tcp_cubic.c
--- linux-libre-3.19.2-gnu/net/ipv4/tcp_cubic.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/ipv4/tcp_cubic.c	2015-03-26 09:00:21.000000000 -0400
@@ -306,8 +306,10 @@ tcp_friendliness:
 		}
 	}
 
-	if (ca->cnt == 0)			/* cannot be zero */
-		ca->cnt = 1;
+	/* The maximum rate of cwnd increase CUBIC allows is 1 packet per
+	 * 2 packets ACKed, meaning cwnd grows at 1.5x per RTT.
+	 */
+	ca->cnt = max(ca->cnt, 2U);
 }
 
 static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/ipv4/tcp_output.c linux-libre-3.19.3-gnu/net/ipv4/tcp_output.c
--- linux-libre-3.19.2-gnu/net/ipv4/tcp_output.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/ipv4/tcp_output.c	2015-03-26 09:00:21.000000000 -0400
@@ -2775,15 +2775,11 @@ void tcp_send_fin(struct sock *sk)
 	} else {
 		/* Socket is locked, keep trying until memory is available. */
 		for (;;) {
-			skb = alloc_skb_fclone(MAX_TCP_HEADER,
-					       sk->sk_allocation);
+			skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
 			if (skb)
 				break;
 			yield();
 		}
-
-		/* Reserve space for headers and prepare control bits. */
-		skb_reserve(skb, MAX_TCP_HEADER);
 		/* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
 		tcp_init_nondata_skb(skb, tp->write_seq,
 				     TCPHDR_ACK | TCPHDR_FIN);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/ipv6/fib6_rules.c linux-libre-3.19.3-gnu/net/ipv6/fib6_rules.c
--- linux-libre-3.19.2-gnu/net/ipv6/fib6_rules.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/ipv6/fib6_rules.c	2015-03-26 09:00:21.000000000 -0400
@@ -104,6 +104,7 @@ static int fib6_rule_action(struct fib_r
 				goto again;
 			flp6->saddr = saddr;
 		}
+		err = rt->dst.error;
 		goto out;
 	}
 again:
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/ipv6/udp_offload.c linux-libre-3.19.3-gnu/net/ipv6/udp_offload.c
--- linux-libre-3.19.2-gnu/net/ipv6/udp_offload.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/ipv6/udp_offload.c	2015-03-26 09:00:21.000000000 -0400
@@ -112,11 +112,9 @@ static struct sk_buff *udp6_ufo_fragment
 		fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
 		fptr->nexthdr = nexthdr;
 		fptr->reserved = 0;
-		if (skb_shinfo(skb)->ip6_frag_id)
-			fptr->identification = skb_shinfo(skb)->ip6_frag_id;
-		else
-			ipv6_select_ident(fptr,
-					  (struct rt6_info *)skb_dst(skb));
+		if (!skb_shinfo(skb)->ip6_frag_id)
+			ipv6_proxy_select_ident(skb);
+		fptr->identification = skb_shinfo(skb)->ip6_frag_id;
 
 		/* Fragment the skb. ipv6 header and the remaining fields of the
 		 * fragment header are updated in ipv6_gso_segment()
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/netfilter/ipvs/ip_vs_ctl.c linux-libre-3.19.3-gnu/net/netfilter/ipvs/ip_vs_ctl.c
--- linux-libre-3.19.2-gnu/net/netfilter/ipvs/ip_vs_ctl.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/netfilter/ipvs/ip_vs_ctl.c	2015-03-26 09:00:21.000000000 -0400
@@ -3399,7 +3399,7 @@ static int ip_vs_genl_set_cmd(struct sk_
 		if (udest.af == 0)
 			udest.af = svc->af;
 
-		if (udest.af != svc->af) {
+		if (udest.af != svc->af && cmd != IPVS_CMD_DEL_DEST) {
 			/* The synchronization protocol is incompatible
 			 * with mixed family services
 			 */
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/netfilter/ipvs/ip_vs_sync.c linux-libre-3.19.3-gnu/net/netfilter/ipvs/ip_vs_sync.c
--- linux-libre-3.19.2-gnu/net/netfilter/ipvs/ip_vs_sync.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/netfilter/ipvs/ip_vs_sync.c	2015-03-26 09:00:21.000000000 -0400
@@ -896,6 +896,8 @@ static void ip_vs_proc_conn(struct net *
 			IP_VS_DBG(2, "BACKUP, add new conn. failed\n");
 			return;
 		}
+		if (!(flags & IP_VS_CONN_F_TEMPLATE))
+			kfree(param->pe_data);
 	}
 
 	if (opt)
@@ -1169,6 +1171,7 @@ static inline int ip_vs_proc_sync_conn(s
 				(opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL)
 				);
 #endif
+	ip_vs_pe_put(param.pe);
 	return 0;
 	/* Error exit */
 out:
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/netfilter/nf_tables_api.c linux-libre-3.19.3-gnu/net/netfilter/nf_tables_api.c
--- linux-libre-3.19.2-gnu/net/netfilter/nf_tables_api.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/netfilter/nf_tables_api.c	2015-03-26 09:00:21.000000000 -0400
@@ -227,7 +227,7 @@ nft_rule_deactivate_next(struct net *net
 
 static inline void nft_rule_clear(struct net *net, struct nft_rule *rule)
 {
-	rule->genmask = 0;
+	rule->genmask &= ~(1 << gencursor_next(net));
 }
 
 static int
@@ -3606,12 +3606,11 @@ static int nf_tables_commit(struct sk_bu
 						 &te->elem,
 						 NFT_MSG_DELSETELEM, 0);
 			te->set->ops->get(te->set, &te->elem);
-			te->set->ops->remove(te->set, &te->elem);
 			nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
-			if (te->elem.flags & NFT_SET_MAP) {
-				nft_data_uninit(&te->elem.data,
-						te->set->dtype);
-			}
+			if (te->set->flags & NFT_SET_MAP &&
+			    !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
+				nft_data_uninit(&te->elem.data, te->set->dtype);
+			te->set->ops->remove(te->set, &te->elem);
 			nft_trans_destroy(trans);
 			break;
 		}
@@ -3652,7 +3651,7 @@ static int nf_tables_abort(struct sk_buf
 {
 	struct net *net = sock_net(skb->sk);
 	struct nft_trans *trans, *next;
-	struct nft_set *set;
+	struct nft_trans_elem *te;
 
 	list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
 		switch (trans->msg_type) {
@@ -3713,9 +3712,13 @@ static int nf_tables_abort(struct sk_buf
 			break;
 		case NFT_MSG_NEWSETELEM:
 			nft_trans_elem_set(trans)->nelems--;
-			set = nft_trans_elem_set(trans);
-			set->ops->get(set, &nft_trans_elem(trans));
-			set->ops->remove(set, &nft_trans_elem(trans));
+			te = (struct nft_trans_elem *)trans->data;
+			te->set->ops->get(te->set, &te->elem);
+			nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
+			if (te->set->flags & NFT_SET_MAP &&
+			    !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
+				nft_data_uninit(&te->elem.data, te->set->dtype);
+			te->set->ops->remove(te->set, &te->elem);
 			nft_trans_destroy(trans);
 			break;
 		case NFT_MSG_DELSETELEM:
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/netfilter/nft_compat.c linux-libre-3.19.3-gnu/net/netfilter/nft_compat.c
--- linux-libre-3.19.2-gnu/net/netfilter/nft_compat.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/netfilter/nft_compat.c	2015-03-26 09:00:21.000000000 -0400
@@ -578,8 +578,12 @@ nft_match_select_ops(const struct nft_ct
 		struct xt_match *match = nft_match->ops.data;
 
 		if (strcmp(match->name, mt_name) == 0 &&
-		    match->revision == rev && match->family == family)
+		    match->revision == rev && match->family == family) {
+			if (!try_module_get(match->me))
+				return ERR_PTR(-ENOENT);
+
 			return &nft_match->ops;
+		}
 	}
 
 	match = xt_request_find_match(family, mt_name, rev);
@@ -648,8 +652,12 @@ nft_target_select_ops(const struct nft_c
 		struct xt_target *target = nft_target->ops.data;
 
 		if (strcmp(target->name, tg_name) == 0 &&
-		    target->revision == rev && target->family == family)
+		    target->revision == rev && target->family == family) {
+			if (!try_module_get(target->me))
+				return ERR_PTR(-ENOENT);
+
 			return &nft_target->ops;
+		}
 	}
 
 	target = xt_request_find_target(family, tg_name, rev);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/netfilter/xt_socket.c linux-libre-3.19.3-gnu/net/netfilter/xt_socket.c
--- linux-libre-3.19.2-gnu/net/netfilter/xt_socket.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/netfilter/xt_socket.c	2015-03-26 09:00:21.000000000 -0400
@@ -243,12 +243,13 @@ static int
 extract_icmp6_fields(const struct sk_buff *skb,
 		     unsigned int outside_hdrlen,
 		     int *protocol,
-		     struct in6_addr **raddr,
-		     struct in6_addr **laddr,
+		     const struct in6_addr **raddr,
+		     const struct in6_addr **laddr,
 		     __be16 *rport,
-		     __be16 *lport)
+		     __be16 *lport,
+		     struct ipv6hdr *ipv6_var)
 {
-	struct ipv6hdr *inside_iph, _inside_iph;
+	const struct ipv6hdr *inside_iph;
 	struct icmp6hdr *icmph, _icmph;
 	__be16 *ports, _ports[2];
 	u8 inside_nexthdr;
@@ -263,12 +264,14 @@ extract_icmp6_fields(const struct sk_buf
 	if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK)
 		return 1;
 
-	inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph);
+	inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph),
+					sizeof(*ipv6_var), ipv6_var);
 	if (inside_iph == NULL)
 		return 1;
 	inside_nexthdr = inside_iph->nexthdr;
 
-	inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph),
+	inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) +
+					      sizeof(*ipv6_var),
 					 &inside_nexthdr, &inside_fragoff);
 	if (inside_hdrlen < 0)
 		return 1; /* hjm: Packet has no/incomplete transport layer headers. */
@@ -315,10 +318,10 @@ xt_socket_get_sock_v6(struct net *net, c
 static bool
 socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
 {
-	struct ipv6hdr *iph = ipv6_hdr(skb);
+	struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb);
 	struct udphdr _hdr, *hp = NULL;
 	struct sock *sk = skb->sk;
-	struct in6_addr *daddr = NULL, *saddr = NULL;
+	const struct in6_addr *daddr = NULL, *saddr = NULL;
 	__be16 uninitialized_var(dport), uninitialized_var(sport);
 	int thoff = 0, uninitialized_var(tproto);
 	const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
@@ -342,7 +345,7 @@ socket_mt6_v1_v2(const struct sk_buff *s
 
 	} else if (tproto == IPPROTO_ICMPV6) {
 		if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
-					 &sport, &dport))
+					 &sport, &dport, &ipv6_var))
 			return false;
 	} else {
 		return false;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/rds/iw_rdma.c linux-libre-3.19.3-gnu/net/rds/iw_rdma.c
--- linux-libre-3.19.2-gnu/net/rds/iw_rdma.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/rds/iw_rdma.c	2015-03-26 09:00:21.000000000 -0400
@@ -88,7 +88,9 @@ static unsigned int rds_iw_unmap_fastreg
 			int *unpinned);
 static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 
-static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
+static int rds_iw_get_device(struct sockaddr_in *src, struct sockaddr_in *dst,
+			     struct rds_iw_device **rds_iwdev,
+			     struct rdma_cm_id **cm_id)
 {
 	struct rds_iw_device *iwdev;
 	struct rds_iw_cm_id *i_cm_id;
@@ -112,15 +114,15 @@ static int rds_iw_get_device(struct rds_
 				src_addr->sin_port,
 				dst_addr->sin_addr.s_addr,
 				dst_addr->sin_port,
-				rs->rs_bound_addr,
-				rs->rs_bound_port,
-				rs->rs_conn_addr,
-				rs->rs_conn_port);
+				src->sin_addr.s_addr,
+				src->sin_port,
+				dst->sin_addr.s_addr,
+				dst->sin_port);
 #ifdef WORKING_TUPLE_DETECTION
-			if (src_addr->sin_addr.s_addr == rs->rs_bound_addr &&
-			    src_addr->sin_port == rs->rs_bound_port &&
-			    dst_addr->sin_addr.s_addr == rs->rs_conn_addr &&
-			    dst_addr->sin_port == rs->rs_conn_port) {
+			if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr &&
+			    src_addr->sin_port == src->sin_port &&
+			    dst_addr->sin_addr.s_addr == dst->sin_addr.s_addr &&
+			    dst_addr->sin_port == dst->sin_port) {
 #else
 			/* FIXME - needs to compare the local and remote
 			 * ipaddr/port tuple, but the ipaddr is the only
@@ -128,7 +130,7 @@ static int rds_iw_get_device(struct rds_
 			 * zero'ed.  It doesn't appear to be properly populated
 			 * during connection setup...
 			 */
-			if (src_addr->sin_addr.s_addr == rs->rs_bound_addr) {
+			if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr) {
 #endif
 				spin_unlock_irq(&iwdev->spinlock);
 				*rds_iwdev = iwdev;
@@ -180,19 +182,13 @@ int rds_iw_update_cm_id(struct rds_iw_de
 {
 	struct sockaddr_in *src_addr, *dst_addr;
 	struct rds_iw_device *rds_iwdev_old;
-	struct rds_sock rs;
 	struct rdma_cm_id *pcm_id;
 	int rc;
 
 	src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
 	dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
 
-	rs.rs_bound_addr = src_addr->sin_addr.s_addr;
-	rs.rs_bound_port = src_addr->sin_port;
-	rs.rs_conn_addr = dst_addr->sin_addr.s_addr;
-	rs.rs_conn_port = dst_addr->sin_port;
-
-	rc = rds_iw_get_device(&rs, &rds_iwdev_old, &pcm_id);
+	rc = rds_iw_get_device(src_addr, dst_addr, &rds_iwdev_old, &pcm_id);
 	if (rc)
 		rds_iw_remove_cm_id(rds_iwdev, cm_id);
 
@@ -598,9 +594,17 @@ void *rds_iw_get_mr(struct scatterlist *
 	struct rds_iw_device *rds_iwdev;
 	struct rds_iw_mr *ibmr = NULL;
 	struct rdma_cm_id *cm_id;
+	struct sockaddr_in src = {
+		.sin_addr.s_addr = rs->rs_bound_addr,
+		.sin_port = rs->rs_bound_port,
+	};
+	struct sockaddr_in dst = {
+		.sin_addr.s_addr = rs->rs_conn_addr,
+		.sin_port = rs->rs_conn_port,
+	};
 	int ret;
 
-	ret = rds_iw_get_device(rs, &rds_iwdev, &cm_id);
+	ret = rds_iw_get_device(&src, &dst, &rds_iwdev, &cm_id);
 	if (ret || !cm_id) {
 		ret = -ENODEV;
 		goto out;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/rxrpc/ar-recvmsg.c linux-libre-3.19.3-gnu/net/rxrpc/ar-recvmsg.c
--- linux-libre-3.19.2-gnu/net/rxrpc/ar-recvmsg.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/rxrpc/ar-recvmsg.c	2015-03-26 09:00:21.000000000 -0400
@@ -87,7 +87,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, st
 		if (!skb) {
 			/* nothing remains on the queue */
 			if (copied &&
-			    (msg->msg_flags & MSG_PEEK || timeo == 0))
+			    (flags & MSG_PEEK || timeo == 0))
 				goto out;
 
 			/* wait for a message to turn up */
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/sched/cls_u32.c linux-libre-3.19.3-gnu/net/sched/cls_u32.c
--- linux-libre-3.19.2-gnu/net/sched/cls_u32.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/sched/cls_u32.c	2015-03-26 09:00:21.000000000 -0400
@@ -78,8 +78,11 @@ struct tc_u_hnode {
 	struct tc_u_common	*tp_c;
 	int			refcnt;
 	unsigned int		divisor;
-	struct tc_u_knode __rcu	*ht[1];
 	struct rcu_head		rcu;
+	/* The 'ht' field MUST be the last field in structure to allow for
+	 * more entries allocated at end of structure.
+	 */
+	struct tc_u_knode __rcu	*ht[1];
 };
 
 struct tc_u_common {
diff -druNp --no-dereference linux-libre-3.19.2-gnu/net/socket.c linux-libre-3.19.3-gnu/net/socket.c
--- linux-libre-3.19.2-gnu/net/socket.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/net/socket.c	2015-03-26 09:00:21.000000000 -0400
@@ -1765,6 +1765,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __
 
 	if (len > INT_MAX)
 		len = INT_MAX;
+	if (unlikely(!access_ok(VERIFY_READ, buff, len)))
+		return -EFAULT;
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1823,6 +1825,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void
 
 	if (size > INT_MAX)
 		size = INT_MAX;
+	if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
+		return -EFAULT;
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
diff -druNp --no-dereference linux-libre-3.19.2-gnu/sound/core/control.c linux-libre-3.19.3-gnu/sound/core/control.c
--- linux-libre-3.19.2-gnu/sound/core/control.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/sound/core/control.c	2015-03-26 09:00:21.000000000 -0400
@@ -1168,6 +1168,10 @@ static int snd_ctl_elem_add(struct snd_c
 
 	if (info->count < 1)
 		return -EINVAL;
+	if (!*info->id.name)
+		return -EINVAL;
+	if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
+		return -EINVAL;
 	access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
 		(info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
 				 SNDRV_CTL_ELEM_ACCESS_INACTIVE|
diff -druNp --no-dereference linux-libre-3.19.2-gnu/sound/pci/hda/hda_controller.c linux-libre-3.19.3-gnu/sound/pci/hda/hda_controller.c
--- linux-libre-3.19.2-gnu/sound/pci/hda/hda_controller.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/sound/pci/hda/hda_controller.c	2015-03-26 09:00:21.000000000 -0400
@@ -1160,7 +1160,7 @@ static unsigned int azx_rirb_get_respons
 		}
 	}
 
-	if (!bus->no_response_fallback)
+	if (bus->no_response_fallback)
 		return -1;
 
 	if (!chip->polling_mode && chip->poll_count < 2) {
diff -druNp --no-dereference linux-libre-3.19.2-gnu/sound/pci/hda/hda_generic.c linux-libre-3.19.3-gnu/sound/pci/hda/hda_generic.c
--- linux-libre-3.19.2-gnu/sound/pci/hda/hda_generic.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/sound/pci/hda/hda_generic.c	2015-03-26 09:00:21.000000000 -0400
@@ -687,12 +687,45 @@ static int get_amp_val_to_activate(struc
 	return val;
 }
 
+/* is this a stereo widget or a stereo-to-mono mix? */
+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, int dir)
+{
+	unsigned int wcaps = get_wcaps(codec, nid);
+	hda_nid_t conn;
+
+	if (wcaps & AC_WCAP_STEREO)
+		return true;
+	if (dir != HDA_INPUT || get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
+		return false;
+	if (snd_hda_get_num_conns(codec, nid) != 1)
+		return false;
+	if (snd_hda_get_connections(codec, nid, &conn, 1) < 0)
+		return false;
+	return !!(get_wcaps(codec, conn) & AC_WCAP_STEREO);
+}
+
 /* initialize the amp value (only at the first time) */
 static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx)
 {
 	unsigned int caps = query_amp_caps(codec, nid, dir);
 	int val = get_amp_val_to_activate(codec, nid, dir, caps, false);
-	snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
+
+	if (is_stereo_amps(codec, nid, dir))
+		snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
+	else
+		snd_hda_codec_amp_init(codec, nid, 0, dir, idx, 0xff, val);
+}
+
+/* update the amp, doing in stereo or mono depending on NID */
+static int update_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx,
+		      unsigned int mask, unsigned int val)
+{
+	if (is_stereo_amps(codec, nid, dir))
+		return snd_hda_codec_amp_stereo(codec, nid, dir, idx,
+						mask, val);
+	else
+		return snd_hda_codec_amp_update(codec, nid, 0, dir, idx,
+						mask, val);
 }
 
 /* calculate amp value mask we can modify;
@@ -732,7 +765,7 @@ static void activate_amp(struct hda_code
 		return;
 
 	val &= mask;
-	snd_hda_codec_amp_stereo(codec, nid, dir, idx, mask, val);
+	update_amp(codec, nid, dir, idx, mask, val);
 }
 
 static void activate_amp_out(struct hda_codec *codec, struct nid_path *path,
@@ -4424,13 +4457,11 @@ static void mute_all_mixer_nid(struct hd
 	has_amp = nid_has_mute(codec, mix, HDA_INPUT);
 	for (i = 0; i < nums; i++) {
 		if (has_amp)
-			snd_hda_codec_amp_stereo(codec, mix,
-						 HDA_INPUT, i,
-						 0xff, HDA_AMP_MUTE);
+			update_amp(codec, mix, HDA_INPUT, i,
+				   0xff, HDA_AMP_MUTE);
 		else if (nid_has_volume(codec, conn[i], HDA_OUTPUT))
-			snd_hda_codec_amp_stereo(codec, conn[i],
-						 HDA_OUTPUT, 0,
-						 0xff, HDA_AMP_MUTE);
+			update_amp(codec, conn[i], HDA_OUTPUT, 0,
+				   0xff, HDA_AMP_MUTE);
 	}
 }
 
diff -druNp --no-dereference linux-libre-3.19.2-gnu/sound/pci/hda/hda_proc.c linux-libre-3.19.3-gnu/sound/pci/hda/hda_proc.c
--- linux-libre-3.19.2-gnu/sound/pci/hda/hda_proc.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/sound/pci/hda/hda_proc.c	2015-03-26 09:00:21.000000000 -0400
@@ -134,13 +134,38 @@ static void print_amp_caps(struct snd_in
 		    (caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT);
 }
 
+/* is this a stereo widget or a stereo-to-mono mix? */
+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid,
+			   int dir, unsigned int wcaps, int indices)
+{
+	hda_nid_t conn;
+
+	if (wcaps & AC_WCAP_STEREO)
+		return true;
+	/* check for a stereo-to-mono mix; it must be:
+	 * only a single connection, only for input, and only a mixer widget
+	 */
+	if (indices != 1 || dir != HDA_INPUT ||
+	    get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
+		return false;
+
+	if (snd_hda_get_raw_connections(codec, nid, &conn, 1) < 0)
+		return false;
+	/* the connection source is a stereo? */
+	wcaps = snd_hda_param_read(codec, conn, AC_PAR_AUDIO_WIDGET_CAP);
+	return !!(wcaps & AC_WCAP_STEREO);
+}
+
 static void print_amp_vals(struct snd_info_buffer *buffer,
 			   struct hda_codec *codec, hda_nid_t nid,
-			   int dir, int stereo, int indices)
+			   int dir, unsigned int wcaps, int indices)
 {
 	unsigned int val;
+	bool stereo;
 	int i;
 
+	stereo = is_stereo_amps(codec, nid, dir, wcaps, indices);
+
 	dir = dir == HDA_OUTPUT ? AC_AMP_GET_OUTPUT : AC_AMP_GET_INPUT;
 	for (i = 0; i < indices; i++) {
 		snd_iprintf(buffer, " [");
@@ -757,12 +782,10 @@ static void print_codec_info(struct snd_
 			    (codec->single_adc_amp &&
 			     wid_type == AC_WID_AUD_IN))
 				print_amp_vals(buffer, codec, nid, HDA_INPUT,
-					       wid_caps & AC_WCAP_STEREO,
-					       1);
+					       wid_caps, 1);
 			else
 				print_amp_vals(buffer, codec, nid, HDA_INPUT,
-					       wid_caps & AC_WCAP_STEREO,
-					       conn_len);
+					       wid_caps, conn_len);
 		}
 		if (wid_caps & AC_WCAP_OUT_AMP) {
 			snd_iprintf(buffer, "  Amp-Out caps: ");
@@ -771,11 +794,10 @@ static void print_codec_info(struct snd_
 			if (wid_type == AC_WID_PIN &&
 			    codec->pin_amp_workaround)
 				print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-					       wid_caps & AC_WCAP_STEREO,
-					       conn_len);
+					       wid_caps, conn_len);
 			else
 				print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-					       wid_caps & AC_WCAP_STEREO, 1);
+					       wid_caps, 1);
 		}
 
 		switch (wid_type) {
diff -druNp --no-dereference linux-libre-3.19.2-gnu/sound/pci/hda/patch_cirrus.c linux-libre-3.19.3-gnu/sound/pci/hda/patch_cirrus.c
--- linux-libre-3.19.2-gnu/sound/pci/hda/patch_cirrus.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/sound/pci/hda/patch_cirrus.c	2015-03-26 09:00:21.000000000 -0400
@@ -393,6 +393,7 @@ static const struct snd_pci_quirk cs420x
 	SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
 	SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
 	SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
+	SND_PCI_QUIRK(0x106b, 0x5600, "MacBookAir 5,2", CS420X_MBP81),
 	SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
 	SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
 	{} /* terminator */
@@ -584,6 +585,7 @@ static int patch_cs420x(struct hda_codec
 		return -ENOMEM;
 
 	spec->gen.automute_hook = cs_automute;
+	codec->single_adc_amp = 1;
 
 	snd_hda_pick_fixup(codec, cs420x_models, cs420x_fixup_tbl,
 			   cs420x_fixups);
diff -druNp --no-dereference linux-libre-3.19.2-gnu/sound/pci/hda/patch_conexant.c linux-libre-3.19.3-gnu/sound/pci/hda/patch_conexant.c
--- linux-libre-3.19.2-gnu/sound/pci/hda/patch_conexant.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/sound/pci/hda/patch_conexant.c	2015-03-26 09:00:21.000000000 -0400
@@ -223,6 +223,7 @@ enum {
 	CXT_PINCFG_LENOVO_TP410,
 	CXT_PINCFG_LEMOTE_A1004,
 	CXT_PINCFG_LEMOTE_A1205,
+	CXT_PINCFG_COMPAQ_CQ60,
 	CXT_FIXUP_STEREO_DMIC,
 	CXT_FIXUP_INC_MIC_BOOST,
 	CXT_FIXUP_HEADPHONE_MIC_PIN,
@@ -660,6 +661,15 @@ static const struct hda_fixup cxt_fixups
 		.type = HDA_FIXUP_PINS,
 		.v.pins = cxt_pincfg_lemote,
 	},
+	[CXT_PINCFG_COMPAQ_CQ60] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			/* 0x17 was falsely set up as a mic, it should 0x1d */
+			{ 0x17, 0x400001f0 },
+			{ 0x1d, 0x97a70120 },
+			{ }
+		}
+	},
 	[CXT_FIXUP_STEREO_DMIC] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = cxt_fixup_stereo_dmic,
@@ -769,6 +779,7 @@ static const struct hda_model_fixup cxt5
 };
 
 static const struct snd_pci_quirk cxt5051_fixups[] = {
+	SND_PCI_QUIRK(0x103c, 0x360b, "Compaq CQ60", CXT_PINCFG_COMPAQ_CQ60),
 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
 	{}
 };
diff -druNp --no-dereference linux-libre-3.19.2-gnu/sound/usb/quirks-table.h linux-libre-3.19.3-gnu/sound/usb/quirks-table.h
--- linux-libre-3.19.2-gnu/sound/usb/quirks-table.h	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/sound/usb/quirks-table.h	2015-03-26 09:00:21.000000000 -0400
@@ -1773,6 +1773,36 @@ YAMAHA_DEVICE(0x7010, "UB99"),
 		}
 	}
 },
+{
+	USB_DEVICE(0x0582, 0x0159),
+	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+		/* .vendor_name = "Roland", */
+		/* .product_name = "UA-22", */
+		.ifnum = QUIRK_ANY_INTERFACE,
+		.type = QUIRK_COMPOSITE,
+		.data = (const struct snd_usb_audio_quirk[]) {
+			{
+				.ifnum = 0,
+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
+			},
+			{
+				.ifnum = 1,
+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
+			},
+			{
+				.ifnum = 2,
+				.type = QUIRK_MIDI_FIXED_ENDPOINT,
+				.data = & (const struct snd_usb_midi_endpoint_info) {
+					.out_cables = 0x0001,
+					.in_cables = 0x0001
+				}
+			},
+			{
+				.ifnum = -1
+			}
+		}
+	}
+},
 /* this catches most recent vendor-specific Roland devices */
 {
 	.match_flags = USB_DEVICE_ID_MATCH_VENDOR |
diff -druNp --no-dereference linux-libre-3.19.2-gnu/virt/kvm/kvm_main.c linux-libre-3.19.3-gnu/virt/kvm/kvm_main.c
--- linux-libre-3.19.2-gnu/virt/kvm/kvm_main.c	2015-03-18 09:11:52.000000000 -0400
+++ linux-libre-3.19.3-gnu/virt/kvm/kvm_main.c	2015-03-26 09:00:21.000000000 -0400
@@ -2416,6 +2416,7 @@ static long kvm_vm_ioctl_check_extension
 	case KVM_CAP_SIGNAL_MSI:
 #endif
 #ifdef CONFIG_HAVE_KVM_IRQFD
+	case KVM_CAP_IRQFD:
 	case KVM_CAP_IRQFD_RESAMPLE:
 #endif
 	case KVM_CAP_CHECK_EXTENSION_VM:
