[gentoo-commits] proj/hardened-patchset:master commit in: 4.5.5/

[Anthony G. Basile]

commit:     91c3b96e63792590118e17193061908a07017497
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Mon May 30 08:00:17 2016 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Mon May 30 08:00:17 2016 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-patchset.git/commit/?id=91c3b96e

grsecurity-3.1-4.5.5-201605291201

 4.5.5/0000_README                                  |     2 +-
 ...> 4420_grsecurity-3.1-4.5.5-201605291201.patch} | 18852 ++++++++++---------
 2 files changed, 9793 insertions(+), 9061 deletions(-)

diff --git a/4.5.5/0000_README b/4.5.5/0000_README
index febdb77..71dba33 100644
--- a/4.5.5/0000_README
+++ b/4.5.5/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.1-4.5.5-201605211442.patch
+Patch:	4420_grsecurity-3.1-4.5.5-201605291201.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/4.5.5/4420_grsecurity-3.1-4.5.5-201605211442.patch b/4.5.5/4420_grsecurity-3.1-4.5.5-201605291201.patch
similarity index 99%
rename from 4.5.5/4420_grsecurity-3.1-4.5.5-201605211442.patch
rename to 4.5.5/4420_grsecurity-3.1-4.5.5-201605291201.patch
index 7202c18..1fb08ce 100644
--- a/4.5.5/4420_grsecurity-3.1-4.5.5-201605211442.patch
+++ b/4.5.5/4420_grsecurity-3.1-4.5.5-201605291201.patch
@@ -408,7 +408,7 @@ index a93b414..f50a50b 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index a23df41..314f8da 100644
+index a23df41..db4f30b 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -298,7 +298,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -422,27 +422,41 @@ index a23df41..314f8da 100644
  
  ifeq ($(shell $(HOSTCC) -v 2>&1 | grep -c "clang version"), 1)
  HOSTCFLAGS  += -Wno-unused-value -Wno-unused-parameter \
-@@ -434,8 +436,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn \
- # Rules shared between *config targets and build targets
- 
- # Basic helpers built in scripts/
--PHONY += scripts_basic
--scripts_basic:
-+PHONY += scripts_basic gcc-plugins
-+scripts_basic: gcc-plugins
- 	$(Q)$(MAKE) $(build)=scripts/basic
- 	$(Q)rm -f .tmp_quiet_recordmcount
- 
-@@ -622,6 +624,8 @@ endif
+@@ -417,6 +419,8 @@ export KBUILD_AFLAGS_MODULE KBUILD_CFLAGS_MODULE KBUILD_LDFLAGS_MODULE
+ export KBUILD_AFLAGS_KERNEL KBUILD_CFLAGS_KERNEL
+ export KBUILD_ARFLAGS
+ 
++export PLUGINCC GCC_PLUGINS_CFLAGS GCC_PLUGINS_AFLAGS
++
+ # When compiling out-of-tree modules, put MODVERDIR in the module
+ # tree rather than in the kernel tree. The kernel tree might
+ # even be read-only.
+@@ -547,7 +551,7 @@ ifeq ($(KBUILD_EXTMOD),)
+ # in parallel
+ PHONY += scripts
+ scripts: scripts_basic include/config/auto.conf include/config/tristate.conf \
+-	 asm-generic
++	 asm-generic gcc-plugins
+ 	$(Q)$(MAKE) $(build)=$(@)
+ 
+ # Objects we will link into vmlinux / subdirs we need to visit
+@@ -622,6 +626,15 @@ endif
  # Tell gcc to never replace conditional load with a non-conditional one
  KBUILD_CFLAGS	+= $(call cc-option,--param=allow-store-data-races=0)
  
++PHONY += gcc-plugins
++gcc-plugins: scripts_basic
++ifdef CONFIG_GCC_PLUGINS
++	$(Q)$(MAKE) $(build)=scripts/gcc-plugins
++endif
++	@:
++
 +include scripts/Makefile.gcc-plugins
 +
  ifdef CONFIG_READABLE_ASM
  # Disable optimizations that make assembler listings hard to read.
  # reorder blocks reorders the control in the function
-@@ -714,7 +718,7 @@ KBUILD_CFLAGS   += $(call cc-option, -gsplit-dwarf, -g)
+@@ -714,7 +727,7 @@ KBUILD_CFLAGS   += $(call cc-option, -gsplit-dwarf, -g)
  else
  KBUILD_CFLAGS	+= -g
  endif
@@ -451,7 +465,7 @@ index a23df41..314f8da 100644
  endif
  ifdef CONFIG_DEBUG_INFO_DWARF4
  KBUILD_CFLAGS	+= $(call cc-option, -gdwarf-4,)
-@@ -886,7 +890,7 @@ export mod_sign_cmd
+@@ -886,7 +899,7 @@ export mod_sign_cmd
  
  
  ifeq ($(KBUILD_EXTMOD),)
@@ -460,57 +474,16 @@ index a23df41..314f8da 100644
  
  vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
  		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -937,6 +941,8 @@ endif
- 
- # The actual objects are generated when descending,
- # make sure no implicit rule kicks in
-+$(filter-out $(init-y),$(vmlinux-deps)): KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+$(filter-out $(init-y),$(vmlinux-deps)): KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
- 
- # Handle descending into subdirectories listed in $(vmlinux-dirs)
-@@ -946,7 +952,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
- # Error messages still appears in the original language
- 
- PHONY += $(vmlinux-dirs)
--$(vmlinux-dirs): prepare scripts
-+$(vmlinux-dirs): gcc-plugins prepare scripts
- 	$(Q)$(MAKE) $(build)=$@
- 
- define filechk_kernel.release
-@@ -989,10 +995,13 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
+@@ -989,7 +1002,7 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
  
  archprepare: archheaders archscripts prepare1 scripts_basic
  
-+prepare0: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+prepare0: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- prepare0: archprepare FORCE
+-prepare0: archprepare FORCE
++prepare0: archprepare gcc-plugins FORCE
  	$(Q)$(MAKE) $(build)=.
  
  # All the preparing..
-+prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
- prepare: prepare0
- 
- # Generate some files
-@@ -1103,6 +1112,8 @@ all: modules
- # using awk while concatenating to the final file.
- 
- PHONY += modules
-+modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
- 	$(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
- 	@$(kecho) '  Building modules, stage 2.';
-@@ -1118,7 +1129,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
- 
- # Target to prepare building external modules
- PHONY += modules_prepare
--modules_prepare: prepare scripts
-+modules_prepare: gcc-plugins prepare scripts
- 
- # Target to install modules
- PHONY += modules_install
-@@ -1184,7 +1195,11 @@ MRPROPER_FILES += .config .config.old .version .old_version \
+@@ -1184,7 +1197,11 @@ MRPROPER_FILES += .config .config.old .version .old_version \
  		  Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \
  		  signing_key.pem signing_key.priv signing_key.x509	\
  		  x509.genkey extra_certificates signing_key.x509.keyid	\
@@ -523,7 +496,7 @@ index a23df41..314f8da 100644
  
  # clean - Delete most, but leave enough to build external modules
  #
-@@ -1223,7 +1238,7 @@ distclean: mrproper
+@@ -1223,7 +1240,7 @@ distclean: mrproper
  	@find $(srctree) $(RCS_FIND_IGNORE) \
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
@@ -532,59 +505,31 @@ index a23df41..314f8da 100644
  		-type f -print | xargs rm -f
  
  
-@@ -1390,6 +1405,8 @@ PHONY += $(module-dirs) modules
- $(module-dirs): crmodverdir $(objtree)/Module.symvers
- 	$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
+diff --git a/arch/Kconfig b/arch/Kconfig
+index f6b649d..5ba628b 100644
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -353,6 +353,20 @@ config SECCOMP_FILTER
  
-+modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- modules: $(module-dirs)
- 	@$(kecho) '  Building modules, stage 2.';
- 	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1531,17 +1548,21 @@ else
-         target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
- endif
+ 	  See Documentation/prctl/seccomp_filter.txt for details.
  
--%.s: %.c prepare scripts FORCE
-+%.s: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%.s: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%.s: %.c gcc-plugins prepare scripts FORCE
- 	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
- %.i: %.c prepare scripts FORCE
- 	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
--%.o: %.c prepare scripts FORCE
-+%.o: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%.o: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%.o: %.c gcc-plugins prepare scripts FORCE
- 	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
- %.lst: %.c prepare scripts FORCE
- 	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
--%.s: %.S prepare scripts FORCE
-+%.s: %.S gcc-plugins prepare scripts FORCE
- 	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
--%.o: %.S prepare scripts FORCE
-+%.o: %.S gcc-plugins prepare scripts FORCE
- 	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
- %.symtypes: %.c prepare scripts FORCE
- 	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1553,11 +1574,15 @@ endif
- 	$(build)=$(build-dir)
- # Make sure the latest headers are built for Documentation
- Documentation/: headers_install
--%/: prepare scripts FORCE
-+%/: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%/: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%/: gcc-plugins prepare scripts FORCE
- 	$(cmd_crmodverdir)
- 	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
- 	$(build)=$(build-dir)
--%.ko: prepare scripts FORCE
-+%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%.ko: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%.ko: gcc-plugins prepare scripts FORCE
- 	$(cmd_crmodverdir)
- 	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1)   \
- 	$(build)=$(build-dir) $(@:.ko=.o)
++config HAVE_GCC_PLUGINS
++	bool
++	help
++	  An arch should select this symbol if it supports building with
++	  GCC plugins.
++
++menuconfig GCC_PLUGINS
++	bool "GCC plugins"
++	depends on HAVE_GCC_PLUGINS
++	default y
++	help
++	  GCC plugins are loadable modules that provide extra features to the
++	  compiler. They are useful for runtime instrumentation and static analysis.
++
+ config HAVE_CC_STACKPROTECTOR
+ 	bool
+ 	help
 diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
 index 572b228..e03acdd 100644
 --- a/arch/alpha/include/asm/atomic.h
@@ -928,10 +873,18 @@ index 8a188bc..26608f1 100644
  	  Counts number of I and D TLB Misses and exports them via Debugfs
  	  The counters can be cleared via Debugfs as well
 diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
-index 4f799e5..cc1200e 100644
+index 4f799e5..c1e2b95 100644
 --- a/arch/arm/Kconfig
 +++ b/arch/arm/Kconfig
-@@ -1622,6 +1622,7 @@ config HIGHPTE
+@@ -53,6 +53,7 @@ config ARM
+ 	select HAVE_FTRACE_MCOUNT_RECORD if (!XIP_KERNEL)
+ 	select HAVE_FUNCTION_GRAPH_TRACER if (!THUMB2_KERNEL)
+ 	select HAVE_FUNCTION_TRACER if (!XIP_KERNEL)
++	select HAVE_GCC_PLUGINS
+ 	select HAVE_GENERIC_DMA_COHERENT
+ 	select HAVE_HW_BREAKPOINT if (PERF_EVENTS && (CPU_V6 || CPU_V6K || CPU_V7))
+ 	select HAVE_IDE if PCI || ISA || PCMCIA
+@@ -1622,6 +1623,7 @@ config HIGHPTE
  config CPU_SW_DOMAIN_PAN
  	bool "Enable use of CPU domains to implement privileged no-access"
  	depends on MMU && !ARM_LPAE
@@ -939,7 +892,7 @@ index 4f799e5..cc1200e 100644
  	default y
  	help
  	  Increase kernel security by ensuring that normal kernel accesses
-@@ -1698,7 +1699,7 @@ config ALIGNMENT_TRAP
+@@ -1698,7 +1700,7 @@ config ALIGNMENT_TRAP
  
  config UACCESS_WITH_MEMCPY
  	bool "Use kernel mem{cpy,set}() for {copy_to,clear}_user()"
@@ -948,7 +901,7 @@ index 4f799e5..cc1200e 100644
  	default y if CPU_FEROCEON
  	help
  	  Implement faster copy_to_user and clear_user methods for CPU
-@@ -1953,6 +1954,7 @@ config KEXEC
+@@ -1953,6 +1955,7 @@ config KEXEC
  	depends on (!SMP || PM_SLEEP_SMP)
  	depends on !CPU_V7M
  	select KEXEC_CORE
@@ -956,7 +909,7 @@ index 4f799e5..cc1200e 100644
  	help
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
-@@ -1997,7 +1999,7 @@ config EFI_STUB
+@@ -1997,7 +2000,7 @@ config EFI_STUB
  
  config EFI
  	bool "UEFI runtime support"
@@ -977,6 +930,19 @@ index c6b6175..2884505 100644
  	---help---
  	  Say Y here if you want to show the kernel pagetable layout in a
  	  debugfs file. This information is only useful for kernel developers
+diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
+index 43788b1..2efefcf 100644
+--- a/arch/arm/boot/compressed/Makefile
++++ b/arch/arm/boot/compressed/Makefile
+@@ -106,6 +106,8 @@ ORIG_CFLAGS := $(KBUILD_CFLAGS)
+ KBUILD_CFLAGS = $(subst -pg, , $(ORIG_CFLAGS))
+ endif
+ 
++KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
++
+ # -fstack-protector-strong triggers protection checks in this code,
+ # but it is being used too early to link to meaningful stack_chk logic.
+ nossp_flags := $(call cc-option, -fno-stack-protector)
 diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
 index 9e10c45..24a14ce 100644
 --- a/arch/arm/include/asm/atomic.h
@@ -3357,7 +3323,7 @@ index 6bd1089..e999400 100644
  {
  	unsigned long ua_flags;
 diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
-index c169cc3..f290a77 100644
+index c169cc3..b007ec6 100644
 --- a/arch/arm/mach-exynos/suspend.c
 +++ b/arch/arm/mach-exynos/suspend.c
 @@ -734,8 +734,10 @@ void __init exynos_pm_init(void)
@@ -3367,8 +3333,8 @@ index c169cc3..f290a77 100644
 -	exynos_pm_syscore_ops.suspend	= pm_data->pm_suspend;
 -	exynos_pm_syscore_ops.resume	= pm_data->pm_resume;
 +	pax_open_kernel();
-+	*(void **)&exynos_pm_syscore_ops.suspend	= pm_data->pm_suspend;
-+	*(void **)&exynos_pm_syscore_ops.resume	= pm_data->pm_resume;
++	const_cast(exynos_pm_syscore_ops.suspend)	= pm_data->pm_suspend;
++	const_cast(exynos_pm_syscore_ops.resume)	= pm_data->pm_resume;
 +	pax_close_kernel();
  
  	register_syscore_ops(&exynos_pm_syscore_ops);
@@ -3501,7 +3467,7 @@ index 2af6ff6..1f2959f 100644
  /* omap_hwmod_list contains all registered struct omap_hwmods */
  static LIST_HEAD(omap_hwmod_list);
 diff --git a/arch/arm/mach-omap2/powerdomains43xx_data.c b/arch/arm/mach-omap2/powerdomains43xx_data.c
-index 95fee54..cfa9cf1 100644
+index 95fee54..b5dd79d 100644
 --- a/arch/arm/mach-omap2/powerdomains43xx_data.c
 +++ b/arch/arm/mach-omap2/powerdomains43xx_data.c
 @@ -10,6 +10,7 @@
@@ -3518,7 +3484,7 @@ index 95fee54..cfa9cf1 100644
  {
 -	omap4_pwrdm_operations.pwrdm_has_voltdm = am43xx_check_vcvp;
 +	pax_open_kernel();
-+	*(void **)&omap4_pwrdm_operations.pwrdm_has_voltdm = am43xx_check_vcvp;
++	const_cast(omap4_pwrdm_operations.pwrdm_has_voltdm) = am43xx_check_vcvp;
 +	pax_close_kernel();
  	pwrdm_register_platform_funcs(&omap4_pwrdm_operations);
  	pwrdm_register_pwrdms(powerdomains_am43xx);
@@ -3548,7 +3514,7 @@ index ff0a68c..b312aa0 100644
  				 sizeof(struct omap_wd_timer_platform_data));
  	WARN(IS_ERR(pdev), "Can't build omap_device for %s:%s.\n",
 diff --git a/arch/arm/mach-shmobile/platsmp-apmu.c b/arch/arm/mach-shmobile/platsmp-apmu.c
-index aba75c8..b55a9d7 100644
+index aba75c8..b2b340f 100644
 --- a/arch/arm/mach-shmobile/platsmp-apmu.c
 +++ b/arch/arm/mach-shmobile/platsmp-apmu.c
 @@ -22,6 +22,7 @@
@@ -3565,7 +3531,7 @@ index aba75c8..b55a9d7 100644
  {
 -	shmobile_suspend_ops.enter = shmobile_smp_apmu_enter_suspend;
 +	pax_open_kernel();
-+	*(void **)&shmobile_suspend_ops.enter = shmobile_smp_apmu_enter_suspend;
++	const_cast(shmobile_suspend_ops.enter) = shmobile_smp_apmu_enter_suspend;
 +	pax_close_kernel();
  }
  #endif
@@ -3727,7 +3693,7 @@ index c8c8b9e..c55cc79 100644
  		atomic64_set(&mm->context.id, asid);
  	}
 diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
-index daafcf1..8205ed6 100644
+index daafcf1..a04e1fd 100644
 --- a/arch/arm/mm/fault.c
 +++ b/arch/arm/mm/fault.c
 @@ -25,6 +25,7 @@
@@ -3841,7 +3807,7 @@ index daafcf1..8205ed6 100644
  	pr_alert("Unhandled fault: %s (0x%03x) at 0x%08lx\n",
  		inf->name, fsr, addr);
  	show_pte(current->mm, addr);
-@@ -574,15 +647,104 @@ hook_ifault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *
+@@ -574,15 +647,118 @@ hook_ifault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *
  	ifsr_info[nr].name = name;
  }
  
@@ -3879,6 +3845,13 @@ index daafcf1..8205ed6 100644
 +			 */
 +			// dmb(); implied by the exception
 +			regs->ARM_pc = regs->ARM_lr;
++#ifdef CONFIG_ARM_THUMB
++			if (regs->ARM_lr & 1) {
++				regs->ARM_cpsr |= PSR_T_BIT;
++				regs->ARM_pc &= ~0x1U;
++			} else
++				regs->ARM_cpsr &= ~PSR_T_BIT;
++#endif
 +			return;
 +		}
 +		if (pc == 0xffff0fc0UL) {
@@ -3901,6 +3874,13 @@ index daafcf1..8205ed6 100644
 +			 */
 +			regs->ARM_r0 = current_thread_info()->tp_value[0];
 +			regs->ARM_pc = regs->ARM_lr;
++#ifdef CONFIG_ARM_THUMB
++			if (regs->ARM_lr & 1) {
++				regs->ARM_cpsr |= PSR_T_BIT;
++				regs->ARM_pc &= ~0x1U;
++			} else
++				regs->ARM_cpsr &= ~PSR_T_BIT;
++#endif
 +			return;
 +		}
 +	}
@@ -4655,6 +4635,18 @@ index a5bc92d..0bb4730 100644
  		  omap_sram_size - omap_sram_skip);
 +	pax_close_kernel();
  }
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 8cc6228..6d6e4f8 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -70,6 +70,7 @@ config ARM64
+ 	select HAVE_FTRACE_MCOUNT_RECORD
+ 	select HAVE_FUNCTION_TRACER
+ 	select HAVE_FUNCTION_GRAPH_TRACER
++	select HAVE_GCC_PLUGINS
+ 	select HAVE_GENERIC_DMA_COHERENT
+ 	select HAVE_HW_BREAKPOINT if PERF_EVENTS
+ 	select HAVE_IRQ_TIME_ACCOUNTING
 diff --git a/arch/arm64/Kconfig.debug b/arch/arm64/Kconfig.debug
 index e13c4bf..3feaea7 100644
 --- a/arch/arm64/Kconfig.debug
@@ -5602,10 +5594,18 @@ index 4efe96a..60e8699 100644
  #define SMP_CACHE_BYTES	L1_CACHE_BYTES
  
 diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
-index d3da79d..e607104 100644
+index d3da79d..e317c97 100644
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
-@@ -2656,6 +2656,7 @@ source "kernel/Kconfig.preempt"
+@@ -49,6 +49,7 @@ config MIPS
+ 	select GENERIC_CMOS_UPDATE
+ 	select HAVE_MOD_ARCH_SPECIFIC
+ 	select VIRT_TO_BUS
++	select HAVE_GCC_PLUGINS
+ 	select MODULES_USE_ELF_REL if MODULES
+ 	select MODULES_USE_ELF_RELA if MODULES && 64BIT
+ 	select CLONE_BACKWARDS
+@@ -2656,6 +2657,7 @@ source "kernel/Kconfig.preempt"
  config KEXEC
  	bool "Kexec system call"
  	select KEXEC_CORE
@@ -7607,10 +7607,18 @@ index f906444..0bb73ae 100644
  	/*
  	 * If for any reason at all we couldn't handle the fault, make
 diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
-index 9faa18c..6061610 100644
+index 9faa18c..b24277a 100644
 --- a/arch/powerpc/Kconfig
 +++ b/arch/powerpc/Kconfig
-@@ -419,6 +419,7 @@ config KEXEC
+@@ -143,6 +143,7 @@ config PPC
+ 	select ARCH_USE_BUILTIN_BSWAP
+ 	select OLD_SIGSUSPEND
+ 	select OLD_SIGACTION if PPC32
++	select HAVE_GCC_PLUGINS
+ 	select HAVE_DEBUG_STACKOVERFLOW
+ 	select HAVE_IRQ_EXIT_ON_IRQ_STACK
+ 	select ARCH_USE_CMPXCHG_LOCKREF if PPC64
+@@ -419,6 +420,7 @@ config KEXEC
  	bool "kexec system call"
  	depends on (PPC_BOOK3S || FSL_BOOKE || (44x && !SMP)) || PPC_BOOK3E
  	select KEXEC_CORE
@@ -7619,7 +7627,7 @@ index 9faa18c..6061610 100644
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
 diff --git a/arch/powerpc/include/asm/atomic.h b/arch/powerpc/include/asm/atomic.h
-index 55f106e..70cc82a 100644
+index 55f106e..5968afb 100644
 --- a/arch/powerpc/include/asm/atomic.h
 +++ b/arch/powerpc/include/asm/atomic.h
 @@ -12,6 +12,11 @@
@@ -7886,19 +7894,7 @@ index 55f106e..70cc82a 100644
  	PPC_ATOMIC_EXIT_BARRIER
  "	subf	%0,%2,%0 \n\
  2:"
-@@ -252,6 +299,11 @@ static __inline__ int atomic_dec_if_positive(atomic_t *v)
- }
- #define atomic_dec_if_positive atomic_dec_if_positive
- 
-+#define smp_mb__before_atomic_dec()     smp_mb()
-+#define smp_mb__after_atomic_dec()      smp_mb()
-+#define smp_mb__before_atomic_inc()     smp_mb()
-+#define smp_mb__after_atomic_inc()      smp_mb()
-+
- #ifdef __powerpc64__
- 
- #define ATOMIC64_INIT(i)	{ (i) }
-@@ -265,37 +317,60 @@ static __inline__ long atomic64_read(const atomic64_t *v)
+@@ -265,37 +312,60 @@ static __inline__ long atomic64_read(const atomic64_t *v)
  	return t;
  }
  
@@ -7963,7 +7959,7 @@ index 55f106e..70cc82a 100644
  	PPC_ATOMIC_EXIT_BARRIER						\
  	: "=&r" (t)							\
  	: "r" (a), "r" (&v->counter)					\
-@@ -304,6 +379,9 @@ static __inline__ long atomic64_##op##_return(long a, atomic64_t *v)	\
+@@ -304,6 +374,9 @@ static __inline__ long atomic64_##op##_return(long a, atomic64_t *v)	\
  	return t;							\
  }
  
@@ -7973,7 +7969,7 @@ index 55f106e..70cc82a 100644
  #define ATOMIC64_OPS(op, asm_op) ATOMIC64_OP(op, asm_op) ATOMIC64_OP_RETURN(op, asm_op)
  
  ATOMIC64_OPS(add, add)
-@@ -314,40 +392,33 @@ ATOMIC64_OP(xor, xor)
+@@ -314,40 +387,33 @@ ATOMIC64_OP(xor, xor)
  
  #undef ATOMIC64_OPS
  #undef ATOMIC64_OP_RETURN
@@ -8033,7 +8029,7 @@ index 55f106e..70cc82a 100644
  }
  
  /*
-@@ -360,36 +431,18 @@ static __inline__ long atomic64_inc_return(atomic64_t *v)
+@@ -360,36 +426,18 @@ static __inline__ long atomic64_inc_return(atomic64_t *v)
   */
  #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
  
@@ -8081,7 +8077,7 @@ index 55f106e..70cc82a 100644
  }
  
  #define atomic64_sub_and_test(a, v)	(atomic64_sub_return((a), (v)) == 0)
-@@ -422,6 +475,16 @@ static __inline__ long atomic64_dec_if_positive(atomic64_t *v)
+@@ -422,6 +470,16 @@ static __inline__ long atomic64_dec_if_positive(atomic64_t *v)
  #define atomic64_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
  #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
  
@@ -8090,7 +8086,7 @@ index 55f106e..70cc82a 100644
 +	return cmpxchg(&(v->counter), old, new);
 +}
 +
-+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new) 
++static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
 +{
 +	return xchg(&(v->counter), new);
 +}
@@ -8098,7 +8094,7 @@ index 55f106e..70cc82a 100644
  /**
   * atomic64_add_unless - add unless the number is a given value
   * @v: pointer of type atomic64_t
-@@ -437,13 +500,29 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+@@ -437,13 +495,29 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
  
  	__asm__ __volatile__ (
  	PPC_ATOMIC_ENTRY_BARRIER
@@ -8698,17 +8694,17 @@ index b7c20f0..4adc0f1 100644
  
  static inline unsigned long clear_user(void __user *addr, unsigned long size)
 diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
-index 794f22a..f8de42b 100644
+index 794f22a..9a76447 100644
 --- a/arch/powerpc/kernel/Makefile
 +++ b/arch/powerpc/kernel/Makefile
 @@ -14,6 +14,11 @@ CFLAGS_prom_init.o      += -fPIC
  CFLAGS_btext.o		+= -fPIC
  endif
  
-+CFLAGS_REMOVE_cputable.o = $(LATENT_ENTROPY_PLUGIN_CFLAGS)
-+CFLAGS_REMOVE_prom_init.o = $(LATENT_ENTROPY_PLUGIN_CFLAGS)
-+CFLAGS_REMOVE_btext.o = $(LATENT_ENTROPY_PLUGIN_CFLAGS)
-+CFLAGS_REMOVE_prom.o = $(LATENT_ENTROPY_PLUGIN_CFLAGS)
++CFLAGS_cputable.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
++CFLAGS_prom_init.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
++CFLAGS_btext.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
++CFLAGS_prom.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
 +
  ifdef CONFIG_FUNCTION_TRACER
  # Do not trace early boot code
@@ -9678,6 +9674,18 @@ index 6777177..d44b592 100644
  		info.high_limit = TASK_SIZE;
  		addr = vm_unmapped_area(&info);
  	}
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index 57ffaf2..4d1fe9a 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -39,6 +39,7 @@ config SPARC
+ 	select GENERIC_STRNCPY_FROM_USER
+ 	select GENERIC_STRNLEN_USER
+ 	select MODULES_USE_ELF_RELA
++	select HAVE_GCC_PLUGINS
+ 	select ODD_RT_SIGACTION
+ 	select OLD_SIGSUSPEND
+ 	select ARCH_HAS_SG_CHAIN
 diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
 index f2fbf9e..fea461e 100644
 --- a/arch/sparc/include/asm/atomic_64.h
@@ -12221,16 +12229,14 @@ index c034dc3..cf1cc96 100644
  
  	/*
 diff --git a/arch/um/Makefile b/arch/um/Makefile
-index e3abe6f..ae224ef 100644
+index e3abe6f..33a363c 100644
 --- a/arch/um/Makefile
 +++ b/arch/um/Makefile
-@@ -73,6 +73,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -I%,,$(KBUILD_CFLAGS))) \
+@@ -73,6 +73,8 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -I%,,$(KBUILD_CFLAGS))) \
  		-D_FILE_OFFSET_BITS=64 -idirafter $(srctree)/include \
  		-idirafter $(obj)/include -D__KERNEL__ -D__UM_HOST__
  
-+ifdef CONSTIFY_PLUGIN
-+USER_CFLAGS	+= -fplugin-arg-constify_plugin-no-constify
-+endif
++USER_CFLAGS	:= $(filter-out $(GCC_PLUGINS_CFLAGS),$(USER_CFLAGS))
 +
  #This will adjust *FLAGS accordingly to the platform.
  include $(ARCH_DIR)/Makefile-os-$(OS)
@@ -12338,7 +12344,7 @@ index ad8f795..2c7eec6 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 3bf45a0..7b04039 100644
+index 3bf45a0..25ca7da 100644
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
 @@ -38,14 +38,13 @@ config X86
@@ -12366,7 +12372,15 @@ index 3bf45a0..7b04039 100644
  	select HAVE_CMPXCHG_DOUBLE
  	select HAVE_CMPXCHG_LOCAL
  	select HAVE_CONTEXT_TRACKING		if X86_64
-@@ -290,7 +289,7 @@ config X86_64_SMP
+@@ -109,6 +108,7 @@ config X86
+ 	select HAVE_FUNCTION_GRAPH_FP_TEST
+ 	select HAVE_FUNCTION_GRAPH_TRACER
+ 	select HAVE_FUNCTION_TRACER
++	select HAVE_GCC_PLUGINS
+ 	select HAVE_GENERIC_DMA_COHERENT	if X86_32
+ 	select HAVE_HW_BREAKPOINT
+ 	select HAVE_IDE
+@@ -290,7 +290,7 @@ config X86_64_SMP
  
  config X86_32_LAZY_GS
  	def_bool y
@@ -12375,7 +12389,7 @@ index 3bf45a0..7b04039 100644
  
  config ARCH_HWEIGHT_CFLAGS
  	string
-@@ -674,6 +673,7 @@ config SCHED_OMIT_FRAME_POINTER
+@@ -674,6 +674,7 @@ config SCHED_OMIT_FRAME_POINTER
  
  menuconfig HYPERVISOR_GUEST
  	bool "Linux guest support"
@@ -12383,7 +12397,7 @@ index 3bf45a0..7b04039 100644
  	---help---
  	  Say Y here to enable options for running Linux under various hyper-
  	  visors. This option enables basic hypervisor detection and platform
-@@ -1073,6 +1073,7 @@ config VM86
+@@ -1073,6 +1074,7 @@ config VM86
  
  config X86_16BIT
  	bool "Enable support for 16-bit segments" if EXPERT
@@ -12391,7 +12405,7 @@ index 3bf45a0..7b04039 100644
  	default y
  	depends on MODIFY_LDT_SYSCALL
  	---help---
-@@ -1227,6 +1228,7 @@ choice
+@@ -1227,6 +1229,7 @@ choice
  
  config NOHIGHMEM
  	bool "off"
@@ -12399,7 +12413,7 @@ index 3bf45a0..7b04039 100644
  	---help---
  	  Linux can use up to 64 Gigabytes of physical memory on x86 systems.
  	  However, the address space of 32-bit x86 processors is only 4
-@@ -1263,6 +1265,7 @@ config NOHIGHMEM
+@@ -1263,6 +1266,7 @@ config NOHIGHMEM
  
  config HIGHMEM4G
  	bool "4GB"
@@ -12407,7 +12421,7 @@ index 3bf45a0..7b04039 100644
  	---help---
  	  Select this if you have a 32-bit processor and between 1 and 4
  	  gigabytes of physical RAM.
-@@ -1315,7 +1318,7 @@ config PAGE_OFFSET
+@@ -1315,7 +1319,7 @@ config PAGE_OFFSET
  	hex
  	default 0xB0000000 if VMSPLIT_3G_OPT
  	default 0x80000000 if VMSPLIT_2G
@@ -12416,7 +12430,7 @@ index 3bf45a0..7b04039 100644
  	default 0x40000000 if VMSPLIT_1G
  	default 0xC0000000
  	depends on X86_32
-@@ -1336,7 +1339,6 @@ config X86_PAE
+@@ -1336,7 +1340,6 @@ config X86_PAE
  
  config ARCH_PHYS_ADDR_T_64BIT
  	def_bool y
@@ -12424,7 +12438,7 @@ index 3bf45a0..7b04039 100644
  
  config ARCH_DMA_ADDR_T_64BIT
  	def_bool y
-@@ -1467,7 +1469,7 @@ config ARCH_PROC_KCORE_TEXT
+@@ -1467,7 +1470,7 @@ config ARCH_PROC_KCORE_TEXT
  
  config ILLEGAL_POINTER_VALUE
         hex
@@ -12433,7 +12447,7 @@ index 3bf45a0..7b04039 100644
         default 0xdead000000000000 if X86_64
  
  source "mm/Kconfig"
-@@ -1776,6 +1778,7 @@ source kernel/Kconfig.hz
+@@ -1776,6 +1779,7 @@ source kernel/Kconfig.hz
  config KEXEC
  	bool "kexec system call"
  	select KEXEC_CORE
@@ -12441,7 +12455,7 @@ index 3bf45a0..7b04039 100644
  	---help---
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
-@@ -1958,7 +1961,9 @@ config X86_NEED_RELOCS
+@@ -1958,7 +1962,9 @@ config X86_NEED_RELOCS
  
  config PHYSICAL_ALIGN
  	hex "Alignment value to which kernel should be aligned"
@@ -12452,7 +12466,7 @@ index 3bf45a0..7b04039 100644
  	range 0x2000 0x1000000 if X86_32
  	range 0x200000 0x1000000 if X86_64
  	---help---
-@@ -2041,6 +2046,7 @@ config COMPAT_VDSO
+@@ -2041,6 +2047,7 @@ config COMPAT_VDSO
  	def_bool n
  	prompt "Disable the 32-bit vDSO (needed for glibc 2.3.3)"
  	depends on X86_32 || IA32_EMULATION
@@ -12460,7 +12474,7 @@ index 3bf45a0..7b04039 100644
  	---help---
  	  Certain buggy versions of glibc will crash if they are
  	  presented with a 32-bit vDSO that is not mapped at the address
-@@ -2081,15 +2087,6 @@ choice
+@@ -2081,15 +2088,6 @@ choice
  
  	  If unsure, select "Emulate".
  
@@ -12476,7 +12490,7 @@ index 3bf45a0..7b04039 100644
  	config LEGACY_VSYSCALL_EMULATE
  		bool "Emulate"
  		help
-@@ -2170,6 +2167,22 @@ config MODIFY_LDT_SYSCALL
+@@ -2170,6 +2168,22 @@ config MODIFY_LDT_SYSCALL
  
  	  Saying 'N' here may make sense for embedded or server kernels.
  
@@ -12610,20 +12624,6 @@ index 4086abc..52a0a9b 100644
 +*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
 +*** Please upgrade your binutils to 2.18 or newer
 +endef
-diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
-index bbe1a62..ec6a3ec 100644
---- a/arch/x86/boot/Makefile
-+++ b/arch/x86/boot/Makefile
-@@ -58,6 +58,9 @@ clean-files += cpustr.h
- # ---------------------------------------------------------------------------
- 
- KBUILD_CFLAGS	:= $(USERINCLUDE) $(REALMODE_CFLAGS) -D_SETUP
-+ifdef CONSTIFY_PLUGIN
-+KBUILD_CFLAGS	+= -fplugin-arg-constify_plugin-no-constify
-+endif
- KBUILD_AFLAGS	:= $(KBUILD_CFLAGS) -D__ASSEMBLY__
- GCOV_PROFILE := n
- UBSAN_SANITIZE := n
 diff --git a/arch/x86/boot/bitops.h b/arch/x86/boot/bitops.h
 index 878e4b9..20537ab 100644
 --- a/arch/x86/boot/bitops.h
@@ -12660,17 +12660,13 @@ index 9011a88..06aa820 100644
  }
  
 diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
-index f9ce75d..0b1600d 100644
+index f9ce75d..245ea76 100644
 --- a/arch/x86/boot/compressed/Makefile
 +++ b/arch/x86/boot/compressed/Makefile
-@@ -30,6 +30,26 @@ KBUILD_CFLAGS += $(cflags-y)
- KBUILD_CFLAGS += -mno-mmx -mno-sse
+@@ -31,6 +31,23 @@ KBUILD_CFLAGS += -mno-mmx -mno-sse
  KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
  KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
-+ifdef CONSTIFY_PLUGIN
-+KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
-+endif
-+
+ 
 +ifdef CONFIG_DEBUG_INFO
 +ifdef CONFIG_DEBUG_INFO_SPLIT
 +KBUILD_CFLAGS   += $(call cc-option, -gsplit-dwarf, -g)
@@ -12687,9 +12683,10 @@ index f9ce75d..0b1600d 100644
 +KBUILD_CFLAGS 	+= $(call cc-option, -femit-struct-debug-baseonly) \
 +		   $(call cc-option,-fno-var-tracking)
 +endif
- 
++
  KBUILD_AFLAGS  := $(KBUILD_CFLAGS) -D__ASSEMBLY__
  GCOV_PROFILE := n
+ UBSAN_SANITIZE :=n
 diff --git a/arch/x86/boot/compressed/efi_stub_32.S b/arch/x86/boot/compressed/efi_stub_32.S
 index a53440e..c3dbf1e 100644
 --- a/arch/x86/boot/compressed/efi_stub_32.S
@@ -15756,7 +15753,7 @@ index e32206e0..809adae 100644
  
  	.macro REMOVE_PT_GPREGS_FROM_STACK addskip=0
 diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
-index 1a4477c..95199ec4 100644
+index 1a4477c..7061819 100644
 --- a/arch/x86/entry/common.c
 +++ b/arch/x86/entry/common.c
 @@ -32,9 +32,7 @@
@@ -15869,7 +15866,7 @@ index 1a4477c..95199ec4 100644
 +			  [param4] "m" (regs->si),
 +			  [param5] "m" (regs->di),
 +			  [param6] "m" (regs->bp)
-+			: "di", "si", "dx", "cx", "r8", "r9", "memory");
++			: "ax", "di", "si", "dx", "cx", "r8", "r9", "r10", "r11", "memory");
 +#else
 +		asm volatile("pushl %[param6]\n\t"
 +			     "pushl %[param5]\n\t"
@@ -22879,7 +22876,7 @@ index 82c34ee..940fa40 100644
  				unsigned, unsigned, unsigned);
  
 diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
-index c7b5510..2ab8977 100644
+index c7b5510..f6d5ca4 100644
 --- a/arch/x86/include/asm/thread_info.h
 +++ b/arch/x86/include/asm/thread_info.h
 @@ -39,7 +39,7 @@
@@ -22961,7 +22958,7 @@ index c7b5510..2ab8977 100644
  }
  
  static inline unsigned long current_stack_pointer(void)
-@@ -179,14 +182,9 @@ static inline unsigned long current_stack_pointer(void)
+@@ -179,41 +182,9 @@ static inline unsigned long current_stack_pointer(void)
  
  #else /* !__ASSEMBLY__ */
  
@@ -22973,11 +22970,38 @@ index c7b5510..2ab8977 100644
  #define GET_THREAD_INFO(reg) \
 -	_ASM_MOV PER_CPU_VAR(cpu_current_top_of_stack),reg ; \
 -	_ASM_SUB $(THREAD_SIZE),reg ;
+-
+-/*
+- * ASM operand which evaluates to a 'thread_info' address of
+- * the current task, if it is known that "reg" is exactly "off"
+- * bytes below the top of the stack currently.
+- *
+- * ( The kernel stack's size is known at build time, it is usually
+- *   2 or 4 pages, and the bottom  of the kernel stack contains
+- *   the thread_info structure. So to access the thread_info very
+- *   quickly from assembly code we can calculate down from the
+- *   top of the kernel stack to the bottom, using constant,
+- *   build-time calculations only. )
+- *
+- * For example, to fetch the current thread_info->flags value into %eax
+- * on x86-64 defconfig kernels, in syscall entry code where RSP is
+- * currently at exactly SIZEOF_PTREGS bytes away from the top of the
+- * stack:
+- *
+- *      mov ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS), %eax
+- *
+- * will translate to:
+- *
+- *      8b 84 24 b8 c0 ff ff      mov    -0x3f48(%rsp), %eax
+- *
+- * which is below the current RSP by almost 16K.
+- */
+-#define ASM_THREAD_INFO(field, reg, off) ((field)+(off)-THREAD_SIZE)(reg)
 +	_ASM_MOV PER_CPU_VAR(current_tinfo),reg ;
  
- /*
-  * ASM operand which evaluates to a 'thread_info' address of
-@@ -279,5 +277,12 @@ static inline bool is_ia32_task(void)
+ #endif
+ 
+@@ -279,5 +250,12 @@ static inline bool is_ia32_task(void)
  extern void arch_task_cache_init(void);
  extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
  extern void arch_release_task_struct(struct task_struct *tsk);
@@ -25722,7 +25746,7 @@ index 2cad71d..5f1baf2 100644
  	__bts_event_stop(event);
  
 diff --git a/arch/x86/kernel/cpu/perf_event_intel_cqm.c b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
-index a316ca9..99344f4 100644
+index a316ca9..07e219e 100644
 --- a/arch/x86/kernel/cpu/perf_event_intel_cqm.c
 +++ b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
 @@ -1364,7 +1364,9 @@ static int __init intel_cqm_init(void)
@@ -25731,7 +25755,7 @@ index a316ca9..99344f4 100644
  
 -	event_attr_intel_cqm_llc_scale.event_str = str;
 +	pax_open_kernel();
-+	*(const char **)&event_attr_intel_cqm_llc_scale.event_str = str;
++	const_cast(event_attr_intel_cqm_llc_scale.event_str) = str;
 +	pax_close_kernel();
  
  	ret = intel_cqm_setup_rmid_cache();
@@ -25798,7 +25822,7 @@ index 653f88d..11b6b78 100644
  	if (!insn.opcode.got)
  		return X86_BR_ABORT;
 diff --git a/arch/x86/kernel/cpu/perf_event_intel_pt.c b/arch/x86/kernel/cpu/perf_event_intel_pt.c
-index c0bbd10..727ae15e 100644
+index c0bbd10..53a5dc6 100644
 --- a/arch/x86/kernel/cpu/perf_event_intel_pt.c
 +++ b/arch/x86/kernel/cpu/perf_event_intel_pt.c
 @@ -133,14 +133,10 @@ static const struct attribute_group *pt_attr_groups[] = {
@@ -25839,22 +25863,22 @@ index c0bbd10..727ae15e 100644
 +		struct dev_ext_attribute *de_attr = &de_attrs[i];
  
 -		de_attr->attr.attr.name = pt_caps[i].name;
-+		*(const char **)&de_attr->attr.attr.name = pt_caps[i].name;
++		const_cast(de_attr->attr.attr.name) = pt_caps[i].name;
  
  		sysfs_attr_init(&de_attr->attr.attr);
  
 -		de_attr->attr.attr.mode		= S_IRUGO;
 -		de_attr->attr.show		= pt_cap_show;
 -		de_attr->var			= (void *)i;
-+		*(umode_t *)&de_attr->attr.attr.mode	= S_IRUGO;
-+		*(void **)&de_attr->attr.show		= pt_cap_show;
-+		*(void **)&de_attr->var			= (void *)i;
++		const_cast(de_attr->attr.attr.mode)	= S_IRUGO;
++		const_cast(de_attr->attr.show)		= pt_cap_show;
++		const_cast(de_attr->var)		= (void *)i;
  
  		attrs[i] = &de_attr->attr.attr;
  	}
  
 -	pt_cap_group.attrs = attrs;
-+	*(struct attribute ***)&pt_cap_group.attrs = attrs;
++	const_cast(pt_cap_group.attrs) = attrs;
 +	pax_close_kernel();
  
  	return 0;
@@ -27813,7 +27837,7 @@ index 64341aa..b1e6632 100644
 +EXPORT_SYMBOL(cpu_pgd);
 +#endif
 diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
-index be22f5a..c5d0e1f 100644
+index be22f5a..a04fa14 100644
 --- a/arch/x86/kernel/i8259.c
 +++ b/arch/x86/kernel/i8259.c
 @@ -110,7 +110,7 @@ static int i8259A_irq_pending(unsigned int irq)
@@ -27845,10 +27869,10 @@ index be22f5a..c5d0e1f 100644
  		 * when acking.
  		 */
 -		i8259A_chip.irq_mask_ack = disable_8259A_irq;
-+		*(void **)&i8259A_chip.irq_mask_ack = disable_8259A_irq;
++		const_cast(i8259A_chip.irq_mask_ack) = disable_8259A_irq;
  	else
 -		i8259A_chip.irq_mask_ack = mask_and_ack_8259A;
-+		*(void **)&i8259A_chip.irq_mask_ack = mask_and_ack_8259A;
++		const_cast(i8259A_chip.irq_mask_ack) = mask_and_ack_8259A;
 +	pax_close_kernel();
  
  	udelay(100);		/* wait for 8259A to initialize */
@@ -29041,7 +29065,7 @@ index 6d9582e..f746287 100644
  		return;
  	}
 diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
-index 33ee3e0..ca43dee 100644
+index 33ee3e0..6d23e5c 100644
 --- a/arch/x86/kernel/paravirt-spinlocks.c
 +++ b/arch/x86/kernel/paravirt-spinlocks.c
 @@ -23,16 +23,32 @@ bool pv_is_native_spin_unlock(void)
@@ -29058,7 +29082,7 @@ index 33ee3e0..ca43dee 100644
 +static void native_kick(int cpu)
 +{
 +}
-+//#else /* !CONFIG_QUEUED_SPINLOCKS */
++#else /* !CONFIG_QUEUED_SPINLOCKS */
 +static void native_unlock_kick(struct arch_spinlock *lock, __ticket_t ticket)
 +{
 +}
@@ -37439,7 +37463,7 @@ index 4e664bd..2beeaa2 100644
  		return NULL;
  
 diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
-index 1d2e639..d7f0e67 100644
+index 1d2e639..6473b8a 100644
 --- a/arch/x86/oprofile/nmi_int.c
 +++ b/arch/x86/oprofile/nmi_int.c
 @@ -23,6 +23,7 @@
@@ -37467,14 +37491,14 @@ index 1d2e639..d7f0e67 100644
 -		model->num_virt_counters = model->num_counters;
 +	if (!model->num_virt_counters) {
 +		pax_open_kernel();
-+		*(unsigned int *)&model->num_virt_counters = model->num_counters;
++		const_cast(model->num_virt_counters) = model->num_counters;
 +		pax_close_kernel();
 +	}
  
  	mux_init(ops);
  
 diff --git a/arch/x86/oprofile/op_model_amd.c b/arch/x86/oprofile/op_model_amd.c
-index 50d86c0..7985318 100644
+index 50d86c0..b0b9ae0 100644
 --- a/arch/x86/oprofile/op_model_amd.c
 +++ b/arch/x86/oprofile/op_model_amd.c
 @@ -519,9 +519,11 @@ static int op_amd_init(struct oprofile_operations *ops)
@@ -37485,15 +37509,15 @@ index 50d86c0..7985318 100644
 -	op_amd_spec.num_controls = num_counters;
 -	op_amd_spec.num_virt_counters = max(num_counters, NUM_VIRT_COUNTERS);
 +	pax_open_kernel();
-+	*(unsigned int *)&op_amd_spec.num_counters = num_counters;
-+	*(unsigned int *)&op_amd_spec.num_controls = num_counters;
-+	*(unsigned int *)&op_amd_spec.num_virt_counters = max(num_counters, NUM_VIRT_COUNTERS);
++	const_cast(op_amd_spec.num_counters) = num_counters;
++	const_cast(op_amd_spec.num_controls) = num_counters;
++	const_cast(op_amd_spec.num_virt_counters) = max(num_counters, NUM_VIRT_COUNTERS);
 +	pax_close_kernel();
  
  	return 0;
  }
 diff --git a/arch/x86/oprofile/op_model_ppro.c b/arch/x86/oprofile/op_model_ppro.c
-index d90528e..0127e2b 100644
+index d90528e..a44aa09 100644
 --- a/arch/x86/oprofile/op_model_ppro.c
 +++ b/arch/x86/oprofile/op_model_ppro.c
 @@ -19,6 +19,7 @@
@@ -37511,8 +37535,8 @@ index d90528e..0127e2b 100644
 -	op_arch_perfmon_spec.num_counters = num_counters;
 -	op_arch_perfmon_spec.num_controls = num_counters;
 +	pax_open_kernel();
-+	*(unsigned int *)&op_arch_perfmon_spec.num_counters = num_counters;
-+	*(unsigned int *)&op_arch_perfmon_spec.num_controls = num_counters;
++	const_cast(op_arch_perfmon_spec.num_counters) = num_counters;
++	const_cast(op_arch_perfmon_spec.num_controls) = num_counters;
 +	pax_close_kernel();
  }
  
@@ -37808,7 +37832,7 @@ index 9770e55..76067ec 100644
  }
  EXPORT_SYMBOL(pcibios_set_irq_routing);
 diff --git a/arch/x86/pci/vmd.c b/arch/x86/pci/vmd.c
-index d57e480..20eb97a 100644
+index d57e480..fc4db30 100644
 --- a/arch/x86/pci/vmd.c
 +++ b/arch/x86/pci/vmd.c
 @@ -374,7 +374,7 @@ static void vmd_teardown_dma_ops(struct vmd_dev *vmd)
@@ -37816,7 +37840,7 @@ index d57e480..20eb97a 100644
  	do {					\
  		if (source->fn)			\
 -			dest->fn = vmd_##fn;	\
-+			*(void **)&dest->fn = vmd_##fn;	\
++			const_cast(dest->fn) = vmd_##fn;	\
  	} while (0)
  
  static void vmd_setup_dma_ops(struct vmd_dev *vmd)
@@ -38238,20 +38262,6 @@ index 0b7a63d..dff2199 100644
  	trampoline_pgd[511] = init_level4_pgt[511].pgd;
  #endif
  }
-diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile
-index 3e75fcf..4cfefb8 100644
---- a/arch/x86/realmode/rm/Makefile
-+++ b/arch/x86/realmode/rm/Makefile
-@@ -68,6 +68,9 @@ $(obj)/realmode.relocs: $(obj)/realmode.elf FORCE
- 
- KBUILD_CFLAGS	:= $(LINUXINCLUDE) $(REALMODE_CFLAGS) -D_SETUP -D_WAKEUP \
- 		   -I$(srctree)/arch/x86/boot
-+ifdef CONSTIFY_PLUGIN
-+KBUILD_CFLAGS	+= -fplugin-arg-constify_plugin-no-constify
-+endif
- KBUILD_AFLAGS	:= $(KBUILD_CFLAGS) -D__ASSEMBLY__
- GCOV_PROFILE := n
- UBSAN_SANITIZE := n
 diff --git a/arch/x86/realmode/rm/header.S b/arch/x86/realmode/rm/header.S
 index a28221d..93c40f1 100644
 --- a/arch/x86/realmode/rm/header.S
@@ -39659,7 +39669,7 @@ index b719ab3..371e2a6 100644
  enum acpi_battery_files {
  	info_tag = 0,
 diff --git a/drivers/acpi/bgrt.c b/drivers/acpi/bgrt.c
-index a83e3c6..c3d617f 100644
+index a83e3c6..7f4a90b 100644
 --- a/drivers/acpi/bgrt.c
 +++ b/drivers/acpi/bgrt.c
 @@ -86,8 +86,10 @@ static int __init bgrt_init(void)
@@ -39669,8 +39679,8 @@ index a83e3c6..c3d617f 100644
 -	bin_attr_image.private = bgrt_image;
 -	bin_attr_image.size = bgrt_image_size;
 +	pax_open_kernel();
-+	*(void **)&bin_attr_image.private = bgrt_image;
-+	*(size_t *)&bin_attr_image.size = bgrt_image_size;
++	const_cast(bin_attr_image.private) = bgrt_image;
++	const_cast(bin_attr_image.size) = bgrt_image_size;
 +	pax_close_kernel();
  
  	bgrt_kobj = kobject_create_and_add("bgrt", acpi_kobj);
@@ -39966,7 +39976,7 @@ index 7d00b7a..d5fd80d 100644
  	int ret;
  
 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 55e257c..28b9a25 100644
+index 55e257c..554c697 100644
 --- a/drivers/ata/libata-core.c
 +++ b/drivers/ata/libata-core.c
 @@ -103,7 +103,7 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev);
@@ -40009,7 +40019,7 @@ index 55e257c..28b9a25 100644
  			*pp = NULL;
  
 -	ops->inherits = NULL;
-+	*(struct ata_port_operations **)&ops->inherits = NULL;
++	const_cast(ops->inherits) = NULL;
  
 +	pax_close_kernel();
  	spin_unlock(&lock);
@@ -40051,7 +40061,7 @@ index f840ca1..edd6ef3 100644
  extern int libata_fua;
  extern int libata_noacpi;
 diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
-index 80fe0f6..8c0fa3f 100644
+index 80fe0f6..d95a192 100644
 --- a/drivers/ata/pata_arasan_cf.c
 +++ b/drivers/ata/pata_arasan_cf.c
 @@ -864,7 +864,9 @@ static int arasan_cf_probe(struct platform_device *pdev)
@@ -40060,7 +40070,7 @@ index 80fe0f6..8c0fa3f 100644
  		if (quirk & CF_BROKEN_PIO) {
 -			ap->ops->set_piomode = NULL;
 +			pax_open_kernel();
-+			*(void **)&ap->ops->set_piomode = NULL;
++			const_cast(ap->ops->set_piomode) = NULL;
 +			pax_close_kernel();
  			ap->pio_mask = 0;
  		}
@@ -41138,7 +41148,7 @@ index 560751b..3a4847a 100644
  static ssize_t show_node_state(struct device *dev,
  			       struct device_attribute *attr, char *buf)
 diff --git a/drivers/base/platform-msi.c b/drivers/base/platform-msi.c
-index 279e539..b87ed03 100644
+index 279e539..4c9d7fb 100644
 --- a/drivers/base/platform-msi.c
 +++ b/drivers/base/platform-msi.c
 @@ -24,6 +24,8 @@
@@ -41157,10 +41167,10 @@ index 279e539..b87ed03 100644
 +	pax_open_kernel();
  	if (ops->msi_init == NULL)
 -		ops->msi_init = platform_msi_init;
-+		*(void **)&ops->msi_init = platform_msi_init;
++		const_cast(ops->msi_init) = platform_msi_init;
  	if (ops->set_desc == NULL)
 -		ops->set_desc = platform_msi_set_desc;
-+		*(void **)&ops->set_desc = platform_msi_set_desc;
++		const_cast(ops->set_desc) = platform_msi_set_desc;
 +	pax_close_kernel();
  }
  
@@ -41172,25 +41182,25 @@ index 279e539..b87ed03 100644
 +	pax_open_kernel();
  	if (!chip->irq_mask)
 -		chip->irq_mask = irq_chip_mask_parent;
-+		*(void **)&chip->irq_mask = irq_chip_mask_parent;
++		const_cast(chip->irq_mask) = irq_chip_mask_parent;
  	if (!chip->irq_unmask)
 -		chip->irq_unmask = irq_chip_unmask_parent;
-+		*(void **)&chip->irq_unmask = irq_chip_unmask_parent;
++		const_cast(chip->irq_unmask) = irq_chip_unmask_parent;
  	if (!chip->irq_eoi)
 -		chip->irq_eoi = irq_chip_eoi_parent;
-+		*(void **)&chip->irq_eoi = irq_chip_eoi_parent;
++		const_cast(chip->irq_eoi) = irq_chip_eoi_parent;
  	if (!chip->irq_set_affinity)
 -		chip->irq_set_affinity = msi_domain_set_affinity;
-+		*(void **)&chip->irq_set_affinity = msi_domain_set_affinity;
++		const_cast(chip->irq_set_affinity) = msi_domain_set_affinity;
  	if (!chip->irq_write_msi_msg)
 -		chip->irq_write_msi_msg = platform_msi_write_msg;
-+		*(void **)&chip->irq_write_msi_msg = platform_msi_write_msg;
++		const_cast(chip->irq_write_msi_msg) = platform_msi_write_msg;
 +	pax_close_kernel();
  }
  
  static void platform_msi_free_descs(struct device *dev, int base, int nvec)
 diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
-index 0caf92a..cff4879 100644
+index 0caf92a..62c184c 100644
 --- a/drivers/base/power/domain.c
 +++ b/drivers/base/power/domain.c
 @@ -1804,8 +1804,10 @@ int genpd_dev_pm_attach(struct device *dev)
@@ -41200,8 +41210,8 @@ index 0caf92a..cff4879 100644
 -	dev->pm_domain->detach = genpd_dev_pm_detach;
 -	dev->pm_domain->sync = genpd_dev_pm_sync;
 +	pax_open_kernel();
-+	*(void **)&dev->pm_domain->detach = genpd_dev_pm_detach;
-+	*(void **)&dev->pm_domain->sync = genpd_dev_pm_sync;
++	const_cast(dev->pm_domain->detach) = genpd_dev_pm_detach;
++	const_cast(dev->pm_domain->sync) = genpd_dev_pm_sync;
 +	pax_close_kernel();
  
  	mutex_lock(&pd->lock);
@@ -42349,7 +42359,7 @@ index 24a652f..2dffae6 100644
  	int err;
  
 diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c
-index 577cc4b..bfe0c2d 100644
+index 577cc4b..129a13e 100644
 --- a/drivers/bus/arm-cci.c
 +++ b/drivers/bus/arm-cci.c
 @@ -1249,16 +1249,22 @@ static int cci_pmu_init_attrs(struct cci_pmu *cci_pmu, struct platform_device *p
@@ -42358,7 +42368,7 @@ index 577cc4b..bfe0c2d 100644
  			return -ENOMEM;
 -		pmu_event_attr_group.attrs = attrs;
 +		pax_open_kernel();
-+		*(struct attribute ***)&pmu_event_attr_group.attrs = attrs;
++		const_cast(pmu_event_attr_group.attrs) = attrs;
 +		pax_close_kernel();
  	}
  	if (model->nformat_attrs) {
@@ -42368,18 +42378,18 @@ index 577cc4b..bfe0c2d 100644
  			return -ENOMEM;
 -		pmu_format_attr_group.attrs = attrs;
 +		pax_open_kernel();
-+		*(struct attribute ***)&pmu_format_attr_group.attrs = attrs;
++		const_cast(pmu_format_attr_group.attrs) = attrs;
 +		pax_close_kernel();
  	}
 -	pmu_cpumask_attr.var = cci_pmu;
 +	pax_open_kernel();
-+	*(void **)&pmu_cpumask_attr.var = cci_pmu;
++	const_cast(pmu_cpumask_attr.var) = cci_pmu;
 +	pax_close_kernel();
  
  	return 0;
  }
 diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
-index 1b257ea..ea76b22 100644
+index 1b257ea..2280898 100644
 --- a/drivers/cdrom/cdrom.c
 +++ b/drivers/cdrom/cdrom.c
 @@ -610,7 +610,6 @@ int register_cdrom(struct cdrom_device_info *cdi)
@@ -42398,7 +42408,7 @@ index 1b257ea..ea76b22 100644
 -		cdo->generic_packet = cdrom_dummy_generic_packet;
 +	if (!cdo->generic_packet) {
 +		pax_open_kernel();
-+		*(void **)&cdo->generic_packet = cdrom_dummy_generic_packet;
++		const_cast(cdo->generic_packet) = cdrom_dummy_generic_packet;
 +		pax_close_kernel();
 +	}
  
@@ -43150,7 +43160,7 @@ index aa872d2..afeae37 100644
  /**
   * struct samsung_clk_reg_dump: register dump of clock controller registers.
 diff --git a/drivers/clk/socfpga/clk-gate.c b/drivers/clk/socfpga/clk-gate.c
-index aa7a6e6..e67210d 100644
+index aa7a6e6..1e9b426 100644
 --- a/drivers/clk/socfpga/clk-gate.c
 +++ b/drivers/clk/socfpga/clk-gate.c
 @@ -21,6 +21,7 @@
@@ -43177,14 +43187,14 @@ index aa7a6e6..e67210d 100644
 -		gateclk_ops.enable = clk_gate_ops.enable;
 -		gateclk_ops.disable = clk_gate_ops.disable;
 +		pax_open_kernel();
-+		*(void **)&gateclk_ops.enable = clk_gate_ops.enable;
-+		*(void **)&gateclk_ops.disable = clk_gate_ops.disable;
++		const_cast(gateclk_ops.enable) = clk_gate_ops.enable;
++		const_cast(gateclk_ops.disable) = clk_gate_ops.disable;
 +		pax_close_kernel();
  	}
  
  	rc = of_property_read_u32(node, "fixed-divider", &fixed_div);
 diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
-index c7f4631..463813a 100644
+index c7f4631..8d1b7d0 100644
 --- a/drivers/clk/socfpga/clk-pll.c
 +++ b/drivers/clk/socfpga/clk-pll.c
 @@ -20,6 +20,7 @@
@@ -43211,14 +43221,14 @@ index c7f4631..463813a 100644
 -	clk_pll_ops.enable = clk_gate_ops.enable;
 -	clk_pll_ops.disable = clk_gate_ops.disable;
 +	pax_open_kernel();
-+	*(void **)&clk_pll_ops.enable = clk_gate_ops.enable;
-+	*(void **)&clk_pll_ops.disable = clk_gate_ops.disable;
++	const_cast(clk_pll_ops.enable) = clk_gate_ops.enable;
++	const_cast(clk_pll_ops.disable) = clk_gate_ops.disable;
 +	pax_close_kernel();
  
  	clk = clk_register(NULL, &pll_clk->hw.hw);
  	if (WARN_ON(IS_ERR(clk))) {
 diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c
-index b5bcd77..0f7bd99 100644
+index b5bcd77..fc230cb 100644
 --- a/drivers/clk/ti/clk.c
 +++ b/drivers/clk/ti/clk.c
 @@ -25,6 +25,8 @@
@@ -43237,14 +43247,14 @@ index b5bcd77..0f7bd99 100644
 -	ops->clk_readl = clk_memmap_readl;
 -	ops->clk_writel = clk_memmap_writel;
 +	pax_open_kernel();
-+	*(void **)&ops->clk_readl = clk_memmap_readl;
-+	*(void **)&ops->clk_writel = clk_memmap_writel;
++	const_cast(ops->clk_readl) = clk_memmap_readl;
++	const_cast(ops->clk_writel) = clk_memmap_writel;
 +	pax_close_kernel();
  
  	return 0;
  }
 diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
-index 51eef87..d944fa7 100644
+index 51eef87..f530cf9 100644
 --- a/drivers/cpufreq/acpi-cpufreq.c
 +++ b/drivers/cpufreq/acpi-cpufreq.c
 @@ -682,8 +682,11 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
@@ -43255,7 +43265,7 @@ index 51eef87..d944fa7 100644
 -		acpi_cpufreq_driver.flags |= CPUFREQ_CONST_LOOPS;
 +	if (cpu_has(c, X86_FEATURE_CONSTANT_TSC)) {
 +		pax_open_kernel();
-+		*(u8 *)&acpi_cpufreq_driver.flags |= CPUFREQ_CONST_LOOPS;
++		const_cast(acpi_cpufreq_driver.flags) |= CPUFREQ_CONST_LOOPS;
 +		pax_close_kernel();
 +	}
  
@@ -43267,7 +43277,7 @@ index 51eef87..d944fa7 100644
  	case ACPI_ADR_SPACE_FIXED_HARDWARE:
 -		acpi_cpufreq_driver.get = get_cur_freq_on_cpu;
 +		pax_open_kernel();
-+		*(void **)&acpi_cpufreq_driver.get = get_cur_freq_on_cpu;
++		const_cast(acpi_cpufreq_driver.get) = get_cur_freq_on_cpu;
 +		pax_close_kernel();
  		break;
  	default:
@@ -43279,14 +43289,14 @@ index 51eef87..d944fa7 100644
 -		acpi_cpufreq_driver.set_boost = set_boost;
 -		acpi_cpufreq_driver.boost_enabled = boost_state(0);
 +		pax_open_kernel();
-+		*(void **)&acpi_cpufreq_driver.set_boost = set_boost;
-+		*(bool *)&acpi_cpufreq_driver.boost_enabled = boost_state(0);
++		const_cast(acpi_cpufreq_driver.set_boost) = set_boost;
++		const_cast(acpi_cpufreq_driver.boost_enabled) = boost_state(0);
 +		pax_close_kernel();
  
  		cpu_notifier_register_begin();
  
 diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
-index 0ca74d0..15705fb 100644
+index 0ca74d0..1a0d302 100644
 --- a/drivers/cpufreq/cpufreq-dt.c
 +++ b/drivers/cpufreq/cpufreq-dt.c
 @@ -461,7 +461,9 @@ static int dt_cpufreq_probe(struct platform_device *pdev)
@@ -43295,13 +43305,13 @@ index 0ca74d0..15705fb 100644
  
 -	dt_cpufreq_driver.driver_data = dev_get_platdata(&pdev->dev);
 +	pax_open_kernel();
-+	*(void **)&dt_cpufreq_driver.driver_data = dev_get_platdata(&pdev->dev);
++	const_cast(dt_cpufreq_driver.driver_data) = dev_get_platdata(&pdev->dev);
 +	pax_close_kernel();
  
  	ret = cpufreq_register_driver(&dt_cpufreq_driver);
  	if (ret)
 diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
-index e979ec7..a024e16 100644
+index e979ec7..a76375c 100644
 --- a/drivers/cpufreq/cpufreq.c
 +++ b/drivers/cpufreq/cpufreq.c
 @@ -474,12 +474,12 @@ EXPORT_SYMBOL_GPL(cpufreq_freq_transition_end);
@@ -43343,7 +43353,7 @@ index e979ec7..a024e16 100644
  	write_lock_irqsave(&cpufreq_driver_lock, flags);
 -	cpufreq_driver->boost_enabled = state;
 +	pax_open_kernel();
-+	*(bool *)&cpufreq_driver->boost_enabled = state;
++	const_cast(cpufreq_driver->boost_enabled) = state;
 +	pax_close_kernel();
  	write_unlock_irqrestore(&cpufreq_driver_lock, flags);
  
@@ -43352,7 +43362,7 @@ index e979ec7..a024e16 100644
  		write_lock_irqsave(&cpufreq_driver_lock, flags);
 -		cpufreq_driver->boost_enabled = !state;
 +		pax_open_kernel();
-+		*(bool *)&cpufreq_driver->boost_enabled = !state;
++		const_cast(cpufreq_driver->boost_enabled) = !state;
 +		pax_close_kernel();
  		write_unlock_irqrestore(&cpufreq_driver_lock, flags);
  
@@ -43363,7 +43373,7 @@ index e979ec7..a024e16 100644
  
 -	cpufreq_driver->set_boost = cpufreq_boost_set_sw;
 +	pax_open_kernel();
-+	*(void **)&cpufreq_driver->set_boost = cpufreq_boost_set_sw;
++	const_cast(cpufreq_driver->set_boost) = cpufreq_boost_set_sw;
 +	pax_close_kernel();
  
  	/* This will get removed on driver unregister */
@@ -43376,7 +43386,7 @@ index e979ec7..a024e16 100644
 -		driver_data->flags |= CPUFREQ_CONST_LOOPS;
 +	if (driver_data->setpolicy) {
 +		pax_open_kernel();
-+		*(u8 *)&driver_data->flags |= CPUFREQ_CONST_LOOPS;
++		const_cast(driver_data->flags) |= CPUFREQ_CONST_LOOPS;
 +		pax_close_kernel();
 +	}
  
@@ -43445,7 +43455,7 @@ index 91e767a0..3b40724 100644
  	struct dbs_data *dbs_data = _gov##_dbs_cdata.gdbs_data;		\
  	return sprintf(buf, "%u\n", dbs_data->min_sampling_rate);	\
 diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
-index eae5107..26e7a39 100644
+index eae5107..3dd6408 100644
 --- a/drivers/cpufreq/cpufreq_ondemand.c
 +++ b/drivers/cpufreq/cpufreq_ondemand.c
 @@ -534,7 +534,7 @@ static void od_exit(struct dbs_data *dbs_data, bool notify)
@@ -43463,7 +43473,7 @@ index eae5107..26e7a39 100644
  {
 -	od_ops.powersave_bias_target = f;
 +	pax_open_kernel();
-+	*(void **)&od_ops.powersave_bias_target = f;
++	const_cast(od_ops.powersave_bias_target) = f;
 +	pax_close_kernel();
  	od_set_powersave_bias(powersave_bias);
  }
@@ -43473,7 +43483,7 @@ index eae5107..26e7a39 100644
  {
 -	od_ops.powersave_bias_target = generic_powersave_bias_target;
 +	pax_open_kernel();
-+	*(void **)&od_ops.powersave_bias_target = generic_powersave_bias_target;
++	const_cast(od_ops.powersave_bias_target) = generic_powersave_bias_target;
 +	pax_close_kernel();
  	od_set_powersave_bias(0);
  }
@@ -43634,7 +43644,7 @@ index e895123..05de99b 100644
  
  #if IS_ENABLED(CONFIG_ACPI)
 diff --git a/drivers/cpufreq/p4-clockmod.c b/drivers/cpufreq/p4-clockmod.c
-index 5dd95da..abc3837 100644
+index 5dd95da..ac41e5e 100644
 --- a/drivers/cpufreq/p4-clockmod.c
 +++ b/drivers/cpufreq/p4-clockmod.c
 @@ -134,10 +134,14 @@ static unsigned int cpufreq_p4_get_frequency(struct cpuinfo_x86 *c)
@@ -43643,13 +43653,13 @@ index 5dd95da..abc3837 100644
  		case 0x1C: /* Atom */
 -			p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
 +			pax_open_kernel();
-+			*(u8 *)&p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
++			const_cast(p4clockmod_driver.flags) |= CPUFREQ_CONST_LOOPS;
 +			pax_close_kernel();
  			return speedstep_get_frequency(SPEEDSTEP_CPU_PCORE);
  		case 0x0D: /* Pentium M (Dothan) */
 -			p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
 +			pax_open_kernel();
-+			*(u8 *)&p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
++			const_cast(p4clockmod_driver.flags) |= CPUFREQ_CONST_LOOPS;
 +			pax_close_kernel();
  			/* fall through */
  		case 0x09: /* Pentium M (Banias) */
@@ -43660,7 +43670,7 @@ index 5dd95da..abc3837 100644
  	 * throttling is active or not. */
 -	p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
 +	pax_open_kernel();
-+	*(u8 *)&p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
++	const_cast(p4clockmod_driver.flags) |= CPUFREQ_CONST_LOOPS;
 +	pax_close_kernel();
  
  	if (speedstep_detect_processor() == SPEEDSTEP_CPU_P4M) {
@@ -43776,7 +43786,7 @@ index 9bb42ba..b01b4a2 100644
  
  MODULE_AUTHOR("David S. Miller <davem@××××××.com>");
 diff --git a/drivers/cpufreq/speedstep-centrino.c b/drivers/cpufreq/speedstep-centrino.c
-index 7d4a315..21bb886 100644
+index 7d4a315..ce41fb3 100644
 --- a/drivers/cpufreq/speedstep-centrino.c
 +++ b/drivers/cpufreq/speedstep-centrino.c
 @@ -351,8 +351,11 @@ static int centrino_cpu_init(struct cpufreq_policy *policy)
@@ -43787,7 +43797,7 @@ index 7d4a315..21bb886 100644
 -		centrino_driver.flags |= CPUFREQ_CONST_LOOPS;
 +	if (cpu_has(cpu, X86_FEATURE_CONSTANT_TSC)) {
 +		pax_open_kernel();
-+		*(u8 *)&centrino_driver.flags |= CPUFREQ_CONST_LOOPS;
++		const_cast(centrino_driver.flags) |= CPUFREQ_CONST_LOOPS;
 +		pax_close_kernel();
 +	}
  
@@ -44575,7 +44585,7 @@ index 94a58a0..5b8dd03 100644
  };
  
 diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 88bebe1..c7b636f 100644
+index 88bebe1..e599fad 100644
 --- a/drivers/firmware/dmi_scan.c
 +++ b/drivers/firmware/dmi_scan.c
 @@ -712,14 +712,18 @@ static int __init dmi_init(void)
@@ -44585,8 +44595,8 @@ index 88bebe1..c7b636f 100644
 -	bin_attr_smbios_entry_point.size = smbios_entry_point_size;
 -	bin_attr_smbios_entry_point.private = smbios_entry_point;
 +	pax_open_kernel();
-+	*(size_t *)&bin_attr_smbios_entry_point.size = smbios_entry_point_size;
-+	*(void **)&bin_attr_smbios_entry_point.private = smbios_entry_point;
++	const_cast(bin_attr_smbios_entry_point.size) = smbios_entry_point_size;
++	const_cast(bin_attr_smbios_entry_point.private) = smbios_entry_point;
 +	pax_close_kernel();
  	ret = sysfs_create_bin_file(tables_kobj, &bin_attr_smbios_entry_point);
  	if (ret)
@@ -44595,8 +44605,8 @@ index 88bebe1..c7b636f 100644
 -	bin_attr_DMI.size = dmi_len;
 -	bin_attr_DMI.private = dmi_table;
 +	pax_open_kernel();
-+	*(size_t *)&bin_attr_DMI.size = dmi_len;
-+	*(void **)&bin_attr_DMI.private = dmi_table;
++	const_cast(bin_attr_DMI.size) = dmi_len;
++	const_cast(bin_attr_DMI.private) = dmi_table;
 +	pax_close_kernel();
  	ret = sysfs_create_bin_file(tables_kobj, &bin_attr_DMI);
  	if (!ret)
@@ -44623,7 +44633,7 @@ index d425374..1da1716 100644
  EXPORT_SYMBOL_GPL(cper_next_record_id);
  
 diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
-index c51f3b2..d1cc54e 100644
+index c51f3b2..54523fd 100644
 --- a/drivers/firmware/efi/efi.c
 +++ b/drivers/firmware/efi/efi.c
 @@ -176,15 +176,17 @@ static struct attribute_group efi_subsys_attr_group = {
@@ -44641,11 +44651,11 @@ index c51f3b2..d1cc54e 100644
 -	generic_ops.get_next_variable = efi.get_next_variable;
 -	generic_ops.query_variable_store = efi_query_variable_store;
 +	pax_open_kernel();
-+	*(void **)&generic_ops.get_variable = efi.get_variable;
-+	*(void **)&generic_ops.set_variable = efi.set_variable;
-+	*(void **)&generic_ops.set_variable_nonblocking = efi.set_variable_nonblocking;
-+	*(void **)&generic_ops.get_next_variable = efi.get_next_variable;
-+	*(void **)&generic_ops.query_variable_store = efi_query_variable_store;
++	const_cast(generic_ops.get_variable) = efi.get_variable;
++	const_cast(generic_ops.set_variable) = efi.set_variable;
++	const_cast(generic_ops.set_variable_nonblocking) = efi.set_variable_nonblocking;
++	const_cast(generic_ops.get_next_variable) = efi.get_next_variable;
++	const_cast(generic_ops.query_variable_store) = efi_query_variable_store;
 +	pax_close_kernel();
  
  	return efivars_register(&generic_efivars, &generic_ops, efi_kobj);
@@ -44690,7 +44700,7 @@ index f1ab05e..ab51228 100644
  		.ident = "Google Board",
  		.matches = {
 diff --git a/drivers/firmware/google/memconsole.c b/drivers/firmware/google/memconsole.c
-index 2f569aa..26e4f39 100644
+index 2f569aa..3af5497 100644
 --- a/drivers/firmware/google/memconsole.c
 +++ b/drivers/firmware/google/memconsole.c
 @@ -136,7 +136,7 @@ static bool __init found_memconsole(void)
@@ -44708,7 +44718,7 @@ index 2f569aa..26e4f39 100644
  
 -	memconsole_bin_attr.size = memconsole_length;
 +	pax_open_kernel();
-+	*(size_t *)&memconsole_bin_attr.size = memconsole_length;
++	const_cast(memconsole_bin_attr.size) = memconsole_length;
 +	pax_close_kernel();
 +
  	return sysfs_create_bin_file(firmware_kobj, &memconsole_bin_attr);
@@ -44840,7 +44850,7 @@ index ac8deb0..f3caa10 100644
  	return -EINVAL;
  }
 diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
-index 5c1ba87..ab4a059 100644
+index 5c1ba87..f711915 100644
 --- a/drivers/gpio/gpiolib.c
 +++ b/drivers/gpio/gpiolib.c
 @@ -669,8 +669,10 @@ static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip)
@@ -44850,8 +44860,8 @@ index 5c1ba87..ab4a059 100644
 -		gpiochip->irqchip->irq_request_resources = NULL;
 -		gpiochip->irqchip->irq_release_resources = NULL;
 +		pax_open_kernel();
-+		*(void **)&gpiochip->irqchip->irq_request_resources = NULL;
-+		*(void **)&gpiochip->irqchip->irq_release_resources = NULL;
++		const_cast(gpiochip->irqchip->irq_request_resources) = NULL;
++		const_cast(gpiochip->irqchip->irq_release_resources) = NULL;
 +		pax_close_kernel();
  		gpiochip->irqchip = NULL;
  	}
@@ -44863,8 +44873,8 @@ index 5c1ba87..ab4a059 100644
 -		irqchip->irq_request_resources = gpiochip_irq_reqres;
 -		irqchip->irq_release_resources = gpiochip_irq_relres;
 +		pax_open_kernel();
-+		*(void **)&irqchip->irq_request_resources = gpiochip_irq_reqres;
-+		*(void **)&irqchip->irq_release_resources = gpiochip_irq_relres;
++		const_cast(irqchip->irq_request_resources) = gpiochip_irq_reqres;
++		const_cast(irqchip->irq_release_resources) = gpiochip_irq_relres;
 +		pax_close_kernel();
  	}
  
@@ -45050,7 +45060,7 @@ index 51bfc11..4d4112a 100644
  
  static const struct vga_switcheroo_client_ops amdgpu_switcheroo_ops = {
 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
-index 9ef1db8..bfd5d78 100644
+index 9ef1db8..5eec19b 100644
 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
 @@ -495,7 +495,7 @@ static struct drm_driver kms_driver = {
@@ -45082,7 +45092,7 @@ index 9ef1db8..bfd5d78 100644
 -	driver->num_ioctls = amdgpu_max_kms_ioctl;
 +
 +	pax_open_kernel();
-+	*(int *)&kms_driver.num_ioctls = amdgpu_max_kms_ioctl;
++	const_cast(kms_driver.num_ioctls) = amdgpu_max_kms_ioctl;
 +	pax_close_kernel();
 +
  	amdgpu_register_atpx_handler();
@@ -46288,7 +46298,7 @@ index d918567..6cfd904 100644
  /**
   * Determine if the device really is AGP or not.
 diff --git a/drivers/gpu/drm/i810/i810_drv.c b/drivers/gpu/drm/i810/i810_drv.c
-index 44f4a13..0063c1b 100644
+index 44f4a13..af9f6f5 100644
 --- a/drivers/gpu/drm/i810/i810_drv.c
 +++ b/drivers/gpu/drm/i810/i810_drv.c
 @@ -87,7 +87,11 @@ static int __init i810_init(void)
@@ -46298,7 +46308,7 @@ index 44f4a13..0063c1b 100644
 -	driver.num_ioctls = i810_max_ioctl;
 +
 +	pax_open_kernel();
-+	*(int *)&driver.num_ioctls = i810_max_ioctl;
++	const_cast(driver.num_ioctls) = i810_max_ioctl;
 +	pax_close_kernel();
 +
  	return drm_pci_init(&driver, &i810_pci_driver);
@@ -46547,7 +46557,7 @@ index 97f3a56..32c712e 100644
  		ret = drm_ioctl(filp, cmd, arg);
  
 diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index fa8afa7..0bac957 100644
+index fa8afa7..7375300 100644
 --- a/drivers/gpu/drm/i915/i915_irq.c
 +++ b/drivers/gpu/drm/i915/i915_irq.c
 @@ -4490,14 +4490,15 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
@@ -46558,14 +46568,14 @@ index fa8afa7..0bac957 100644
  	if (IS_GEN2(dev_priv)) {
  		dev->max_vblank_count = 0;
 -		dev->driver->get_vblank_counter = i8xx_get_vblank_counter;
-+		*(void **)&dev->driver->get_vblank_counter = i8xx_get_vblank_counter;
++		const_cast(dev->driver->get_vblank_counter) = i8xx_get_vblank_counter;
  	} else if (IS_G4X(dev_priv) || INTEL_INFO(dev_priv)->gen >= 5) {
  		dev->max_vblank_count = 0xffffffff; /* full 32 bit counter */
 -		dev->driver->get_vblank_counter = g4x_get_vblank_counter;
-+		*(void **)&dev->driver->get_vblank_counter = g4x_get_vblank_counter;
++		const_cast(dev->driver->get_vblank_counter) = g4x_get_vblank_counter;
  	} else {
 -		dev->driver->get_vblank_counter = i915_get_vblank_counter;
-+		*(void **)&dev->driver->get_vblank_counter = i915_get_vblank_counter;
++		const_cast(dev->driver->get_vblank_counter) = i915_get_vblank_counter;
  		dev->max_vblank_count = 0xffffff; /* only 24 bits of frame count */
  	}
  
@@ -46575,8 +46585,8 @@ index fa8afa7..0bac957 100644
  
 -	dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
 -	dev->driver->get_scanout_position = i915_get_crtc_scanoutpos;
-+	*(void **)&dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
-+	*(void **)&dev->driver->get_scanout_position = i915_get_crtc_scanoutpos;
++	const_cast(dev->driver->get_vblank_timestamp) = i915_get_vblank_timestamp;
++	const_cast(dev->driver->get_scanout_position) = i915_get_crtc_scanoutpos;
  
  	if (IS_CHERRYVIEW(dev_priv)) {
 -		dev->driver->irq_handler = cherryview_irq_handler;
@@ -46585,12 +46595,12 @@ index fa8afa7..0bac957 100644
 -		dev->driver->irq_uninstall = cherryview_irq_uninstall;
 -		dev->driver->enable_vblank = valleyview_enable_vblank;
 -		dev->driver->disable_vblank = valleyview_disable_vblank;
-+		*(void **)&dev->driver->irq_handler = cherryview_irq_handler;
-+		*(void **)&dev->driver->irq_preinstall = cherryview_irq_preinstall;
-+		*(void **)&dev->driver->irq_postinstall = cherryview_irq_postinstall;
-+		*(void **)&dev->driver->irq_uninstall = cherryview_irq_uninstall;
-+		*(void **)&dev->driver->enable_vblank = valleyview_enable_vblank;
-+		*(void **)&dev->driver->disable_vblank = valleyview_disable_vblank;
++		const_cast(dev->driver->irq_handler) = cherryview_irq_handler;
++		const_cast(dev->driver->irq_preinstall) = cherryview_irq_preinstall;
++		const_cast(dev->driver->irq_postinstall) = cherryview_irq_postinstall;
++		const_cast(dev->driver->irq_uninstall) = cherryview_irq_uninstall;
++		const_cast(dev->driver->enable_vblank) = valleyview_enable_vblank;
++		const_cast(dev->driver->disable_vblank) = valleyview_disable_vblank;
  		dev_priv->display.hpd_irq_setup = i915_hpd_irq_setup;
  	} else if (IS_VALLEYVIEW(dev_priv)) {
 -		dev->driver->irq_handler = valleyview_irq_handler;
@@ -46599,12 +46609,12 @@ index fa8afa7..0bac957 100644
 -		dev->driver->irq_uninstall = valleyview_irq_uninstall;
 -		dev->driver->enable_vblank = valleyview_enable_vblank;
 -		dev->driver->disable_vblank = valleyview_disable_vblank;
-+		*(void **)&dev->driver->irq_handler = valleyview_irq_handler;
-+		*(void **)&dev->driver->irq_preinstall = valleyview_irq_preinstall;
-+		*(void **)&dev->driver->irq_postinstall = valleyview_irq_postinstall;
-+		*(void **)&dev->driver->irq_uninstall = valleyview_irq_uninstall;
-+		*(void **)&dev->driver->enable_vblank = valleyview_enable_vblank;
-+		*(void **)&dev->driver->disable_vblank = valleyview_disable_vblank;
++		const_cast(dev->driver->irq_handler) = valleyview_irq_handler;
++		const_cast(dev->driver->irq_preinstall) = valleyview_irq_preinstall;
++		const_cast(dev->driver->irq_postinstall) = valleyview_irq_postinstall;
++		const_cast(dev->driver->irq_uninstall) = valleyview_irq_uninstall;
++		const_cast(dev->driver->enable_vblank) = valleyview_enable_vblank;
++		const_cast(dev->driver->disable_vblank) = valleyview_disable_vblank;
  		dev_priv->display.hpd_irq_setup = i915_hpd_irq_setup;
  	} else if (INTEL_INFO(dev_priv)->gen >= 8) {
 -		dev->driver->irq_handler = gen8_irq_handler;
@@ -46613,12 +46623,12 @@ index fa8afa7..0bac957 100644
 -		dev->driver->irq_uninstall = gen8_irq_uninstall;
 -		dev->driver->enable_vblank = gen8_enable_vblank;
 -		dev->driver->disable_vblank = gen8_disable_vblank;
-+		*(void **)&dev->driver->irq_handler = gen8_irq_handler;
-+		*(void **)&dev->driver->irq_preinstall = gen8_irq_reset;
-+		*(void **)&dev->driver->irq_postinstall = gen8_irq_postinstall;
-+		*(void **)&dev->driver->irq_uninstall = gen8_irq_uninstall;
-+		*(void **)&dev->driver->enable_vblank = gen8_enable_vblank;
-+		*(void **)&dev->driver->disable_vblank = gen8_disable_vblank;
++		const_cast(dev->driver->irq_handler) = gen8_irq_handler;
++		const_cast(dev->driver->irq_preinstall) = gen8_irq_reset;
++		const_cast(dev->driver->irq_postinstall) = gen8_irq_postinstall;
++		const_cast(dev->driver->irq_uninstall) = gen8_irq_uninstall;
++		const_cast(dev->driver->enable_vblank) = gen8_enable_vblank;
++		const_cast(dev->driver->disable_vblank) = gen8_disable_vblank;
  		if (IS_BROXTON(dev))
  			dev_priv->display.hpd_irq_setup = bxt_hpd_irq_setup;
  		else if (HAS_PCH_SPT(dev))
@@ -46632,12 +46642,12 @@ index fa8afa7..0bac957 100644
 -		dev->driver->irq_uninstall = ironlake_irq_uninstall;
 -		dev->driver->enable_vblank = ironlake_enable_vblank;
 -		dev->driver->disable_vblank = ironlake_disable_vblank;
-+		*(void **)&dev->driver->irq_handler = ironlake_irq_handler;
-+		*(void **)&dev->driver->irq_preinstall = ironlake_irq_reset;
-+		*(void **)&dev->driver->irq_postinstall = ironlake_irq_postinstall;
-+		*(void **)&dev->driver->irq_uninstall = ironlake_irq_uninstall;
-+		*(void **)&dev->driver->enable_vblank = ironlake_enable_vblank;
-+		*(void **)&dev->driver->disable_vblank = ironlake_disable_vblank;
++		const_cast(dev->driver->irq_handler) = ironlake_irq_handler;
++		const_cast(dev->driver->irq_preinstall) = ironlake_irq_reset;
++		const_cast(dev->driver->irq_postinstall) = ironlake_irq_postinstall;
++		const_cast(dev->driver->irq_uninstall) = ironlake_irq_uninstall;
++		const_cast(dev->driver->enable_vblank) = ironlake_enable_vblank;
++		const_cast(dev->driver->disable_vblank) = ironlake_disable_vblank;
  		dev_priv->display.hpd_irq_setup = ilk_hpd_irq_setup;
  	} else {
  		if (INTEL_INFO(dev_priv)->gen == 2) {
@@ -46645,42 +46655,42 @@ index fa8afa7..0bac957 100644
 -			dev->driver->irq_postinstall = i8xx_irq_postinstall;
 -			dev->driver->irq_handler = i8xx_irq_handler;
 -			dev->driver->irq_uninstall = i8xx_irq_uninstall;
-+			*(void **)&dev->driver->irq_preinstall = i8xx_irq_preinstall;
-+			*(void **)&dev->driver->irq_postinstall = i8xx_irq_postinstall;
-+			*(void **)&dev->driver->irq_handler = i8xx_irq_handler;
-+			*(void **)&dev->driver->irq_uninstall = i8xx_irq_uninstall;
++			const_cast(dev->driver->irq_preinstall) = i8xx_irq_preinstall;
++			const_cast(dev->driver->irq_postinstall) = i8xx_irq_postinstall;
++			const_cast(dev->driver->irq_handler) = i8xx_irq_handler;
++			const_cast(dev->driver->irq_uninstall) = i8xx_irq_uninstall;
  		} else if (INTEL_INFO(dev_priv)->gen == 3) {
 -			dev->driver->irq_preinstall = i915_irq_preinstall;
 -			dev->driver->irq_postinstall = i915_irq_postinstall;
 -			dev->driver->irq_uninstall = i915_irq_uninstall;
 -			dev->driver->irq_handler = i915_irq_handler;
-+			*(void **)&dev->driver->irq_preinstall = i915_irq_preinstall;
-+			*(void **)&dev->driver->irq_postinstall = i915_irq_postinstall;
-+			*(void **)&dev->driver->irq_uninstall = i915_irq_uninstall;
-+			*(void **)&dev->driver->irq_handler = i915_irq_handler;
++			const_cast(dev->driver->irq_preinstall) = i915_irq_preinstall;
++			const_cast(dev->driver->irq_postinstall) = i915_irq_postinstall;
++			const_cast(dev->driver->irq_uninstall) = i915_irq_uninstall;
++			const_cast(dev->driver->irq_handler) = i915_irq_handler;
  		} else {
 -			dev->driver->irq_preinstall = i965_irq_preinstall;
 -			dev->driver->irq_postinstall = i965_irq_postinstall;
 -			dev->driver->irq_uninstall = i965_irq_uninstall;
 -			dev->driver->irq_handler = i965_irq_handler;
-+			*(void **)&dev->driver->irq_preinstall = i965_irq_preinstall;
-+			*(void **)&dev->driver->irq_postinstall = i965_irq_postinstall;
-+			*(void **)&dev->driver->irq_uninstall = i965_irq_uninstall;
-+			*(void **)&dev->driver->irq_handler = i965_irq_handler;
++			const_cast(dev->driver->irq_preinstall) = i965_irq_preinstall;
++			const_cast(dev->driver->irq_postinstall) = i965_irq_postinstall;
++			const_cast(dev->driver->irq_uninstall) = i965_irq_uninstall;
++			const_cast(dev->driver->irq_handler) = i965_irq_handler;
  		}
  		if (I915_HAS_HOTPLUG(dev_priv))
  			dev_priv->display.hpd_irq_setup = i915_hpd_irq_setup;
 -		dev->driver->enable_vblank = i915_enable_vblank;
 -		dev->driver->disable_vblank = i915_disable_vblank;
-+		*(void **)&dev->driver->enable_vblank = i915_enable_vblank;
-+		*(void **)&dev->driver->disable_vblank = i915_disable_vblank;
++		const_cast(dev->driver->enable_vblank) = i915_enable_vblank;
++		const_cast(dev->driver->disable_vblank) = i915_disable_vblank;
  	}
 +	pax_close_kernel();
  }
  
  /**
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 39b00b9..aa9fc8a 100644
+index 39b00b9..244538d 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
 @@ -15111,13 +15111,13 @@ struct intel_quirk {
@@ -46693,8 +46703,9 @@ index 39b00b9..aa9fc8a 100644
  /* For systems that don't have a meaningful PCI subdevice/subvendor ID */
  struct intel_dmi_quirk {
  	void (*hook)(struct drm_device *dev);
- 	const struct dmi_system_id (*dmi_id_list)[];
+-	const struct dmi_system_id (*dmi_id_list)[];
 -};
++	const struct dmi_system_id *dmi_id_list;
 +} __do_const;
  
  static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
@@ -46726,10 +46737,19 @@ index 39b00b9..aa9fc8a 100644
 +
 +static const struct intel_dmi_quirk intel_dmi_quirks[] = {
 +	{
-+		.dmi_id_list = &intel_dmi_quirks_table,
++		.dmi_id_list = intel_dmi_quirks_table,
  		.hook = quirk_invert_brightness,
  	},
  };
+@@ -15219,7 +15221,7 @@ static void intel_init_quirks(struct drm_device *dev)
+ 			q->hook(dev);
+ 	}
+ 	for (i = 0; i < ARRAY_SIZE(intel_dmi_quirks); i++) {
+-		if (dmi_check_system(*intel_dmi_quirks[i].dmi_id_list) != 0)
++		if (dmi_check_system(intel_dmi_quirks[i].dmi_id_list) != 0)
+ 			intel_dmi_quirks[i].hook(dev);
+ 	}
+ }
 diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c
 index 2f57d79..7152e6e 100644
 --- a/drivers/gpu/drm/imx/imx-drm-core.c
@@ -46744,7 +46764,7 @@ index 2f57d79..7152e6e 100644
  
  	imx_drm_crtc = kzalloc(sizeof(*imx_drm_crtc), GFP_KERNEL);
 diff --git a/drivers/gpu/drm/mga/mga_drv.c b/drivers/gpu/drm/mga/mga_drv.c
-index 5e2f131..d227dbc 100644
+index 5e2f131..c134c7c 100644
 --- a/drivers/gpu/drm/mga/mga_drv.c
 +++ b/drivers/gpu/drm/mga/mga_drv.c
 @@ -92,7 +92,10 @@ static struct pci_driver mga_pci_driver = {
@@ -46753,7 +46773,7 @@ index 5e2f131..d227dbc 100644
  {
 -	driver.num_ioctls = mga_max_ioctl;
 +	pax_open_kernel();
-+	*(int *)&driver.num_ioctls = mga_max_ioctl;
++	const_cast(driver.num_ioctls) = mga_max_ioctl;
 +	pax_close_kernel();
 +
  	return drm_pci_init(&driver, &mga_pci_driver);
@@ -47140,7 +47160,7 @@ index fe4c222..48b7b75 100644
  	omap_irq.o \
  	omap_debugfs.o \
 diff --git a/drivers/gpu/drm/omapdrm/dss/display.c b/drivers/gpu/drm/omapdrm/dss/display.c
-index ef5b902..47cf7f5 100644
+index ef5b902..2ae011b 100644
 --- a/drivers/gpu/drm/omapdrm/dss/display.c
 +++ b/drivers/gpu/drm/omapdrm/dss/display.c
 @@ -161,12 +161,14 @@ int omapdss_register_display(struct omap_dss_device *dssdev)
@@ -47150,13 +47170,13 @@ index ef5b902..47cf7f5 100644
 +	pax_open_kernel();
  	if (drv && drv->get_resolution == NULL)
 -		drv->get_resolution = omapdss_default_get_resolution;
-+		*(void **)&drv->get_resolution = omapdss_default_get_resolution;
++		const_cast(drv->get_resolution) = omapdss_default_get_resolution;
  	if (drv && drv->get_recommended_bpp == NULL)
 -		drv->get_recommended_bpp = omapdss_default_get_recommended_bpp;
-+		*(void **)&drv->get_recommended_bpp = omapdss_default_get_recommended_bpp;
++		const_cast(drv->get_recommended_bpp) = omapdss_default_get_recommended_bpp;
  	if (drv && drv->get_timings == NULL)
 -		drv->get_timings = omapdss_default_get_timings;
-+		*(void **)&drv->get_timings = omapdss_default_get_timings;
++		const_cast(drv->get_timings) = omapdss_default_get_timings;
 +	pax_close_kernel();
  
  	mutex_lock(&panel_list_mutex);
@@ -47232,7 +47252,7 @@ index 47e5264..3393741 100644
  {
  	struct drm_device *ddev = connector->dev;
 diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c
-index 7307b07..8eecdd0 100644
+index 7307b07..3346540 100644
 --- a/drivers/gpu/drm/qxl/qxl_drv.c
 +++ b/drivers/gpu/drm/qxl/qxl_drv.c
 @@ -37,7 +37,7 @@
@@ -47251,7 +47271,7 @@ index 7307b07..8eecdd0 100644
 -	qxl_driver.num_ioctls = qxl_max_ioctls;
 +
 +	pax_open_kernel();
-+	*(int *)&qxl_driver.num_ioctls = qxl_max_ioctls;
++	const_cast(qxl_driver.num_ioctls) = qxl_max_ioctls;
 +	pax_close_kernel();
 +
  	return drm_pci_init(&qxl_driver, &qxl_pci_driver);
@@ -47362,7 +47382,7 @@ index 0bf1e20..42a7310 100644
  	ret = drm_irq_install(qdev->ddev, qdev->ddev->pdev->irq);
  	qdev->ram_header->int_mask = QXL_INTERRUPT_MASK;
 diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
-index 9534127..3fbab8c 100644
+index 9534127..1d17b3f 100644
 --- a/drivers/gpu/drm/qxl/qxl_ttm.c
 +++ b/drivers/gpu/drm/qxl/qxl_ttm.c
 @@ -103,7 +103,7 @@ static void qxl_ttm_global_fini(struct qxl_device *qdev)
@@ -47416,8 +47436,8 @@ index 9534127..3fbab8c 100644
 -		else
 -			qxl_mem_types_list[i].data = qdev->mman.bdev.man[TTM_PL_PRIV0].priv;
 +	pax_open_kernel();
-+	*(void **)&qxl_mem_types_list[0].data = qdev->mman.bdev.man[TTM_PL_VRAM].priv;
-+	*(void **)&qxl_mem_types_list[1].data = qdev->mman.bdev.man[TTM_PL_PRIV0].priv;
++	const_cast(qxl_mem_types_list[0].data) = qdev->mman.bdev.man[TTM_PL_VRAM].priv;
++	const_cast(qxl_mem_types_list[1].data) = qdev->mman.bdev.man[TTM_PL_PRIV0].priv;
 +	pax_close_kernel();
  
 -	}
@@ -47440,7 +47460,7 @@ index 14fd83b5f..b2acbd19 100644
  	/* We don't support anything other than bus-mastering ring mode,
  	 * but the ring can be in either AGP or PCI space for the ring
 diff --git a/drivers/gpu/drm/r128/r128_drv.c b/drivers/gpu/drm/r128/r128_drv.c
-index c57b4de..2614d79 100644
+index c57b4de..1a875fb 100644
 --- a/drivers/gpu/drm/r128/r128_drv.c
 +++ b/drivers/gpu/drm/r128/r128_drv.c
 @@ -94,7 +94,9 @@ static struct pci_driver r128_pci_driver = {
@@ -47449,7 +47469,7 @@ index c57b4de..2614d79 100644
  {
 -	driver.num_ioctls = r128_max_ioctl;
 +	pax_open_kernel();
-+	*(int *)&driver.num_ioctls = r128_max_ioctl;
++	const_cast(driver.num_ioctls) = r128_max_ioctl;
 +	pax_close_kernel();
  
  	return drm_pci_init(&driver, &r128_pci_driver);
@@ -47659,7 +47679,7 @@ index 4197ca1..f07709e 100644
  
  static const struct vga_switcheroo_client_ops radeon_switcheroo_ops = {
 diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
-index e266ffc..0392d08 100644
+index e266ffc..e510e3f 100644
 --- a/drivers/gpu/drm/radeon/radeon_drv.c
 +++ b/drivers/gpu/drm/radeon/radeon_drv.c
 @@ -130,7 +130,7 @@ extern int radeon_get_crtc_scanoutpos(struct drm_device *dev, unsigned int crtc,
@@ -47688,7 +47708,7 @@ index e266ffc..0392d08 100644
 -		driver->num_ioctls = radeon_max_kms_ioctl;
 +
 +		pax_open_kernel();
-+		*(int *)&driver->num_ioctls = radeon_max_kms_ioctl;
++		const_cast(driver->num_ioctls) = radeon_max_kms_ioctl;
 +		pax_close_kernel();
 +
  		radeon_register_atpx_handler();
@@ -47808,7 +47828,7 @@ index d47dff9..0752202 100644
 -int savage_max_ioctl = ARRAY_SIZE(savage_ioctls);
 +const int savage_max_ioctl = ARRAY_SIZE(savage_ioctls);
 diff --git a/drivers/gpu/drm/savage/savage_drv.c b/drivers/gpu/drm/savage/savage_drv.c
-index 21aed1f..5db7419 100644
+index 21aed1f..85d23a0 100644
 --- a/drivers/gpu/drm/savage/savage_drv.c
 +++ b/drivers/gpu/drm/savage/savage_drv.c
 @@ -76,7 +76,10 @@ static struct pci_driver savage_pci_driver = {
@@ -47817,7 +47837,7 @@ index 21aed1f..5db7419 100644
  {
 -	driver.num_ioctls = savage_max_ioctl;
 +	pax_open_kernel();
-+	*(int *)&driver.num_ioctls = savage_max_ioctl;
++	const_cast(driver.num_ioctls) = savage_max_ioctl;
 +	pax_close_kernel();
 +
  	return drm_pci_init(&driver, &savage_pci_driver);
@@ -47837,7 +47857,7 @@ index 37b6995..9b31aaf 100644
  #define S3_SAVAGE3D_SERIES(chip)  ((chip>=S3_SAVAGE3D) && (chip<=S3_SAVAGE_MX))
  
 diff --git a/drivers/gpu/drm/sis/sis_drv.c b/drivers/gpu/drm/sis/sis_drv.c
-index 79bce76..4fd9a20 100644
+index 79bce76..6c02219 100644
 --- a/drivers/gpu/drm/sis/sis_drv.c
 +++ b/drivers/gpu/drm/sis/sis_drv.c
 @@ -128,7 +128,10 @@ static struct pci_driver sis_pci_driver = {
@@ -47846,7 +47866,7 @@ index 79bce76..4fd9a20 100644
  {
 -	driver.num_ioctls = sis_max_ioctl;
 +	pax_open_kernel();
-+	*(int *)&driver.num_ioctls = sis_max_ioctl;
++	const_cast(driver.num_ioctls) = sis_max_ioctl;
 +	pax_close_kernel();
 +
  	return drm_pci_init(&driver, &sis_pci_driver);
@@ -47875,7 +47895,7 @@ index 93ad8a5..48f0a57 100644
 -int sis_max_ioctl = ARRAY_SIZE(sis_ioctls);
 +const int sis_max_ioctl = ARRAY_SIZE(sis_ioctls);
 diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
-index dde6f20..1969ca6 100644
+index dde6f20..a74f8b9 100644
 --- a/drivers/gpu/drm/tegra/dc.c
 +++ b/drivers/gpu/drm/tegra/dc.c
 @@ -1657,7 +1657,7 @@ static int tegra_dc_debugfs_init(struct tegra_dc *dc, struct drm_minor *minor)
@@ -47883,7 +47903,7 @@ index dde6f20..1969ca6 100644
  
  	for (i = 0; i < ARRAY_SIZE(debugfs_files); i++)
 -		dc->debugfs_files[i].data = dc;
-+		*(void **)&dc->debugfs_files[i].data = dc;
++		const_cast(dc->debugfs_files[i].data) = dc;
  
  	err = drm_debugfs_create_files(dc->debugfs_files,
  				       ARRAY_SIZE(debugfs_files),
@@ -47914,7 +47934,7 @@ index b7ef492..8968507 100644
  	struct dentry *debugfs;
  };
 diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
-index 757c6e8..710a6ff 100644
+index 757c6e8..36532d6 100644
 --- a/drivers/gpu/drm/tegra/sor.c
 +++ b/drivers/gpu/drm/tegra/sor.c
 @@ -1003,8 +1003,11 @@ static int tegra_sor_debugfs_init(struct tegra_sor *sor,
@@ -47925,7 +47945,7 @@ index 757c6e8..710a6ff 100644
 -		sor->debugfs_files[i].data = sor;
 +	for (i = 0; i < ARRAY_SIZE(debugfs_files); i++) {
 +		pax_open_kernel();
-+		*(void **)&sor->debugfs_files[i].data = sor;
++		const_cast(sor->debugfs_files[i].data) = sor;
 +		pax_close_kernel();
 +	}
  
@@ -48205,7 +48225,7 @@ index d17d8f2..67e8e48b 100644
 -int via_max_ioctl = ARRAY_SIZE(via_ioctls);
 +const int via_max_ioctl = ARRAY_SIZE(via_ioctls);
 diff --git a/drivers/gpu/drm/via/via_drv.c b/drivers/gpu/drm/via/via_drv.c
-index ed8aa8f..16c84fc 100644
+index ed8aa8f..114cc8d 100644
 --- a/drivers/gpu/drm/via/via_drv.c
 +++ b/drivers/gpu/drm/via/via_drv.c
 @@ -107,7 +107,10 @@ static struct pci_driver via_pci_driver = {
@@ -48214,7 +48234,7 @@ index ed8aa8f..16c84fc 100644
  {
 -	driver.num_ioctls = via_max_ioctl;
 +	pax_open_kernel();
-+	*(int *)&driver.num_ioctls = via_max_ioctl;
++	const_cast(driver.num_ioctls) = via_max_ioctl;
 +	pax_close_kernel();
 +
  	via_init_command_verifier();
@@ -49094,7 +49114,7 @@ index d127ace..6ee866f 100644
  	int i, j = 1;
  
 diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
-index 146eed70b..7679efd 100644
+index 146eed70b..7312f08 100644
 --- a/drivers/idle/intel_idle.c
 +++ b/drivers/idle/intel_idle.c
 @@ -1060,8 +1060,10 @@ static void sklh_idle_state_table_update(void)
@@ -49104,8 +49124,8 @@ index 146eed70b..7679efd 100644
 -	skl_cstates[5].disabled = 1;	/* C8-SKL */
 -	skl_cstates[6].disabled = 1;	/* C9-SKL */
 +	pax_open_kernel();
-+	*(bool *)&skl_cstates[5].disabled = 1;	/* C8-SKL */
-+	*(bool *)&skl_cstates[6].disabled = 1;	/* C9-SKL */
++	const_cast(skl_cstates[5].disabled) = 1;	/* C8-SKL */
++	const_cast(skl_cstates[6].disabled) = 1;	/* C9-SKL */
 +	pax_close_kernel();
  }
  /*
@@ -50103,18 +50123,6 @@ index 8c4daf7..77a87ab 100644
  	nesqp->destroyed = 1;
  
  	/* Blow away the connection if it exists. */
-diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
-index 7df16f7..7e1b21e 100644
---- a/drivers/infiniband/hw/qib/qib.h
-+++ b/drivers/infiniband/hw/qib/qib.h
-@@ -52,6 +52,7 @@
- #include <linux/kref.h>
- #include <linux/sched.h>
- #include <linux/kthread.h>
-+#include <linux/slab.h>
- 
- #include "qib_common.h"
- #include "qib_verbs.h"
 diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
 index 6c8ff10..73cfbb6 100644
 --- a/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -50492,7 +50500,7 @@ index 2087534..c3f6b6c 100644
  		return -ENOMEM;
  
 diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
-index 59ee4b8..6632759 100644
+index 59ee4b8..e4b6234 100644
 --- a/drivers/iommu/arm-smmu.c
 +++ b/drivers/iommu/arm-smmu.c
 @@ -341,7 +341,7 @@ enum arm_smmu_domain_stage {
@@ -50528,7 +50536,7 @@ index 59ee4b8..6632759 100644
  	/* Update our support page sizes to reflect the page table format */
 -	arm_smmu_ops.pgsize_bitmap = pgtbl_cfg.pgsize_bitmap;
 +	pax_open_kernel();
-+	*(unsigned long *)&arm_smmu_ops.pgsize_bitmap = pgtbl_cfg.pgsize_bitmap;
++	const_cast(arm_smmu_ops.pgsize_bitmap) = pgtbl_cfg.pgsize_bitmap;
 +	pax_close_kernel();
  
  	/* Initialise the context bank with our page table cfg */
@@ -50630,7 +50638,7 @@ index 59ee4b8..6632759 100644
  
 -	arm_smmu_ops.pgsize_bitmap &= size;
 +	pax_open_kernel();
-+	*(unsigned long *)&arm_smmu_ops.pgsize_bitmap &= size;
++	const_cast(arm_smmu_ops.pgsize_bitmap) &= size;
 +	pax_close_kernel();
  	dev_notice(smmu->dev, "\tSupported page sizes: 0x%08lx\n", size);
  
@@ -51582,7 +51590,7 @@ index fef6586..22353ff 100644
  		} else if ((DIDD_Table[x].type > 0)
  			   && (DIDD_Table[x].type < 16)) {	/* IDI Adapter found */
 diff --git a/drivers/isdn/hardware/eicon/mntfunc.c b/drivers/isdn/hardware/eicon/mntfunc.c
-index 1cd9aff..1a3e2b6 100644
+index 1cd9aff..3775d52 100644
 --- a/drivers/isdn/hardware/eicon/mntfunc.c
 +++ b/drivers/isdn/hardware/eicon/mntfunc.c
 @@ -26,8 +26,13 @@ extern void DIVA_DIDD_Read(void *, int);
@@ -51592,7 +51600,7 @@ index 1cd9aff..1a3e2b6 100644
 +
 +static void didd_nothing(ENTITY IDI_CALL_ENTITY_T *e)
 +{
-+	diva_maint_prtComp(e);
++	diva_maint_prtComp((char *)e);
 +}
  static DESCRIPTOR MaintDescriptor =
 -{ IDI_DIMAINT, 0, 0, (IDI_CALL) diva_maint_prtComp };
@@ -52967,10 +52975,50 @@ index 6b420a5..d5acb8f 100644
  
  struct gc_stat {
 diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
-index 22b9e34..ac456ec 100644
+index 22b9e34..d8406e7 100644
 --- a/drivers/md/bcache/btree.c
 +++ b/drivers/md/bcache/btree.c
-@@ -468,7 +468,7 @@ void __bch_btree_node_write(struct btree *b, struct closure *parent)
+@@ -337,15 +337,17 @@ static void btree_complete_write(struct btree *b, struct btree_write *w)
+ 	w->journal	= NULL;
+ }
+ 
+-static void btree_node_write_unlock(struct closure *cl)
++static void btree_node_write_unlock(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct btree *b = container_of(cl, struct btree, io);
+ 
+ 	up(&b->io_mutex);
+ }
+ 
+-static void __btree_node_write_done(struct closure *cl)
++static void __btree_node_write_done(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct btree *b = container_of(cl, struct btree, io);
+ 	struct btree_write *w = btree_prev_write(b);
+ 
+@@ -359,8 +361,9 @@ static void __btree_node_write_done(struct closure *cl)
+ 	closure_return_with_destructor(cl, btree_node_write_unlock);
+ }
+ 
+-static void btree_node_write_done(struct closure *cl)
++static void btree_node_write_done(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct btree *b = container_of(cl, struct btree, io);
+ 	struct bio_vec *bv;
+ 	int n;
+@@ -368,7 +371,7 @@ static void btree_node_write_done(struct closure *cl)
+ 	bio_for_each_segment_all(bv, b->bio, n)
+ 		__free_page(bv->bv_page);
+ 
+-	__btree_node_write_done(cl);
++	__btree_node_write_done(&cl->work);
+ }
+ 
+ static void btree_node_write_endio(struct bio *bio)
+@@ -468,7 +471,7 @@ void __bch_btree_node_write(struct btree *b, struct closure *parent)
  
  	do_btree_node_write(b);
  
@@ -52979,12 +53027,44 @@ index 22b9e34..ac456ec 100644
  			&PTR_CACHE(b->c, &b->key, 0)->btree_sectors_written);
  
  	b->written += set_blocks(i, block_bytes(b->c));
+diff --git a/drivers/md/bcache/closure.c b/drivers/md/bcache/closure.c
+index 9eaf1d6..86e6fa1 100644
+--- a/drivers/md/bcache/closure.c
++++ b/drivers/md/bcache/closure.c
+@@ -29,12 +29,12 @@ static inline void closure_put_after_sub(struct closure *cl, int flags)
+ 			closure_queue(cl);
+ 		} else {
+ 			struct closure *parent = cl->parent;
+-			closure_fn *destructor = cl->fn;
++			work_func_t destructor = cl->fn;
+ 
+ 			closure_debug_destroy(cl);
+ 
+ 			if (destructor)
+-				destructor(cl);
++				destructor(&cl->work);
+ 
+ 			if (parent)
+ 				closure_put(parent);
 diff --git a/drivers/md/bcache/closure.h b/drivers/md/bcache/closure.h
-index 782cc2c..4fdd593 100644
+index 782cc2c..34864f4 100644
 --- a/drivers/md/bcache/closure.h
 +++ b/drivers/md/bcache/closure.h
-@@ -238,7 +238,7 @@ static inline void closure_set_stopped(struct closure *cl)
- static inline void set_closure_fn(struct closure *cl, closure_fn *fn,
+@@ -151,7 +151,7 @@ struct closure {
+ 			struct workqueue_struct *wq;
+ 			struct task_struct	*task;
+ 			struct llist_node	list;
+-			closure_fn		*fn;
++			work_func_t		fn;
+ 		};
+ 		struct work_struct	work;
+ 	};
+@@ -235,10 +235,10 @@ static inline void closure_set_stopped(struct closure *cl)
+ 	atomic_sub(CLOSURE_RUNNING, &cl->remaining);
+ }
+ 
+-static inline void set_closure_fn(struct closure *cl, closure_fn *fn,
++static inline void set_closure_fn(struct closure *cl, work_func_t fn,
  				  struct workqueue_struct *wq)
  {
 -	BUG_ON(object_is_on_stack(cl));
@@ -52992,6 +53072,24 @@ index 782cc2c..4fdd593 100644
  	closure_set_ip(cl);
  	cl->fn = fn;
  	cl->wq = wq;
+@@ -253,7 +253,7 @@ static inline void closure_queue(struct closure *cl)
+ 		INIT_WORK(&cl->work, cl->work.func);
+ 		BUG_ON(!queue_work(wq, &cl->work));
+ 	} else
+-		cl->fn(cl);
++		cl->fn(&cl->work);
+ }
+ 
+ /**
+@@ -372,7 +372,7 @@ do {									\
+  * asynchronously out of a new closure - @parent will then wait for @cl to
+  * finish.
+  */
+-static inline void closure_call(struct closure *cl, closure_fn fn,
++static inline void closure_call(struct closure *cl, work_func_t fn,
+ 				struct workqueue_struct *wq,
+ 				struct closure *parent)
+ {
 diff --git a/drivers/md/bcache/io.c b/drivers/md/bcache/io.c
 index 86a0bb8..0832b32 100644
 --- a/drivers/md/bcache/io.c
@@ -53035,10 +53133,46 @@ index 86a0bb8..0832b32 100644
  		errors >>= IO_ERROR_SHIFT;
  
 diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
-index 29eba72..348efc9 100644
+index 29eba72..1d0108a 100644
 --- a/drivers/md/bcache/journal.c
 +++ b/drivers/md/bcache/journal.c
-@@ -621,7 +621,7 @@ static void journal_write_unlocked(struct closure *cl)
+@@ -555,10 +555,11 @@ static void journal_write_endio(struct bio *bio)
+ 	closure_put(&w->c->journal.io);
+ }
+ 
+-static void journal_write(struct closure *);
++static void journal_write(struct work_struct *);
+ 
+-static void journal_write_done(struct closure *cl)
++static void journal_write_done(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct journal *j = container_of(cl, struct journal, io);
+ 	struct journal_write *w = (j->cur == j->w)
+ 		? &j->w[1]
+@@ -568,17 +569,19 @@ static void journal_write_done(struct closure *cl)
+ 	continue_at_nobarrier(cl, journal_write, system_wq);
+ }
+ 
+-static void journal_write_unlock(struct closure *cl)
++static void journal_write_unlock(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct cache_set *c = container_of(cl, struct cache_set, journal.io);
+ 
+ 	c->journal.io_in_flight = 0;
+ 	spin_unlock(&c->journal.lock);
+ }
+ 
+-static void journal_write_unlocked(struct closure *cl)
++static void journal_write_unlocked(struct work_struct *work)
+ 	__releases(c->journal.lock)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct cache_set *c = container_of(cl, struct cache_set, journal.io);
+ 	struct cache *ca;
+ 	struct journal_write *w = c->journal.cur;
+@@ -621,7 +624,7 @@ static void journal_write_unlocked(struct closure *cl)
  		ca = PTR_CACHE(c, k, i);
  		bio = &ca->journal.bio;
  
@@ -53047,6 +53181,278 @@ index 29eba72..348efc9 100644
  
  		bio_reset(bio);
  		bio->bi_iter.bi_sector	= PTR_OFFSET(k, i);
+@@ -653,12 +656,13 @@ static void journal_write_unlocked(struct closure *cl)
+ 	continue_at(cl, journal_write_done, NULL);
+ }
+ 
+-static void journal_write(struct closure *cl)
++static void journal_write(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct cache_set *c = container_of(cl, struct cache_set, journal.io);
+ 
+ 	spin_lock(&c->journal.lock);
+-	journal_write_unlocked(cl);
++	journal_write_unlocked(&cl->work);
+ }
+ 
+ static void journal_try_write(struct cache_set *c)
+diff --git a/drivers/md/bcache/movinggc.c b/drivers/md/bcache/movinggc.c
+index b929fc9..4557031 100644
+--- a/drivers/md/bcache/movinggc.c
++++ b/drivers/md/bcache/movinggc.c
+@@ -34,14 +34,16 @@ static bool moving_pred(struct keybuf *buf, struct bkey *k)
+ 
+ /* Moving GC - IO loop */
+ 
+-static void moving_io_destructor(struct closure *cl)
++static void moving_io_destructor(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct moving_io *io = container_of(cl, struct moving_io, cl);
+ 	kfree(io);
+ }
+ 
+-static void write_moving_finish(struct closure *cl)
++static void write_moving_finish(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct moving_io *io = container_of(cl, struct moving_io, cl);
+ 	struct bio *bio = &io->bio.bio;
+ 	struct bio_vec *bv;
+@@ -92,8 +94,9 @@ static void moving_init(struct moving_io *io)
+ 	bch_bio_map(bio, NULL);
+ }
+ 
+-static void write_moving(struct closure *cl)
++static void write_moving(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct moving_io *io = container_of(cl, struct moving_io, cl);
+ 	struct data_insert_op *op = &io->op;
+ 
+@@ -116,8 +119,9 @@ static void write_moving(struct closure *cl)
+ 	continue_at(cl, write_moving_finish, op->wq);
+ }
+ 
+-static void read_moving_submit(struct closure *cl)
++static void read_moving_submit(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct moving_io *io = container_of(cl, struct moving_io, cl);
+ 	struct bio *bio = &io->bio.bio;
+ 
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index 25fa844..8181a97 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -24,7 +24,7 @@
+ 
+ struct kmem_cache *bch_search_cache;
+ 
+-static void bch_data_insert_start(struct closure *);
++static void bch_data_insert_start(struct work_struct *);
+ 
+ static unsigned cache_mode(struct cached_dev *dc, struct bio *bio)
+ {
+@@ -53,8 +53,9 @@ static void bio_csum(struct bio *bio, struct bkey *k)
+ 
+ /* Insert data into cache */
+ 
+-static void bch_data_insert_keys(struct closure *cl)
++static void bch_data_insert_keys(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct data_insert_op *op = container_of(cl, struct data_insert_op, cl);
+ 	atomic_t *journal_ref = NULL;
+ 	struct bkey *replace_key = op->replace ? &op->replace_key : NULL;
+@@ -143,8 +144,9 @@ out:
+ 	continue_at(cl, bch_data_insert_keys, op->wq);
+ }
+ 
+-static void bch_data_insert_error(struct closure *cl)
++static void bch_data_insert_error(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct data_insert_op *op = container_of(cl, struct data_insert_op, cl);
+ 
+ 	/*
+@@ -170,7 +172,7 @@ static void bch_data_insert_error(struct closure *cl)
+ 
+ 	op->insert_keys.top = dst;
+ 
+-	bch_data_insert_keys(cl);
++	bch_data_insert_keys(&cl->work);
+ }
+ 
+ static void bch_data_insert_endio(struct bio *bio)
+@@ -191,8 +193,9 @@ static void bch_data_insert_endio(struct bio *bio)
+ 	bch_bbio_endio(op->c, bio, bio->bi_error, "writing data to cache");
+ }
+ 
+-static void bch_data_insert_start(struct closure *cl)
++static void bch_data_insert_start(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct data_insert_op *op = container_of(cl, struct data_insert_op, cl);
+ 	struct bio *bio = op->bio, *n;
+ 
+@@ -313,8 +316,9 @@ err:
+  * If s->bypass is true, instead of inserting the data it invalidates the
+  * region of the cache represented by s->cache_bio and op->inode.
+  */
+-void bch_data_insert(struct closure *cl)
++void bch_data_insert(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct data_insert_op *op = container_of(cl, struct data_insert_op, cl);
+ 
+ 	trace_bcache_write(op->c, op->inode, op->bio,
+@@ -322,7 +326,7 @@ void bch_data_insert(struct closure *cl)
+ 
+ 	bch_keylist_init(&op->insert_keys);
+ 	bio_get(op->bio);
+-	bch_data_insert_start(cl);
++	bch_data_insert_start(&cl->work);
+ }
+ 
+ /* Congested? */
+@@ -570,8 +574,9 @@ static int cache_lookup_fn(struct btree_op *op, struct btree *b, struct bkey *k)
+ 	return n == bio ? MAP_DONE : MAP_CONTINUE;
+ }
+ 
+-static void cache_lookup(struct closure *cl)
++static void cache_lookup(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct search *s = container_of(cl, struct search, iop.cl);
+ 	struct bio *bio = &s->bio.bio;
+ 	int ret;
+@@ -631,8 +636,9 @@ static void do_bio_hook(struct search *s, struct bio *orig_bio)
+ 	bio_cnt_set(bio, 3);
+ }
+ 
+-static void search_free(struct closure *cl)
++static void search_free(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct search *s = container_of(cl, struct search, cl);
+ 	bio_complete(s);
+ 
+@@ -676,19 +682,21 @@ static inline struct search *search_alloc(struct bio *bio,
+ 
+ /* Cached devices */
+ 
+-static void cached_dev_bio_complete(struct closure *cl)
++static void cached_dev_bio_complete(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct search *s = container_of(cl, struct search, cl);
+ 	struct cached_dev *dc = container_of(s->d, struct cached_dev, disk);
+ 
+-	search_free(cl);
++	search_free(&cl->work);
+ 	cached_dev_put(dc);
+ }
+ 
+ /* Process reads */
+ 
+-static void cached_dev_cache_miss_done(struct closure *cl)
++static void cached_dev_cache_miss_done(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct search *s = container_of(cl, struct search, cl);
+ 
+ 	if (s->iop.replace_collision)
+@@ -702,11 +710,12 @@ static void cached_dev_cache_miss_done(struct closure *cl)
+ 			__free_page(bv->bv_page);
+ 	}
+ 
+-	cached_dev_bio_complete(cl);
++	cached_dev_bio_complete(&cl->work);
+ }
+ 
+-static void cached_dev_read_error(struct closure *cl)
++static void cached_dev_read_error(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct search *s = container_of(cl, struct search, cl);
+ 	struct bio *bio = &s->bio.bio;
+ 
+@@ -725,8 +734,9 @@ static void cached_dev_read_error(struct closure *cl)
+ 	continue_at(cl, cached_dev_cache_miss_done, NULL);
+ }
+ 
+-static void cached_dev_read_done(struct closure *cl)
++static void cached_dev_read_done(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct search *s = container_of(cl, struct search, cl);
+ 	struct cached_dev *dc = container_of(s->d, struct cached_dev, disk);
+ 
+@@ -765,8 +775,9 @@ static void cached_dev_read_done(struct closure *cl)
+ 	continue_at(cl, cached_dev_cache_miss_done, NULL);
+ }
+ 
+-static void cached_dev_read_done_bh(struct closure *cl)
++static void cached_dev_read_done_bh(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct search *s = container_of(cl, struct search, cl);
+ 	struct cached_dev *dc = container_of(s->d, struct cached_dev, disk);
+ 
+@@ -864,13 +875,14 @@ static void cached_dev_read(struct cached_dev *dc, struct search *s)
+ 
+ /* Process writes */
+ 
+-static void cached_dev_write_complete(struct closure *cl)
++static void cached_dev_write_complete(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct search *s = container_of(cl, struct search, cl);
+ 	struct cached_dev *dc = container_of(s->d, struct cached_dev, disk);
+ 
+ 	up_read_non_owner(&dc->writeback_lock);
+-	cached_dev_bio_complete(cl);
++	cached_dev_bio_complete(&cl->work);
+ }
+ 
+ static void cached_dev_write(struct cached_dev *dc, struct search *s)
+@@ -942,8 +954,9 @@ static void cached_dev_write(struct cached_dev *dc, struct search *s)
+ 	continue_at(cl, cached_dev_write_complete, NULL);
+ }
+ 
+-static void cached_dev_nodata(struct closure *cl)
++static void cached_dev_nodata(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct search *s = container_of(cl, struct search, cl);
+ 	struct bio *bio = &s->bio.bio;
+ 
+@@ -1063,8 +1076,9 @@ static int flash_dev_cache_miss(struct btree *b, struct search *s,
+ 	return MAP_CONTINUE;
+ }
+ 
+-static void flash_dev_nodata(struct closure *cl)
++static void flash_dev_nodata(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct search *s = container_of(cl, struct search, cl);
+ 
+ 	if (s->iop.flush_journal)
+diff --git a/drivers/md/bcache/request.h b/drivers/md/bcache/request.h
+index 1ff3687..b8f4a05 100644
+--- a/drivers/md/bcache/request.h
++++ b/drivers/md/bcache/request.h
+@@ -33,7 +33,7 @@ struct data_insert_op {
+ };
+ 
+ unsigned bch_get_congested(struct cache_set *);
+-void bch_data_insert(struct closure *cl);
++void bch_data_insert(struct work_struct *work);
+ 
+ void bch_cached_dev_request_init(struct cached_dev *dc);
+ void bch_flash_dev_request_init(struct bcache_device *d);
 diff --git a/drivers/md/bcache/stats.c b/drivers/md/bcache/stats.c
 index 0ca072c..5e6e5c3 100644
 --- a/drivers/md/bcache/stats.c
@@ -53161,10 +53567,43 @@ index adbff14..018c2d2 100644
  	struct cache_stat_collector collector;
  
 diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
-index a296425..397607e 100644
+index a296425..c5d881c 100644
 --- a/drivers/md/bcache/super.c
 +++ b/drivers/md/bcache/super.c
-@@ -530,7 +530,7 @@ void bch_prio_write(struct cache *ca)
+@@ -241,8 +241,9 @@ static void __write_super(struct cache_sb *sb, struct bio *bio)
+ 	submit_bio(REQ_WRITE, bio);
+ }
+ 
+-static void bch_write_bdev_super_unlock(struct closure *cl)
++static void bch_write_bdev_super_unlock(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct cached_dev *dc = container_of(cl, struct cached_dev, sb_write);
+ 
+ 	up(&dc->sb_write_mutex);
+@@ -275,8 +276,9 @@ static void write_super_endio(struct bio *bio)
+ 	closure_put(&ca->set->sb_write);
+ }
+ 
+-static void bcache_write_super_unlock(struct closure *cl)
++static void bcache_write_super_unlock(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct cache_set *c = container_of(cl, struct cache_set, sb_write);
+ 
+ 	up(&c->sb_write_mutex);
+@@ -326,8 +328,9 @@ static void uuid_endio(struct bio *bio)
+ 	closure_put(cl);
+ }
+ 
+-static void uuid_io_unlock(struct closure *cl)
++static void uuid_io_unlock(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct cache_set *c = container_of(cl, struct cache_set, uuid_write);
+ 
+ 	up(&c->uuid_write_mutex);
+@@ -530,7 +533,7 @@ void bch_prio_write(struct cache *ca)
  
  	ca->disk_buckets->seq++;
  
@@ -53173,6 +53612,83 @@ index a296425..397607e 100644
  			&ca->meta_sectors_written);
  
  	//pr_debug("free %zu, free_inc %zu, unused %zu", fifo_used(&ca->free),
+@@ -1049,8 +1052,9 @@ void bch_cached_dev_release(struct kobject *kobj)
+ 	module_put(THIS_MODULE);
+ }
+ 
+-static void cached_dev_free(struct closure *cl)
++static void cached_dev_free(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct cached_dev *dc = container_of(cl, struct cached_dev, disk.cl);
+ 
+ 	cancel_delayed_work_sync(&dc->writeback_rate_update);
+@@ -1074,8 +1078,9 @@ static void cached_dev_free(struct closure *cl)
+ 	kobject_put(&dc->disk.kobj);
+ }
+ 
+-static void cached_dev_flush(struct closure *cl)
++static void cached_dev_flush(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct cached_dev *dc = container_of(cl, struct cached_dev, disk.cl);
+ 	struct bcache_device *d = &dc->disk;
+ 
+@@ -1191,8 +1196,9 @@ void bch_flash_dev_release(struct kobject *kobj)
+ 	kfree(d);
+ }
+ 
+-static void flash_dev_free(struct closure *cl)
++static void flash_dev_free(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct bcache_device *d = container_of(cl, struct bcache_device, cl);
+ 	mutex_lock(&bch_register_lock);
+ 	bcache_device_free(d);
+@@ -1200,8 +1206,9 @@ static void flash_dev_free(struct closure *cl)
+ 	kobject_put(&d->kobj);
+ }
+ 
+-static void flash_dev_flush(struct closure *cl)
++static void flash_dev_flush(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct bcache_device *d = container_of(cl, struct bcache_device, cl);
+ 
+ 	mutex_lock(&bch_register_lock);
+@@ -1320,8 +1327,9 @@ void bch_cache_set_release(struct kobject *kobj)
+ 	module_put(THIS_MODULE);
+ }
+ 
+-static void cache_set_free(struct closure *cl)
++static void cache_set_free(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct cache_set *c = container_of(cl, struct cache_set, cl);
+ 	struct cache *ca;
+ 	unsigned i;
+@@ -1366,8 +1374,9 @@ static void cache_set_free(struct closure *cl)
+ 	kobject_put(&c->kobj);
+ }
+ 
+-static void cache_set_flush(struct closure *cl)
++static void cache_set_flush(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct cache_set *c = container_of(cl, struct cache_set, caching);
+ 	struct cache *ca;
+ 	struct btree *b;
+@@ -1408,8 +1417,9 @@ static void cache_set_flush(struct closure *cl)
+ 	closure_return(cl);
+ }
+ 
+-static void __cache_set_unregister(struct closure *cl)
++static void __cache_set_unregister(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct cache_set *c = container_of(cl, struct cache_set, caching);
+ 	struct cached_dev *dc;
+ 	size_t i;
 diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
 index b3ff57d..b2e30fb 100644
 --- a/drivers/md/bcache/sysfs.c
@@ -53215,6 +53731,51 @@ index b3ff57d..b2e30fb 100644
  	}
  
  	return size;
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index b9346cd..708ea8f 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -118,14 +118,16 @@ static void dirty_init(struct keybuf_key *w)
+ 	bch_bio_map(bio, NULL);
+ }
+ 
+-static void dirty_io_destructor(struct closure *cl)
++static void dirty_io_destructor(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct dirty_io *io = container_of(cl, struct dirty_io, cl);
+ 	kfree(io);
+ }
+ 
+-static void write_dirty_finish(struct closure *cl)
++static void write_dirty_finish(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct dirty_io *io = container_of(cl, struct dirty_io, cl);
+ 	struct keybuf_key *w = io->bio.bi_private;
+ 	struct cached_dev *dc = io->dc;
+@@ -177,8 +179,9 @@ static void dirty_endio(struct bio *bio)
+ 	closure_put(&io->cl);
+ }
+ 
+-static void write_dirty(struct closure *cl)
++static void write_dirty(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct dirty_io *io = container_of(cl, struct dirty_io, cl);
+ 	struct keybuf_key *w = io->bio.bi_private;
+ 
+@@ -204,8 +207,9 @@ static void read_dirty_endio(struct bio *bio)
+ 	dirty_endio(bio);
+ }
+ 
+-static void read_dirty_submit(struct closure *cl)
++static void read_dirty_submit(struct work_struct *work)
+ {
++	struct closure *cl = container_of(work, struct closure, work);
+ 	struct dirty_io *io = container_of(cl, struct dirty_io, cl);
+ 
+ 	closure_bio_submit(&io->bio, cl);
 diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
 index d80cce4..d7f15c4 100644
 --- a/drivers/md/bitmap.c
@@ -54725,6 +55286,19 @@ index 80caa70..d076ecf 100644
  
  	vma->vm_ops = &zoran_vm_ops;
  	vma->vm_flags |= VM_DONTEXPAND;
+diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c
+index de32e3a..e6a7bff 100644
+--- a/drivers/media/platform/am437x/am437x-vpfe.c
++++ b/drivers/media/platform/am437x/am437x-vpfe.c
+@@ -1706,7 +1706,7 @@ static int vpfe_get_app_input_index(struct vpfe_device *vpfe,
+ 		sdinfo = &cfg->sub_devs[i];
+ 		client = v4l2_get_subdevdata(sdinfo->sd);
+ 		if (client->addr == curr_client->addr &&
+-		    client->adapter->nr == client->adapter->nr) {
++		    client->adapter->nr == curr_client->adapter->nr) {
+ 			if (vpfe->current_input >= 1)
+ 				return -1;
+ 			*app_input_index = j + vpfe->current_input;
 diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
 index 70c28d1..ff21b13 100644
 --- a/drivers/media/platform/omap/omap_vout.c
@@ -56578,7 +57152,7 @@ index f7ab115..16b2087 100644
  	if (!irq) {
  		dev_warn(tps65910->dev, "No interrupt support, no core IRQ\n");
 diff --git a/drivers/mfd/twl4030-irq.c b/drivers/mfd/twl4030-irq.c
-index 40e51b0..b986312 100644
+index 40e51b0..af35565 100644
 --- a/drivers/mfd/twl4030-irq.c
 +++ b/drivers/mfd/twl4030-irq.c
 @@ -34,6 +34,7 @@
@@ -56597,16 +57171,16 @@ index 40e51b0..b986312 100644
 -	twl4030_irq_chip.name = "twl4030";
 +	pax_open_kernel();
 +	memcpy((void *)&twl4030_irq_chip, &dummy_irq_chip, sizeof twl4030_irq_chip);
-+	*(const char **)&twl4030_irq_chip.name = "twl4030";
++	const_cast(twl4030_irq_chip.name) = "twl4030";
  
 -	twl4030_sih_irq_chip.irq_ack = dummy_irq_chip.irq_ack;
-+	*(void **)&twl4030_sih_irq_chip.irq_ack = dummy_irq_chip.irq_ack;
++	const_cast(twl4030_sih_irq_chip.irq_ack) = dummy_irq_chip.irq_ack;
 +	pax_close_kernel();
  
  	for (i = irq_base; i < irq_end; i++) {
  		irq_set_chip_and_handler(i, &twl4030_irq_chip,
 diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
-index cc8645b..7cc15e4 100644
+index cc8645b..ab85ae4 100644
 --- a/drivers/misc/c2port/core.c
 +++ b/drivers/misc/c2port/core.c
 @@ -922,7 +922,9 @@ struct c2port_device *c2port_device_register(char *name,
@@ -56615,7 +57189,7 @@ index cc8645b..7cc15e4 100644
  
 -	bin_attr_flash_data.size = ops->blocks_num * ops->block_size;
 +	pax_open_kernel();
-+	*(size_t *)&bin_attr_flash_data.size = ops->blocks_num * ops->block_size;
++	const_cast(bin_attr_flash_data.size) = ops->blocks_num * ops->block_size;
 +	pax_close_kernel();
  
  	c2dev->dev = device_create(c2port_class, NULL, 0, c2dev,
@@ -56705,7 +57279,7 @@ index c439c82..1f20f57 100644
  	int			mapped_btns[3];
  
 diff --git a/drivers/misc/mic/scif/scif_api.c b/drivers/misc/mic/scif/scif_api.c
-index ddc9e4b..7b9c669 100644
+index ddc9e4b..9e27f41 100644
 --- a/drivers/misc/mic/scif/scif_api.c
 +++ b/drivers/misc/mic/scif/scif_api.c
 @@ -1486,10 +1486,12 @@ int scif_client_register(struct scif_client *client)
@@ -56717,10 +57291,10 @@ index ddc9e4b..7b9c669 100644
 -	si->add_dev = scif_add_client_dev;
 -	si->remove_dev = scif_remove_client_dev;
 +	pax_open_kernel();
-+	*(const char **)&si->name = client->name;
-+	*(struct bus_type **)&si->subsys = &scif_peer_bus;
-+	*(void **)&si->add_dev = scif_add_client_dev;
-+	*(void **)&si->remove_dev = scif_remove_client_dev;
++	const_cast(si->name) = client->name;
++	const_cast(si->subsys) = &scif_peer_bus;
++	const_cast(si->add_dev) = scif_add_client_dev;
++	const_cast(si->remove_dev) = scif_remove_client_dev;
 +	pax_close_kernel();
  
  	return subsys_interface_register(&client->si);
@@ -57235,7 +57809,7 @@ index f695b58..7b7d017 100644
 +} __do_const;
  #endif /* _DW_MMC_H_ */
 diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
-index 0d6ca41..d438654 100644
+index 0d6ca41..bdc6710 100644
 --- a/drivers/mmc/host/mmci.c
 +++ b/drivers/mmc/host/mmci.c
 @@ -1634,7 +1634,9 @@ static int mmci_probe(struct amba_device *dev,
@@ -57244,13 +57818,13 @@ index 0d6ca41..d438654 100644
  	if (variant->busy_detect) {
 -		mmci_ops.card_busy = mmci_card_busy;
 +		pax_open_kernel();
-+		*(void **)&mmci_ops.card_busy = mmci_card_busy;
++		const_cast(mmci_ops.card_busy) = mmci_card_busy;
 +		pax_close_kernel();
  		mmci_write_datactrlreg(host, MCI_ST_DPSM_BUSYMODE);
  		mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY;
  		mmc->max_busy_timeout = 0;
 diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
-index f6e4d97..57358ff 100644
+index f6e4d97..8bd8c05 100644
 --- a/drivers/mmc/host/omap_hsmmc.c
 +++ b/drivers/mmc/host/omap_hsmmc.c
 @@ -2088,7 +2088,9 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
@@ -57259,13 +57833,13 @@ index f6e4d97..57358ff 100644
  		dev_info(&pdev->dev, "multiblock reads disabled due to 35xx erratum 2.1.1.128; MMC read performance may suffer\n");
 -		omap_hsmmc_ops.multi_io_quirk = omap_hsmmc_multi_io_quirk;
 +		pax_open_kernel();
-+		*(void **)&omap_hsmmc_ops.multi_io_quirk = omap_hsmmc_multi_io_quirk;
++		const_cast(omap_hsmmc_ops.multi_io_quirk) = omap_hsmmc_multi_io_quirk;
 +		pax_close_kernel();
  	}
  
  	device_init_wakeup(&pdev->dev, true);
 diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
-index f25f292..a0e1250 100644
+index f25f292..7f4b03f 100644
 --- a/drivers/mmc/host/sdhci-esdhc-imx.c
 +++ b/drivers/mmc/host/sdhci-esdhc-imx.c
 @@ -1194,9 +1194,12 @@ static int sdhci_esdhc_imx_probe(struct platform_device *pdev)
@@ -57276,7 +57850,7 @@ index f25f292..a0e1250 100644
 -		sdhci_esdhc_ops.platform_execute_tuning =
 +	if (imx_data->socdata->flags & ESDHC_FLAG_MAN_TUNING) {
 +		pax_open_kernel();
-+		*(void **)&sdhci_esdhc_ops.platform_execute_tuning =
++		const_cast(sdhci_esdhc_ops.platform_execute_tuning) =
  					esdhc_executing_tuning;
 +		pax_close_kernel();
 +	}
@@ -57284,7 +57858,7 @@ index f25f292..a0e1250 100644
  	if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING)
  		writel(readl(host->ioaddr + ESDHC_TUNING_CTRL) |
 diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
-index 70c724b..308aafc 100644
+index 70c724b..0c24beb 100644
 --- a/drivers/mmc/host/sdhci-s3c.c
 +++ b/drivers/mmc/host/sdhci-s3c.c
 @@ -598,9 +598,11 @@ static int sdhci_s3c_probe(struct platform_device *pdev)
@@ -57295,9 +57869,9 @@ index 70c724b..308aafc 100644
 -		sdhci_s3c_ops.get_min_clock = sdhci_cmu_get_min_clock;
 -		sdhci_s3c_ops.get_max_clock = sdhci_cmu_get_max_clock;
 +		pax_open_kernel();
-+		*(void **)&sdhci_s3c_ops.set_clock = sdhci_cmu_set_clock;
-+		*(void **)&sdhci_s3c_ops.get_min_clock = sdhci_cmu_get_min_clock;
-+		*(void **)&sdhci_s3c_ops.get_max_clock = sdhci_cmu_get_max_clock;
++		const_cast(sdhci_s3c_ops.set_clock) = sdhci_cmu_set_clock;
++		const_cast(sdhci_s3c_ops.get_min_clock) = sdhci_cmu_get_min_clock;
++		const_cast(sdhci_s3c_ops.get_max_clock) = sdhci_cmu_get_max_clock;
 +		pax_close_kernel();
  	}
  
@@ -59971,7 +60545,7 @@ index 245c063..74ed9c9 100644
  	mdio_cmd->op = op;
  	mdio_cmd->mdio_addr = loc;
 diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
-index 34d269c..43dcc17 100644
+index 34d269c..69e1ac2 100644
 --- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
 +++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
 @@ -475,7 +475,7 @@ static void stop_pci_io(struct octeon_device *oct)
@@ -60018,7 +60592,7 @@ index 34d269c..43dcc17 100644
 -			lionetdevops.ndo_select_queue = select_q;
 +		if (num_iqueues > 1) {
 +			pax_open_kernel();
-+			*(void **)&lionetdevops.ndo_select_queue = select_q;
++			const_cast(lionetdevops.ndo_select_queue) = select_q;
 +			pax_close_kernel();
 +		}
  
@@ -60316,7 +60890,7 @@ index e51892d..3e645f4 100644
  	struct hix5hd2_priv *priv = netdev_priv(dev);
  	struct hix5hd2_desc *desc;
 diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
-index d4f92ed..38fdf5b 100644
+index d4f92ed..d4755e0 100644
 --- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
 +++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
 @@ -857,16 +857,18 @@ int hns_dsaf_ae_init(struct dsaf_device *dsaf_dev)
@@ -60327,11 +60901,11 @@ index d4f92ed..38fdf5b 100644
  	switch (dsaf_dev->dsaf_ver) {
  	case AE_VERSION_1:
 -		hns_dsaf_ops.toggle_ring_irq = hns_ae_toggle_ring_irq;
-+		*(void **)&hns_dsaf_ops.toggle_ring_irq = hns_ae_toggle_ring_irq;
++		const_cast(hns_dsaf_ops.toggle_ring_irq) = hns_ae_toggle_ring_irq;
  		break;
  	case AE_VERSION_2:
 -		hns_dsaf_ops.toggle_ring_irq = hns_aev2_toggle_ring_irq;
-+		*(void **)&hns_dsaf_ops.toggle_ring_irq = hns_aev2_toggle_ring_irq;
++		const_cast(hns_dsaf_ops.toggle_ring_irq) = hns_aev2_toggle_ring_irq;
  		break;
  	default:
  		break;
@@ -60809,7 +61383,7 @@ index 6409a06..e5bd4d6 100644
  	struct netxen_adapter *adapter = pci_get_drvdata(pdev);
  
 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
-index bf89216..4044d8c 100644
+index bf89216..b08442a 100644
 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
 @@ -2324,7 +2324,9 @@ int qlcnic_83xx_configure_opmode(struct qlcnic_adapter *adapter)
@@ -60818,13 +61392,13 @@ index bf89216..4044d8c 100644
  		ahw->nic_mode = QLCNIC_DEFAULT_MODE;
 -		adapter->nic_ops->init_driver = qlcnic_83xx_init_default_driver;
 +		pax_open_kernel();
-+		*(void **)&adapter->nic_ops->init_driver = qlcnic_83xx_init_default_driver;
++		const_cast(adapter->nic_ops->init_driver) = qlcnic_83xx_init_default_driver;
 +		pax_close_kernel();
  		ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
  		max_sds_rings = QLCNIC_MAX_SDS_RINGS;
  		max_tx_rings = QLCNIC_MAX_TX_RINGS;
 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
-index 3490675..0b9e15a 100644
+index 3490675..cf148ea 100644
 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
 @@ -207,17 +207,23 @@ int qlcnic_83xx_config_vnic_opmode(struct qlcnic_adapter *adapter)
@@ -60833,7 +61407,7 @@ index 3490675..0b9e15a 100644
  		ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
 -		nic_ops->init_driver = qlcnic_83xx_init_non_privileged_vnic;
 +		pax_open_kernel();
-+		*(void **)&nic_ops->init_driver = qlcnic_83xx_init_non_privileged_vnic;
++		const_cast(nic_ops->init_driver) = qlcnic_83xx_init_non_privileged_vnic;
 +		pax_close_kernel();
  		break;
  	case QLCNIC_PRIV_FUNC:
@@ -60841,7 +61415,7 @@ index 3490675..0b9e15a 100644
  		ahw->idc.state_entry = qlcnic_83xx_idc_vnic_pf_entry;
 -		nic_ops->init_driver = qlcnic_83xx_init_privileged_vnic;
 +		pax_open_kernel();
-+		*(void **)&nic_ops->init_driver = qlcnic_83xx_init_privileged_vnic;
++		const_cast(nic_ops->init_driver) = qlcnic_83xx_init_privileged_vnic;
 +		pax_close_kernel();
  		break;
  	case QLCNIC_MGMT_FUNC:
@@ -60849,7 +61423,7 @@ index 3490675..0b9e15a 100644
  		ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
 -		nic_ops->init_driver = qlcnic_83xx_init_mgmt_vnic;
 +		pax_open_kernel();
-+		*(void **)&nic_ops->init_driver = qlcnic_83xx_init_mgmt_vnic;
++		const_cast(nic_ops->init_driver) = qlcnic_83xx_init_mgmt_vnic;
 +		pax_close_kernel();
  		break;
  	default:
@@ -61604,7 +62178,7 @@ index f9db2ce..6cd460c 100644
  }
  
 diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
-index 94e6888..1d08b6a 100644
+index 94e6888..c5c3f55 100644
 --- a/drivers/net/macvlan.c
 +++ b/drivers/net/macvlan.c
 @@ -335,7 +335,7 @@ static void macvlan_broadcast_enqueue(struct macvlan_port *port,
@@ -61628,13 +62202,13 @@ index 94e6888..1d08b6a 100644
 -	ops->get_size		= macvlan_get_size;
 -	ops->fill_info		= macvlan_fill_info;
 +	pax_open_kernel();
-+	*(size_t *)&ops->priv_size	= sizeof(struct macvlan_dev);
-+	*(void **)&ops->validate	= macvlan_validate;
-+	*(int *)&ops->maxtype		= IFLA_MACVLAN_MAX;
-+	*(const void **)&ops->policy	= macvlan_policy;
-+	*(void **)&ops->changelink	= macvlan_changelink;
-+	*(void **)&ops->get_size	= macvlan_get_size;
-+	*(void **)&ops->fill_info	= macvlan_fill_info;
++	const_cast(ops->priv_size)	= sizeof(struct macvlan_dev);
++	const_cast(ops->validate)	= macvlan_validate;
++	const_cast(ops->maxtype)	= IFLA_MACVLAN_MAX;
++	const_cast(ops->policy)		= macvlan_policy;
++	const_cast(ops->changelink)	= macvlan_changelink;
++	const_cast(ops->get_size)	= macvlan_get_size;
++	const_cast(ops->fill_info)	= macvlan_fill_info;
 +	pax_close_kernel();
  
  	return rtnl_link_register(ops);
@@ -62585,7 +63159,7 @@ index 831a544..d846785 100644
  struct ath_nf_limits {
  	s16 max;
 diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
-index c1b33fd..9f904b1 100644
+index c1b33fd..d61f3b4 100644
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
 @@ -2589,16 +2589,18 @@ void ath9k_fill_chanctx_ops(void)
@@ -62603,16 +63177,16 @@ index c1b33fd..9f904b1 100644
 -	ath9k_ops.unassign_vif_chanctx     = ath9k_unassign_vif_chanctx;
 -	ath9k_ops.mgd_prepare_tx           = ath9k_mgd_prepare_tx;
 +	pax_open_kernel();
-+	*(void **)&ath9k_ops.hw_scan                  = ath9k_hw_scan;
-+	*(void **)&ath9k_ops.cancel_hw_scan           = ath9k_cancel_hw_scan;
-+	*(void **)&ath9k_ops.remain_on_channel        = ath9k_remain_on_channel;
-+	*(void **)&ath9k_ops.cancel_remain_on_channel = ath9k_cancel_remain_on_channel;
-+	*(void **)&ath9k_ops.add_chanctx              = ath9k_add_chanctx;
-+	*(void **)&ath9k_ops.remove_chanctx           = ath9k_remove_chanctx;
-+	*(void **)&ath9k_ops.change_chanctx           = ath9k_change_chanctx;
-+	*(void **)&ath9k_ops.assign_vif_chanctx       = ath9k_assign_vif_chanctx;
-+	*(void **)&ath9k_ops.unassign_vif_chanctx     = ath9k_unassign_vif_chanctx;
-+	*(void **)&ath9k_ops.mgd_prepare_tx           = ath9k_mgd_prepare_tx;
++	const_cast(ath9k_ops.hw_scan)                  = ath9k_hw_scan;
++	const_cast(ath9k_ops.cancel_hw_scan)           = ath9k_cancel_hw_scan;
++	const_cast(ath9k_ops.remain_on_channel)        = ath9k_remain_on_channel;
++	const_cast(ath9k_ops.cancel_remain_on_channel) = ath9k_cancel_remain_on_channel;
++	const_cast(ath9k_ops.add_chanctx)              = ath9k_add_chanctx;
++	const_cast(ath9k_ops.remove_chanctx)           = ath9k_remove_chanctx;
++	const_cast(ath9k_ops.change_chanctx)           = ath9k_change_chanctx;
++	const_cast(ath9k_ops.assign_vif_chanctx)       = ath9k_assign_vif_chanctx;
++	const_cast(ath9k_ops.unassign_vif_chanctx)     = ath9k_unassign_vif_chanctx;
++	const_cast(ath9k_ops.mgd_prepare_tx)           = ath9k_mgd_prepare_tx;
 +	pax_close_kernel();
  }
  
@@ -63861,7 +64435,7 @@ index ed0adaf..4bb4f53 100644
  	return ret;
  }
 diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
-index af1b3e6..9bc08d3 100644
+index af1b3e6..c014779 100644
 --- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
 +++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
 @@ -1399,8 +1399,9 @@ il3945_dump_nic_error_log(struct il_priv *il)
@@ -63899,7 +64473,7 @@ index af1b3e6..9bc08d3 100644
  		D_INFO("Disabling hw_scan\n");
 -		il3945_mac_ops.hw_scan = NULL;
 +		pax_open_kernel();
-+		*(void **)&il3945_mac_ops.hw_scan = NULL;
++		const_cast(il3945_mac_ops.hw_scan) = NULL;
 +		pax_close_kernel();
  	}
  
@@ -65682,7 +66256,7 @@ index 48e8a97..3499ec8 100644
  
  const struct iw_handler_def prism54_handler_def = {
 diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
-index a28414c..26c8768 100644
+index a28414c..ad61156 100644
 --- a/drivers/net/wireless/mac80211_hwsim.c
 +++ b/drivers/net/wireless/mac80211_hwsim.c
 @@ -3218,20 +3218,20 @@ static int __init init_mac80211_hwsim(void)
@@ -65705,17 +66279,17 @@ index a28414c..26c8768 100644
 -		mac80211_hwsim_unassign_vif_chanctx;
 +	pax_open_kernel();
 +	memcpy((void *)&mac80211_hwsim_mchan_ops, &mac80211_hwsim_ops, sizeof mac80211_hwsim_mchan_ops);
-+	*(void **)&mac80211_hwsim_mchan_ops.hw_scan = mac80211_hwsim_hw_scan;
-+	*(void **)&mac80211_hwsim_mchan_ops.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan;
-+	*(void **)&mac80211_hwsim_mchan_ops.sw_scan_start = NULL;
-+	*(void **)&mac80211_hwsim_mchan_ops.sw_scan_complete = NULL;
-+	*(void **)&mac80211_hwsim_mchan_ops.remain_on_channel = mac80211_hwsim_roc;
-+	*(void **)&mac80211_hwsim_mchan_ops.cancel_remain_on_channel = mac80211_hwsim_croc;
-+	*(void **)&mac80211_hwsim_mchan_ops.add_chanctx = mac80211_hwsim_add_chanctx;
-+	*(void **)&mac80211_hwsim_mchan_ops.remove_chanctx = mac80211_hwsim_remove_chanctx;
-+	*(void **)&mac80211_hwsim_mchan_ops.change_chanctx = mac80211_hwsim_change_chanctx;
-+	*(void **)&mac80211_hwsim_mchan_ops.assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx;
-+	*(void **)&mac80211_hwsim_mchan_ops.unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx;
++	const_cast(mac80211_hwsim_mchan_ops.hw_scan) = mac80211_hwsim_hw_scan;
++	const_cast(mac80211_hwsim_mchan_ops.cancel_hw_scan) = mac80211_hwsim_cancel_hw_scan;
++	const_cast(mac80211_hwsim_mchan_ops.sw_scan_start) = NULL;
++	const_cast(mac80211_hwsim_mchan_ops.sw_scan_complete) = NULL;
++	const_cast(mac80211_hwsim_mchan_ops.remain_on_channel) = mac80211_hwsim_roc;
++	const_cast(mac80211_hwsim_mchan_ops.cancel_remain_on_channel) = mac80211_hwsim_croc;
++	const_cast(mac80211_hwsim_mchan_ops.add_chanctx) = mac80211_hwsim_add_chanctx;
++	const_cast(mac80211_hwsim_mchan_ops.remove_chanctx) = mac80211_hwsim_remove_chanctx;
++	const_cast(mac80211_hwsim_mchan_ops.change_chanctx) = mac80211_hwsim_change_chanctx;
++	const_cast(mac80211_hwsim_mchan_ops.assign_vif_chanctx) = mac80211_hwsim_assign_vif_chanctx;
++	const_cast(mac80211_hwsim_mchan_ops.unassign_vif_chanctx) = mac80211_hwsim_unassign_vif_chanctx;
 +	pax_close_kernel();
  
  	spin_lock_init(&hwsim_radio_lock);
@@ -66131,7 +66705,7 @@ index 29dfc51..8297755 100644
  void rtl_swlps_rf_sleep(struct ieee80211_hw *hw);
  void rtl_p2p_ps_cmd(struct ieee80211_hw *hw , u8 p2p_ps_state);
 diff --git a/drivers/net/wireless/ti/wl1251/sdio.c b/drivers/net/wireless/ti/wl1251/sdio.c
-index b661f896..ddf7d2b 100644
+index b661f896..ebea675 100644
 --- a/drivers/net/wireless/ti/wl1251/sdio.c
 +++ b/drivers/net/wireless/ti/wl1251/sdio.c
 @@ -282,13 +282,17 @@ static int wl1251_sdio_probe(struct sdio_func *func,
@@ -66141,8 +66715,8 @@ index b661f896..ddf7d2b 100644
 -		wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
 -		wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
 +		pax_open_kernel();
-+		*(void **)&wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
-+		*(void **)&wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
++		const_cast(wl1251_sdio_ops.enable_irq) = wl1251_enable_line_irq;
++		const_cast(wl1251_sdio_ops.disable_irq) = wl1251_disable_line_irq;
 +		pax_close_kernel();
  
  		wl1251_info("using dedicated interrupt line");
@@ -66150,14 +66724,14 @@ index b661f896..ddf7d2b 100644
 -		wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq;
 -		wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq;
 +		pax_open_kernel();
-+		*(void **)&wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq;
-+		*(void **)&wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq;
++		const_cast(wl1251_sdio_ops.enable_irq) = wl1251_sdio_enable_irq;
++		const_cast(wl1251_sdio_ops.disable_irq) = wl1251_sdio_disable_irq;
 +		pax_close_kernel();
  
  		wl1251_info("using SDIO interrupt");
  	}
 diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
-index a0d6ccc..93d9ac5 100644
+index a0d6ccc..36e1ae3 100644
 --- a/drivers/net/wireless/ti/wl12xx/main.c
 +++ b/drivers/net/wireless/ti/wl12xx/main.c
 @@ -656,7 +656,9 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
@@ -66166,7 +66740,7 @@ index a0d6ccc..93d9ac5 100644
  		/* read data preparation is only needed by wl127x */
 -		wl->ops->prepare_read = wl127x_prepare_read;
 +		pax_open_kernel();
-+		*(void **)&wl->ops->prepare_read = wl127x_prepare_read;
++		const_cast(wl->ops->prepare_read) = wl127x_prepare_read;
 +		pax_close_kernel();
  
  		wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER,
@@ -66177,13 +66751,13 @@ index a0d6ccc..93d9ac5 100644
  		/* read data preparation is only needed by wl127x */
 -		wl->ops->prepare_read = wl127x_prepare_read;
 +		pax_open_kernel();
-+		*(void **)&wl->ops->prepare_read = wl127x_prepare_read;
++		const_cast(wl->ops->prepare_read) = wl127x_prepare_read;
 +		pax_close_kernel();
  
  		wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER,
  			      WL127X_IFTYPE_SR_VER,  WL127X_MAJOR_SR_VER,
 diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
-index 1bf26cc..3b15c02 100644
+index 1bf26cc..7dd1267 100644
 --- a/drivers/net/wireless/ti/wl18xx/main.c
 +++ b/drivers/net/wireless/ti/wl18xx/main.c
 @@ -2018,8 +2018,10 @@ static int wl18xx_setup(struct wl1271 *wl)
@@ -66193,8 +66767,8 @@ index 1bf26cc..3b15c02 100644
 -		wl18xx_ops.set_rx_csum = NULL;
 -		wl18xx_ops.init_vif = NULL;
 +		pax_open_kernel();
-+		*(void **)&wl18xx_ops.set_rx_csum = NULL;
-+		*(void **)&wl18xx_ops.init_vif = NULL;
++		const_cast(wl18xx_ops.set_rx_csum) = NULL;
++		const_cast(wl18xx_ops.init_vif) = NULL;
 +		pax_close_kernel();
  	}
  
@@ -66687,7 +67261,7 @@ index 680f578..cf80097 100644
  	struct nvme_dev *dev = pci_get_drvdata(pdev);
  
 diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
-index 655f79d..509e3cd 100644
+index 655f79d..c684ede 100644
 --- a/drivers/of/fdt.c
 +++ b/drivers/of/fdt.c
 @@ -1170,7 +1170,9 @@ static int __init of_fdt_raw_init(void)
@@ -66696,7 +67270,7 @@ index 655f79d..509e3cd 100644
  	}
 -	of_fdt_raw_attr.size = fdt_totalsize(initial_boot_params);
 +	pax_open_kernel();
-+	*(size_t *)&of_fdt_raw_attr.size = fdt_totalsize(initial_boot_params);
++	const_cast(of_fdt_raw_attr.size) = fdt_totalsize(initial_boot_params);
 +	pax_close_kernel();
  	return sysfs_create_bin_file(firmware_kobj, &of_fdt_raw_attr);
  }
@@ -66881,7 +67455,7 @@ index 1652bc7..4f999c4 100644
  struct gen_pci_cfg_windows {
  	struct resource				res;
 diff --git a/drivers/pci/hotplug/acpiphp_ibm.c b/drivers/pci/hotplug/acpiphp_ibm.c
-index 2f6d3a1..5bc1bf1 100644
+index 2f6d3a1..cb43cfc 100644
 --- a/drivers/pci/hotplug/acpiphp_ibm.c
 +++ b/drivers/pci/hotplug/acpiphp_ibm.c
 @@ -463,7 +463,9 @@ static int __init ibm_acpiphp_init(void)
@@ -66890,7 +67464,7 @@ index 2f6d3a1..5bc1bf1 100644
  
 -	ibm_apci_table_attr.size = ibm_get_table_from_acpi(NULL);
 +	pax_open_kernel();
-+	*(size_t *)&ibm_apci_table_attr.size = ibm_get_table_from_acpi(NULL);
++	const_cast(ibm_apci_table_attr.size) = ibm_get_table_from_acpi(NULL);
 +	pax_close_kernel();
  	retval = sysfs_create_bin_file(sysdir, &ibm_apci_table_attr);
  
@@ -66927,7 +67501,7 @@ index 88a44a7..de358ce 100644
  
  	status = cpci_hp_register_controller(&generic_hpc);
 diff --git a/drivers/pci/hotplug/cpcihp_zt5550.c b/drivers/pci/hotplug/cpcihp_zt5550.c
-index 5f49c3f..989cd41 100644
+index 5f49c3f..438f019 100644
 --- a/drivers/pci/hotplug/cpcihp_zt5550.c
 +++ b/drivers/pci/hotplug/cpcihp_zt5550.c
 @@ -59,7 +59,6 @@
@@ -66964,9 +67538,9 @@ index 5f49c3f..989cd41 100644
 -		zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
 -		zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
 +		pax_open_kernel();
-+		*(void **)&zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
-+		*(void **)&zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
-+		*(void **)&zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
++		const_cast(zt5550_hpc_ops.enable_irq) = zt5550_hc_enable_irq;
++		const_cast(zt5550_hpc_ops.disable_irq) = zt5550_hc_disable_irq;
++		const_cast(zt5550_hpc_ops.check_irq) = zt5550_hc_check_irq;
 +		pax_open_kernel();
  	} else {
  		info("using ENUM# polling mode");
@@ -66987,7 +67561,7 @@ index c25fc90..b054774 100644
  	dbg("int15 entry  = %p\n", compaq_int15_entry_point);
  
 diff --git a/drivers/pci/hotplug/pci_hotplug_core.c b/drivers/pci/hotplug/pci_hotplug_core.c
-index 9acd199..0645a09 100644
+index 9acd199..1b19f5b 100644
 --- a/drivers/pci/hotplug/pci_hotplug_core.c
 +++ b/drivers/pci/hotplug/pci_hotplug_core.c
 @@ -434,8 +434,10 @@ int __pci_hp_register(struct hotplug_slot *slot, struct pci_bus *bus,
@@ -66997,8 +67571,8 @@ index 9acd199..0645a09 100644
 -	slot->ops->owner = owner;
 -	slot->ops->mod_name = mod_name;
 +	pax_open_kernel();
-+	*(struct module **)&slot->ops->owner = owner;
-+	*(const char **)&slot->ops->mod_name = mod_name;
++	const_cast(slot->ops->owner) = owner;
++	const_cast(slot->ops->mod_name) = mod_name;
 +	pax_close_kernel();
  
  	mutex_lock(&pci_hp_mutex);
@@ -67017,7 +67591,7 @@ index ac531e6..716d058 100644
  	int retval = -ENOMEM;
  
 diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
-index a080f44..9ff42d9 100644
+index a080f44..24ad26c 100644
 --- a/drivers/pci/msi.c
 +++ b/drivers/pci/msi.c
 @@ -474,8 +474,8 @@ static int populate_msi_sysfs(struct pci_dev *pdev)
@@ -67047,13 +67621,13 @@ index a080f44..9ff42d9 100644
 +		pax_open_kernel();
  		if (ops->set_desc == NULL)
 -			ops->set_desc = pci_msi_domain_set_desc;
-+			*(void **)&ops->set_desc = pci_msi_domain_set_desc;
++			const_cast(ops->set_desc) = pci_msi_domain_set_desc;
  		if (ops->msi_check == NULL)
 -			ops->msi_check = pci_msi_domain_check_cap;
-+			*(void **)&ops->msi_check = pci_msi_domain_check_cap;
++			const_cast(ops->msi_check) = pci_msi_domain_check_cap;
  		if (ops->handle_error == NULL)
 -			ops->handle_error = pci_msi_domain_handle_error;
-+			*(void **)&ops->handle_error = pci_msi_domain_handle_error;
++			const_cast(ops->handle_error) = pci_msi_domain_handle_error;
 +		pax_close_kernel();
  	}
  }
@@ -67065,13 +67639,13 @@ index a080f44..9ff42d9 100644
 +	pax_open_kernel();
  	if (!chip->irq_write_msi_msg)
 -		chip->irq_write_msi_msg = pci_msi_domain_write_msg;
-+		*(void **)&chip->irq_write_msi_msg = pci_msi_domain_write_msg;
++		const_cast(chip->irq_write_msi_msg) = pci_msi_domain_write_msg;
  	if (!chip->irq_mask)
 -		chip->irq_mask = pci_msi_mask_irq;
-+		*(void **)&chip->irq_mask = pci_msi_mask_irq;
++		const_cast(chip->irq_mask) = pci_msi_mask_irq;
  	if (!chip->irq_unmask)
 -		chip->irq_unmask = pci_msi_unmask_irq;
-+		*(void **)&chip->irq_unmask = pci_msi_unmask_irq;
++		const_cast(chip->irq_unmask) = pci_msi_unmask_irq;
 +	pax_close_kernel();
  }
  
@@ -67238,7 +67812,7 @@ index c8969dd..4764267 100644
  	bool supports_sleepmode;
  	int irq;
 diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
-index 523b6b7..e9aa88d 100644
+index 523b6b7..eb4c74d 100644
 --- a/drivers/pinctrl/pinctrl-at91.c
 +++ b/drivers/pinctrl/pinctrl-at91.c
 @@ -24,6 +24,7 @@
@@ -67255,7 +67829,7 @@ index 523b6b7..e9aa88d 100644
  	/* Setup proper .irq_set_type function */
 -	gpio_irqchip.irq_set_type = at91_gpio->ops->irq_type;
 +	pax_open_kernel();
-+	*(void **)&gpio_irqchip.irq_set_type = at91_gpio->ops->irq_type;
++	const_cast(gpio_irqchip.irq_set_type) = at91_gpio->ops->irq_type;
 +	pax_close_kernel();
  
  	/* Disable irqs of this PIO controller */
@@ -67398,7 +67972,7 @@ index 6aa33c4..cfb5425 100644
  		.ident = "OakTrail platform",
  		.matches = {
 diff --git a/drivers/platform/x86/msi-laptop.c b/drivers/platform/x86/msi-laptop.c
-index 4231770..10a6caf 100644
+index 4231770..cbf93a6 100644
 --- a/drivers/platform/x86/msi-laptop.c
 +++ b/drivers/platform/x86/msi-laptop.c
 @@ -605,7 +605,7 @@ static int dmi_check_cb(const struct dmi_system_id *dmi)
@@ -67421,12 +67995,12 @@ index 4231770..10a6caf 100644
 -		dev_attr_wlan.attr.mode |= S_IWUSR;
 -		dev_attr_threeg.attr.mode |= S_IWUSR;
 +		pax_open_kernel();
-+		*(void **)&dev_attr_bluetooth.store = store_bluetooth;
-+		*(void **)&dev_attr_wlan.store = store_wlan;
-+		*(void **)&dev_attr_threeg.store = store_threeg;
-+		*(umode_t *)&dev_attr_bluetooth.attr.mode |= S_IWUSR;
-+		*(umode_t *)&dev_attr_wlan.attr.mode |= S_IWUSR;
-+		*(umode_t *)&dev_attr_threeg.attr.mode |= S_IWUSR;
++		const_cast(dev_attr_bluetooth.store) = store_bluetooth;
++		const_cast(dev_attr_wlan.store) = store_wlan;
++		const_cast(dev_attr_threeg.store) = store_threeg;
++		const_cast(dev_attr_bluetooth.attr.mode) |= S_IWUSR;
++		const_cast(dev_attr_wlan.attr.mode) |= S_IWUSR;
++		const_cast(dev_attr_threeg.attr.mode) |= S_IWUSR;
 +		pax_close_kernel();
  	}
  
@@ -67756,7 +68330,7 @@ index ed2d7fd..266b28f 100644
  		__power_supply_attrs[i] = &power_supply_attrs[i].attr;
  }
 diff --git a/drivers/power/reset/at91-reset.c b/drivers/power/reset/at91-reset.c
-index 1b5d450..3257054 100644
+index 1b5d450..b6042f8 100644
 --- a/drivers/power/reset/at91-reset.c
 +++ b/drivers/power/reset/at91-reset.c
 @@ -17,6 +17,7 @@
@@ -67773,13 +68347,13 @@ index 1b5d450..3257054 100644
  	match = of_match_node(at91_reset_of_match, pdev->dev.of_node);
 -	at91_restart_nb.notifier_call = match->data;
 +	pax_open_kernel();
-+	*(void **)&at91_restart_nb.notifier_call = match->data;
++	const_cast(at91_restart_nb.notifier_call) = match->data;
 +	pax_close_kernel();
  
  	sclk = devm_clk_get(&pdev->dev, NULL);
  	if (IS_ERR(sclk))
 diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
-index 14bde0d..89f2669 100644
+index 14bde0d..9391277 100644
 --- a/drivers/powercap/powercap_sys.c
 +++ b/drivers/powercap/powercap_sys.c
 @@ -154,8 +154,77 @@ struct powercap_constraint_attr {
@@ -67887,7 +68461,7 @@ index 14bde0d..89f2669 100644
 -	dev_attr->store = store;
 +
 +	pax_open_kernel();
-+	*(const char **)&dev_attr->attr.name = name;
++	const_cast(dev_attr->attr.name) = name;
 +	pax_close_kernel();
  
  	return 0;
@@ -67959,10 +68533,10 @@ index 14bde0d..89f2669 100644
 +		pax_open_kernel();
  		if (power_zone->ops->reset_energy_uj)
 -			dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
-+			*(umode_t *)&dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
++			const_cast(dev_attr_energy_uj.attr.mode) = S_IWUSR | S_IRUGO;
  		else
 -			dev_attr_energy_uj.attr.mode = S_IRUGO;
-+			*(umode_t *)&dev_attr_energy_uj.attr.mode = S_IRUGO;
++			const_cast(dev_attr_energy_uj.attr.mode) = S_IRUGO;
 +		pax_close_kernel();
  		power_zone->zone_dev_attrs[count++] =
  					&dev_attr_energy_uj.attr;
@@ -68016,7 +68590,7 @@ index 744c988..a269ffb 100644
  	if (ret != 0) {
  		put_device(&rdev->dev);
 diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
-index b87f62d..345b9a1 100644
+index b87f62d..34f1cdf 100644
 --- a/drivers/regulator/max8660.c
 +++ b/drivers/regulator/max8660.c
 @@ -423,8 +423,10 @@ static int max8660_probe(struct i2c_client *client,
@@ -68026,14 +68600,14 @@ index b87f62d..345b9a1 100644
 -		max8660_dcdc_ops.enable = max8660_dcdc_enable;
 -		max8660_dcdc_ops.disable = max8660_dcdc_disable;
 +		pax_open_kernel();
-+		*(void **)&max8660_dcdc_ops.enable = max8660_dcdc_enable;
-+		*(void **)&max8660_dcdc_ops.disable = max8660_dcdc_disable;
++		const_cast(max8660_dcdc_ops.enable) = max8660_dcdc_enable;
++		const_cast(max8660_dcdc_ops.disable) = max8660_dcdc_disable;
 +		pax_close_kernel();
  	}
  
  	/*
 diff --git a/drivers/regulator/max8973-regulator.c b/drivers/regulator/max8973-regulator.c
-index 5b75b7c..142c226 100644
+index 5b75b7c..8b1bb06 100644
 --- a/drivers/regulator/max8973-regulator.c
 +++ b/drivers/regulator/max8973-regulator.c
 @@ -658,9 +658,11 @@ static int max8973_probe(struct i2c_client *client,
@@ -68044,9 +68618,9 @@ index 5b75b7c..142c226 100644
 -			max->ops.disable = regulator_disable_regmap;
 -			max->ops.is_enabled = regulator_is_enabled_regmap;
 +			pax_open_kernel();
-+			*(void **)&max->ops.enable = regulator_enable_regmap;
-+			*(void **)&max->ops.disable = regulator_disable_regmap;
-+			*(void **)&max->ops.is_enabled = regulator_is_enabled_regmap;
++			const_cast(max->ops.enable) = regulator_enable_regmap;
++			const_cast(max->ops.disable) = regulator_disable_regmap;
++			const_cast(max->ops.is_enabled) = regulator_is_enabled_regmap;
 +			pax_close_kernel();
  			break;
  		}
@@ -68059,15 +68633,15 @@ index 5b75b7c..142c226 100644
 -		max->ops.disable = regulator_disable_regmap;
 -		max->ops.is_enabled = regulator_is_enabled_regmap;
 +		pax_open_kernel();
-+		*(void **)&max->ops.enable = regulator_enable_regmap;
-+		*(void **)&max->ops.disable = regulator_disable_regmap;
-+		*(void **)&max->ops.is_enabled = regulator_is_enabled_regmap;
++		const_cast(max->ops.enable) = regulator_enable_regmap;
++		const_cast(max->ops.disable) = regulator_disable_regmap;
++		const_cast(max->ops.is_enabled) = regulator_is_enabled_regmap;
 +		pax_close_kernel();
  		max->ops.set_current_limit = max8973_set_current_limit;
  		max->ops.get_current_limit = max8973_get_current_limit;
  		break;
 diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c
-index 0d17c92..a29f627 100644
+index 0d17c92..ce5897e 100644
 --- a/drivers/regulator/mc13892-regulator.c
 +++ b/drivers/regulator/mc13892-regulator.c
 @@ -584,10 +584,12 @@ static int mc13892_regulator_probe(struct platform_device *pdev)
@@ -68080,8 +68654,8 @@ index 0d17c92..a29f627 100644
  						sizeof(struct regulator_ops));
 -	mc13892_vcam_ops.set_mode = mc13892_vcam_set_mode,
 -	mc13892_vcam_ops.get_mode = mc13892_vcam_get_mode,
-+	*(void **)&mc13892_vcam_ops.set_mode = mc13892_vcam_set_mode,
-+	*(void **)&mc13892_vcam_ops.get_mode = mc13892_vcam_get_mode,
++	const_cast(mc13892_vcam_ops.set_mode) = mc13892_vcam_set_mode,
++	const_cast(mc13892_vcam_ops.get_mode) = mc13892_vcam_get_mode,
 +	pax_close_kernel();
  	mc13892_regulators[MC13892_VCAM].desc.ops = &mc13892_vcam_ops;
  
@@ -68177,7 +68751,7 @@ index 9e03d15..36e341c 100644
  
  /* handle firmware resource entries before booting the remote processor */
 diff --git a/drivers/rtc/rtc-armada38x.c b/drivers/rtc/rtc-armada38x.c
-index 9a3f2a6..604f463 100644
+index 9a3f2a6..c19b00a 100644
 --- a/drivers/rtc/rtc-armada38x.c
 +++ b/drivers/rtc/rtc-armada38x.c
 @@ -18,6 +18,7 @@
@@ -68195,14 +68769,14 @@ index 9a3f2a6..604f463 100644
 -		armada38x_rtc_ops.set_alarm = NULL;
 -		armada38x_rtc_ops.alarm_irq_enable = NULL;
 +		pax_open_kernel();
-+		*(void **)&armada38x_rtc_ops.set_alarm = NULL;
-+		*(void **)&armada38x_rtc_ops.alarm_irq_enable = NULL;
++		const_cast(armada38x_rtc_ops.set_alarm) = NULL;
++		const_cast(armada38x_rtc_ops.alarm_irq_enable) = NULL;
 +		pax_close_kernel();
  	}
  	platform_set_drvdata(pdev, rtc);
  	if (rtc->irq != -1)
 diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
-index 84fb541..fee0421a 100644
+index 84fb541..a526dd0 100644
 --- a/drivers/rtc/rtc-cmos.c
 +++ b/drivers/rtc/rtc-cmos.c
 @@ -735,7 +735,9 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
@@ -68211,7 +68785,7 @@ index 84fb541..fee0421a 100644
  	/* export at least the first block of NVRAM */
 -	nvram.size = address_space - NVRAM_OFFSET;
 +	pax_open_kernel();
-+	*(size_t *)&nvram.size = address_space - NVRAM_OFFSET;
++	const_cast(nvram.size) = address_space - NVRAM_OFFSET;
 +	pax_close_kernel();
  	retval = sysfs_create_bin_file(&dev->kobj, &nvram);
  	if (retval < 0) {
@@ -68251,7 +68825,7 @@ index cf685f6..2311b8f 100644
  	unsigned long		flags;
  #define HAS_NVRAM	0		/* bit 0 == sysfs file active */
 diff --git a/drivers/rtc/rtc-m48t59.c b/drivers/rtc/rtc-m48t59.c
-index d99a705..f8ebd79 100644
+index d99a705..99654e7 100644
 --- a/drivers/rtc/rtc-m48t59.c
 +++ b/drivers/rtc/rtc-m48t59.c
 @@ -485,7 +485,9 @@ static int m48t59_rtc_probe(struct platform_device *pdev)
@@ -68260,7 +68834,7 @@ index d99a705..f8ebd79 100644
  
 -	m48t59_nvram_attr.size = pdata->offset;
 +	pax_open_kernel();
-+	*(size_t *)&m48t59_nvram_attr.size = pdata->offset;
++	const_cast(m48t59_nvram_attr.size) = pdata->offset;
 +	pax_close_kernel();
  
  	ret = sysfs_create_bin_file(&pdev->dev.kobj, &m48t59_nvram_attr);
@@ -68303,7 +68877,7 @@ index 7155c08..10ba718 100644
  		dev_err(&client->dev, "unable to register the class device\n");
  		return PTR_ERR(rv8803->rtc);
 diff --git a/drivers/rtc/rtc-rx8010.c b/drivers/rtc/rtc-rx8010.c
-index 772d221..60e31aa 100644
+index 772d221..3a56e42 100644
 --- a/drivers/rtc/rtc-rx8010.c
 +++ b/drivers/rtc/rtc-rx8010.c
 @@ -489,9 +489,11 @@ static int rx8010_probe(struct i2c_client *client,
@@ -68314,15 +68888,15 @@ index 772d221..60e31aa 100644
 -			rx8010_rtc_ops.set_alarm = rx8010_set_alarm;
 -			rx8010_rtc_ops.alarm_irq_enable = rx8010_alarm_irq_enable;
 +			pax_open_kernel();
-+			*(void **)&rx8010_rtc_ops.read_alarm = rx8010_read_alarm;
-+			*(void **)&rx8010_rtc_ops.set_alarm = rx8010_set_alarm;
-+			*(void **)&rx8010_rtc_ops.alarm_irq_enable = rx8010_alarm_irq_enable;
++			const_cast(rx8010_rtc_ops.read_alarm) = rx8010_read_alarm;
++			const_cast(rx8010_rtc_ops.set_alarm) = rx8010_set_alarm;
++			const_cast(rx8010_rtc_ops.alarm_irq_enable) = rx8010_alarm_irq_enable;
 +			pax_close_kernel();
  		}
  	}
  
 diff --git a/drivers/rtc/rtc-test.c b/drivers/rtc/rtc-test.c
-index 3a2da4c..e88493c 100644
+index 3a2da4c..1d1d4b1 100644
 --- a/drivers/rtc/rtc-test.c
 +++ b/drivers/rtc/rtc-test.c
 @@ -112,8 +112,10 @@ static int test_probe(struct platform_device *plat_dev)
@@ -68332,34 +68906,16 @@ index 3a2da4c..e88493c 100644
 -		test_rtc_ops.set_mmss64 = test_rtc_set_mmss64;
 -		test_rtc_ops.set_mmss = NULL;
 +		pax_open_kernel();
-+		*(void **)&test_rtc_ops.set_mmss64 = test_rtc_set_mmss64;
-+		*(void **)&test_rtc_ops.set_mmss = NULL;
++		const_cast(test_rtc_ops.set_mmss64) = test_rtc_set_mmss64;
++		const_cast(test_rtc_ops.set_mmss) = NULL;
 +		pax_close_kernel();
  	}
  
  	rtc = devm_rtc_device_register(&plat_dev->dev, "test",
 diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
-index e4c2437..2297164 100644
+index e4c2437..3b3cd62 100644
 --- a/drivers/scsi/aacraid/aachba.c
 +++ b/drivers/scsi/aacraid/aachba.c
-@@ -647,7 +647,7 @@ static void _aac_probe_container2(void * context, struct fib * fibptr)
- 	}
- 	aac_fib_complete(fibptr);
- 	aac_fib_free(fibptr);
--	callback = (int (*)(struct scsi_cmnd *))(scsicmd->SCp.ptr);
-+	callback = scsicmd->SCp.ptr;
- 	scsicmd->SCp.ptr = NULL;
- 	(*callback)(scsicmd);
- 	return;
-@@ -726,7 +726,7 @@ static int _aac_probe_container(struct scsi_cmnd * scsicmd, int (*callback)(stru
- 
- 		dinfo->count = cpu_to_le32(scmd_id(scsicmd));
- 		dinfo->type = cpu_to_le32(FT_FILESYS);
--		scsicmd->SCp.ptr = (char *)callback;
-+		scsicmd->SCp.ptr = callback;
- 
- 		status = aac_fib_send(ContainerCommand,
- 			  fibptr,
 @@ -775,6 +775,11 @@ static int aac_probe_container_callback1(struct scsi_cmnd * scsicmd)
  	return 0;
  }
@@ -70641,7 +71197,7 @@ index 25aa9b9..d700a65 100644
  	snprintf(name, sizeof(name), "discovery_trace");
  	vport->debug_disc_trc =
 diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
-index f57d02c..ab7b70c 100644
+index f57d02c..6ba534b 100644
 --- a/drivers/scsi/lpfc/lpfc_init.c
 +++ b/drivers/scsi/lpfc/lpfc_init.c
 @@ -11028,7 +11028,7 @@ lpfc_pci_resume_one(struct pci_dev *pdev)
@@ -70660,8 +71216,8 @@ index f57d02c..ab7b70c 100644
 -		lpfc_transport_functions.vport_create = lpfc_vport_create;
 -		lpfc_transport_functions.vport_delete = lpfc_vport_delete;
 +		pax_open_kernel();
-+		*(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
-+		*(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
++		const_cast(lpfc_transport_functions.vport_create) = lpfc_vport_create;
++		const_cast(lpfc_transport_functions.vport_delete) = lpfc_vport_delete;
 +		pax_close_kernel();
  	}
  	lpfc_transport_template =
@@ -71004,7 +71560,7 @@ index 0103e46..6220a84 100644
  extern void qla2x00_free_sysfs_attr(scsi_qla_host_t *, bool);
  extern void qla2x00_init_host_attr(scsi_qla_host_t *);
 diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index f6c7ce3..2dd675b 100644
+index f6c7ce3..dccd3d4 100644
 --- a/drivers/scsi/qla2xxx/qla_os.c
 +++ b/drivers/scsi/qla2xxx/qla_os.c
 @@ -291,12 +291,12 @@ struct scsi_transport_template *qla2xxx_transport_vport_template = NULL;
@@ -71029,8 +71585,8 @@ index f6c7ce3..2dd675b 100644
 -			ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
 -			ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
 +			pax_open_kernel();
-+			*(void **)&ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
-+			*(void **)&ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
++			const_cast(ha->isp_ops->calc_req_entries) = qla2x00_calc_iocbs_64;
++			const_cast(ha->isp_ops->build_iocbs) = qla2x00_build_scsi_iocbs_64;
 +			pax_close_kernel();
  			return;
  		}
@@ -74424,7 +74980,7 @@ index 9a14074..3d02410 100644
  	struct rtw_adapter *padapter = netdev_priv(pnetdev);
  	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
 diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
-index c78421b..f75c4c4 100644
+index c78421b..e1ba746 100644
 --- a/drivers/staging/sm750fb/sm750.c
 +++ b/drivers/staging/sm750fb/sm750.c
 @@ -720,6 +720,7 @@ static struct fb_ops lynxfb_ops = {
@@ -74449,7 +75005,7 @@ index c78421b..f75c4c4 100644
  	if (!g_hwcursor) {
 -		lynxfb_ops.fb_cursor = NULL;
 +		pax_open_kernel();
-+		*(void **)&lynxfb_ops.fb_cursor = NULL;
++		const_cast(lynxfb_ops.fb_cursor) = NULL;
 +		pax_close_kernel();
  		hw_cursor_disable(&crtc->cursor);
  	}
@@ -74461,9 +75017,9 @@ index c78421b..f75c4c4 100644
 -		lynxfb_ops.fb_copyarea = lynxfb_ops_copyarea;
 -		lynxfb_ops.fb_imageblit = lynxfb_ops_imageblit;
 +		pax_open_kernel();
-+		*(void **)&lynxfb_ops.fb_fillrect = lynxfb_ops_fillrect;
-+		*(void **)&lynxfb_ops.fb_copyarea = lynxfb_ops_copyarea;
-+		*(void **)&lynxfb_ops.fb_imageblit = lynxfb_ops_imageblit;
++		const_cast(lynxfb_ops.fb_fillrect) = lynxfb_ops_fillrect;
++		const_cast(lynxfb_ops.fb_copyarea) = lynxfb_ops_copyarea;
++		const_cast(lynxfb_ops.fb_imageblit) = lynxfb_ops_imageblit;
 +		pax_close_kernel();
  	}
  	info->fbops = &lynxfb_ops;
@@ -74589,7 +75145,7 @@ index 3072f1a..1071742 100644
  	login->tgt_agt = sbp_target_agent_register(login);
  	if (IS_ERR(login->tgt_agt)) {
 diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
-index 6ceac4f..b2ed52c 100644
+index 6ceac4f..f8059ccd 100644
 --- a/drivers/thermal/cpu_cooling.c
 +++ b/drivers/thermal/cpu_cooling.c
 @@ -838,10 +838,11 @@ __cpufreq_cooling_register(struct device_node *np,
@@ -74601,9 +75157,9 @@ index 6ceac4f..b2ed52c 100644
 -		cpufreq_cooling_ops.state2power = cpufreq_state2power;
 -		cpufreq_cooling_ops.power2state = cpufreq_power2state;
 +		pax_open_kernel();
-+		*(void **)&cpufreq_cooling_ops.get_requested_power = cpufreq_get_requested_power;
-+		*(void **)&cpufreq_cooling_ops.state2power = cpufreq_state2power;
-+		*(void **)&cpufreq_cooling_ops.power2state = cpufreq_power2state;
++		const_cast(cpufreq_cooling_ops.get_requested_power) = cpufreq_get_requested_power;
++		const_cast(cpufreq_cooling_ops.state2power) = cpufreq_state2power;
++		const_cast(cpufreq_cooling_ops.power2state) = cpufreq_power2state;
 +		pax_close_kernel();
  		cpufreq_dev->plat_get_static_power = plat_static_func;
  
@@ -74655,7 +75211,7 @@ index 01f0015..aa56551 100644
  		err = PTR_ERR(cdev);
  		dev_err(df->dev.parent,
 diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c
-index 5836e55..740ab89 100644
+index 5836e55..708bbd6 100644
 --- a/drivers/thermal/int340x_thermal/int3400_thermal.c
 +++ b/drivers/thermal/int340x_thermal/int3400_thermal.c
 @@ -272,8 +272,10 @@ static int int3400_thermal_probe(struct platform_device *pdev)
@@ -74665,14 +75221,14 @@ index 5836e55..740ab89 100644
 -		int3400_thermal_ops.get_mode = int3400_thermal_get_mode;
 -		int3400_thermal_ops.set_mode = int3400_thermal_set_mode;
 +		pax_open_kernel();
-+		*(void **)&int3400_thermal_ops.get_mode = int3400_thermal_get_mode;
-+		*(void **)&int3400_thermal_ops.set_mode = int3400_thermal_set_mode;
++		const_cast(int3400_thermal_ops.get_mode) = int3400_thermal_get_mode;
++		const_cast(int3400_thermal_ops.set_mode) = int3400_thermal_set_mode;
 +		pax_close_kernel();
  	}
  	priv->thermal = thermal_zone_device_register("INT3400 Thermal", 0, 0,
  						priv, &int3400_thermal_ops,
 diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
-index 9043f8f..ab0f354 100644
+index 9043f8f..1b53349 100644
 --- a/drivers/thermal/of-thermal.c
 +++ b/drivers/thermal/of-thermal.c
 @@ -31,6 +31,7 @@
@@ -74691,9 +75247,9 @@ index 9043f8f..ab0f354 100644
 -	tzd->ops->get_trend = of_thermal_get_trend;
 -	tzd->ops->set_emul_temp = of_thermal_set_emul_temp;
 +	pax_open_kernel();
-+	*(void **)&tzd->ops->get_temp = of_thermal_get_temp;
-+	*(void **)&tzd->ops->get_trend = of_thermal_get_trend;
-+	*(void **)&tzd->ops->set_emul_temp = of_thermal_set_emul_temp;
++	const_cast(tzd->ops->get_temp) = of_thermal_get_temp;
++	const_cast(tzd->ops->get_trend) = of_thermal_get_trend;
++	const_cast(tzd->ops->set_emul_temp) = of_thermal_set_emul_temp;
 +	pax_close_kernel();
  	mutex_unlock(&tzd->lock);
  
@@ -74706,9 +75262,9 @@ index 9043f8f..ab0f354 100644
 -	tzd->ops->get_trend = NULL;
 -	tzd->ops->set_emul_temp = NULL;
 +	pax_open_kernel();
-+	*(void **)&tzd->ops->get_temp = NULL;
-+	*(void **)&tzd->ops->get_trend = NULL;
-+	*(void **)&tzd->ops->set_emul_temp = NULL;
++	const_cast(tzd->ops->get_temp) = NULL;
++	const_cast(tzd->ops->get_trend) = NULL;
++	const_cast(tzd->ops->set_emul_temp) = NULL;
 +	pax_close_kernel();
  
  	tz->ops = NULL;
@@ -75289,7 +75845,7 @@ index b280abaa..3ccd7d1 100644
  }
  EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
 diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
-index 2348fa6..14894f4 100644
+index 2348fa6..490e407 100644
 --- a/drivers/tty/pty.c
 +++ b/drivers/tty/pty.c
 @@ -879,8 +879,10 @@ static void __init unix98_pty_init(void)
@@ -75299,7 +75855,7 @@ index 2348fa6..14894f4 100644
 +	pax_open_kernel();
  	tty_default_fops(&ptmx_fops);
 -	ptmx_fops.open = ptmx_open;
-+	*(void **)&ptmx_fops.open = ptmx_open;
++	const_cast(ptmx_fops.open) = ptmx_open;
 +	pax_close_kernel();
  
  	cdev_init(&ptmx_cdev, &ptmx_fops);
@@ -75336,7 +75892,7 @@ index 802eac7..f5dcf07 100644
  	clear_bit((info->aiop * 8) + info->chan, (void *) &xmit_flags[info->board]);
  	spin_unlock_irqrestore(&info->port.lock, flags);
 diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
-index c9720a9..f6c9276 100644
+index c9720a9..964f2d9 100644
 --- a/drivers/tty/serial/8250/8250_core.c
 +++ b/drivers/tty/serial/8250/8250_core.c
 @@ -488,9 +488,9 @@ static void univ8250_release_port(struct uart_port *port)
@@ -75346,9 +75902,9 @@ index c9720a9..f6c9276 100644
 -	ops->config_port  = univ8250_config_port;
 -	ops->request_port = univ8250_request_port;
 -	ops->release_port = univ8250_release_port;
-+	*(void **)&ops->config_port  = univ8250_config_port;
-+	*(void **)&ops->request_port = univ8250_request_port;
-+	*(void **)&ops->release_port = univ8250_release_port;
++	const_cast(ops->config_port)  = univ8250_config_port;
++	const_cast(ops->request_port) = univ8250_request_port;
++	const_cast(ops->release_port) = univ8250_release_port;
  }
  
  #else
@@ -75435,7 +75991,7 @@ index a119f11..120444e 100644
  	struct jsm_board *brd = pci_get_drvdata(pdev);
  
 diff --git a/drivers/tty/serial/kgdb_nmi.c b/drivers/tty/serial/kgdb_nmi.c
-index 117df15..2f7dfcf 100644
+index 117df15..8f7486f 100644
 --- a/drivers/tty/serial/kgdb_nmi.c
 +++ b/drivers/tty/serial/kgdb_nmi.c
 @@ -53,7 +53,9 @@ static int kgdb_nmi_console_setup(struct console *co, char *options)
@@ -75444,7 +76000,7 @@ index 117df15..2f7dfcf 100644
  	 */
 -	dbg_io_ops->is_console = true;
 +	pax_open_kernel();
-+	*(int *)&dbg_io_ops->is_console = true;
++	const_cast(dbg_io_ops->is_console) = true;
 +	pax_close_kernel();
  
  	return 0;
@@ -76984,6 +77540,105 @@ index 48672fa..9245081 100644
  
  /* Device for a quirk */
  #define PCI_VENDOR_ID_FRESCO_LOGIC	0x1b73
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index a85a1c9..0f198bc 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1861,9 +1861,9 @@ td_cleanup:
+ 	 * unsigned).  Play it safe and say we didn't transfer anything.
+ 	 */
+ 	if (urb->actual_length > urb->transfer_buffer_length) {
+-		xhci_warn(xhci, "URB transfer length is wrong, xHC issue? req. len = %u, act. len = %u\n",
++		xhci_warn(xhci, "URB transfer length is wrong, xHC issue? req. len = %u, trans. len = %u\n",
+ 			urb->transfer_buffer_length,
+-			urb->actual_length);
++			EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
+ 		urb->actual_length = 0;
+ 		if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+ 			*status = -EREMOTEIO;
+@@ -1942,10 +1942,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 		return finish_td(xhci, td, event_trb, event, ep, status, false);
+ 	case COMP_STOP:
+ 		/* Did we stop at data stage? */
+-		if (event_trb != ep_ring->dequeue && event_trb != td->last_trb)
+-			td->urb->actual_length =
+-				td->urb->transfer_buffer_length -
+-				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
++		if (event_trb != ep_ring->dequeue && event_trb != td->last_trb) {
++			if (td->urb->transfer_buffer_length >= EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)))
++				td->urb->actual_length =
++					td->urb->transfer_buffer_length -
++					EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
++			else
++				td->urb->actual_length =
++					td->urb->transfer_buffer_length + 1;
++		}
+ 		/* fall through */
+ 	case COMP_STOP_INVAL:
+ 		return finish_td(xhci, td, event_trb, event, ep, status, false);
+@@ -1959,12 +1964,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 		/* else fall through */
+ 	case COMP_STALL:
+ 		/* Did we transfer part of the data (middle) phase? */
+-		if (event_trb != ep_ring->dequeue &&
+-				event_trb != td->last_trb)
+-			td->urb->actual_length =
+-				td->urb->transfer_buffer_length -
+-				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+-		else if (!td->urb_length_set)
++		if (event_trb != ep_ring->dequeue && event_trb != td->last_trb) {
++			if (td->urb->transfer_buffer_length >= EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)))
++				td->urb->actual_length =
++					td->urb->transfer_buffer_length -
++					EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
++			else
++				td->urb->actual_length =
++					td->urb->transfer_buffer_length + 1;
++		} else if (!td->urb_length_set)
+ 			td->urb->actual_length = 0;
+ 
+ 		return finish_td(xhci, td, event_trb, event, ep, status, false);
+@@ -1997,9 +2005,12 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 			 * the last TRB.
+ 			 */
+ 			td->urb_length_set = true;
+-			td->urb->actual_length =
+-				td->urb->transfer_buffer_length -
+-				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
++			if (td->urb->transfer_buffer_length >= EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)))
++				td->urb->actual_length =
++					td->urb->transfer_buffer_length -
++					EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
++			else
++				BUG();
+ 			xhci_dbg(xhci, "Waiting for status "
+ 					"stage event\n");
+ 			return 0;
+@@ -2194,11 +2205,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 	/* Fast path - was this the last TRB in the TD for this URB? */
+ 	} else if (event_trb == td->last_trb) {
+ 		if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+-			td->urb->actual_length =
+-				td->urb->transfer_buffer_length -
+-				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+-			if (td->urb->transfer_buffer_length <
+-					td->urb->actual_length) {
++			if (td->urb->transfer_buffer_length < EVENT_TRB_LEN(le32_to_cpu(event->transfer_len))) {
+ 				xhci_warn(xhci, "HC gave bad length "
+ 						"of %d bytes left\n",
+ 					  EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
+@@ -2207,7 +2214,10 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 					*status = -EREMOTEIO;
+ 				else
+ 					*status = 0;
+-			}
++			} else
++				td->urb->actual_length =
++					td->urb->transfer_buffer_length -
++					EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+ 			/* Don't overwrite a previously set error code */
+ 			if (*status == -EINPROGRESS) {
+ 				if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
 index 8e713cc..8c92a15 100644
 --- a/drivers/usb/host/xhci.c
@@ -77621,7 +78276,7 @@ index c42ce2f..4c8bc59 100644
  	"PCI",
  	"PRO AGP",
 diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c
-index f34ed47f..026367f 100644
+index f34ed47f..7283c9f 100644
 --- a/drivers/video/fbdev/aty/atyfb_base.c
 +++ b/drivers/video/fbdev/aty/atyfb_base.c
 @@ -1335,10 +1335,14 @@ static int atyfb_set_par(struct fb_info *info)
@@ -77630,13 +78285,13 @@ index f34ed47f..026367f 100644
  	if (var->accel_flags) {
 -		info->fbops->fb_sync = atyfb_sync;
 +		pax_open_kernel();
-+		*(void **)&info->fbops->fb_sync = atyfb_sync;
++		const_cast(info->fbops->fb_sync) = atyfb_sync;
 +		pax_close_kernel();
  		info->flags &= ~FBINFO_HWACCEL_DISABLED;
  	} else {
 -		info->fbops->fb_sync = NULL;
 +		pax_open_kernel();
-+		*(void **)&info->fbops->fb_sync = NULL;
++		const_cast(info->fbops->fb_sync) = NULL;
 +		pax_close_kernel();
  		info->flags |= FBINFO_HWACCEL_DISABLED;
  	}
@@ -77663,7 +78318,7 @@ index 51f29d6..2c15339 100644
  
  const struct aty_pll_ops aty_pll_ct = {
 diff --git a/drivers/video/fbdev/aty/mach64_cursor.c b/drivers/video/fbdev/aty/mach64_cursor.c
-index 2fa0317..4983f2a 100644
+index 2fa0317..d687dab 100644
 --- a/drivers/video/fbdev/aty/mach64_cursor.c
 +++ b/drivers/video/fbdev/aty/mach64_cursor.c
 @@ -8,6 +8,7 @@
@@ -77680,7 +78335,7 @@ index 2fa0317..4983f2a 100644
  
 -	info->fbops->fb_cursor = atyfb_cursor;
 +	pax_open_kernel();
-+	*(void **)&info->fbops->fb_cursor = atyfb_cursor;
++	const_cast(info->fbops->fb_cursor) = atyfb_cursor;
 +	pax_close_kernel();
  
  	return 0;
@@ -77721,7 +78376,7 @@ index 10c988a..f7d9299 100644
 +	.set_pll	= aty_set_pll,
  };
 diff --git a/drivers/video/fbdev/core/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c
-index 57721c7..55142ed 100644
+index 57721c7..332b94b 100644
 --- a/drivers/video/fbdev/core/fb_defio.c
 +++ b/drivers/video/fbdev/core/fb_defio.c
 @@ -207,7 +207,9 @@ void fb_deferred_io_init(struct fb_info *info)
@@ -77730,17 +78385,19 @@ index 57721c7..55142ed 100644
  	mutex_init(&fbdefio->lock);
 -	info->fbops->fb_mmap = fb_deferred_io_mmap;
 +	pax_open_kernel();
-+	*(void **)&info->fbops->fb_mmap = fb_deferred_io_mmap;
++	const_cast(info->fbops->fb_mmap) = fb_deferred_io_mmap;
 +	pax_close_kernel();
  	INIT_DELAYED_WORK(&info->deferred_work, fb_deferred_io_work);
  	INIT_LIST_HEAD(&fbdefio->pagelist);
  	if (fbdefio->delay == 0) /* set a default of 1 s */
-@@ -238,7 +240,7 @@ void fb_deferred_io_cleanup(struct fb_info *info)
+@@ -238,7 +240,9 @@ void fb_deferred_io_cleanup(struct fb_info *info)
  		page->mapping = NULL;
  	}
  
 -	info->fbops->fb_mmap = NULL;
-+	*(void **)&info->fbops->fb_mmap = NULL;
++	pax_open_kernel();
++	const_cast(info->fbops->fb_mmap) = NULL;
++	pax_close_kernel();
  	mutex_destroy(&fbdefio->lock);
  }
  EXPORT_SYMBOL_GPL(fb_deferred_io_cleanup);
@@ -77872,7 +78529,7 @@ index 11eb094..622ee31 100644
  	{  640,  480,  48, 16, 33, 10,  96, 2, 60 },
  	{  800,  600, 144, 24, 28,  8, 112, 6, 60 },
 diff --git a/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
-index fe92eed..106e085 100644
+index fe92eed..239e386 100644
 --- a/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
 +++ b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
 @@ -312,14 +312,18 @@ void mb862xxfb_init_accel(struct fb_info *info, int xres)
@@ -77883,9 +78540,9 @@ index fe92eed..106e085 100644
 -		info->fbops->fb_copyarea = cfb_copyarea;
 -		info->fbops->fb_imageblit = cfb_imageblit;
 +		pax_open_kernel();
-+		*(void **)&info->fbops->fb_fillrect = cfb_fillrect;
-+		*(void **)&info->fbops->fb_copyarea = cfb_copyarea;
-+		*(void **)&info->fbops->fb_imageblit = cfb_imageblit;
++		const_cast(info->fbops->fb_fillrect) = cfb_fillrect;
++		const_cast(info->fbops->fb_copyarea) = cfb_copyarea;
++		const_cast(info->fbops->fb_imageblit) = cfb_imageblit;
 +		pax_close_kernel();
  	} else {
  		outreg(disp, GC_L0EM, 3);
@@ -77893,15 +78550,15 @@ index fe92eed..106e085 100644
 -		info->fbops->fb_copyarea = mb86290fb_copyarea;
 -		info->fbops->fb_imageblit = mb86290fb_imageblit;
 +		pax_open_kernel();
-+		*(void **)&info->fbops->fb_fillrect = mb86290fb_fillrect;
-+		*(void **)&info->fbops->fb_copyarea = mb86290fb_copyarea;
-+		*(void **)&info->fbops->fb_imageblit = mb86290fb_imageblit;
++		const_cast(info->fbops->fb_fillrect) = mb86290fb_fillrect;
++		const_cast(info->fbops->fb_copyarea) = mb86290fb_copyarea;
++		const_cast(info->fbops->fb_imageblit) = mb86290fb_imageblit;
 +		pax_close_kernel();
  	}
  	outreg(draw, GDC_REG_DRAW_BASE, 0);
  	outreg(draw, GDC_REG_MODE_MISC, 0x8000);
 diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
-index ce7dab7..a87baf8 100644
+index ce7dab7..89d6521 100644
 --- a/drivers/video/fbdev/nvidia/nvidia.c
 +++ b/drivers/video/fbdev/nvidia/nvidia.c
 @@ -660,19 +660,23 @@ static int nvidiafb_set_par(struct fb_info *info)
@@ -77913,10 +78570,10 @@ index ce7dab7..a87baf8 100644
 -		info->fbops->fb_copyarea = nvidiafb_copyarea;
 -		info->fbops->fb_sync = nvidiafb_sync;
 +		pax_open_kernel();
-+		*(void **)&info->fbops->fb_imageblit = nvidiafb_imageblit;
-+		*(void **)&info->fbops->fb_fillrect = nvidiafb_fillrect;
-+		*(void **)&info->fbops->fb_copyarea = nvidiafb_copyarea;
-+		*(void **)&info->fbops->fb_sync = nvidiafb_sync;
++		const_cast(info->fbops->fb_imageblit) = nvidiafb_imageblit;
++		const_cast(info->fbops->fb_fillrect) = nvidiafb_fillrect;
++		const_cast(info->fbops->fb_copyarea) = nvidiafb_copyarea;
++		const_cast(info->fbops->fb_sync) = nvidiafb_sync;
 +		pax_close_kernel();
  		info->pixmap.scan_align = 4;
  		info->flags &= ~FBINFO_HWACCEL_DISABLED;
@@ -77928,10 +78585,10 @@ index ce7dab7..a87baf8 100644
 -		info->fbops->fb_copyarea = cfb_copyarea;
 -		info->fbops->fb_sync = NULL;
 +		pax_open_kernel();
-+		*(void **)&info->fbops->fb_imageblit = cfb_imageblit;
-+		*(void **)&info->fbops->fb_fillrect = cfb_fillrect;
-+		*(void **)&info->fbops->fb_copyarea = cfb_copyarea;
-+		*(void **)&info->fbops->fb_sync = NULL;
++		const_cast(info->fbops->fb_imageblit) = cfb_imageblit;
++		const_cast(info->fbops->fb_fillrect) = cfb_fillrect;
++		const_cast(info->fbops->fb_copyarea) = cfb_copyarea;
++		const_cast(info->fbops->fb_sync) = NULL;
 +		pax_close_kernel();
  		info->pixmap.scan_align = 1;
  		info->flags |= FBINFO_HWACCEL_DISABLED;
@@ -77944,14 +78601,14 @@ index ce7dab7..a87baf8 100644
 -	    info->fbops->fb_cursor = NULL;
 +	if (!hwcur) {
 +		pax_open_kernel();
-+		*(void **)&info->fbops->fb_cursor = NULL;
++		const_cast(info->fbops->fb_cursor) = NULL;
 +		pax_close_kernel();
 +	}
  
  	info->var.accel_flags = (!noaccel);
  
 diff --git a/drivers/video/fbdev/omap2/omapfb/dss/display.c b/drivers/video/fbdev/omap2/omapfb/dss/display.c
-index ef5b902..47cf7f5 100644
+index ef5b902..2ae011b 100644
 --- a/drivers/video/fbdev/omap2/omapfb/dss/display.c
 +++ b/drivers/video/fbdev/omap2/omapfb/dss/display.c
 @@ -161,12 +161,14 @@ int omapdss_register_display(struct omap_dss_device *dssdev)
@@ -77961,19 +78618,19 @@ index ef5b902..47cf7f5 100644
 +	pax_open_kernel();
  	if (drv && drv->get_resolution == NULL)
 -		drv->get_resolution = omapdss_default_get_resolution;
-+		*(void **)&drv->get_resolution = omapdss_default_get_resolution;
++		const_cast(drv->get_resolution) = omapdss_default_get_resolution;
  	if (drv && drv->get_recommended_bpp == NULL)
 -		drv->get_recommended_bpp = omapdss_default_get_recommended_bpp;
-+		*(void **)&drv->get_recommended_bpp = omapdss_default_get_recommended_bpp;
++		const_cast(drv->get_recommended_bpp) = omapdss_default_get_recommended_bpp;
  	if (drv && drv->get_timings == NULL)
 -		drv->get_timings = omapdss_default_get_timings;
-+		*(void **)&drv->get_timings = omapdss_default_get_timings;
++		const_cast(drv->get_timings) = omapdss_default_get_timings;
 +	pax_close_kernel();
  
  	mutex_lock(&panel_list_mutex);
  	list_add_tail(&dssdev->panel_list, &panel_list);
 diff --git a/drivers/video/fbdev/s1d13xxxfb.c b/drivers/video/fbdev/s1d13xxxfb.c
-index 96aa46d..c67c213 100644
+index 96aa46d..65e2554 100644
 --- a/drivers/video/fbdev/s1d13xxxfb.c
 +++ b/drivers/video/fbdev/s1d13xxxfb.c
 @@ -880,8 +880,10 @@ static int s1d13xxxfb_probe(struct platform_device *pdev)
@@ -77983,8 +78640,8 @@ index 96aa46d..c67c213 100644
 -		s1d13xxxfb_fbops.fb_fillrect = s1d13xxxfb_bitblt_solidfill;
 -		s1d13xxxfb_fbops.fb_copyarea = s1d13xxxfb_bitblt_copyarea;
 +		pax_open_kernel();
-+		*(void **)&s1d13xxxfb_fbops.fb_fillrect = s1d13xxxfb_bitblt_solidfill;
-+		*(void **)&s1d13xxxfb_fbops.fb_copyarea = s1d13xxxfb_bitblt_copyarea;
++		const_cast(s1d13xxxfb_fbops.fb_fillrect) = s1d13xxxfb_bitblt_solidfill;
++		const_cast(s1d13xxxfb_fbops.fb_copyarea) = s1d13xxxfb_bitblt_copyarea;
 +		pax_close_kernel();
  		info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_YPAN |
  			FBINFO_HWACCEL_FILLRECT | FBINFO_HWACCEL_COPYAREA;
@@ -78020,7 +78677,7 @@ index 32e23c2..7b73082 100644
  extern void		SiS_SetChrontelGPIO(struct SiS_Private *SiS_Pr, unsigned short myvbinfo);
  extern unsigned short	SiS_HandleDDC(struct SiS_Private *SiS_Pr, unsigned int VBFlags, int VGAEngine,
 diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
-index 9279e5f..d5f5276 100644
+index 9279e5f..d9fb0bd 100644
 --- a/drivers/video/fbdev/smscufx.c
 +++ b/drivers/video/fbdev/smscufx.c
 @@ -1174,7 +1174,9 @@ static int ufx_ops_release(struct fb_info *info, int user)
@@ -78029,13 +78686,13 @@ index 9279e5f..d5f5276 100644
  		info->fbdefio = NULL;
 -		info->fbops->fb_mmap = ufx_ops_mmap;
 +		pax_open_kernel();
-+		*(void **)&info->fbops->fb_mmap = ufx_ops_mmap;
++		const_cast(info->fbops->fb_mmap) = ufx_ops_mmap;
 +		pax_close_kernel();
  	}
  
  	pr_debug("released /dev/fb%d user=%d count=%d",
 diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
-index e9c2f7b..8df1264 100644
+index e9c2f7b..87506f4 100644
 --- a/drivers/video/fbdev/udlfb.c
 +++ b/drivers/video/fbdev/udlfb.c
 @@ -623,11 +623,11 @@ static int dlfb_handle_damage(struct dlfb_data *dev, int x, int y,
@@ -78076,7 +78733,7 @@ index e9c2f7b..8df1264 100644
  		info->fbdefio = NULL;
 -		info->fbops->fb_mmap = dlfb_ops_mmap;
 +		pax_open_kernel();
-+		*(void **)&info->fbops->fb_mmap = dlfb_ops_mmap;
++		const_cast(info->fbops->fb_mmap) = dlfb_ops_mmap;
 +		pax_close_kernel();
  	}
  
@@ -78133,7 +78790,7 @@ index e9c2f7b..8df1264 100644
  	return count;
  }
 diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c
-index 178ae93..624b2eb 100644
+index 178ae93..043ddca 100644
 --- a/drivers/video/fbdev/uvesafb.c
 +++ b/drivers/video/fbdev/uvesafb.c
 @@ -19,6 +19,7 @@
@@ -78202,7 +78859,7 @@ index 178ae93..624b2eb 100644
 -		info->fbops->fb_blank = NULL;
 +	if (!blank) {
 +		pax_open_kernel();
-+		*(void **)&info->fbops->fb_blank = NULL;
++		const_cast(info->fbops->fb_blank) = NULL;
 +		pax_close_kernel();
 +	}
  
@@ -78216,7 +78873,7 @@ index 178ae93..624b2eb 100644
 -		info->fbops->fb_pan_display = NULL;
 +	if (!par->ypan) {
 +		pax_open_kernel();
-+		*(void **)&info->fbops->fb_pan_display = NULL;
++		const_cast(info->fbops->fb_pan_display) = NULL;
 +		pax_close_kernel();
 +	}
  }
@@ -78247,7 +78904,7 @@ index 178ae93..624b2eb 100644
  	}
  	return 0;
 diff --git a/drivers/video/fbdev/vesafb.c b/drivers/video/fbdev/vesafb.c
-index 528fe91..6fd29fe 100644
+index 528fe91..475d9e6 100644
 --- a/drivers/video/fbdev/vesafb.c
 +++ b/drivers/video/fbdev/vesafb.c
 @@ -9,6 +9,7 @@
@@ -78348,7 +79005,7 @@ index 528fe91..6fd29fe 100644
 -		info->fbops->fb_pan_display = NULL;
 +	if (!ypan) {
 +		pax_open_kernel();
-+		*(void **)&info->fbops->fb_pan_display = NULL;
++		const_cast(info->fbops->fb_pan_display) = NULL;
 +		pax_close_kernel();
 +	}
  
@@ -99826,7 +100483,7 @@ index 7cfa0aa..d5ef97b7 100644
  	seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
  		   atomic_read(&fscache_n_cop_alloc_object),
 diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
-index c5b6b71..3949af6 100644
+index c5b6b71..527e347 100644
 --- a/fs/fuse/cuse.c
 +++ b/fs/fuse/cuse.c
 @@ -611,10 +611,12 @@ static int __init cuse_init(void)
@@ -99839,9 +100496,9 @@ index c5b6b71..3949af6 100644
 -	cuse_channel_fops.release	= cuse_channel_release;
 +	pax_open_kernel();
 +	memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
-+	*(void **)&cuse_channel_fops.owner	= THIS_MODULE;
-+	*(void **)&cuse_channel_fops.open	= cuse_channel_open;
-+	*(void **)&cuse_channel_fops.release	= cuse_channel_release;
++	const_cast(cuse_channel_fops.owner)	= THIS_MODULE;
++	const_cast(cuse_channel_fops.open)	= cuse_channel_open;
++	const_cast(cuse_channel_fops.release)	= cuse_channel_release;
 +	pax_close_kernel();
  
  	cuse_class = class_create(THIS_MODULE, "cuse");
@@ -100191,7 +100848,7 @@ index 4a6cf28..d3a29d3 100644
  
  		jffs2_prealloc_raw_node_refs(c, jeb, 1);
 diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
-index cad86ba..a0bfc33 100644
+index cad86ba..7de4d99 100644
 --- a/fs/jffs2/file.c
 +++ b/fs/jffs2/file.c
 @@ -111,8 +111,9 @@ static int jffs2_do_readpage_nolock (struct inode *inode, struct page *pg)
@@ -100205,6 +100862,15 @@ index cad86ba..a0bfc33 100644
  	int ret = jffs2_do_readpage_nolock(inode, pg);
  	unlock_page(pg);
  	return ret;
+@@ -125,7 +126,7 @@ static int jffs2_readpage (struct file *filp, struct page *pg)
+ 	int ret;
+ 
+ 	mutex_lock(&f->sem);
+-	ret = jffs2_do_readpage_unlock(pg->mapping->host, pg);
++	ret = jffs2_do_readpage_unlock((struct file *)pg->mapping->host, pg);
+ 	mutex_unlock(&f->sem);
+ 	return ret;
+ }
 diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
 index bead25a..5186b1c 100644
 --- a/fs/jffs2/fs.c
@@ -110271,7 +110937,7 @@ index d955481..a985dc41 100644
  
  #endif
 diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c
-index 52ccd34..7a6b202 100644
+index 52ccd34..a166501 100644
 --- a/fs/nls/nls_base.c
 +++ b/fs/nls/nls_base.c
 @@ -234,21 +234,25 @@ EXPORT_SYMBOL(utf16s_to_utf8s);
@@ -110286,7 +110952,7 @@ index 52ccd34..7a6b202 100644
  
 -	nls->owner = owner;
 +	pax_open_kernel();
-+	*(void **)&nls->owner = owner;
++	const_cast(nls->owner) = owner;
 +	pax_close_kernel();
  	spin_lock(&nls_lock);
 -	while (*tmp) {
@@ -110301,7 +110967,7 @@ index 52ccd34..7a6b202 100644
  	}
 -	nls->next = tables;
 +	pax_open_kernel();
-+	*(struct nls_table **)&nls->next = tables;
++	const_cast(nls->next) = tables;
 +	pax_close_kernel();
  	tables = nls;
  	spin_unlock(&nls_lock);
@@ -110394,7 +111060,7 @@ index 8e14187..d9cec2f 100644
  {
  	const unsigned char *uni2charset;
 diff --git a/fs/nls/nls_euc-jp.c b/fs/nls/nls_euc-jp.c
-index 162b3f1..2cb932a 100644
+index 162b3f1..b9121f8 100644
 --- a/fs/nls/nls_euc-jp.c
 +++ b/fs/nls/nls_euc-jp.c
 @@ -406,7 +406,7 @@ static inline int sjisnec2sjisibm(unsigned char *sjisibm,
@@ -110413,14 +111079,14 @@ index 162b3f1..2cb932a 100644
 -		table.charset2upper = p_nls->charset2upper;
 -		table.charset2lower = p_nls->charset2lower;
 +		pax_open_kernel();
-+		*(const unsigned char **)&table.charset2upper = p_nls->charset2upper;
-+		*(const unsigned char **)&table.charset2lower = p_nls->charset2lower;
++		const_cast(table.charset2upper) = p_nls->charset2upper;
++		const_cast(table.charset2lower) = p_nls->charset2lower;
 +		pax_close_kernel();
  		return register_nls(&table);
  	}
  
 diff --git a/fs/nls/nls_koi8-ru.c b/fs/nls/nls_koi8-ru.c
-index a80a741..13030f7 100644
+index a80a741..f28c9c9 100644
 --- a/fs/nls/nls_koi8-ru.c
 +++ b/fs/nls/nls_koi8-ru.c
 @@ -13,7 +13,7 @@
@@ -110439,8 +111105,8 @@ index a80a741..13030f7 100644
 -		table.charset2upper = p_nls->charset2upper;
 -		table.charset2lower = p_nls->charset2lower;
 +		pax_open_kernel();
-+		*(const unsigned char **)&table.charset2upper = p_nls->charset2upper;
-+		*(const unsigned char **)&table.charset2lower = p_nls->charset2lower;
++		const_cast(table.charset2upper) = p_nls->charset2upper;
++		const_cast(table.charset2lower) = p_nls->charset2lower;
 +		pax_close_kernel();
  		return register_nls(&table);
  	}
@@ -112482,7 +113148,7 @@ index 350984a..0fb02a9 100644
  	net = get_proc_net(inode);
  	if (net == NULL)
 diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
-index fe5b6e6..e5f3883 100644
+index fe5b6e6..cd2913c 100644
 --- a/fs/proc/proc_sysctl.c
 +++ b/fs/proc/proc_sysctl.c
 @@ -11,13 +11,21 @@
@@ -112515,7 +113181,7 @@ index fe5b6e6..e5f3883 100644
  {
 -	dir->header.ctl_table[0].child = sysctl_mount_point;
 +	pax_open_kernel();
-+	*(const void **)&dir->header.ctl_table[0].child = sysctl_mount_point;
++	const_cast(dir->header.ctl_table[0].child) = sysctl_mount_point;
 +	pax_close_kernel();
  }
  
@@ -112524,7 +113190,7 @@ index fe5b6e6..e5f3883 100644
  {
 -	dir->header.ctl_table[0].child = NULL;
 +	pax_open_kernel();
-+	*(void **)&dir->header.ctl_table[0].child = NULL;
++	const_cast(dir->header.ctl_table[0].child) = NULL;
 +	pax_close_kernel();
  }
  
@@ -112565,7 +113231,7 @@ index fe5b6e6..e5f3883 100644
 +	if (gr_handle_chroot_sysctl(op))
 +		goto out;
 +	dget(filp->f_path.dentry);
-+	if (gr_handle_sysctl_mod(filp->f_path.dentry->d_parent->d_name.name, table->procname, op)) {
++	if (gr_handle_sysctl_mod((const char *)filp->f_path.dentry->d_parent->d_name.name, table->procname, op)) {
 +		dput(filp->f_path.dentry);
 +		goto out;
 +	}
@@ -113941,7 +114607,7 @@ index 6c21228..9afd5fe 100644
  	if (sbi->s_bytesex == BYTESEX_PDP)
  		return PDP_swab((__force __u32)n);
 diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
-index 4a0e48f..ca5b016 100644
+index 4a0e48f..d3e1fbf 100644
 --- a/fs/tracefs/inode.c
 +++ b/fs/tracefs/inode.c
 @@ -53,7 +53,7 @@ static const struct file_operations tracefs_file_operations = {
@@ -113960,8 +114626,8 @@ index 4a0e48f..ca5b016 100644
 -	tracefs_ops.mkdir = mkdir;
 -	tracefs_ops.rmdir = rmdir;
 +	pax_open_kernel();
-+	*(void **)&tracefs_ops.mkdir = mkdir;
-+	*(void **)&tracefs_ops.rmdir = rmdir;
++	const_cast(tracefs_ops.mkdir) = mkdir;
++	const_cast(tracefs_ops.rmdir) = rmdir;
 +	pax_close_kernel();
  
  	return dentry;
@@ -115665,7 +116331,7 @@ index 0000000..e136e5f
 +endif
 diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
 new file mode 100644
-index 0000000..7ad630a
+index 0000000..3c66319
 --- /dev/null
 +++ b/grsecurity/gracl.c
 @@ -0,0 +1,2757 @@
@@ -115867,7 +116533,7 @@ index 0000000..7ad630a
 +
 +static int prepend_name(char **buffer, int *buflen, struct qstr *name)
 +{
-+	return prepend(buffer, buflen, name->name, name->len);
++	return prepend(buffer, buflen, (const char *)name->name, name->len);
 +}
 +
 +static int prepend_path(const struct path *path, struct path *root,
@@ -116231,7 +116897,7 @@ index 0000000..7ad630a
 +__lookup_name_entry(const struct gr_policy_state *state, const char *name)
 +{
 +	unsigned int len = strlen(name);
-+	unsigned int key = full_name_hash(name, len);
++	unsigned int key = full_name_hash((const unsigned char *)name, len);
 +	unsigned int index = key % state->name_set.n_size;
 +	struct name_entry *match;
 +
@@ -116253,7 +116919,7 @@ index 0000000..7ad630a
 +lookup_name_entry_create(const char *name)
 +{
 +	unsigned int len = strlen(name);
-+	unsigned int key = full_name_hash(name, len);
++	unsigned int key = full_name_hash((const unsigned char *)name, len);
 +	unsigned int index = key % running_polstate.name_set.n_size;
 +	struct name_entry *match;
 +
@@ -120006,7 +120672,7 @@ index 0000000..25f54ef
 +};
 diff --git a/grsecurity/gracl_policy.c b/grsecurity/gracl_policy.c
 new file mode 100644
-index 0000000..302bda8
+index 0000000..2fc92ec
 --- /dev/null
 +++ b/grsecurity/gracl_policy.c
 @@ -0,0 +1,1784 @@
@@ -120362,7 +121028,7 @@ index 0000000..302bda8
 +	struct name_entry **curr, *nentry;
 +	struct inodev_entry *ientry;
 +	unsigned int len = strlen(name);
-+	unsigned int key = full_name_hash(name, len);
++	unsigned int key = full_name_hash((const unsigned char *)name, len);
 +	unsigned int index = key % polstate->name_set.n_size;
 +
 +	curr = &polstate->name_set.n_hash[index];
@@ -121387,7 +122053,7 @@ index 0000000..302bda8
 +	FOR_EACH_ROLE_END(r)
 +
 +	for (i = 0; i < polstate->num_sprole_pws; i++) {
-+		if (!strcmp(rolename, polstate->acl_special_roles[i]->rolename)) {
++		if (!strcmp(rolename, (const char *)polstate->acl_special_roles[i]->rolename)) {
 +			*salt = polstate->acl_special_roles[i]->salt;
 +			*sum = polstate->acl_special_roles[i]->sum;
 +			return 1;
@@ -121674,11 +122340,11 @@ index 0000000..302bda8
 +		}
 +
 +		if (lookup_special_role_auth
-+		    (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
++		    (gr_usermode->mode, (const char *)gr_usermode->sp_role, &sprole_salt, &sprole_sum)
 +		    && ((!sprole_salt && !sprole_sum)
 +			|| !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
 +			char *p = "";
-+			assign_special_role(gr_usermode->sp_role);
++			assign_special_role((const char *)gr_usermode->sp_role);
 +			read_lock(&tasklist_lock);
 +			if (current->real_parent)
 +				p = current->real_parent->role->rolename;
@@ -125636,7 +126302,7 @@ index 0000000..ae02d8e
 +EXPORT_SYMBOL_GPL(gr_handle_new_usb);
 diff --git a/grsecurity/grsum.c b/grsecurity/grsum.c
 new file mode 100644
-index 0000000..4fb2ce6
+index 0000000..aef6b92
 --- /dev/null
 +++ b/grsecurity/grsum.c
 @@ -0,0 +1,54 @@
@@ -125674,12 +126340,12 @@ index 0000000..4fb2ce6
 +
 +	sg_init_table(sg, 2);
 +	sg_set_buf(&sg[0], salt, GR_SALT_LEN);
-+	sg_set_buf(&sg[1], entry->pw, strlen(entry->pw));
++	sg_set_buf(&sg[1], entry->pw, strlen((const char *)entry->pw));
 +
 +	desc.tfm = tfm;
 +	desc.flags = 0;
 +
-+	cryptres = crypto_hash_digest(&desc, sg, GR_SALT_LEN + strlen(entry->pw),
++	cryptres = crypto_hash_digest(&desc, sg, GR_SALT_LEN + strlen((const char *)entry->pw),
 +					temp_sum);
 +
 +	memset(entry->pw, 0, GR_PW_LEN);
@@ -127062,7 +127728,7 @@ index a76c917..75d6aeb 100644
  asmlinkage long compat_sys_lookup_dcookie(u32, u32, char __user *, compat_size_t);
  /*
 diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
-index eeae401..a2a9f48 100644
+index eeae401..c108d27 100644
 --- a/include/linux/compiler-gcc.h
 +++ b/include/linux/compiler-gcc.h
 @@ -116,9 +116,9 @@
@@ -127078,7 +127744,7 @@ index eeae401..a2a9f48 100644
  #define __maybe_unused		__attribute__((unused))
  #define __always_unused		__attribute__((unused))
  
-@@ -184,9 +184,38 @@
+@@ -184,9 +184,39 @@
  # define __compiletime_warning(message) __attribute__((warning(message)))
  # define __compiletime_error(message) __attribute__((error(message)))
  #endif /* __CHECKER__ */
@@ -127099,6 +127765,7 @@ index eeae401..a2a9f48 100644
 +#ifdef CONSTIFY_PLUGIN
 +#define __no_const __attribute__((no_const))
 +#define __do_const __attribute__((do_const))
++#define const_cast(x) (*(typeof((typeof(x))0) *)&(x))
 +#endif
 +
 +#ifdef SIZE_OVERFLOW_PLUGIN
@@ -127118,7 +127785,7 @@ index eeae401..a2a9f48 100644
   * Mark a position in code as unreachable.  This can be used to
   * suppress control flow warnings after asm blocks that transfer
 diff --git a/include/linux/compiler.h b/include/linux/compiler.h
-index 48f5aab..2d1c52f 100644
+index 48f5aab..4206700 100644
 --- a/include/linux/compiler.h
 +++ b/include/linux/compiler.h
 @@ -5,11 +5,14 @@
@@ -127340,7 +128007,7 @@ index 48f5aab..2d1c52f 100644
  })
  
  /**
-@@ -416,6 +432,38 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+@@ -416,6 +432,42 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
  # define __attribute_const__	/* unimplemented */
  #endif
  
@@ -127376,10 +128043,14 @@ index 48f5aab..2d1c52f 100644
 +# define __nocapture(...)
 +#endif
 +
++#ifndef const_cast
++# define const_cast(x)	(x)
++#endif
++
  /*
   * Tell gcc if a function is cold. The compiler will assume any path
   * directly leading to the call is unlikely.
-@@ -425,6 +473,22 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+@@ -425,6 +477,22 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
  #define __cold
  #endif
  
@@ -127402,7 +128073,7 @@ index 48f5aab..2d1c52f 100644
  /* Simple shorthand for a section definition */
  #ifndef __section
  # define __section(S) __attribute__ ((__section__(#S)))
-@@ -447,6 +511,8 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+@@ -447,6 +515,8 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
  # define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
  #endif
  
@@ -127411,7 +128082,7 @@ index 48f5aab..2d1c52f 100644
  /* Is this type a native word size -- useful for atomic operations */
  #ifndef __native_word
  # define __native_word(t) (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
-@@ -526,8 +592,9 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+@@ -526,8 +596,9 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
   */
  #define __ACCESS_ONCE(x) ({ \
  	 __maybe_unused typeof(x) __var = (__force typeof(x)) 0; \
@@ -131980,7 +132651,7 @@ index 556ec1e..38c19c9 100644
  
  /*
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index a10494a..2facd6d 100644
+index a10494a..9f25fd6 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -7,7 +7,7 @@
@@ -132253,7 +132924,7 @@ index a10494a..2facd6d 100644
  {
  	return tsk->pid;
  }
-@@ -2289,6 +2397,25 @@ extern u64 sched_clock_cpu(int cpu);
+@@ -2289,6 +2397,26 @@ extern u64 sched_clock_cpu(int cpu);
  
  extern void sched_clock_init(void);
  
@@ -132267,6 +132938,7 @@ index a10494a..2facd6d 100644
 +
 +	while (ptr < end) {
 +		c = *(volatile int *)ptr;
++		(void)c;
 +		ptr += PAGE_SIZE/sizeof(int);
 +	}
 +}
@@ -132279,7 +132951,7 @@ index a10494a..2facd6d 100644
  #ifndef CONFIG_HAVE_UNSTABLE_SCHED_CLOCK
  static inline void sched_clock_tick(void)
  {
-@@ -2417,7 +2544,9 @@ extern void set_curr_task(int cpu, struct task_struct *p);
+@@ -2417,7 +2545,9 @@ extern void set_curr_task(int cpu, struct task_struct *p);
  void yield(void);
  
  union thread_union {
@@ -132289,7 +132961,7 @@ index a10494a..2facd6d 100644
  	unsigned long stack[THREAD_SIZE/sizeof(long)];
  };
  
-@@ -2450,6 +2579,7 @@ extern struct pid_namespace init_pid_ns;
+@@ -2450,6 +2580,7 @@ extern struct pid_namespace init_pid_ns;
   */
  
  extern struct task_struct *find_task_by_vpid(pid_t nr);
@@ -132297,7 +132969,7 @@ index a10494a..2facd6d 100644
  extern struct task_struct *find_task_by_pid_ns(pid_t nr,
  		struct pid_namespace *ns);
  
-@@ -2481,7 +2611,7 @@ extern void proc_caches_init(void);
+@@ -2481,7 +2612,7 @@ extern void proc_caches_init(void);
  extern void flush_signals(struct task_struct *);
  extern void ignore_signals(struct task_struct *);
  extern void flush_signal_handlers(struct task_struct *, int force_default);
@@ -132306,7 +132978,7 @@ index a10494a..2facd6d 100644
  
  static inline int kernel_dequeue_signal(siginfo_t *info)
  {
-@@ -2635,7 +2765,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
+@@ -2635,7 +2766,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
  extern void exit_itimers(struct signal_struct *);
  extern void flush_itimer_signals(void);
  
@@ -132315,7 +132987,7 @@ index a10494a..2facd6d 100644
  
  extern int do_execve(struct filename *,
  		     const char __user * const __user *,
-@@ -2750,11 +2880,13 @@ static inline int thread_group_empty(struct task_struct *p)
+@@ -2750,11 +2881,13 @@ static inline int thread_group_empty(struct task_struct *p)
   * It must not be nested with write_lock_irq(&tasklist_lock),
   * neither inside nor outside.
   */
@@ -132329,7 +133001,7 @@ index a10494a..2facd6d 100644
  static inline void task_unlock(struct task_struct *p)
  {
  	spin_unlock(&p->alloc_lock);
-@@ -2840,9 +2972,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
+@@ -2840,9 +2973,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
  #define task_stack_end_corrupted(task) \
  		(*(end_of_stack(task)) != STACK_END_MAGIC)
  
@@ -132404,6 +133076,19 @@ index dc368b8..e895209 100644
  extern int __must_check down_killable(struct semaphore *sem);
  extern int __must_check down_trylock(struct semaphore *sem);
  extern int __must_check down_timeout(struct semaphore *sem, long jiffies);
+diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h
+index fb7eb9c..1b493dc 100644
+--- a/include/linux/seq_buf.h
++++ b/include/linux/seq_buf.h
+@@ -16,7 +16,7 @@
+  * @readpos:	The next position to read in the buffer.
+  */
+ struct seq_buf {
+-	char			*buffer;
++	unsigned char		*buffer;
+ 	size_t			size;
+ 	size_t			len;
+ 	loff_t			readpos;
 diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
 index dde00de..202bfd3 100644
 --- a/include/linux/seq_file.h
@@ -133368,7 +134053,7 @@ index fa7bc29..0d96561 100644
  struct ctl_node {
  	struct rb_node node;
 diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
-index c6f0f0d..a34ab2d 100644
+index c6f0f0d..e663567 100644
 --- a/include/linux/sysfs.h
 +++ b/include/linux/sysfs.h
 @@ -34,7 +34,8 @@ struct attribute {
@@ -133401,6 +134086,15 @@ index c6f0f0d..a34ab2d 100644
  
  /**
   *	sysfs_bin_attr_init - initialize a dynamically allocated bin_attribute
+@@ -512,7 +515,7 @@ static inline void sysfs_notify_dirent(struct kernfs_node *kn)
+ }
+ 
+ static inline struct kernfs_node *sysfs_get_dirent(struct kernfs_node *parent,
+-						   const unsigned char *name)
++						   const char *name)
+ {
+ 	return kernfs_find_and_get(parent, name);
+ }
 diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
 index 387fa7d..3fcde6b 100644
 --- a/include/linux/sysrq.h
@@ -136761,7 +137455,7 @@ index 45432b5..988f1e4 100644
 +}
 +EXPORT_SYMBOL(capable_wrt_inode_uidgid_nolog);
 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 355cd5f..6273802 100644
+index 355cd5f..93e1510 100644
 --- a/kernel/cgroup.c
 +++ b/kernel/cgroup.c
 @@ -3333,7 +3333,7 @@ static int cgroup_add_file(struct cgroup_subsys_state *css, struct cgroup *cgrp,
@@ -136781,12 +137475,12 @@ index 355cd5f..6273802 100644
 -		cft->ss = NULL;
 +
 +		pax_open_kernel();
-+		*(void **)&cft->kf_ops = NULL;
-+		*(void **)&cft->ss = NULL;
++		const_cast(cft->kf_ops) = NULL;
++		const_cast(cft->ss) = NULL;
  
  		/* revert flags set by cgroup core while adding @cfts */
 -		cft->flags &= ~(__CFTYPE_ONLY_ON_DFL | __CFTYPE_NOT_ON_DFL);
-+		*(unsigned int *)&cft->flags &= ~(__CFTYPE_ONLY_ON_DFL | __CFTYPE_NOT_ON_DFL);
++		const_cast(cft->flags) &= ~(__CFTYPE_ONLY_ON_DFL | __CFTYPE_NOT_ON_DFL);
 +		pax_close_kernel();
  	}
  }
@@ -136798,8 +137492,8 @@ index 355cd5f..6273802 100644
 -		cft->kf_ops = kf_ops;
 -		cft->ss = ss;
 +		pax_open_kernel();
-+		*(void **)&cft->kf_ops = kf_ops;
-+		*(void **)&cft->ss = ss;
++		const_cast(cft->kf_ops) = kf_ops;
++		const_cast(cft->ss) = ss;
 +		pax_close_kernel();
  	}
  
@@ -136829,7 +137523,7 @@ index 355cd5f..6273802 100644
 +	pax_open_kernel();
  	for (cft = cfts; cft && cft->name[0] != '\0'; cft++)
 -		cft->flags |= __CFTYPE_ONLY_ON_DFL;
-+		*(unsigned int *)&cft->flags |= __CFTYPE_ONLY_ON_DFL;
++		const_cast(cft->flags) |= __CFTYPE_ONLY_ON_DFL;
 +	pax_close_kernel();
  	return cgroup_add_cftypes(ss, cfts);
  }
@@ -136841,7 +137535,7 @@ index 355cd5f..6273802 100644
 +	pax_open_kernel();
  	for (cft = cfts; cft && cft->name[0] != '\0'; cft++)
 -		cft->flags |= __CFTYPE_NOT_ON_DFL;
-+		*(unsigned int *)&cft->flags |= __CFTYPE_NOT_ON_DFL;
++		const_cast(cft->flags) |= __CFTYPE_NOT_ON_DFL;
 +	pax_close_kernel();
  	return cgroup_add_cftypes(ss, cfts);
  }
@@ -138224,7 +138918,7 @@ index 84118723..317f7a5 100644
  			irq_wake_secondary(desc, action);
  
 diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
-index 38e89ce..58960ac 100644
+index 38e89ce..8b7a537 100644
 --- a/kernel/irq/msi.c
 +++ b/kernel/irq/msi.c
 @@ -214,16 +214,18 @@ static void msi_domain_update_dom_ops(struct msi_domain_info *info)
@@ -138234,19 +138928,19 @@ index 38e89ce..58960ac 100644
 +	pax_open_kernel();
  	if (ops->get_hwirq == NULL)
 -		ops->get_hwirq = msi_domain_ops_default.get_hwirq;
-+		*(void **)&ops->get_hwirq = msi_domain_ops_default.get_hwirq;
++		const_cast(ops->get_hwirq) = msi_domain_ops_default.get_hwirq;
  	if (ops->msi_init == NULL)
 -		ops->msi_init = msi_domain_ops_default.msi_init;
-+		*(void **)&ops->msi_init = msi_domain_ops_default.msi_init;
++		const_cast(ops->msi_init) = msi_domain_ops_default.msi_init;
  	if (ops->msi_check == NULL)
 -		ops->msi_check = msi_domain_ops_default.msi_check;
-+		*(void **)&ops->msi_check = msi_domain_ops_default.msi_check;
++		const_cast(ops->msi_check) = msi_domain_ops_default.msi_check;
  	if (ops->msi_prepare == NULL)
 -		ops->msi_prepare = msi_domain_ops_default.msi_prepare;
-+		*(void **)&ops->msi_prepare = msi_domain_ops_default.msi_prepare;
++		const_cast(ops->msi_prepare) = msi_domain_ops_default.msi_prepare;
  	if (ops->set_desc == NULL)
 -		ops->set_desc = msi_domain_ops_default.set_desc;
-+		*(void **)&ops->set_desc = msi_domain_ops_default.set_desc;
++		const_cast(ops->set_desc) = msi_domain_ops_default.set_desc;
 +	pax_close_kernel();
  }
  
@@ -138259,7 +138953,7 @@ index 38e89ce..58960ac 100644
 -		chip->irq_set_affinity = msi_domain_set_affinity;
 +	if (!chip->irq_set_affinity) {
 +		pax_open_kernel();
-+		*(void **)&chip->irq_set_affinity = msi_domain_set_affinity;
++		const_cast(chip->irq_set_affinity) = msi_domain_set_affinity;
 +		pax_close_kernel();
 +	}
  }
@@ -139888,7 +140582,7 @@ index 794ebe8..f81f123 100644
  	}
  	return mod;
 diff --git a/kernel/notifier.c b/kernel/notifier.c
-index fd2c9ac..95e58f6 100644
+index fd2c9ac..6263e05 100644
 --- a/kernel/notifier.c
 +++ b/kernel/notifier.c
 @@ -5,6 +5,7 @@
@@ -139908,7 +140602,7 @@ index fd2c9ac..95e58f6 100644
  	}
 -	n->next = *nl;
 +	pax_open_kernel();
-+	*(const void **)&n->next = *nl;
++	const_cast(n->next) = *nl;
  	rcu_assign_pointer(*nl, n);
 +	pax_close_kernel();
  	return 0;
@@ -139923,7 +140617,7 @@ index fd2c9ac..95e58f6 100644
  	}
 -	n->next = *nl;
 +	pax_open_kernel();
-+	*(const void **)&n->next = *nl;
++	const_cast(n->next) = *nl;
  	rcu_assign_pointer(*nl, n);
 +	pax_close_kernel();
  	return 0;
@@ -140025,7 +140719,7 @@ index d96469d..81d6d28 100644
  }
  EXPORT_SYMBOL(__stack_chk_fail);
 diff --git a/kernel/pid.c b/kernel/pid.c
-index 4d73a83..4712357 100644
+index 4d73a83..9df1950 100644
 --- a/kernel/pid.c
 +++ b/kernel/pid.c
 @@ -33,6 +33,7 @@
@@ -140078,15 +140772,18 @@ index 4d73a83..4712357 100644
  struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
  {
  	struct pid *pid;
-@@ -497,7 +513,7 @@ struct pid *find_get_pid(pid_t nr)
+@@ -497,9 +513,9 @@ struct pid *find_get_pid(pid_t nr)
  }
  EXPORT_SYMBOL_GPL(find_get_pid);
  
 -pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns)
 +pid_t pid_nr_ns(const struct pid *pid, const struct pid_namespace *ns)
  {
- 	struct upid *upid;
+-	struct upid *upid;
++	const struct upid *upid;
  	pid_t nr = 0;
+ 
+ 	if (pid && ns->level <= pid->level) {
 @@ -511,7 +527,7 @@ pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns)
  }
  EXPORT_SYMBOL_GPL(pid_nr_ns);
@@ -143248,7 +143945,7 @@ index 2be8c4f..444ecfb 100644
  	}
  	entry	= ring_buffer_event_data(event);
 diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
-index 2829821..a290dc89 100644
+index 2829821..cd4ea77 100644
 --- a/kernel/trace/trace_output.c
 +++ b/kernel/trace/trace_output.c
 @@ -713,14 +713,16 @@ int register_trace_event(struct trace_event *event)
@@ -143258,16 +143955,16 @@ index 2829821..a290dc89 100644
 +	pax_open_kernel();
  	if (event->funcs->trace == NULL)
 -		event->funcs->trace = trace_nop_print;
-+		*(void **)&event->funcs->trace = trace_nop_print;
++		const_cast(event->funcs->trace) = trace_nop_print;
  	if (event->funcs->raw == NULL)
 -		event->funcs->raw = trace_nop_print;
-+		*(void **)&event->funcs->raw = trace_nop_print;
++		const_cast(event->funcs->raw) = trace_nop_print;
  	if (event->funcs->hex == NULL)
 -		event->funcs->hex = trace_nop_print;
-+		*(void **)&event->funcs->hex = trace_nop_print;
++		const_cast(event->funcs->hex) = trace_nop_print;
  	if (event->funcs->binary == NULL)
 -		event->funcs->binary = trace_nop_print;
-+		*(void **)&event->funcs->binary = trace_nop_print;
++		const_cast(event->funcs->binary) = trace_nop_print;
 +	pax_close_kernel();
  
  	key = event->type & (EVENT_HASHSIZE - 1);
@@ -151655,7 +152352,7 @@ index 1474cfd..961bc9f 100644
  		pr_warn("cannot create /proc/net/%s\n", PG_PROC_DIR);
  		return -ENODEV;
 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 482c371..b02a761 100644
+index 482c371..150e1ee 100644
 --- a/net/core/rtnetlink.c
 +++ b/net/core/rtnetlink.c
 @@ -61,7 +61,7 @@ struct rtnl_link {
@@ -151675,7 +152372,7 @@ index 482c371..b02a761 100644
 -		ops->dellink = unregister_netdevice_queue;
 +	if (ops->setup && !ops->dellink) {
 +		pax_open_kernel();
-+		*(void **)&ops->dellink = unregister_netdevice_queue;
++		const_cast(ops->dellink) = unregister_netdevice_queue;
 +		pax_close_kernel();
 +	}
  
@@ -160008,7 +160705,7 @@ index b5e665b..3030b1d 100644
  	}
  
 diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
-index 9895a8c..705c302 100644
+index 9895a8c..e7c5936 100644
 --- a/net/xfrm/xfrm_state.c
 +++ b/net/xfrm/xfrm_state.c
 @@ -166,12 +166,14 @@ int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
@@ -160082,7 +160779,7 @@ index 9895a8c..705c302 100644
  
 -	mode->afinfo = afinfo;
 +	pax_open_kernel();
-+	*(const void **)&mode->afinfo = afinfo;
++	const_cast(mode->afinfo) = afinfo;
  	modemap[mode->encap] = mode;
 +	pax_close_kernel();
  	err = 0;
@@ -160172,6 +160869,18 @@ index 1db6d73..0819042 100644
  
  # ld-option
  # Usage: LDFLAGS += $(call ld-option, -X)
+diff --git a/scripts/Makefile b/scripts/Makefile
+index fd0d53d..1471190 100644
+--- a/scripts/Makefile
++++ b/scripts/Makefile
+@@ -44,6 +44,7 @@ subdir-y                     += mod
+ subdir-$(CONFIG_SECURITY_SELINUX) += selinux
+ subdir-$(CONFIG_DTC)         += dtc
+ subdir-$(CONFIG_GDB_SCRIPTS) += gdb
++subdir-$(CONFIG_GCC_PLUGINS) += gcc-plugins
+ 
+ # Let clean descend into subdirs
+ subdir-	+= basic kconfig package
 diff --git a/scripts/Makefile.build b/scripts/Makefile.build
 index 2c47f9c..9d46008 100644
 --- a/scripts/Makefile.build
@@ -160216,81 +160925,83 @@ index f9e47a7..b72022a 100644
  warning-2 += -Wdisabled-optimization
 diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins
 new file mode 100644
-index 0000000..02fd848
+index 0000000..08d4e22
 --- /dev/null
 +++ b/scripts/Makefile.gcc-plugins
-@@ -0,0 +1,69 @@
-+__PLUGINCC := $(call cc-ifversion, -ge, 0408, $(HOSTCXX), $(HOSTCC))
-+PLUGINCC := $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(__PLUGINCC)" "$(HOSTCXX)" "$(CC)")
-+ifneq ($(PLUGINCC),)
-+ifdef CONFIG_PAX_CONSTIFY_PLUGIN
-+CONSTIFY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
-+endif
-+ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+STACKLEAK_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
-+STACKLEAK_PLUGIN_CFLAGS += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
-+endif
-+ifdef CONFIG_KALLOCSTAT_PLUGIN
-+KALLOCSTAT_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
-+endif
-+ifdef CONFIG_PAX_KERNEXEC_PLUGIN
-+KERNEXEC_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
-+KERNEXEC_PLUGIN_CFLAGS += -fplugin-arg-kernexec_plugin-method=$(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD) -DKERNEXEC_PLUGIN
-+KERNEXEC_PLUGIN_AFLAGS := -DKERNEXEC_PLUGIN
-+endif
-+ifdef CONFIG_CHECKER_PLUGIN
-+ifeq ($(call cc-ifversion, -ge, 0406, y), y)
-+CHECKER_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
-+ifdef CONFIG_CHECKER_PLUGIN_USER
-+CHECKER_PLUGIN_CFLAGS += -fplugin-arg-checker_plugin-user -DCHECKER_PLUGIN_USER
-+endif
-+ifdef CONFIG_CHECKER_PLUGIN_CONTEXT
-+CHECKER_PLUGIN_CFLAGS += -fplugin-arg-checker_plugin-context -DCHECKER_PLUGIN_CONTEXT
-+endif
-+endif
-+endif
-+COLORIZE_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/colorize_plugin.so
-+ifdef CONFIG_PAX_SIZE_OVERFLOW
-+SIZE_OVERFLOW_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/size_overflow_plugin/size_overflow_plugin.so -DSIZE_OVERFLOW_PLUGIN
-+endif
-+ifdef CONFIG_PAX_LATENT_ENTROPY
-+LATENT_ENTROPY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/latent_entropy_plugin.so -DLATENT_ENTROPY_PLUGIN
-+endif
-+ifdef CONFIG_PAX_MEMORY_STRUCTLEAK
-+STRUCTLEAK_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/structleak_plugin.so -DSTRUCTLEAK_PLUGIN
-+endif
-+INITIFY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/initify_plugin.so -DINITIFY_PLUGIN
-+ifdef CONFIG_PAX_RAP
-+RAP_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/rap_plugin/rap_plugin.so -fplugin-arg-rap_plugin-check=call -DRAP_PLUGIN
-+#RAP_PLUGIN_CFLAGS += -fplugin-arg-rap_plugin-report=func,fptr,abs
-+RAP_PLUGIN_ABS_CFLAGS := -fplugin-arg-rap_plugin-hash=abs-finish
-+RAP_PLUGIN_AFLAGS := -DRAP_PLUGIN
-+endif
-+GCC_PLUGINS_CFLAGS := $(CONSTIFY_PLUGIN_CFLAGS) $(STACKLEAK_PLUGIN_CFLAGS) $(KALLOCSTAT_PLUGIN_CFLAGS)
-+GCC_PLUGINS_CFLAGS += $(KERNEXEC_PLUGIN_CFLAGS) $(CHECKER_PLUGIN_CFLAGS) $(COLORIZE_PLUGIN_CFLAGS)
-+GCC_PLUGINS_CFLAGS += $(SIZE_OVERFLOW_PLUGIN_CFLAGS) $(LATENT_ENTROPY_PLUGIN_CFLAGS) $(STRUCTLEAK_PLUGIN_CFLAGS)
-+GCC_PLUGINS_CFLAGS += $(INITIFY_PLUGIN_CFLAGS)
-+GCC_PLUGINS_CFLAGS += $(RAP_PLUGIN_CFLAGS) $(RAP_PLUGIN_ABS_CFLAGS)
-+GCC_PLUGINS_AFLAGS := $(KERNEXEC_PLUGIN_AFLAGS) $(RAP_PLUGIN_AFLAGS)
-+export PLUGINCC GCC_PLUGINS_CFLAGS GCC_PLUGINS_AFLAGS CONSTIFY_PLUGIN LATENT_ENTROPY_PLUGIN_CFLAGS RAP_PLUGIN_CFLAGS RAP_PLUGIN_ABS_CFLAGS
-+ifeq ($(KBUILD_EXTMOD),)
-+gcc-plugins:
-+	$(Q)$(MAKE) $(build)=tools/gcc
-+else
-+gcc-plugins: ;
-+endif
-+else
-+gcc-plugins:
-+ifeq ($(call cc-ifversion, -ge, 0405, y), y)
-+	$(warning warning, your gcc installation does not support plugins, perhaps the necessary headers are missing?)
-+	$(CONFIG_SHELL) -x $(srctree)/scripts/gcc-plugin.sh "$(__PLUGINCC)" "$(HOSTCXX)" "$(CC)"
-+else
-+	$(warning warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least)
-+endif
-+	$(warning PAX_MEMORY_STACKLEAK and other features will be less secure)
+@@ -0,0 +1,71 @@
++ifdef CONFIG_GCC_PLUGINS
++  __PLUGINCC := $(call cc-ifversion, -ge, 0408, $(HOSTCXX), $(HOSTCC))
++  PLUGINCC := $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(__PLUGINCC)" "$(HOSTCXX)" "$(CC)")
++
++  gcc-plugin-$(CONFIG_PAX_CONSTIFY_PLUGIN)		+= constify_plugin.so
++  gcc-plugin-cflags-$(CONFIG_PAX_CONSTIFY_PLUGIN)	+= -DCONSTIFY_PLUGIN
++
++  gcc-plugin-$(CONFIG_PAX_MEMORY_STACKLEAK)		+= stackleak_plugin.so
++  gcc-plugin-cflags-$(CONFIG_PAX_MEMORY_STACKLEAK)	+= -DSTACKLEAK_PLUGIN -fplugin-arg-stackleak_plugin-track-lowest-sp=100
++
++  gcc-plugin-$(CONFIG_KALLOCSTAT_PLUGIN)		+= kallocstat_plugin.so
++
++  gcc-plugin-$(CONFIG_PAX_KERNEXEC_PLUGIN)		+= kernexec_plugin.so
++  gcc-plugin-cflags-$(CONFIG_PAX_KERNEXEC_PLUGIN)	+= -DKERNEXEC_PLUGIN -fplugin-arg-kernexec_plugin-method=$(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD)
++  gcc-plugin-aflags-$(CONFIG_PAX_KERNEXEC_PLUGIN)	+= -DKERNEXEC_PLUGIN
++
++  ifdef CONFIG_CHECKER_PLUGIN
++    ifeq ($(call cc-ifversion, -ge, 0406, y), y)
++      gcc-plugin-$(CONFIG_CHECKER_PLUGIN)		+= checker_plugin.so
++      gcc-plugin-cflags-$(CONFIG_CHECKER_PLUGIN)	+= -DCHECKER_PLUGIN
++      gcc-plugin-cflags-$(CONFIG_CHECKER_PLUGIN_USER)	+= -DCHECKER_PLUGIN_USER -fplugin-arg-checker_plugin-user
++      gcc-plugin-cflags-$(CONFIG_CHECKER_PLUGIN_CONTEXT)+= -DCHECKER_PLUGIN_CONTEXT -fplugin-arg-checker_plugin-context
++    endif
++  endif
++
++  gcc-plugin-y						+= colorize_plugin.so
++
++  gcc-plugin-$(CONFIG_PAX_SIZE_OVERFLOW)		+= size_overflow_plugin/size_overflow_plugin.so
++  gcc-plugin-cflags-$(CONFIG_PAX_SIZE_OVERFLOW)		+= -DSIZE_OVERFLOW_PLUGIN
++
++  gcc-plugin-$(CONFIG_PAX_LATENT_ENTROPY)		+= latent_entropy_plugin.so
++  gcc-plugin-cflags-$(CONFIG_PAX_LATENT_ENTROPY)	+= -DLATENT_ENTROPY_PLUGIN
++  ifdef CONFIG_PAX_LATENT_ENTROPY
++    DISABLE_LATENT_ENTROPY_PLUGIN				+= -fplugin-arg-latent_entropy_plugin-disable
++  endif
++
++  gcc-plugin-$(CONFIG_PAX_MEMORY_STRUCTLEAK)		+= structleak_plugin.so
++  gcc-plugin-cflags-$(CONFIG_PAX_MEMORY_STRUCTLEAK)	+= -DSTRUCTLEAK_PLUGIN
++
++  gcc-plugin-y						+= initify_plugin.so
++  gcc-plugin-cflags-y					+= -DINITIFY_PLUGIN
++
++  gcc-plugin-$(CONFIG_PAX_RAP)				+= rap_plugin/rap_plugin.so
++  gcc-plugin-cflags-$(CONFIG_PAX_RAP)			+= -DRAP_PLUGIN -fplugin-arg-rap_plugin-check=call
++#  gcc-plugin-cflags-$(CONFIG_PAX_RAP)			+= -fplugin-arg-rap_plugin-report=func,fptr,abs
++  gcc-plugin-aflags-$(CONFIG_PAX_RAP)			+= -DRAP_PLUGIN
++  ifdef CONFIG_PAX_RAP
++    RAP_PLUGIN_ABS_CFLAGS				:= -fplugin-arg-rap_plugin-hash=abs-finish
++  endif
++  gcc-plugin-cflags-$(CONFIG_PAX_RAP)			+= $(RAP_PLUGIN_ABS_CFLAGS)
++
++  GCC_PLUGINS_CFLAGS := $(strip $(addprefix -fplugin=$(objtree)/scripts/gcc-plugins/, $(gcc-plugin-y)) $(gcc-plugin-cflags-y))
++  GCC_PLUGINS_AFLAGS := $(gcc-plugin-aflags-y)
++
++  export DISABLE_LATENT_ENTROPY_PLUGIN RAP_PLUGIN_ABS_CFLAGS
++
++  ifeq ($(PLUGINCC),)
++    ifneq ($(GCC_PLUGINS_CFLAGS),)
++      ifeq ($(call cc-ifversion, -ge, 0405, y), y)
++        PLUGINCC := $(shell $(CONFIG_SHELL) -x $(srctree)/scripts/gcc-plugin.sh "$(__PLUGINCC)" "$(HOSTCXX)" "$(CC)")
++        $(warning warning, your gcc installation does not support plugins, perhaps the necessary headers are missing?)
++      else
++        $(warning warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least)
++      endif
++      $(warning PAX_MEMORY_STACKLEAK and other features will be less secure)
++    endif
++  endif
++
++  KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
++  KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
 +endif
 diff --git a/scripts/Makefile.host b/scripts/Makefile.host
-index 133edfa..3cc6af2 100644
+index 133edfa..3439bd8 100644
 --- a/scripts/Makefile.host
 +++ b/scripts/Makefile.host
 @@ -20,7 +20,25 @@
@@ -160349,7 +161060,7 @@ index 133edfa..3cc6af2 100644
  host-objdirs    := $(addprefix $(obj)/,$(host-objdirs))
  
  obj-dirs += $(host-objdirs)
-@@ -124,5 +158,37 @@ quiet_cmd_host-cxxobjs	= HOSTCXX $@
+@@ -124,5 +158,39 @@ quiet_cmd_host-cxxobjs	= HOSTCXX $@
  $(host-cxxobjs): $(obj)/%.o: $(src)/%.cc FORCE
  	$(call if_changed_dep,host-cxxobjs)
  
@@ -160373,8 +161084,9 @@ index 133edfa..3cc6af2 100644
 +      cmd_host-cshlib	= $(HOSTCC) $(HOSTLDFLAGS) -shared -o $@ \
 +			  $(addprefix $(obj)/,$($(@F:.so=-objs))) \
 +			  $(HOST_LOADLIBES) $(HOSTLOADLIBES_$(@F))
-+$(host-cshlib): $(obj)/%: $(host-cshobjs) FORCE
++$(host-cshlib): FORCE
 +	$(call if_changed,host-cshlib)
++$(call multi_depend, $(host-cshlib), .so, -objs -cshobjs)
 +
 +# Link a shared library, based on position independent .o files
 +# *.o -> .so shared library (host-cxxshlib)
@@ -160382,8 +161094,9 @@ index 133edfa..3cc6af2 100644
 +      cmd_host-cxxshlib	= $(HOSTCXX) $(HOSTLDFLAGS) -shared -o $@ \
 +			  $(addprefix $(obj)/,$($(@F:.so=-objs))) \
 +			  $(HOST_LOADLIBES) $(HOSTLOADLIBES_$(@F))
-+$(host-cxxshlib): $(obj)/%: $(host-cxxshobjs) FORCE
++$(host-cxxshlib): FORCE
 +	$(call if_changed,host-cxxshlib)
++$(call multi_depend, $(host-cxxshlib), .so, -objs -cxxshobjs)
 +
  targets += $(host-csingle)  $(host-cmulti) $(host-cobjs)\
 -	   $(host-cxxmulti) $(host-cxxobjs)
@@ -160592,14 +161305,14 @@ index e229b84..7141e8e 100644
  	while (get_node_by_phandle(root, phandle))
 diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
 new file mode 100644
-index 0000000..eaa4fce
+index 0000000..fb92075
 --- /dev/null
 +++ b/scripts/gcc-plugin.sh
 @@ -0,0 +1,51 @@
 +#!/bin/sh
 +srctree=$(dirname "$0")
 +gccplugins_dir=$($3 -print-file-name=plugin)
-+plugincc=$($1 -E -x c++ - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
++plugincc=$($1 -E -x c++ - -o /dev/null -I"${srctree}"/gcc-plugins -I"${gccplugins_dir}"/include 2>&1 <<EOF
 +#include "gcc-common.h"
 +#if BUILDING_GCC_VERSION >= 4008 || defined(ENABLE_BUILD_WITH_CXX)
 +#warning $2 CXX
@@ -160630,7 +161343,7 @@ index 0000000..eaa4fce
 +esac
 +
 +# we need a c++ compiler that supports the designated initializer GNU extension
-+plugincc=$($2 -c -x c++ -std=gnu++98 - -fsyntax-only -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
++plugincc=$($2 -c -x c++ -std=gnu++98 - -fsyntax-only -I"${srctree}"/gcc-plugins -I"${gccplugins_dir}"/include 2>&1 <<EOF
 +#include "gcc-common.h"
 +class test {
 +public:
@@ -160647,4765 +161360,1324 @@ index 0000000..eaa4fce
 +	exit 0
 +fi
 +exit 1
-diff --git a/scripts/headers_install.sh b/scripts/headers_install.sh
-index fdebd66..a349e33 100755
---- a/scripts/headers_install.sh
-+++ b/scripts/headers_install.sh
-@@ -32,6 +32,7 @@ do
- 	FILE="$(basename "$i")"
- 	sed -r \
- 		-e 's/([ \t(])(__user|__force|__iomem)[ \t]/\1/g' \
-+		-e 's/__intentional_overflow\([- \t,0-9]*\)//g' \
- 		-e 's/__attribute_const__([ \t]|$)/\1/g' \
- 		-e 's@^#include <linux/compiler.h>@@' \
- 		-e 's/(^|[^a-zA-Z0-9])__packed([^a-zA-Z0-9_]|$)/\1__attribute__((packed))\2/g' \
-diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
-index 8fa81e8..a9ac144 100644
---- a/scripts/kallsyms.c
-+++ b/scripts/kallsyms.c
-@@ -89,7 +89,7 @@ static inline int is_arm_mapping_symbol(const char *str)
- }
- 
- static int check_symbol_range(const char *sym, unsigned long long addr,
--			      struct addr_range *ranges, int entries)
-+			      struct addr_range *ranges, size_t entries)
- {
- 	size_t i;
- 	struct addr_range *ar;
-@@ -178,7 +178,7 @@ static int read_symbol(FILE *in, struct sym_entry *s)
- }
- 
- static int symbol_in_range(struct sym_entry *s, struct addr_range *ranges,
--			   int entries)
-+			   size_t entries)
- {
- 	size_t i;
- 	struct addr_range *ar;
-diff --git a/scripts/kconfig/lkc.h b/scripts/kconfig/lkc.h
-index 91ca126..5f7cad6 100644
---- a/scripts/kconfig/lkc.h
-+++ b/scripts/kconfig/lkc.h
-@@ -108,7 +108,8 @@ void menu_add_expr(enum prop_type type, struct expr *expr, struct expr *dep);
- void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep);
- void menu_add_option(int token, char *arg);
- void menu_finalize(struct menu *parent);
--void menu_set_type(int type);
-+enum symbol_type;
-+void menu_set_type(enum symbol_type type);
- 
- /* util.c */
- struct file *file_lookup(const char *name);
-@@ -123,7 +124,7 @@ struct gstr {
- 	* when max_width is not zero long lines in string s (if any) get
- 	* wrapped not to exceed the max_width value
- 	*/
--	int max_width;
-+	size_t max_width;
- };
- struct gstr str_new(void);
- void str_free(struct gstr *gs);
-diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
-index aed678e..1a703de 100644
---- a/scripts/kconfig/menu.c
-+++ b/scripts/kconfig/menu.c
-@@ -109,7 +109,7 @@ void menu_add_dep(struct expr *dep)
- 	current_entry->dep = expr_alloc_and(current_entry->dep, menu_check_dep(dep));
- }
- 
--void menu_set_type(int type)
-+void menu_set_type(enum symbol_type type)
- {
- 	struct symbol *sym = current_entry->sym;
- 
-diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
-index 25cf0c2..eb178ce 100644
---- a/scripts/kconfig/symbol.c
-+++ b/scripts/kconfig/symbol.c
-@@ -956,7 +956,7 @@ const char *sym_escape_string_value(const char *in)
- 
- struct sym_match {
- 	struct symbol	*sym;
--	off_t		so, eo;
-+	regoff_t	so, eo;
- };
- 
- /* Compare matched symbols as thus:
-@@ -978,8 +978,8 @@ static int sym_rel_comp(const void *sym1, const void *sym2)
- 	 * exactly; if this is the case, we can't decide which comes first,
- 	 * and we fallback to sorting alphabetically.
- 	 */
--	exact1 = (s1->eo - s1->so) == strlen(s1->sym->name);
--	exact2 = (s2->eo - s2->so) == strlen(s2->sym->name);
-+	exact1 = (s1->eo - s1->so) == (long)strlen(s1->sym->name);
-+	exact2 = (s2->eo - s2->so) == (long)strlen(s2->sym->name);
- 	if (exact1 && !exact2)
- 		return -1;
- 	if (!exact1 && exact2)
-diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
-index ba6c34e..ea10bce 100755
---- a/scripts/link-vmlinux.sh
-+++ b/scripts/link-vmlinux.sh
-@@ -179,7 +179,7 @@ else
- fi;
- 
- # final build of init/
--${MAKE} -f "${srctree}/scripts/Makefile.build" obj=init
-+${MAKE} -f "${srctree}/scripts/Makefile.build" obj=init GCC_PLUGINS_CFLAGS="${GCC_PLUGINS_CFLAGS}" GCC_PLUGINS_AFLAGS="${GCC_PLUGINS_AFLAGS}"
- 
- kallsymso=""
- kallsyms_vmlinux=""
-diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
-index a915507..27c1b41 100644
---- a/scripts/mod/file2alias.c
-+++ b/scripts/mod/file2alias.c
-@@ -156,7 +156,7 @@ static void device_id_check(const char *modname, const char *device_id,
- 			    unsigned long size, unsigned long id_size,
- 			    void *symval)
- {
--	int i;
-+	unsigned int i;
- 
- 	if (size % id_size || size < id_size) {
- 		fatal("%s: sizeof(struct %s_device_id)=%lu is not a modulo "
-@@ -185,7 +185,7 @@ static void device_id_check(const char *modname, const char *device_id,
- /* USB is special because the bcdDevice can be matched against a numeric range */
- /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipNinN" */
- static void do_usb_entry(void *symval,
--			 unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
-+			 unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
- 			 unsigned char range_lo, unsigned char range_hi,
- 			 unsigned char max, struct module *mod)
- {
-@@ -295,7 +295,7 @@ static void do_usb_entry_multi(void *symval, struct module *mod)
- {
- 	unsigned int devlo, devhi;
- 	unsigned char chi, clo, max;
--	int ndigits;
-+	unsigned int ndigits;
- 
- 	DEF_FIELD(symval, usb_device_id, match_flags);
- 	DEF_FIELD(symval, usb_device_id, idVendor);
-@@ -619,7 +619,7 @@ static void do_pnp_device_entry(void *symval, unsigned long size,
- 	for (i = 0; i < count; i++) {
- 		DEF_FIELD_ADDR(symval + i*id_size, pnp_device_id, id);
- 		char acpi_id[sizeof(*id)];
--		int j;
-+		unsigned int j;
- 
- 		buf_printf(&mod->dev_table_buf,
- 			   "MODULE_ALIAS(\"pnp:d%s*\");\n", *id);
-@@ -648,7 +648,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
- 
- 		for (j = 0; j < PNP_MAX_DEVICES; j++) {
- 			const char *id = (char *)(*devs)[j].id;
--			int i2, j2;
-+			unsigned int i2, j2;
- 			int dup = 0;
- 
- 			if (!id[0])
-@@ -674,7 +674,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
- 			/* add an individual alias for every device entry */
- 			if (!dup) {
- 				char acpi_id[PNP_ID_LEN];
--				int k;
-+				unsigned int k;
- 
- 				buf_printf(&mod->dev_table_buf,
- 					   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -999,7 +999,7 @@ static void dmi_ascii_filter(char *d, const char *s)
- static int do_dmi_entry(const char *filename, void *symval,
- 			char *alias)
- {
--	int i, j;
-+	unsigned int i, j;
- 	DEF_FIELD_ADDR(symval, dmi_system_id, matches);
- 	sprintf(alias, "dmi*");
- 
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index 48958d3..d5ccb52 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -37,6 +37,7 @@ static int vmlinux_section_warnings = 1;
- static int warn_unresolved = 0;
- /* How a symbol is exported */
- static int sec_mismatch_count = 0;
-+static int writable_fptr_count = 0;
- static int sec_mismatch_verbose = 1;
- static int sec_mismatch_fatal = 0;
- /* ignore missing files */
-@@ -947,6 +948,7 @@ enum mismatch {
- 	ANY_EXIT_TO_ANY_INIT,
- 	EXPORT_TO_INIT_EXIT,
- 	EXTABLE_TO_NON_TEXT,
-+	DATA_TO_TEXT
- };
- 
- /**
-@@ -1073,6 +1075,12 @@ static const struct sectioncheck sectioncheck[] = {
- 	.good_tosec = {ALL_TEXT_SECTIONS , NULL},
- 	.mismatch = EXTABLE_TO_NON_TEXT,
- 	.handler = extable_mismatch_handler,
-+},
-+/* Do not reference code from writable data */
-+{
-+	.fromsec = { DATA_SECTIONS, NULL },
-+	.bad_tosec = { ALL_TEXT_SECTIONS, NULL },
-+	.mismatch = DATA_TO_TEXT
- }
- };
- 
-@@ -1222,10 +1230,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
- 			continue;
- 		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
- 			continue;
--		if (sym->st_value == addr)
--			return sym;
- 		/* Find a symbol nearby - addr are maybe negative */
- 		d = sym->st_value - addr;
-+		if (d == 0)
-+			return sym;
- 		if (d < 0)
- 			d = addr - sym->st_value;
- 		if (d < distance) {
-@@ -1384,7 +1392,11 @@ static void report_sec_mismatch(const char *modname,
- 	char *prl_from;
- 	char *prl_to;
- 
--	sec_mismatch_count++;
-+	if (mismatch->mismatch == DATA_TO_TEXT)
-+		writable_fptr_count++;
-+	else
-+		sec_mismatch_count++;
-+
- 	if (!sec_mismatch_verbose)
- 		return;
- 
-@@ -1508,6 +1520,14 @@ static void report_sec_mismatch(const char *modname,
- 		fatal("There's a special handler for this mismatch type, "
- 		      "we should never get here.");
- 		break;
-+	case DATA_TO_TEXT:
-+#if 0
-+		fprintf(stderr,
-+		"The %s %s:%s references\n"
-+		"the %s %s:%s%s\n",
-+		from, fromsec, fromsym, to, tosec, tosym, to_p);
-+#endif
-+		break;
- 	}
- 	fprintf(stderr, "\n");
- }
-@@ -1897,7 +1917,7 @@ static void section_rel(const char *modname, struct elf_info *elf,
- static void check_sec_ref(struct module *mod, const char *modname,
- 			  struct elf_info *elf)
- {
--	int i;
-+	unsigned int i;
- 	Elf_Shdr *sechdrs = elf->sechdrs;
- 
- 	/* Walk through all sections */
-@@ -2028,7 +2048,7 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf,
- 	va_end(ap);
- }
- 
--void buf_write(struct buffer *buf, const char *s, int len)
-+void buf_write(struct buffer *buf, const char *s, unsigned int len)
- {
- 	if (buf->size - buf->pos < len) {
- 		buf->size += len + SZ;
-@@ -2258,7 +2278,7 @@ static void write_if_changed(struct buffer *b, const char *fname)
- 	if (fstat(fileno(file), &st) < 0)
- 		goto close_write;
- 
--	if (st.st_size != b->pos)
-+	if (st.st_size != (off_t)b->pos)
- 		goto close_write;
- 
- 	tmp = NOFAIL(malloc(b->pos));
-@@ -2496,6 +2516,14 @@ int main(int argc, char **argv)
- 			      "Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them.\n");
- 		}
- 	}
-+	if (writable_fptr_count) {
-+		if (!sec_mismatch_verbose) {
-+			warn("modpost: Found %d writable function pointer(s).\n"
-+			     "To see full details build your kernel with:\n"
-+			     "'make CONFIG_DEBUG_SECTION_MISMATCH=y'\n",
-+			     writable_fptr_count);
-+		}
-+	}
- 
- 	return err;
- }
-diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h
-index 6a5e151..f2fbaf5 100644
---- a/scripts/mod/modpost.h
-+++ b/scripts/mod/modpost.h
-@@ -98,15 +98,15 @@ void *do_nofail(void *ptr, const char *expr);
- 
- struct buffer {
- 	char *p;
--	int pos;
--	int size;
-+	unsigned int pos;
-+	unsigned int size;
- };
- 
- void __attribute__((format(printf, 2, 3)))
- buf_printf(struct buffer *buf, const char *fmt, ...);
- 
- void
--buf_write(struct buffer *buf, const char *s, int len);
-+buf_write(struct buffer *buf, const char *s, unsigned int len);
- 
- struct module {
- 	struct module *next;
-diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
-index 944418d..15291e4 100644
---- a/scripts/mod/sumversion.c
-+++ b/scripts/mod/sumversion.c
-@@ -470,7 +470,7 @@ static void write_version(const char *filename, const char *sum,
- 		goto out;
- 	}
- 
--	if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
-+	if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
- 		warn("writing sum in %s failed: %s\n",
- 			filename, strerror(errno));
- 		goto out;
-diff --git a/scripts/module-common.lds b/scripts/module-common.lds
-index 73a2c7d..df11b31 100644
---- a/scripts/module-common.lds
-+++ b/scripts/module-common.lds
-@@ -6,6 +6,10 @@
- SECTIONS {
- 	/DISCARD/ : { *(.discard) }
- 
-+	.rodata			0: {
-+		*(.rodata) *(.rodata.*)
-+		*(.data..read_only)
-+	}
- 	__ksymtab		0 : { *(SORT(___ksymtab+*)) }
- 	__ksymtab_gpl		0 : { *(SORT(___ksymtab_gpl+*)) }
- 	__ksymtab_unused	0 : { *(SORT(___ksymtab_unused+*)) }
-diff --git a/scripts/package/Makefile b/scripts/package/Makefile
-index c2c7389..81b8117 100644
---- a/scripts/package/Makefile
-+++ b/scripts/package/Makefile
-@@ -40,7 +40,7 @@ if test "$(objtree)" != "$(srctree)"; then \
- fi ; \
- $(srctree)/scripts/setlocalversion --save-scmversion; \
- ln -sf $(srctree) $(2); \
--tar -cz $(RCS_TAR_IGNORE) -f $(2).tar.gz \
-+tar --owner=root --group=root -cz $(RCS_TAR_IGNORE) -f $(2).tar.gz \
- 	$(addprefix $(2)/,$(TAR_CONTENT) $(3)); \
- rm -f $(2) $(objtree)/.scmversion
- 
-diff --git a/scripts/package/builddeb b/scripts/package/builddeb
-index 6c3b038..54e0b5e 100755
---- a/scripts/package/builddeb
-+++ b/scripts/package/builddeb
-@@ -326,6 +326,7 @@ fi
- (cd $srctree; find arch/$SRCARCH -name module.lds -o -name Kbuild.platforms -o -name Platform) >> "$objtree/debian/hdrsrcfiles"
- (cd $srctree; find $(find arch/$SRCARCH -name include -o -name scripts -type d) -type f) >> "$objtree/debian/hdrsrcfiles"
- (cd $objtree; find arch/$SRCARCH/include Module.symvers include scripts -type f) >> "$objtree/debian/hdrobjfiles"
-+(cd $objtree; find tools/gcc -name \*.so -o -name gcc-common.h) >> "$objtree/debian/hdrobjfiles"
- destdir=$kernel_headers_dir/usr/src/linux-headers-$version
- mkdir -p "$destdir"
- (cd $srctree; tar -c -f - -T -) < "$objtree/debian/hdrsrcfiles" | (cd $destdir; tar -xf -)
-diff --git a/scripts/package/mkspec b/scripts/package/mkspec
-index fe44d68..3874acb 100755
---- a/scripts/package/mkspec
-+++ b/scripts/package/mkspec
-@@ -120,29 +120,40 @@ echo 'rm -f $RPM_BUILD_ROOT'"/lib/modules/$KERNELRELEASE/{build,source}"
- echo "mkdir -p "'$RPM_BUILD_ROOT'"/usr/src/kernels/$KERNELRELEASE"
- echo "EXCLUDES=\"$RCS_TAR_IGNORE --exclude .tmp_versions --exclude=*vmlinux* --exclude=*.o --exclude=*.ko --exclude=*.cmd --exclude=Documentation --exclude=firmware --exclude .config.old --exclude .missing-syscalls.d\""
- echo "tar "'$EXCLUDES'" -cf- . | (cd "'$RPM_BUILD_ROOT'"/usr/src/kernels/$KERNELRELEASE;tar xvf -)"
--echo 'cd $RPM_BUILD_ROOT'"/lib/modules/$KERNELRELEASE"
--echo "ln -sf /usr/src/kernels/$KERNELRELEASE build"
--echo "ln -sf /usr/src/kernels/$KERNELRELEASE source"
- fi
- 
- echo ""
- echo "%clean"
- echo 'rm -rf $RPM_BUILD_ROOT'
- echo ""
-+echo "%pre"
-+echo 'chmod -f 0500 /boot'
-+echo 'if [ -d /lib/modules ]; then'
-+echo 'chmod -f 0500 /lib/modules'
-+echo 'fi'
-+echo 'if [ -d /lib32/modules ]; then'
-+echo 'chmod -f 0500 /lib32/modules'
-+echo 'fi'
-+echo 'if [ -d /lib64/modules ]; then'
-+echo 'chmod -f 0500 /lib64/modules'
-+echo 'fi'
-+echo ""
-+echo "%post devel"
-+echo "ln -sf /usr/src/kernels/$KERNELRELEASE /lib/modules/$KERNELRELEASE/build"
-+echo "ln -sf /usr/src/kernels/$KERNELRELEASE /lib/modules/$KERNELRELEASE/source"
-+echo ""
- echo "%post"
--echo "if [ -x /sbin/installkernel -a -r /boot/vmlinuz-$KERNELRELEASE -a -r /boot/System.map-$KERNELRELEASE ]; then"
--echo "cp /boot/vmlinuz-$KERNELRELEASE /boot/.vmlinuz-$KERNELRELEASE-rpm"
--echo "cp /boot/System.map-$KERNELRELEASE /boot/.System.map-$KERNELRELEASE-rpm"
--echo "rm -f /boot/vmlinuz-$KERNELRELEASE /boot/System.map-$KERNELRELEASE"
--echo "/sbin/installkernel $KERNELRELEASE /boot/.vmlinuz-$KERNELRELEASE-rpm /boot/.System.map-$KERNELRELEASE-rpm"
--echo "rm -f /boot/.vmlinuz-$KERNELRELEASE-rpm /boot/.System.map-$KERNELRELEASE-rpm"
-+echo "if [ -x /sbin/dracut ]; then"
-+echo '/sbin/new-kernel-pkg --dracut --mkinitrd --depmod --install --make-default '"$KERNELRELEASE"' || exit $?'
-+echo "else"
-+echo '/sbin/new-kernel-pkg --mkinitrd --depmod --install --make-default '"$KERNELRELEASE"' || exit $?'
- echo "fi"
- echo ""
- echo "%files"
--echo '%defattr (-, root, root)'
--echo "/lib/modules/$KERNELRELEASE"
-+echo '%defattr (400, root, root, 500)'
- echo "%exclude /lib/modules/$KERNELRELEASE/build"
- echo "%exclude /lib/modules/$KERNELRELEASE/source"
-+echo "/lib/modules/$KERNELRELEASE"
- echo "/lib/firmware/$KERNELRELEASE"
- echo "/boot/*"
- echo ""
-@@ -152,9 +163,11 @@ echo "/usr/include"
- echo ""
- if ! $PREBUILT; then
- echo "%files devel"
--echo '%defattr (-, root, root)'
-+echo '%defattr (400, root, root, 500)'
-+echo "%dir /lib/modules/$KERNELRELEASE"
- echo "/usr/src/kernels/$KERNELRELEASE"
--echo "/lib/modules/$KERNELRELEASE/build"
--echo "/lib/modules/$KERNELRELEASE/source"
-+echo "%attr (500, root, root) /usr/src/kernels/$KERNELRELEASE/scripts/recordmcount"
-+echo "%attr (500, root, root) /usr/src/kernels/$KERNELRELEASE/scripts/basic/fixdep"
-+echo "%attr (500, root, root) /usr/src/kernels/$KERNELRELEASE/scripts/mod/modpost"
- echo ""
- fi
-diff --git a/scripts/pnmtologo.c b/scripts/pnmtologo.c
-index 4718d78..9220d58 100644
---- a/scripts/pnmtologo.c
-+++ b/scripts/pnmtologo.c
-@@ -244,14 +244,14 @@ static void write_header(void)
-     fprintf(out, " *  Linux logo %s\n", logoname);
-     fputs(" */\n\n", out);
-     fputs("#include <linux/linux_logo.h>\n\n", out);
--    fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
-+    fprintf(out, "static unsigned char %s_data[] = {\n",
- 	    logoname);
- }
- 
- static void write_footer(void)
- {
-     fputs("\n};\n\n", out);
--    fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
-+    fprintf(out, "const struct linux_logo %s = {\n", logoname);
-     fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
-     fprintf(out, "\t.width\t\t= %d,\n", logo_width);
-     fprintf(out, "\t.height\t\t= %d,\n", logo_height);
-@@ -381,7 +381,7 @@ static void write_logo_clut224(void)
-     fputs("\n};\n\n", out);
- 
-     /* write logo clut */
--    fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
-+    fprintf(out, "static unsigned char %s_clut[] = {\n",
- 	    logoname);
-     write_hex_cnt = 0;
-     for (i = 0; i < logo_clutsize; i++) {
-diff --git a/scripts/sortextable.h b/scripts/sortextable.h
-index ba87004..3f4852c 100644
---- a/scripts/sortextable.h
-+++ b/scripts/sortextable.h
-@@ -108,9 +108,9 @@ do_func(Elf_Ehdr *ehdr, char const *const fname, table_sort_t custom_sort)
- 	const char *secstrtab;
- 	const char *strtab;
- 	char *extab_image;
--	int extab_index = 0;
--	int i;
--	int idx;
-+	unsigned int extab_index = 0;
-+	unsigned int i;
-+	unsigned int idx;
- 	unsigned int num_sections;
- 	unsigned int secindex_strings;
- 
-diff --git a/scripts/tags.sh b/scripts/tags.sh
-index 23ba1c6..cad2484 100755
---- a/scripts/tags.sh
-+++ b/scripts/tags.sh
-@@ -26,7 +26,7 @@ else
- fi
- 
- # ignore userspace tools
--ignore="$ignore ( -path ${tree}tools ) -prune -o"
-+ignore="$ignore ( -path \"${tree}tools/[^g]*\" ) -prune -o"
- 
- # Find all available archs
- find_all_archs()
-diff --git a/security/Kconfig b/security/Kconfig
-index e452378..4388a35 100644
---- a/security/Kconfig
-+++ b/security/Kconfig
-@@ -4,6 +4,989 @@
- 
- menu "Security options"
- 
-+menu "Grsecurity"
+diff --git a/scripts/gcc-plugins/.gitignore b/scripts/gcc-plugins/.gitignore
+new file mode 100644
+index 0000000..de92ed9
+--- /dev/null
++++ b/scripts/gcc-plugins/.gitignore
+@@ -0,0 +1 @@
++randomize_layout_seed.h
+diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile
+new file mode 100644
+index 0000000..ad7ca02
+--- /dev/null
++++ b/scripts/gcc-plugins/Makefile
+@@ -0,0 +1,57 @@
++#CC := gcc
++#PLUGIN_SOURCE_FILES := pax_plugin.c
++#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
++GCCPLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
++#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W -std=gnu99
 +
-+	config ARCH_TRACK_EXEC_LIMIT
-+	bool
++ifeq ($(PLUGINCC),$(HOSTCC))
++HOSTLIBS := hostlibs
++HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(src) -std=gnu99 -ggdb -Wall -W
++export HOST_EXTRACFLAGS
++else
++HOSTLIBS := hostcxxlibs
++HOST_EXTRACXXFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(src) -std=gnu++98 -fno-rtti -fno-exceptions -fasynchronous-unwind-tables -ggdb -Wall -W -Wno-unused-parameter -Wno-narrowing -Wno-unused-variable
++export HOST_EXTRACXXFLAGS
++endif
 +
-+	config PAX_KERNEXEC_PLUGIN
-+	bool
++export GCCPLUGINS_DIR HOSTLIBS
 +
-+	config PAX_PER_CPU_PGD
-+	bool
++$(HOSTLIBS)-$(CONFIG_PAX_CONSTIFY_PLUGIN) := constify_plugin.so
++$(HOSTLIBS)-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
++$(HOSTLIBS)-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so
++$(HOSTLIBS)-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so
++$(HOSTLIBS)-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
++$(HOSTLIBS)-y += colorize_plugin.so
++$(HOSTLIBS)-$(CONFIG_PAX_LATENT_ENTROPY) += latent_entropy_plugin.so
++$(HOSTLIBS)-$(CONFIG_PAX_MEMORY_STRUCTLEAK) += structleak_plugin.so
++$(HOSTLIBS)-y += initify_plugin.so
++$(HOSTLIBS)-$(CONFIG_GRKERNSEC_RANDSTRUCT) += randomize_layout_plugin.so
 +
-+	config TASK_SIZE_MAX_SHIFT
-+	int
-+	depends on X86_64
-+	default 47 if !PAX_PER_CPU_PGD
-+	default 42 if PAX_PER_CPU_PGD
++subdir-$(CONFIG_PAX_SIZE_OVERFLOW) := size_overflow_plugin
++subdir- += size_overflow_plugin
 +
-+	config PAX_ENABLE_PAE
-+	bool
-+	default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
-+	
-+	config PAX_USERCOPY_SLABS
-+	bool
++subdir-$(CONFIG_PAX_RAP) += rap_plugin
++subdir- += rap_plugin
 +
-+config GRKERNSEC
-+	bool "Grsecurity"
-+	select CRYPTO
-+	select CRYPTO_SHA256
-+	select PROC_FS
-+	select STOP_MACHINE
-+	select TTY
-+	select DEBUG_KERNEL
-+	select DEBUG_LIST
-+	select MULTIUSER
-+	help
-+	  If you say Y here, you will be able to configure many features
-+	  that will enhance the security of your system.  It is highly
-+	  recommended that you say Y here and read through the help
-+	  for each option so that you fully understand the features and
-+	  can evaluate their usefulness for your machine.
++always := $($(HOSTLIBS)-y)
 +
-+choice
-+	prompt "Configuration Method"
-+	depends on GRKERNSEC
-+	default GRKERNSEC_CONFIG_CUSTOM
-+	help
++constify_plugin-objs := constify_plugin.o
++stackleak_plugin-objs := stackleak_plugin.o
++kallocstat_plugin-objs := kallocstat_plugin.o
++kernexec_plugin-objs := kernexec_plugin.o
++checker_plugin-objs := checker_plugin.o
++colorize_plugin-objs := colorize_plugin.o
++latent_entropy_plugin-objs := latent_entropy_plugin.o
++structleak_plugin-objs := structleak_plugin.o
++initify_plugin-objs := initify_plugin.o
++randomize_layout_plugin-objs := randomize_layout_plugin.o
 +
-+config GRKERNSEC_CONFIG_AUTO
-+	bool "Automatic"
-+	help
-+	  If you choose this configuration method, you'll be able to answer a small
-+	  number of simple questions about how you plan to use this kernel.
-+	  The settings of grsecurity and PaX will be automatically configured for
-+	  the highest commonly-used settings within the provided constraints.
++$(obj)/randomize_layout_plugin.o: $(objtree)/$(obj)/randomize_layout_seed.h
 +
-+	  If you require additional configuration, custom changes can still be made
-+	  from the "custom configuration" menu.
++quiet_cmd_create_randomize_layout_seed = GENSEED  $@
++      cmd_create_randomize_layout_seed = \
++	$(CONFIG_SHELL) $(srctree)/$(src)/gen-random-seed.sh $@ $(objtree)/include/generated/randomize_layout_hash.h
++$(objtree)/$(obj)/randomize_layout_seed.h: FORCE
++	$(call if_changed,create_randomize_layout_seed)
 +
-+config GRKERNSEC_CONFIG_CUSTOM
-+	bool "Custom"
-+	help
-+	  If you choose this configuration method, you'll be able to configure all
-+	  grsecurity and PaX settings manually.  Via this method, no options are
-+	  automatically enabled.
++targets += randomize_layout_seed.h randomize_layout_hash.h
+diff --git a/scripts/gcc-plugins/checker_plugin.c b/scripts/gcc-plugins/checker_plugin.c
+new file mode 100644
+index 0000000..efaf576
+--- /dev/null
++++ b/scripts/gcc-plugins/checker_plugin.c
+@@ -0,0 +1,496 @@
++/*
++ * Copyright 2011-2016 by the PaX Team <pageexec@××××××××.hu>
++ * Licensed under the GPL v2
++ *
++ * Note: the choice of the license means that the compilation process is
++ *       NOT 'eligible' as defined by gcc's library exception to the GPL v3,
++ *       but for the kernel it doesn't matter since it doesn't link against
++ *       any of the gcc libraries
++ *
++ * gcc plugin to implement various sparse (source code checker) features
++ *
++ * TODO:
++ * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch)
++ *
++ * BUGS:
++ * - none known
++ */
 +
-+	  Take note that if menuconfig is exited with this configuration method
-+	  chosen, you will not be able to use the automatic configuration methods
-+	  without starting again with a kernel configuration with no grsecurity
-+	  or PaX options specified inside.
++#include "gcc-common.h"
 +
-+endchoice
++extern void c_register_addr_space (const char *str, addr_space_t as);
++extern enum machine_mode default_addr_space_pointer_mode (addr_space_t);
++extern enum machine_mode default_addr_space_address_mode (addr_space_t);
++extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as);
++extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as);
++extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as);
 +
-+choice
-+	prompt "Usage Type"
-+	depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
-+	default GRKERNSEC_CONFIG_SERVER
-+	help
++int plugin_is_GPL_compatible;
 +
-+config GRKERNSEC_CONFIG_SERVER
-+	bool "Server"
-+	help
-+	  Choose this option if you plan to use this kernel on a server.
++static struct plugin_info checker_plugin_info = {
++	.version	= "201602181345",
++	.help		= "user\tturn on user/kernel address space checking\n"
++			  "context\tturn on locking context checking\n"
++};
 +
-+config GRKERNSEC_CONFIG_DESKTOP
-+	bool "Desktop"
-+	help
-+	  Choose this option if you plan to use this kernel on a desktop.
++#define ADDR_SPACE_KERNEL		0
++#define ADDR_SPACE_FORCE_KERNEL		1
++#define ADDR_SPACE_USER			2
++#define ADDR_SPACE_FORCE_USER		3
++#define ADDR_SPACE_IOMEM		0
++#define ADDR_SPACE_FORCE_IOMEM		0
++#define ADDR_SPACE_PERCPU		0
++#define ADDR_SPACE_FORCE_PERCPU		0
++#define ADDR_SPACE_RCU			0
++#define ADDR_SPACE_FORCE_RCU		0
 +
-+endchoice
++static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace)
++{
++	return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC);
++}
 +
-+choice
-+	prompt "Virtualization Type"
-+	depends on (GRKERNSEC && X86 && GRKERNSEC_CONFIG_AUTO)
-+	default GRKERNSEC_CONFIG_VIRT_NONE
-+	help
++static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace)
++{
++	return default_addr_space_address_mode(ADDR_SPACE_GENERIC);
++}
 +
-+config GRKERNSEC_CONFIG_VIRT_NONE
-+	bool "None"
-+	help
-+	  Choose this option if this kernel will be run on bare metal.
++static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as)
++{
++	return default_addr_space_valid_pointer_mode(mode, as);
++}
 +
-+config GRKERNSEC_CONFIG_VIRT_GUEST
-+	bool "Guest"
-+	help
-+	  Choose this option if this kernel will be run as a VM guest.
++static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as)
++{
++	return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC);
++}
 +
-+config GRKERNSEC_CONFIG_VIRT_HOST
-+	bool "Host"
-+	help
-+	  Choose this option if this kernel will be run as a VM host.
++static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as)
++{
++	return default_addr_space_legitimize_address(x, oldx, mode, as);
++}
 +
-+endchoice
++static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset)
++{
++	if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL)
++		return true;
 +
-+choice
-+	prompt "Virtualization Hardware"
-+	depends on (GRKERNSEC && X86 && GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_GUEST || GRKERNSEC_CONFIG_VIRT_HOST))
-+	help
++	if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER)
++		return true;
 +
-+config GRKERNSEC_CONFIG_VIRT_EPT
-+	bool "EPT/RVI Processor Support"
-+	depends on X86
-+	help
-+	  Choose this option if your CPU supports the EPT or RVI features of 2nd-gen
-+	  hardware virtualization.  This allows for additional kernel hardening protections
-+	  to operate without additional performance impact.
++	if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM)
++		return true;
 +
-+	  To see if your Intel processor supports EPT, see:
-+	  http://ark.intel.com/Products/VirtualizationTechnology
-+	  (Most Core i3/5/7 support EPT)
++	if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER)
++		return true;
 +
-+	  To see if your AMD processor supports RVI, see:
-+	  http://support.amd.com/us/kbarticles/Pages/GPU120AMDRVICPUsHyperVWin8.aspx
++	if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM)
++		return true;
 +
-+config GRKERNSEC_CONFIG_VIRT_SOFT
-+	bool "First-gen/No Hardware Virtualization"
-+	help
-+	  Choose this option if you use an Atom/Pentium/Core 2 processor that either doesn't
-+	  support hardware virtualization or doesn't support the EPT/RVI extensions.
++	if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL)
++		return true;
 +
-+endchoice
++	if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL)
++		return true;
 +
-+choice
-+	prompt "Virtualization Software"
-+	depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_GUEST || GRKERNSEC_CONFIG_VIRT_HOST))
-+	help
++	return subset == superset;
++}
 +
-+config GRKERNSEC_CONFIG_VIRT_XEN
-+	bool "Xen"
-+	help
-+	  Choose this option if this kernel is running as a Xen guest or host.
++static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type)
++{
++//	addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type));
++//	addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type));
 +
-+config GRKERNSEC_CONFIG_VIRT_VMWARE
-+	bool "VMWare"
-+	help
-+	  Choose this option if this kernel is running as a VMWare guest or host.
++	return op;
++}
 +
-+config GRKERNSEC_CONFIG_VIRT_KVM
-+	bool "KVM"
-+	help
-+	  Choose this option if this kernel is running as a KVM guest or host.
++static void register_checker_address_spaces(void *event_data, void *data)
++{
++	c_register_addr_space("__kernel", ADDR_SPACE_KERNEL);
++	c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL);
++	c_register_addr_space("__user", ADDR_SPACE_USER);
++	c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER);
++//	c_register_addr_space("__iomem", ADDR_SPACE_IOMEM);
++//	c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM);
++//	c_register_addr_space("__percpu", ADDR_SPACE_PERCPU);
++//	c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU);
++//	c_register_addr_space("__rcu", ADDR_SPACE_RCU);
++//	c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU);
 +
-+config GRKERNSEC_CONFIG_VIRT_VIRTUALBOX
-+	bool "VirtualBox"
-+	help
-+	  Choose this option if this kernel is running as a VirtualBox guest or host.
++	targetm.addr_space.pointer_mode		= checker_addr_space_pointer_mode;
++	targetm.addr_space.address_mode		= checker_addr_space_address_mode;
++	targetm.addr_space.valid_pointer_mode	= checker_addr_space_valid_pointer_mode;
++	targetm.addr_space.legitimate_address_p	= checker_addr_space_legitimate_address_p;
++//	targetm.addr_space.legitimize_address	= checker_addr_space_legitimize_address;
++	targetm.addr_space.subset_p		= checker_addr_space_subset_p;
++	targetm.addr_space.convert		= checker_addr_space_convert;
++}
 +
-+config GRKERNSEC_CONFIG_VIRT_HYPERV
-+	bool "Hyper-V"
-+	help
-+	  Choose this option if this kernel is running as a Hyper-V guest.
++static bool split_context_attribute(tree args, tree *lock, tree *in, tree *out)
++{
++	*in = TREE_VALUE(args);
 +
-+endchoice
++	if (TREE_CODE(*in) != INTEGER_CST) {
++		*lock = *in;
++		args = TREE_CHAIN(args);
++		*in = TREE_VALUE(args);
++	} else
++		*lock = NULL_TREE;
 +
-+choice
-+	prompt "Required Priorities"
-+	depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
-+	default GRKERNSEC_CONFIG_PRIORITY_PERF
-+	help
++	args = TREE_CHAIN(args);
++	if (*lock && !args)
++		return false;
 +
-+config GRKERNSEC_CONFIG_PRIORITY_PERF
-+	bool "Performance"
-+	help
-+	  Choose this option if performance is of highest priority for this deployment
-+	  of grsecurity.  Features like UDEREF on a 64bit kernel, kernel stack clearing,
-+	  clearing of structures intended for userland, and freed memory sanitizing will
-+	  be disabled.
++	*out = TREE_VALUE(args);
++	return true;
++}
 +
-+config GRKERNSEC_CONFIG_PRIORITY_SECURITY
-+	bool "Security"
-+	help
-+	  Choose this option if security is of highest priority for this deployment of
-+	  grsecurity.  UDEREF, kernel stack clearing, clearing of structures intended
-+	  for userland, and freed memory sanitizing will be enabled for this kernel.
-+	  In a worst-case scenario, these features can introduce a 20% performance hit
-+	  (UDEREF on x64 contributing half of this hit).
++static tree handle_context_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
++{
++	*no_add_attrs = true;
++	tree lock, in, out;
 +
-+endchoice
++	if (TREE_CODE(*node) != FUNCTION_DECL) {
++		error("%qE attribute applies to functions only (%qD)", name, *node);
++		return NULL_TREE;
++	}
 +
-+menu "Default Special Groups"
-+depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
++	if (!split_context_attribute(args, &lock, &in, &out)) {
++		error("%qE attribute needs two integers after the lock expression", name);
++		return NULL_TREE;
++	}
 +
-+config GRKERNSEC_PROC_GID
-+	int "GID exempted from /proc restrictions"
-+	default 1001
-+	help
-+	  Setting this GID determines which group will be exempted from
-+	  grsecurity's /proc restrictions, allowing users of the specified
-+	  group  to view network statistics and the existence of other users'
-+	  processes on the system.  This GID may also be chosen at boot time
-+	  via "grsec_proc_gid=" on the kernel commandline.
++	if (TREE_CODE(in) != INTEGER_CST) {
++		error("the 'in' argument of the %qE attribute must be an integer (%qE)", name, in);
++		return NULL_TREE;
++	}
 +
-+config GRKERNSEC_TPE_UNTRUSTED_GID
-+        int "GID for TPE-untrusted users"
-+        depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
-+        default 1005
-+        help
-+	  Setting this GID determines which group untrusted users should
-+	  be added to.  These users will be placed under grsecurity's Trusted Path
-+	  Execution mechanism, preventing them from executing their own binaries.
-+	  The users will only be able to execute binaries in directories owned and
-+	  writable only by the root user.  If the sysctl option is enabled, a sysctl
-+	  option with name "tpe_gid" is created.
++	if (TREE_CODE(out) != INTEGER_CST) {
++		error("the 'out' argument of the %qE attribute must be an integer (%qE)", name, out);
++		return NULL_TREE;
++	}
 +
-+config GRKERNSEC_TPE_TRUSTED_GID
-+        int "GID for TPE-trusted users"
-+        depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
-+        default 1005
-+        help
-+          Setting this GID determines what group TPE restrictions will be
-+          *disabled* for.  If the sysctl option is enabled, a sysctl option
-+          with name "tpe_gid" is created.
++	*no_add_attrs = false;
++	return NULL_TREE;
++}
 +
-+config GRKERNSEC_SYMLINKOWN_GID
-+        int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
-+        depends on GRKERNSEC_CONFIG_SERVER
-+        default 1006
-+        help
-+          Setting this GID determines what group kernel-enforced
-+          SymlinksIfOwnerMatch will be enabled for.  If the sysctl option
-+          is enabled, a sysctl option with name "symlinkown_gid" is created.
++static struct attribute_spec context_attr = {
++	.name			= "context",
++	.min_length		= 2,
++	.max_length		= 3,
++	.decl_required		= true,
++	.type_required		= false,
++	.function_type_required	= false,
++	.handler		= handle_context_attribute,
++#if BUILDING_GCC_VERSION >= 4007
++	.affects_type_identity	= true
++#endif
++};
 +
++static void register_attributes(void *event_data, void *data)
++{
++	register_attribute(&context_attr);
++}
 +
-+endmenu
++static const char context_function[] = "__context__";
++static GTY(()) tree context_function_decl;
 +
-+menu "Customize Configuration"
-+depends on GRKERNSEC
++static const char context_error[] = "__context_error__";
++static GTY(()) tree context_error_decl;
 +
-+menu "PaX"
++static void context_start_unit(void __unused *gcc_data, void __unused *user_data)
++{
++	tree fntype, attr;
 +
-+config PAX
-+	bool "Enable various PaX features"
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
-+	help
-+	  This allows you to enable various PaX features.  PaX adds
-+	  intrusion prevention mechanisms to the kernel that reduce
-+	  the risks posed by exploitable memory corruption bugs.
++	// void __context__(void *, int);
++	fntype = build_function_type_list(void_type_node, ptr_type_node, integer_type_node, NULL_TREE);
++	context_function_decl = build_fn_decl(context_function, fntype);
 +
-+menu "PaX Control"
-+	depends on PAX
++	TREE_PUBLIC(context_function_decl) = 1;
++	TREE_USED(context_function_decl) = 1;
++	DECL_EXTERNAL(context_function_decl) = 1;
++	DECL_ARTIFICIAL(context_function_decl) = 1;
++	DECL_PRESERVE_P(context_function_decl) = 1;
++//	TREE_NOTHROW(context_function_decl) = 1;
++//	DECL_UNINLINABLE(context_function_decl) = 1;
++	DECL_ASSEMBLER_NAME(context_function_decl); // for LTO
++	lang_hooks.decls.pushdecl(context_function_decl);
 +
-+config PAX_SOFTMODE
-+	bool 'Support soft mode'
-+	help
-+	  Enabling this option will allow you to run PaX in soft mode, that
-+	  is, PaX features will not be enforced by default, only on executables
-+	  marked explicitly.  You must also enable PT_PAX_FLAGS or XATTR_PAX_FLAGS
-+	  support as they are the only way to mark executables for soft mode use.
++	// void __context_error__(const void *, int) __attribute__((error("context error")));
++	fntype = build_function_type_list(void_type_node, const_ptr_type_node, integer_type_node, NULL_TREE);
++	context_error_decl = build_fn_decl(context_error, fntype);
 +
-+	  Soft mode can be activated by using the "pax_softmode=1" kernel command
-+	  line option on boot.  Furthermore you can control various PaX features
-+	  at runtime via the entries in /proc/sys/kernel/pax.
++	TREE_PUBLIC(context_error_decl) = 1;
++	TREE_USED(context_error_decl) = 1;
++	DECL_EXTERNAL(context_error_decl) = 1;
++	DECL_ARTIFICIAL(context_error_decl) = 1;
++	DECL_PRESERVE_P(context_error_decl) = 1;
++//	TREE_NOTHROW(context_error_decl) = 1;
++//	DECL_UNINLINABLE(context_error_decl) = 1;
++	TREE_THIS_VOLATILE(context_error_decl) = 1;
++	DECL_ASSEMBLER_NAME(context_error_decl);
 +
-+config PAX_EI_PAX
-+	bool 'Use legacy ELF header marking'
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	help
-+	  Enabling this option will allow you to control PaX features on
-+	  a per executable basis via the 'chpax' utility available at
-+	  http://pax.grsecurity.net/.  The control flags will be read from
-+	  an otherwise reserved part of the ELF header.  This marking has
-+	  numerous drawbacks (no support for soft-mode, toolchain does not
-+	  know about the non-standard use of the ELF header) therefore it
-+	  has been deprecated in favour of PT_PAX_FLAGS and XATTR_PAX_FLAGS
-+	  support.
++	attr = tree_cons(NULL, build_string(14, "context error"), NULL);
++	attr = tree_cons(get_identifier("error"), attr, NULL);
++	decl_attributes(&context_error_decl, attr, 0);
++}
 +
-+	  Note that if you enable PT_PAX_FLAGS or XATTR_PAX_FLAGS marking
-+	  support as well, they will override the legacy EI_PAX marks.
++static bool context_gate(void)
++{
++	tree context_attr;
 +
-+	  If you enable none of the marking options then all applications
-+	  will run with PaX enabled on them by default.
++return true;
 +
-+config PAX_PT_PAX_FLAGS
-+	bool 'Use ELF program header marking'
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	help
-+	  Enabling this option will allow you to control PaX features on
-+	  a per executable basis via the 'paxctl' utility available at
-+	  http://pax.grsecurity.net/.  The control flags will be read from
-+	  a PaX specific ELF program header (PT_PAX_FLAGS).  This marking
-+	  has the benefits of supporting both soft mode and being fully
-+	  integrated into the toolchain (the binutils patch is available
-+	  from http://pax.grsecurity.net).
-+
-+	  Note that if you enable the legacy EI_PAX marking support as well,
-+	  the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
-+
-+	  If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
-+	  must make sure that the marks are the same if a binary has both marks.
++	context_attr = lookup_attribute("context", DECL_ATTRIBUTES(current_function_decl));
++	return context_attr != NULL_TREE;
++}
 +
-+	  If you enable none of the marking options then all applications
-+	  will run with PaX enabled on them by default.
++static basic_block verify_context_before(gimple_stmt_iterator *gsi, tree context, tree inout, tree error)
++{
++	gimple stmt;
++	basic_block cond_bb, join_bb, true_bb;
++	edge e;
++	location_t loc;
++	const char *file;
++	int line;
++	size_t len;
++	tree filename;
 +
-+config PAX_XATTR_PAX_FLAGS
-+	bool 'Use filesystem extended attributes marking'
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	select CIFS_XATTR if CIFS
-+	select EXT2_FS_XATTR if EXT2_FS
-+	select EXT3_FS_XATTR if EXT3_FS
-+	select F2FS_FS_XATTR if F2FS_FS
-+	select JFFS2_FS_XATTR if JFFS2_FS
-+	select REISERFS_FS_XATTR if REISERFS_FS
-+	select SQUASHFS_XATTR if SQUASHFS
-+	select TMPFS_XATTR if TMPFS
-+	help
-+	  Enabling this option will allow you to control PaX features on
-+	  a per executable basis via the 'setfattr' utility.  The control
-+	  flags will be read from the user.pax.flags extended attribute of
-+	  the file.  This marking has the benefit of supporting binary-only
-+	  applications that self-check themselves (e.g., skype) and would
-+	  not tolerate chpax/paxctl changes.  The main drawback is that
-+	  extended attributes are not supported by some filesystems (e.g.,
-+	  isofs, udf, vfat) so copying files through such filesystems will
-+	  lose the extended attributes and these PaX markings.
++	stmt = gsi_stmt(*gsi);
++	if (gimple_has_location(stmt)) {
++		loc = gimple_location(stmt);
++		file = gimple_filename(stmt);
++		line = gimple_lineno(stmt);
++	} else {
++		loc = DECL_SOURCE_LOCATION(current_function_decl);
++		file = DECL_SOURCE_FILE(current_function_decl);
++		line = DECL_SOURCE_LINE(current_function_decl);
++	}
++	gcc_assert(file);
 +
-+	  Note that if you enable the legacy EI_PAX marking support as well,
-+	  the EI_PAX marks will be overridden by the XATTR_PAX_FLAGS marks.
++	// if (context != count) __context_error__(__FILE__, __LINE__);
++	stmt = gimple_build_cond(NE_EXPR, context, inout, NULL_TREE, NULL_TREE);
++	gimple_set_location(stmt, loc);
++	gsi_insert_before(gsi, stmt, GSI_NEW_STMT);
 +
-+	  If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
-+	  must make sure that the marks are the same if a binary has both marks.
++	cond_bb = gsi_bb(*gsi);
++	gcc_assert(!gsi_end_p(*gsi));
++	gcc_assert(stmt == gsi_stmt(*gsi));
 +
-+	  If you enable none of the marking options then all applications
-+	  will run with PaX enabled on them by default.
++	e = split_block(cond_bb, gsi_stmt(*gsi));
++	cond_bb = e->src;
++	join_bb = e->dest;
++	e->flags = EDGE_FALSE_VALUE;
++	e->probability = REG_BR_PROB_BASE;
 +
-+choice
-+	prompt 'MAC system integration'
-+	default PAX_HAVE_ACL_FLAGS
-+	help
-+	  Mandatory Access Control systems have the option of controlling
-+	  PaX flags on a per executable basis, choose the method supported
-+	  by your particular system.
++	true_bb = create_empty_bb(EXIT_BLOCK_PTR_FOR_FN(cfun)->prev_bb);
++	make_edge(cond_bb, true_bb, EDGE_TRUE_VALUE);
++	make_edge(true_bb, join_bb, EDGE_FALLTHRU);
 +
-+	  - "none": if your MAC system does not interact with PaX,
-+	  - "direct": if your MAC system defines pax_set_initial_flags() itself,
-+	  - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
++	set_immediate_dominator(CDI_DOMINATORS, true_bb, cond_bb);
++	set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
 +
-+	  NOTE: this option is for developers/integrators only.
++	gcc_assert(cond_bb->loop_father == join_bb->loop_father);
++	add_bb_to_loop(true_bb, cond_bb->loop_father);
 +
-+	config PAX_NO_ACL_FLAGS
-+		bool 'none'
++	// insert call to builtin_trap or __context_error__
++	*gsi = gsi_start_bb(true_bb);
 +
-+	config PAX_HAVE_ACL_FLAGS
-+		bool 'direct'
++//	stmt = gimple_build_call(builtin_decl_implicit(BUILT_IN_TRAP), 0);
++	len = strlen(file) + 1;
++	filename = build_string(len, file);
++	TREE_TYPE(filename) = build_array_type(unsigned_char_type_node, build_index_type(size_int(len)));
++	filename = build1(ADDR_EXPR, const_ptr_type_node, filename);
++	stmt = gimple_build_call(error, 2, filename, build_int_cst(NULL_TREE, line));
++	gimple_set_location(stmt, loc);
++	gsi_insert_after(gsi, stmt, GSI_CONTINUE_LINKING);
 +
-+	config PAX_HOOK_ACL_FLAGS
-+		bool 'hook'
-+endchoice
++	*gsi = gsi_start_nondebug_bb(join_bb);
++	return join_bb;
++}
 +
-+endmenu
++static void update_context(gimple_stmt_iterator *gsi, tree context, int diff)
++{
++	gimple assign;
++	tree op;
 +
-+menu "Non-executable pages"
-+	depends on PAX
++	op = fold_build2_loc(UNKNOWN_LOCATION, PLUS_EXPR, integer_type_node, context, build_int_cst(integer_type_node, diff));
++	assign = gimple_build_assign(context, op);
++	gsi_insert_after(gsi, assign, GSI_NEW_STMT);
++	update_stmt(assign);
++}
 +
-+config PAX_NOEXEC
-+	bool "Enforce non-executable pages"
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	depends on ALPHA || (ARM && (CPU_V6 || CPU_V6K || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86
-+	help
-+	  By design some architectures do not allow for protecting memory
-+	  pages against execution or even if they do, Linux does not make
-+	  use of this feature.  In practice this means that if a page is
-+	  readable (such as the stack or heap) it is also executable.
++static basic_block track_context(basic_block bb, tree context)
++{
++	gimple_stmt_iterator gsi;
++	gimple assign;
 +
-+	  There is a well known exploit technique that makes use of this
-+	  fact and a common programming mistake where an attacker can
-+	  introduce code of his choice somewhere in the attacked program's
-+	  memory (typically the stack or the heap) and then execute it.
++	// adjust context according to the context information on any call stmt
++	for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
++		gimple stmt = gsi_stmt(gsi);
++		tree fndecl, context_attr;
++		tree lock, in, out;
++		int incount, outcount;
 +
-+	  If the attacked program was running with different (typically
-+	  higher) privileges than that of the attacker, then he can elevate
-+	  his own privilege level (e.g. get a root shell, write to files for
-+	  which he does not have write access to, etc).
++		if (!is_gimple_call(stmt))
++			continue;
 +
-+	  Enabling this option will let you choose from various features
-+	  that prevent the injection and execution of 'foreign' code in
-+	  a program.
++		fndecl = gimple_call_fndecl(stmt);
++		if (!fndecl)
++			continue;
 +
-+	  This will also break programs that rely on the old behaviour and
-+	  expect that dynamically allocated memory via the malloc() family
-+	  of functions is executable (which it is not).  Notable examples
-+	  are the XFree86 4.x server, the java runtime and wine.
++		if (fndecl == context_function_decl) {
++			unsigned int num_ops = gimple_num_ops(stmt);
++			int diff = tree_to_shwi(gimple_op(stmt, num_ops - 1));
 +
-+config PAX_PAGEEXEC
-+	bool "Paging based non-executable pages"
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
-+	select ARCH_TRACK_EXEC_LIMIT if X86_32
-+	help
-+	  This implementation is based on the paging feature of the CPU.
-+	  On i386 without hardware non-executable bit support there is a
-+	  variable but usually low performance impact, however on Intel's
-+	  P4 core based CPUs it is very high so you should not enable this
-+	  for kernels meant to be used on such CPUs.
++			gcc_assert(diff);
++			update_context(&gsi, context, diff);
++			continue;
++		}
 +
-+	  On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
-+	  with hardware non-executable bit support there is no performance
-+	  impact, on ppc the impact is negligible.
++		context_attr = lookup_attribute("context", DECL_ATTRIBUTES(fndecl));
++		if (!context_attr)
++			continue;
 +
-+	  Note that several architectures require various emulations due to
-+	  badly designed userland ABIs, this will cause a performance impact
-+	  but will disappear as soon as userland is fixed. For example, ppc
-+	  userland MUST have been built with secure-plt by a recent toolchain.
++		gcc_assert(split_context_attribute(TREE_VALUE(context_attr), &lock, &in, &out));
++		incount = tree_to_shwi(in);
++		outcount = tree_to_shwi(out);
++		bb = verify_context_before(&gsi, context, in, context_error_decl);
++		update_context(&gsi, context, outcount - incount);
++	}
 +
-+config PAX_SEGMEXEC
-+	bool "Segmentation based non-executable pages"
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	depends on PAX_NOEXEC && X86_32
-+	help
-+	  This implementation is based on the segmentation feature of the
-+	  CPU and has a very small performance impact, however applications
-+	  will be limited to a 1.5 GB address space instead of the normal
-+	  3 GB.
++	return bb;
++}
 +
-+config PAX_EMUTRAMP
-+	bool "Emulate trampolines"
-+	default y if PARISC || GRKERNSEC_CONFIG_AUTO
-+	depends on (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
-+	help
-+	  There are some programs and libraries that for one reason or
-+	  another attempt to execute special small code snippets from
-+	  non-executable memory pages.  Most notable examples are the
-+	  signal handler return code generated by the kernel itself and
-+	  the GCC trampolines.
++static bool bb_any_loop(basic_block bb)
++{
++	return bb_loop_depth(bb) || (bb->flags & BB_IRREDUCIBLE_LOOP);
++}
 +
-+	  If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
-+	  such programs will no longer work under your kernel.
++static unsigned int context_execute(void)
++{
++	basic_block bb;
++	gimple assign;
++	gimple_stmt_iterator gsi;
++	tree context_attr, context;
++	tree lock, in, out;
 +
-+	  As a remedy you can say Y here and use the 'chpax' or 'paxctl'
-+	  utilities to enable trampoline emulation for the affected programs
-+	  yet still have the protection provided by the non-executable pages.
++	loop_optimizer_init(LOOPS_NORMAL | LOOPS_HAVE_RECORDED_EXITS);
++	gcc_assert(current_loops);
 +
-+	  On parisc you MUST enable this option and EMUSIGRT as well, otherwise
-+	  your system will not even boot.
++	calculate_dominance_info(CDI_DOMINATORS);
++	calculate_dominance_info(CDI_POST_DOMINATORS);
 +
-+	  Alternatively you can say N here and use the 'chpax' or 'paxctl'
-+	  utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
-+	  for the affected files.
++	context_attr = lookup_attribute("context", DECL_ATTRIBUTES(current_function_decl));
++	if (context_attr) {
++		gcc_assert(split_context_attribute(TREE_VALUE(context_attr), &lock, &in, &out));
++	} else {
++		in = out = integer_zero_node;
++	}
 +
-+	  NOTE: enabling this feature *may* open up a loophole in the
-+	  protection provided by non-executable pages that an attacker
-+	  could abuse.  Therefore the best solution is to not have any
-+	  files on your system that would require this option.  This can
-+	  be achieved by not using libc5 (which relies on the kernel
-+	  signal handler return code) and not using or rewriting programs
-+	  that make use of the nested function implementation of GCC.
-+	  Skilled users can just fix GCC itself so that it implements
-+	  nested function calls in a way that does not interfere with PaX.
++	// 1. create local context variable
++	context = create_tmp_var(integer_type_node, "context");
++	add_referenced_var(context);
++	mark_sym_for_renaming(context);
 +
-+config PAX_EMUSIGRT
-+	bool "Automatically emulate sigreturn trampolines"
-+	depends on PAX_EMUTRAMP && PARISC
-+	default y
-+	help
-+	  Enabling this option will have the kernel automatically detect
-+	  and emulate signal return trampolines executing on the stack
-+	  that would otherwise lead to task termination.
++	// 2. initialize local context variable
++	gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
++	bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
++	if (!single_pred_p(bb)) {
++		gcc_assert(bb_any_loop(bb));
++		split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
++		bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
++	}
++	gsi = gsi_start_bb(bb);
++	assign = gimple_build_assign(context, in);
++	gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
++	update_stmt(assign);
 +
-+	  This solution is intended as a temporary one for users with
-+	  legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
-+	  Modula-3 runtime, etc) or executables linked to such, basically
-+	  everything that does not specify its own SA_RESTORER function in
-+	  normal executable memory like glibc 2.1+ does.
++	// 3. instrument each BB to track the local context variable
++	FOR_EACH_BB_FN(bb, cfun) {
++		bb = track_context(bb, context);
++	}
 +
-+	  On parisc you MUST enable this option, otherwise your system will
-+	  not even boot.
++	// 4. verify the local context variable against the expected state
++	if (EDGE_COUNT(EXIT_BLOCK_PTR_FOR_FN(cfun)->preds)) {
++		gcc_assert(single_pred_p(EXIT_BLOCK_PTR_FOR_FN(cfun)));
++		gsi = gsi_last_nondebug_bb(single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun)));
++		verify_context_before(&gsi, context, out, context_error_decl);
++	}
 +
-+	  NOTE: this feature cannot be disabled on a per executable basis
-+	  and since it *does* open up a loophole in the protection provided
-+	  by non-executable pages, the best solution is to not have any
-+	  files on your system that would require this option.
++	free_dominance_info(CDI_DOMINATORS);
++	free_dominance_info(CDI_POST_DOMINATORS);
++	loop_optimizer_finalize();
++	return 0;
++}
 +
-+config PAX_MPROTECT
-+	bool "Restrict mprotect()"
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
-+	help
-+	  Enabling this option will prevent programs from
-+	   - changing the executable status of memory pages that were
-+	     not originally created as executable,
-+	   - making read-only executable pages writable again,
-+	   - creating executable pages from anonymous memory,
-+	   - making read-only-after-relocations (RELRO) data pages writable again.
++#define PASS_NAME context
++#define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
++//#define TODO_FLAGS_START TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts
++#define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_verify_flow | TODO_update_ssa
++#include "gcc-generate-gimple-pass.h"
 +
-+	  You should say Y here to complete the protection provided by
-+	  the enforcement of non-executable pages.
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++	const char * const plugin_name = plugin_info->base_name;
++	const int argc = plugin_info->argc;
++	const struct plugin_argument * const argv = plugin_info->argv;
++	int i;
++	bool enable_user, enable_context;
++	struct register_pass_info context_pass_info;
 +
-+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+	  this feature on a per file basis.
++	static const struct ggc_root_tab gt_ggc_r_gt_checker[] = {
++		{
++			.base = &context_function_decl,
++			.nelt = 1,
++			.stride = sizeof(context_function_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		{
++			.base = &context_error_decl,
++			.nelt = 1,
++			.stride = sizeof(context_error_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		LAST_GGC_ROOT_TAB
++	};
 +
-+config PAX_MPROTECT_COMPAT
-+	bool "Use legacy/compat protection demoting (read help)"
-+	depends on PAX_MPROTECT
-+	default n
-+	help
-+	  The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
-+	  by sending the proper error code to the application.  For some older
-+	  userland, this can cause problems with applications that assume such
-+	  allocations will not be prevented by PaX or SELinux and other access
-+	  control systems and have no fallback mechanisms.  For modern distros,
-+	  this option should generally be set to 'N'.
-+	  
-+config PAX_ELFRELOCS
-+	bool "Allow ELF text relocations (read help)"
-+	depends on PAX_MPROTECT
-+	default n
-+	help
-+	  Non-executable pages and mprotect() restrictions are effective
-+	  in preventing the introduction of new executable code into an
-+	  attacked task's address space.  There remain only two venues
-+	  for this kind of attack: if the attacker can execute already
-+	  existing code in the attacked task then he can either have it
-+	  create and mmap() a file containing his code or have it mmap()
-+	  an already existing ELF library that does not have position
-+	  independent code in it and use mprotect() on it to make it
-+	  writable and copy his code there.  While protecting against
-+	  the former approach is beyond PaX, the latter can be prevented
-+	  by having only PIC ELF libraries on one's system (which do not
-+	  need to relocate their code).  If you are sure this is your case,
-+	  as is the case with all modern Linux distributions, then leave
-+	  this option disabled.  You should say 'n' here.
++	context_pass_info.pass				= make_context_pass();
++//	context_pass_info.reference_pass_name		= "ssa";
++	context_pass_info.reference_pass_name		= "phiprop";
++	context_pass_info.ref_pass_instance_number	= 1;
++	context_pass_info.pos_op 			= PASS_POS_INSERT_AFTER;
 +
-+config PAX_ETEXECRELOCS
-+	bool "Allow ELF ET_EXEC text relocations"
-+	depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
-+	select PAX_ELFRELOCS
-+	default y
-+	help
-+	  On some architectures there are incorrectly created applications
-+	  that require text relocations and would not work without enabling
-+	  this option.  If you are an alpha, ia64 or parisc user, you should
-+	  enable this option and disable it once you have made sure that
-+	  none of your applications need it.
++	if (!plugin_default_version_check(version, &gcc_version)) {
++		error(G_("incompatible gcc/plugin versions"));
++		return 1;
++	}
 +
-+config PAX_EMUPLT
-+	bool "Automatically emulate ELF PLT"
-+	depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
-+	default y
-+	help
-+	  Enabling this option will have the kernel automatically detect
-+	  and emulate the Procedure Linkage Table entries in ELF files.
-+	  On some architectures such entries are in writable memory, and
-+	  become non-executable leading to task termination.  Therefore
-+	  it is mandatory that you enable this option on alpha, parisc,
-+	  sparc and sparc64, otherwise your system would not even boot.
++	register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info);
 +
-+	  NOTE: this feature *does* open up a loophole in the protection
-+	  provided by the non-executable pages, therefore the proper
-+	  solution is to modify the toolchain to produce a PLT that does
-+	  not need to be writable.
++	enable_user = false;
++	enable_context = false;
++	for (i = 0; i < argc; ++i) {
++		if (!strcmp(argv[i].key, "user")) {
++			enable_user = true;
++			continue;
++		}
++		if (!strcmp(argv[i].key, "context")) {
++			enable_context = true;
++			continue;
++		}
++		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++	}
 +
-+config PAX_DLRESOLVE
-+	bool 'Emulate old glibc resolver stub'
-+	depends on PAX_EMUPLT && SPARC
-+	default n
-+	help
-+	  This option is needed if userland has an old glibc (before 2.4)
-+	  that puts a 'save' instruction into the runtime generated resolver
-+	  stub that needs special emulation.
++	if (enable_user)
++		register_callback(plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL);
++	if (enable_context) {
++		register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
++		register_callback(plugin_name, PLUGIN_START_UNIT, context_start_unit, NULL);
++		register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_checker);
++		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &context_pass_info);
++	}
 +
-+config PAX_KERNEXEC
-+	bool "Enforce non-executable kernel pages"
-+	default y if GRKERNSEC_CONFIG_AUTO && (!X86 || GRKERNSEC_CONFIG_VIRT_NONE || (GRKERNSEC_CONFIG_VIRT_EPT && GRKERNSEC_CONFIG_VIRT_GUEST) || (GRKERNSEC_CONFIG_VIRT_EPT && GRKERNSEC_CONFIG_VIRT_KVM))
-+	depends on (X86 || (ARM && (CPU_V6 || CPU_V6K || CPU_V7) && !(ARM_LPAE && MODULES))) && !XEN
-+	select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
-+	select PAX_KERNEXEC_PLUGIN if X86_64
-+	select ARM_KERNMEM_PERMS if ARM
-+	help
-+	  This is the kernel land equivalent of PAGEEXEC and MPROTECT,
-+	  that is, enabling this option will make it harder to inject
-+	  and execute 'foreign' code in kernel memory itself.
++	return 0;
++}
+diff --git a/scripts/gcc-plugins/colorize_plugin.c b/scripts/gcc-plugins/colorize_plugin.c
+new file mode 100644
+index 0000000..ffe60f6
+--- /dev/null
++++ b/scripts/gcc-plugins/colorize_plugin.c
+@@ -0,0 +1,162 @@
++/*
++ * Copyright 2012-2016 by PaX Team <pageexec@××××××××.hu>
++ * Licensed under the GPL v2
++ *
++ * Note: the choice of the license means that the compilation process is
++ *       NOT 'eligible' as defined by gcc's library exception to the GPL v3,
++ *       but for the kernel it doesn't matter since it doesn't link against
++ *       any of the gcc libraries
++ *
++ * gcc plugin to colorize diagnostic output
++ *
++ */
 +
-+	  Note that on amd64, CONFIG_EFI enabled with "efi=old_map" on
-+	  the kernel command-line will result in an RWX physical map.
++#include "gcc-common.h"
 +
-+	  Likewise, the EFI runtime services are necessarily mapped as
-+	  RWX.  If CONFIG_EFI is enabled on an EFI-capable system, it
-+	  is recommended that you boot with "noefi" on the kernel
-+	  command-line if possible to eliminate the mapping.
++int plugin_is_GPL_compatible;
 +
-+choice
-+	prompt "Return Address Instrumentation Method"
-+	default PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+	depends on PAX_KERNEXEC_PLUGIN
-+	help
-+	  Select the method used to instrument function pointer dereferences.
-+	  Note that binary modules cannot be instrumented by this approach.
++static struct plugin_info colorize_plugin_info = {
++	.version	= "201602181345",
++	.help		= "color=[never|always|auto]\tdetermine when to colorize\n",
++};
 +
-+	  Note that the implementation requires a gcc with plugin support,
-+	  i.e., gcc 4.5 or newer.  You may need to install the supporting
-+	  headers explicitly in addition to the normal gcc package.
++#define GREEN		"\033[32m\033[K"
++#define LIGHTGREEN	"\033[1;32m\033[K"
++#define YELLOW		"\033[33m\033[K"
++#define LIGHTYELLOW	"\033[1;33m\033[K"
++#define RED		"\033[31m\033[K"
++#define LIGHTRED	"\033[1;31m\033[K"
++#define BLUE		"\033[34m\033[K"
++#define LIGHTBLUE	"\033[1;34m\033[K"
++#define BRIGHT		"\033[1;m\033[K"
++#define NORMAL		"\033[m\033[K"
 +
-+	config PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+		bool "bts"
-+		help
-+		  This method is compatible with binary only modules but has
-+		  a higher runtime overhead.
++static diagnostic_starter_fn old_starter;
++static diagnostic_finalizer_fn old_finalizer;
 +
-+	config PAX_KERNEXEC_PLUGIN_METHOD_OR
-+		bool "or"
-+		depends on !PARAVIRT
-+		help
-+		  This method is incompatible with binary only modules but has
-+		  a lower runtime overhead.
-+endchoice
++static void start_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
++{
++	const char *color;
++	char *newprefix;
 +
-+config PAX_KERNEXEC_PLUGIN_METHOD
-+	string
-+	default "bts" if PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+	default "or" if PAX_KERNEXEC_PLUGIN_METHOD_OR
-+	default ""
++	switch (diagnostic->kind) {
++	case DK_NOTE:
++		color = LIGHTBLUE;
++		break;
 +
-+config PAX_KERNEXEC_MODULE_TEXT
-+	int "Minimum amount of memory reserved for module code"
-+	default "8" if (!GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_SERVER)
-+	default "12" if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP)
-+	depends on PAX_KERNEXEC && X86_32
-+	help
-+	  Due to implementation details the kernel must reserve a fixed
-+	  amount of memory for runtime allocated code (such as modules)
-+	  at compile time that cannot be changed at runtime.  Here you
-+	  can specify the minimum amount in MB that will be reserved.
-+	  Due to the same implementation details this size will always
-+	  be rounded up to the next 2/4 MB boundary (depends on PAE) so
-+	  the actually available memory for runtime allocated code will
-+	  usually be more than this minimum.
++	case DK_PEDWARN:
++	case DK_WARNING:
++		color = LIGHTYELLOW;
++		break;
 +
-+	  The default 4 MB should be enough for most users but if you have
-+	  an excessive number of modules (e.g., most distribution configs
-+	  compile many drivers as modules) or use huge modules such as
-+	  nvidia's kernel driver, you will need to adjust this amount.
-+	  A good rule of thumb is to look at your currently loaded kernel
-+	  modules and add up their sizes.
++	case DK_ERROR:
++	case DK_FATAL:
++	case DK_ICE:
++	case DK_PERMERROR:
++	case DK_SORRY:
++		color = LIGHTRED;
++		break;
 +
-+endmenu
++	default:
++		color = NORMAL;
++	}
 +
-+menu "Address Space Layout Randomization"
-+	depends on PAX
++	old_starter(context, diagnostic);
++	if (-1 == asprintf(&newprefix, "%s%s" NORMAL, color, context->printer->prefix))
++		return;
++	pp_destroy_prefix(context->printer);
++	pp_set_prefix(context->printer, newprefix);
++}
 +
-+config PAX_ASLR
-+	bool "Address Space Layout Randomization"
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	help
-+	  Many if not most exploit techniques rely on the knowledge of
-+	  certain addresses in the attacked program.  The following options
-+	  will allow the kernel to apply a certain amount of randomization
-+	  to specific parts of the program thereby forcing an attacker to
-+	  guess them in most cases.  Any failed guess will most likely crash
-+	  the attacked program which allows the kernel to detect such attempts
-+	  and react on them.  PaX itself provides no reaction mechanisms,
-+	  instead it is strongly encouraged that you make use of grsecurity's
-+	  (http://www.grsecurity.net/) built-in crash detection features or
-+	  develop one yourself.
++static void finalize_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
++{
++	old_finalizer(context, diagnostic);
++}
 +
-+	  By saying Y here you can choose to randomize the following areas:
-+	   - top of the task's kernel stack
-+	   - top of the task's userland stack
-+	   - base address for mmap() requests that do not specify one
-+	     (this includes all libraries)
-+	   - base address of the main executable
++static void colorize_arm(void)
++{
++	old_starter = diagnostic_starter(global_dc);
++	old_finalizer = diagnostic_finalizer(global_dc);
 +
-+	  It is strongly recommended to say Y here as address space layout
-+	  randomization has negligible impact on performance yet it provides
-+	  a very effective protection.
++	diagnostic_starter(global_dc) = start_colorize;
++	diagnostic_finalizer(global_dc) = finalize_colorize;
++}
 +
-+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+	  this feature on a per file basis.
++static unsigned int colorize_rearm_execute(void)
++{
++	if (diagnostic_starter(global_dc) == start_colorize)
++		return 0;
 +
-+config PAX_RANDKSTACK
-+	bool "Randomize kernel stack base"
-+	default y if GRKERNSEC_CONFIG_AUTO && !(GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_VIRTUALBOX)
-+	depends on X86_TSC && X86
-+	help
-+	  By saying Y here the kernel will randomize every task's kernel
-+	  stack on every system call.  This will not only force an attacker
-+	  to guess it but also prevent him from making use of possible
-+	  leaked information about it.
++	colorize_arm();
++	return 0;
++}
 +
-+	  Since the kernel stack is a rather scarce resource, randomization
-+	  may cause unexpected stack overflows, therefore you should very
-+	  carefully test your system.  Note that once enabled in the kernel
-+	  configuration, this feature cannot be disabled on a per file basis.
++#define PASS_NAME colorize_rearm
++#define NO_GATE
++#include "gcc-generate-simple_ipa-pass.h"
 +
-+config PAX_RANDUSTACK
-+	bool
++static void colorize_start_unit(void *gcc_data, void *user_data)
++{
++	colorize_arm();
++}
 +
-+config PAX_RANDMMAP
-+	bool "Randomize user stack and mmap() bases"
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	depends on PAX_ASLR
-+	select PAX_RANDUSTACK
-+	help
-+	  By saying Y here the kernel will randomize every task's userland
-+	  stack and use a randomized base address for mmap() requests that
-+	  do not specify one themselves.
++static bool should_colorize(void)
++{
++#if BUILDING_GCC_VERSION >= 4009
++	return false;
++#else
++	char const *t = getenv("TERM");
 +
-+	  The stack randomization is done in two steps where the second
-+	  one may apply a big amount of shift to the top of the stack and
-+	  cause problems for programs that want to use lots of memory (more
-+	  than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
++	return t && strcmp(t, "dumb") && isatty(STDERR_FILENO);
++#endif
++}
 +
-+	  As a result of mmap randomization all dynamically loaded libraries
-+	  will appear at random addresses and therefore be harder to exploit
-+	  by a technique where an attacker attempts to execute library code
-+	  for his purposes (e.g. spawn a shell from an exploited program that
-+	  is running at an elevated privilege level).
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++	const char * const plugin_name = plugin_info->base_name;
++	const int argc = plugin_info->argc;
++	const struct plugin_argument * const argv = plugin_info->argv;
++	int i;
++	struct register_pass_info colorize_rearm_pass_info;
++	bool colorize;
 +
-+	  Furthermore, if a program is relinked as a dynamic ELF file, its
-+	  base address will be randomized as well, completing the full
-+	  randomization of the address space layout.  Attacking such programs
-+	  becomes a guess game.  You can find an example of doing this at
-+	  http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
-+	  http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
++	colorize_rearm_pass_info.pass				= make_colorize_rearm_pass();
++	colorize_rearm_pass_info.reference_pass_name		= "*free_lang_data";
++	colorize_rearm_pass_info.ref_pass_instance_number	= 1;
++	colorize_rearm_pass_info.pos_op 			= PASS_POS_INSERT_AFTER;
 +
-+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
-+	  feature on a per file basis.
++	if (!plugin_default_version_check(version, &gcc_version)) {
++		error(G_("incompatible gcc/plugin versions"));
++		return 1;
++	}
 +
-+endmenu
++	register_callback(plugin_name, PLUGIN_INFO, NULL, &colorize_plugin_info);
 +
-+menu "Miscellaneous hardening features"
++	colorize = getenv("GCC_COLORS") ? should_colorize() : false;
 +
-+config PAX_MEMORY_SANITIZE
-+	bool "Sanitize all freed memory"
-+	default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
-+	help
-+	  By saying Y here the kernel will erase memory pages and slab objects
-+	  as soon as they are freed.  This in turn reduces the lifetime of data
-+	  stored in them, making it less likely that sensitive information such
-+	  as passwords, cryptographic secrets, etc stay in memory for too long.
++	for (i = 0; i < argc; ++i) {
++		if (!strcmp(argv[i].key, "color")) {
++			if (!argv[i].value) {
++				error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++				continue;
++			}
++			if (!strcmp(argv[i].value, "always"))
++				colorize = true;
++			else if (!strcmp(argv[i].value, "never"))
++				colorize = false;
++			else if (!strcmp(argv[i].value, "auto"))
++				colorize = should_colorize();
++			else
++				error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
++			continue;
++		}
++		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++	}
 +
-+	  This is especially useful for programs whose runtime is short, long
-+	  lived processes and the kernel itself benefit from this as long as
-+	  they ensure timely freeing of memory that may hold sensitive
-+	  information.
++	if (colorize) {
++		// TODO: parse GCC_COLORS as used by gcc 4.9+
++		register_callback(plugin_name, PLUGIN_START_UNIT, &colorize_start_unit, NULL);
++		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &colorize_rearm_pass_info);
++	}
++	return 0;
++}
+diff --git a/scripts/gcc-plugins/constify_plugin.c b/scripts/gcc-plugins/constify_plugin.c
+new file mode 100644
+index 0000000..7142f36
+--- /dev/null
++++ b/scripts/gcc-plugins/constify_plugin.c
+@@ -0,0 +1,521 @@
++/*
++ * Copyright 2011 by Emese Revfy <re.emese@×××××.com>
++ * Copyright 2011-2016 by PaX Team <pageexec@××××××××.hu>
++ * Licensed under the GPL v2, or (at your option) v3
++ *
++ * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
++ *
++ * Homepage:
++ * http://www.grsecurity.net/~ephox/const_plugin/
++ *
++ * Usage:
++ * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
++ * $ gcc -fplugin=constify_plugin.so test.c -O2
++ */
 +
-+	  A nice side effect of the sanitization of slab objects is the
-+	  reduction of possible info leaks caused by padding bytes within the
-+	  leaky structures.  Use-after-free bugs for structures containing
-+	  pointers can also be detected as dereferencing the sanitized pointer
-+	  will generate an access violation.
++#include "gcc-common.h"
 +
-+	  The tradeoff is performance impact, on a single CPU system kernel
-+	  compilation sees a 3% slowdown, other systems and workloads may vary
-+	  and you are advised to test this feature on your expected workload
-+	  before deploying it.
++// unused C type flag in all versions 4.5-6
++#define TYPE_CONSTIFY_VISITED(TYPE) TYPE_LANG_FLAG_4(TYPE)
 +
-+	  The slab sanitization feature excludes a few slab caches per default
-+	  for performance reasons.  To extend the feature to cover those as
-+	  well, pass "pax_sanitize_slab=full" as kernel command line parameter.
++int plugin_is_GPL_compatible;
 +
-+	  To reduce the performance penalty by sanitizing pages only, albeit
-+	  limiting the effectiveness of this feature at the same time, slab
-+	  sanitization can be disabled with the kernel command line parameter
-+	  "pax_sanitize_slab=off".
++static bool enabled = true;
 +
-+	  Note that this feature does not protect data stored in live pages,
-+	  e.g., process memory swapped to disk may stay there for a long time.
++static struct plugin_info const_plugin_info = {
++	.version	= "201605212045",
++	.help		= "disable\tturn off constification\n",
++};
 +
-+config PAX_MEMORY_STACKLEAK
-+	bool "Sanitize kernel stack"
-+	default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
-+	depends on X86
-+	help
-+	  By saying Y here the kernel will erase the kernel stack before it
-+	  returns from a system call.  This in turn reduces the information
-+	  that a kernel stack leak bug can reveal.
++typedef struct {
++	bool has_fptr_field;
++	bool has_writable_field;
++	bool has_do_const_field;
++	bool has_no_const_field;
++} constify_info;
 +
-+	  Note that such a bug can still leak information that was put on
-+	  the stack by the current system call (the one eventually triggering
-+	  the bug) but traces of earlier system calls on the kernel stack
-+	  cannot leak anymore.
++static const_tree get_field_type(const_tree field)
++{
++	return strip_array_types(TREE_TYPE(field));
++}
 +
-+	  The tradeoff is performance impact: on a single CPU system kernel
-+	  compilation sees a 1% slowdown, other systems and workloads may vary
-+	  and you are advised to test this feature on your expected workload
-+	  before deploying it.
++static bool is_fptr(const_tree field)
++{
++	const_tree ptr = get_field_type(field);
 +
-+	  Note that the full feature requires a gcc with plugin support,
-+	  i.e., gcc 4.5 or newer.  You may need to install the supporting
-+	  headers explicitly in addition to the normal gcc package.  Using
-+	  older gcc versions means that functions with large enough stack
-+	  frames may leave uninitialized memory behind that may be exposed
-+	  to a later syscall leaking the stack.
++	if (TREE_CODE(ptr) != POINTER_TYPE)
++		return false;
 +
-+config PAX_MEMORY_STRUCTLEAK
-+	bool "Forcibly initialize local variables copied to userland"
-+	default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
-+	help
-+	  By saying Y here the kernel will zero initialize some local
-+	  variables that are going to be copied to userland.  This in
-+	  turn prevents unintended information leakage from the kernel
-+	  stack should later code forget to explicitly set all parts of
-+	  the copied variable.
++	return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
++}
 +
-+	  The tradeoff is less performance impact than PAX_MEMORY_STACKLEAK
-+	  at a much smaller coverage.
++/*
++ * determine whether the given structure type meets the requirements for automatic constification,
++ * including the constification attributes on nested structure types
++ */
++static void constifiable(const_tree node, constify_info *cinfo)
++{
++	const_tree field;
 +
-+	  Note that the implementation requires a gcc with plugin support,
-+	  i.e., gcc 4.5 or newer.  You may need to install the supporting
-+	  headers explicitly in addition to the normal gcc package.
++	gcc_assert(TREE_CODE(node) == RECORD_TYPE || TREE_CODE(node) == UNION_TYPE);
 +
-+config PAX_MEMORY_UDEREF
-+	bool "Prevent invalid userland pointer dereference"
-+	default y if GRKERNSEC_CONFIG_AUTO && !(X86_64 && GRKERNSEC_CONFIG_PRIORITY_PERF) && !(X86_64 && GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_VIRTUALBOX) && (!X86 || GRKERNSEC_CONFIG_VIRT_NONE || GRKERNSEC_CONFIG_VIRT_EPT)
-+	depends on (X86 || (ARM && (CPU_V6 || CPU_V6K || CPU_V7) && !ARM_LPAE)) && !UML_X86 && !XEN
-+	select PAX_PER_CPU_PGD if X86_64
-+	help
-+	  By saying Y here the kernel will be prevented from dereferencing
-+	  userland pointers in contexts where the kernel expects only kernel
-+	  pointers.  This is both a useful runtime debugging feature and a
-+	  security measure that prevents exploiting a class of kernel bugs.
++	// e.g., pointer to structure fields while still constructing the structure type
++	if (TYPE_FIELDS(node) == NULL_TREE)
++		return;
 +
-+	  The tradeoff is that some virtualization solutions may experience
-+	  a huge slowdown and therefore you should not enable this feature
-+	  for kernels meant to run in such environments.  Whether a given VM
-+	  solution is affected or not is best determined by simply trying it
-+	  out, the performance impact will be obvious right on boot as this
-+	  mechanism engages from very early on.  A good rule of thumb is that
-+	  VMs running on CPUs without hardware virtualization support (i.e.,
-+	  the majority of IA-32 CPUs) will likely experience the slowdown.
++	for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
++		const_tree type = get_field_type(field);
++		enum tree_code code = TREE_CODE(type);
 +
-+	  On X86_64 the kernel will make use of PCID support when available
-+	  (Intel's Westmere, Sandy Bridge, etc) for better security (default)
-+	  or performance impact.  Pass pax_weakuderef on the kernel command
-+	  line to choose the latter.
++		if (node == type)
++			continue;
 +
-+config PAX_REFCOUNT
-+	bool "Prevent various kernel object reference counter overflows"
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	depends on GRKERNSEC && ((ARM && (CPU_V6 || CPU_V6K || CPU_V7)) || MIPS || PPC || SPARC64 || X86)
-+	help
-+	  By saying Y here the kernel will detect and prevent overflowing
-+	  various (but not all) kinds of object reference counters.  Such
-+	  overflows can normally occur due to bugs only and are often, if
-+	  not always, exploitable.
++		if (is_fptr(field))
++			cinfo->has_fptr_field = true;
++		else if (code == RECORD_TYPE || code == UNION_TYPE) {
++			if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type)))
++				cinfo->has_do_const_field = true;
++			else if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type)))
++				cinfo->has_no_const_field = true;
++			else
++				constifiable(type, cinfo);
++		} else if (!TREE_READONLY(field))
++			cinfo->has_writable_field = true;
++	}
++}
 +
-+	  The tradeoff is that data structures protected by an overflowed
-+	  refcount will never be freed and therefore will leak memory.  Note
-+	  that this leak also happens even without this protection but in
-+	  that case the overflow can eventually trigger the freeing of the
-+	  data structure while it is still being used elsewhere, resulting
-+	  in the exploitable situation that this feature prevents.
++static bool constified(const_tree node)
++{
++	constify_info cinfo = {
++		.has_fptr_field = false,
++		.has_writable_field = false,
++		.has_do_const_field = false,
++		.has_no_const_field = false
++	};
 +
-+	  Since this has a negligible performance impact, you should enable
-+	  this feature.
++	gcc_assert(TREE_CODE(node) == RECORD_TYPE || TREE_CODE(node) == UNION_TYPE);
 +
-+config PAX_CONSTIFY_PLUGIN
-+	bool "Automatically constify eligible structures"
-+	default y
-+	depends on !UML && PAX_KERNEXEC
-+	help
-+	  By saying Y here the compiler will automatically constify a class
-+	  of types that contain only function pointers.  This reduces the
-+	  kernel's attack surface and also produces a better memory layout.
++	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node))) {
++//		gcc_assert(!TYPE_READONLY(node));
++		return false;
++	}
 +
-+	  Note that the implementation requires a gcc with plugin support,
-+	  i.e., gcc 4.5 or newer.  You may need to install the supporting
-+	  headers explicitly in addition to the normal gcc package.
-+ 
-+	  Note that if some code really has to modify constified variables
-+	  then the source code will have to be patched to allow it.  Examples
-+	  can be found in PaX itself (the no_const attribute) and for some
-+	  out-of-tree modules at http://www.grsecurity.net/~paxguy1/ .
++	if (lookup_attribute("do_const", TYPE_ATTRIBUTES(node))) {
++		gcc_assert(TYPE_READONLY(node));
++		return true;
++	}
 +
-+config PAX_USERCOPY
-+	bool "Harden heap object copies between kernel and userland"
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	depends on ARM || IA64 || PPC || SPARC || X86
-+	depends on GRKERNSEC && (SLAB || SLUB || SLOB)
-+	select PAX_USERCOPY_SLABS
-+	help
-+	  By saying Y here the kernel will enforce the size of heap objects
-+	  when they are copied in either direction between the kernel and
-+	  userland, even if only a part of the heap object is copied.
++	constifiable(node, &cinfo);
++	if ((!cinfo.has_fptr_field || cinfo.has_writable_field || cinfo.has_no_const_field) && !cinfo.has_do_const_field)
++		return false;
 +
-+	  Specifically, this checking prevents information leaking from the
-+	  kernel heap during kernel to userland copies (if the kernel heap
-+	  object is otherwise fully initialized) and prevents kernel heap
-+	  overflows during userland to kernel copies.
++	return TYPE_READONLY(node);
++}
 +
-+	  Note that the current implementation provides the strictest bounds
-+	  checks for the SLUB allocator.
++static void deconstify_tree(tree node);
 +
-+	  Enabling this option also enables per-slab cache protection against
-+	  data in a given cache being copied into/out of via userland
-+	  accessors.  Though the whitelist of regions will be reduced over
-+	  time, it notably protects important data structures like task structs.
++static void deconstify_type(tree type)
++{
++	tree field;
 +
-+	  If frame pointers are enabled on x86, this option will also restrict
-+	  copies into and out of the kernel stack to local variables within a
-+	  single frame.
++	gcc_assert(TREE_CODE(type) == RECORD_TYPE || TREE_CODE(type) == UNION_TYPE);
 +
-+	  Since this has a negligible performance impact, you should enable
-+	  this feature.
++	for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
++		const_tree fieldtype = get_field_type(field);
 +
-+config PAX_USERCOPY_DEBUG
-+	bool
-+	depends on X86 && PAX_USERCOPY
-+	default n
++		// special case handling of simple ptr-to-same-array-type members
++		if (TREE_CODE(TREE_TYPE(field)) == POINTER_TYPE) {
++			tree ptrtype = TREE_TYPE(TREE_TYPE(field));
 +
-+config PAX_SIZE_OVERFLOW
-+	bool "Prevent various integer overflows in function size parameters"
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	help
-+	  By saying Y here the kernel recomputes expressions of function
-+	  arguments marked by a size_overflow attribute with double integer
-+	  precision (DImode/TImode for 32/64 bit integer types).
++			if (TREE_TYPE(TREE_TYPE(field)) == type)
++				continue;
++			if (TREE_CODE(ptrtype) != RECORD_TYPE && TREE_CODE(ptrtype) != UNION_TYPE)
++				continue;
++			if (!constified(ptrtype))
++				continue;
++			if (TYPE_MAIN_VARIANT(ptrtype) == TYPE_MAIN_VARIANT(type)) {
++				TREE_TYPE(field) = copy_node(TREE_TYPE(field));
++				TREE_TYPE(TREE_TYPE(field)) = build_qualified_type(type, TYPE_QUALS(ptrtype) & ~TYPE_QUAL_CONST);
++			}
++			continue;
++		}
++		if (TREE_CODE(fieldtype) != RECORD_TYPE && TREE_CODE(fieldtype) != UNION_TYPE)
++			continue;
++		if (!constified(fieldtype))
++			continue;
 +
-+	  The recomputed argument is checked against TYPE_MAX and an event
-+	  is logged on overflow and the triggering process is killed.
++		deconstify_tree(field);
++		TREE_READONLY(field) = 0;
++	}
++	TYPE_READONLY(type) = 0;
++	C_TYPE_FIELDS_READONLY(type) = 0;
++	if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type))) {
++		TYPE_ATTRIBUTES(type) = copy_list(TYPE_ATTRIBUTES(type));
++		TYPE_ATTRIBUTES(type) = remove_attribute("do_const", TYPE_ATTRIBUTES(type));
++	}
++}
 +
-+	  Homepage: https://github.com/ephox-gcc-plugins
++static void deconstify_tree(tree node)
++{
++	tree old_type, new_type, field;
 +
-+	  Note that the implementation requires a gcc with plugin support,
-+	  i.e., gcc 4.5 or newer.  You may need to install the supporting
-+	  headers explicitly in addition to the normal gcc package.
++	old_type = TREE_TYPE(node);
++	while (TREE_CODE(old_type) == ARRAY_TYPE && TREE_CODE(TREE_TYPE(old_type)) != ARRAY_TYPE) {
++		node = TREE_TYPE(node) = copy_node(old_type);
++		old_type = TREE_TYPE(old_type);
++	}
 +
-+config PAX_LATENT_ENTROPY
-+	bool "Generate some entropy during boot and runtime"
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	help
-+	  By saying Y here the kernel will instrument some kernel code to
-+	  extract some entropy from both original and artificially created
-+	  program state.  This will help especially embedded systems where
-+	  there is little 'natural' source of entropy normally.  The cost
-+	  is some slowdown of the boot process and fork and irq processing.
++	gcc_assert(TREE_CODE(old_type) == RECORD_TYPE || TREE_CODE(old_type) == UNION_TYPE);
++	gcc_assert(TYPE_READONLY(old_type) && (TYPE_QUALS(old_type) & TYPE_QUAL_CONST));
 +
-+	  When pax_extra_latent_entropy is passed on the kernel command line,
-+	  entropy will be extracted from up to the first 4GB of RAM while the
-+	  runtime memory allocator is being initialized.  This costs even more
-+	  slowdown of the boot process.
++	new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
++	TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
++	for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
++		DECL_FIELD_CONTEXT(field) = new_type;
 +
-+	  Note that the implementation requires a gcc with plugin support,
-+	  i.e., gcc 4.5 or newer.  You may need to install the supporting
-+	  headers explicitly in addition to the normal gcc package.
++	deconstify_type(new_type);
 +
-+	  Note that entropy extracted this way is not cryptographically
-+	  secure!
++	TREE_TYPE(node) = new_type;
++}
 +
-+config PAX_RAP
-+	bool "Prevent code reuse attacks"
-+	depends on X86_64
-+	default y if GRKERNSEC_CONFIG_AUTO
-+	help
-+	  By saying Y here the kernel will check indirect control transfers
-+	  in order to detect and prevent attacks that try to hijack control
-+	  flow by overwriting code pointers.
++static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
++{
++	tree type;
++	constify_info cinfo = {
++		.has_fptr_field = false,
++		.has_writable_field = false,
++		.has_do_const_field = false,
++		.has_no_const_field = false
++	};
 +
-+	  Note that binary modules cannot be instrumented by this approach.
++	*no_add_attrs = true;
++	if (TREE_CODE(*node) == FUNCTION_DECL) {
++		error("%qE attribute does not apply to functions (%qF)", name, *node);
++		return NULL_TREE;
++	}
 +
-+	  Note that the implementation requires a gcc with plugin support,
-+	  i.e., gcc 4.5 or newer.  You may need to install the supporting
-+	  headers explicitly in addition to the normal gcc package.
++	if (TREE_CODE(*node) == PARM_DECL) {
++		error("%qE attribute does not apply to function parameters (%qD)", name, *node);
++		return NULL_TREE;
++	}
 +
-+endmenu
++	if (TREE_CODE(*node) == VAR_DECL) {
++		error("%qE attribute does not apply to variables (%qD)", name, *node);
++		return NULL_TREE;
++	}
 +
-+endmenu
++	if (TYPE_P(*node)) {
++		type = *node;
++	} else {
++		if (TREE_CODE(*node) != TYPE_DECL) {
++			error("%qE attribute does not apply to %qD (%qT)", name, *node, TREE_TYPE(*node));
++			return NULL_TREE;
++		}
++		type = TREE_TYPE(*node);
++	}
 +
-+source grsecurity/Kconfig
++	if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE) {
++		error("%qE attribute used on %qT applies to struct and union types only", name, type);
++		return NULL_TREE;
++	}
 +
-+endmenu
++	if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
++		error("%qE attribute is already applied to the type %qT", name, type);
++		return NULL_TREE;
++	}
 +
-+endmenu
++	if (TYPE_P(*node)) {
++		if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type)))
++			error("%qE attribute used on type %qT is incompatible with 'do_const'", name, type);
++		else
++			*no_add_attrs = false;
++		return NULL_TREE;
++	}
 +
- source security/keys/Kconfig
- 
- config SECURITY_DMESG_RESTRICT
-@@ -104,7 +1087,7 @@ config INTEL_TXT
- config LSM_MMAP_MIN_ADDR
- 	int "Low address space for LSM to protect from user allocation"
- 	depends on SECURITY && SECURITY_SELINUX
--	default 32768 if ARM || (ARM64 && COMPAT)
-+	default 32768 if ALPHA || ARM || (ARM64 && COMPAT) || PARISC || SPARC32
- 	default 65536
- 	help
- 	  This is the portion of low virtual memory which should be protected
-diff --git a/security/apparmor/file.c b/security/apparmor/file.c
-index 913f377..6e392d5 100644
---- a/security/apparmor/file.c
-+++ b/security/apparmor/file.c
-@@ -348,8 +348,8 @@ static inline bool xindex_is_subset(u32 link, u32 target)
- int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
- 		 struct path *new_dir, struct dentry *new_dentry)
- {
--	struct path link = { new_dir->mnt, new_dentry };
--	struct path target = { new_dir->mnt, old_dentry };
-+	struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry };
-+	struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry };
- 	struct path_cond cond = {
- 		d_backing_inode(old_dentry)->i_uid,
- 		d_backing_inode(old_dentry)->i_mode
-diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
-index c28b0f2..3b9fee0 100644
---- a/security/apparmor/include/policy.h
-+++ b/security/apparmor/include/policy.h
-@@ -134,7 +134,7 @@ struct aa_namespace {
- 	struct aa_ns_acct acct;
- 	struct aa_profile *unconfined;
- 	struct list_head sub_ns;
--	atomic_t uniq_null;
-+	atomic_unchecked_t uniq_null;
- 	long uniq_id;
- 
- 	struct dentry *dents[AAFS_NS_SIZEOF];
-diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
-index dec607c..37fe357 100644
---- a/security/apparmor/lsm.c
-+++ b/security/apparmor/lsm.c
-@@ -176,7 +176,7 @@ static int common_perm_dir_dentry(int op, struct path *dir,
- 				  struct dentry *dentry, u32 mask,
- 				  struct path_cond *cond)
- {
--	struct path path = { dir->mnt, dentry };
-+	struct path path = { .mnt = dir->mnt, .dentry = dentry };
- 
- 	return common_perm(op, &path, mask, cond);
- }
-@@ -193,7 +193,7 @@ static int common_perm_dir_dentry(int op, struct path *dir,
- static int common_perm_mnt_dentry(int op, struct vfsmount *mnt,
- 				  struct dentry *dentry, u32 mask)
- {
--	struct path path = { mnt, dentry };
-+	struct path path = { .mnt = mnt, .dentry = dentry };
- 	struct path_cond cond = { d_backing_inode(dentry)->i_uid,
- 				  d_backing_inode(dentry)->i_mode
- 	};
-@@ -315,8 +315,8 @@ static int apparmor_path_rename(struct path *old_dir, struct dentry *old_dentry,
- 
- 	profile = aa_current_profile();
- 	if (!unconfined(profile)) {
--		struct path old_path = { old_dir->mnt, old_dentry };
--		struct path new_path = { new_dir->mnt, new_dentry };
-+		struct path old_path = { .mnt = old_dir->mnt, .dentry = old_dentry };
-+		struct path new_path = { .mnt = new_dir->mnt, .dentry = new_dentry };
- 		struct path_cond cond = { d_backing_inode(old_dentry)->i_uid,
- 					  d_backing_inode(old_dentry)->i_mode
- 		};
-@@ -677,11 +677,11 @@ static const struct kernel_param_ops param_ops_aalockpolicy = {
- 	.get = param_get_aalockpolicy
- };
- 
--static int param_set_audit(const char *val, struct kernel_param *kp);
--static int param_get_audit(char *buffer, struct kernel_param *kp);
-+static int param_set_audit(const char *val, const struct kernel_param *kp);
-+static int param_get_audit(char *buffer, const struct kernel_param *kp);
- 
--static int param_set_mode(const char *val, struct kernel_param *kp);
--static int param_get_mode(char *buffer, struct kernel_param *kp);
-+static int param_set_mode(const char *val, const struct kernel_param *kp);
-+static int param_get_mode(char *buffer, const struct kernel_param *kp);
- 
- /* Flag values, also controllable via /sys/module/apparmor/parameters
-  * We define special types as we want to do additional mediation.
-@@ -791,7 +791,7 @@ static int param_get_aauint(char *buffer, const struct kernel_param *kp)
- 	return param_get_uint(buffer, kp);
- }
- 
--static int param_get_audit(char *buffer, struct kernel_param *kp)
-+static int param_get_audit(char *buffer, const struct kernel_param *kp)
- {
- 	if (!capable(CAP_MAC_ADMIN))
- 		return -EPERM;
-@@ -802,7 +802,7 @@ static int param_get_audit(char *buffer, struct kernel_param *kp)
- 	return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]);
- }
- 
--static int param_set_audit(const char *val, struct kernel_param *kp)
-+static int param_set_audit(const char *val, const struct kernel_param *kp)
- {
- 	int i;
- 	if (!capable(CAP_MAC_ADMIN))
-@@ -824,7 +824,7 @@ static int param_set_audit(const char *val, struct kernel_param *kp)
- 	return -EINVAL;
- }
- 
--static int param_get_mode(char *buffer, struct kernel_param *kp)
-+static int param_get_mode(char *buffer, const struct kernel_param *kp)
- {
- 	if (!capable(CAP_MAC_ADMIN))
- 		return -EPERM;
-@@ -835,7 +835,7 @@ static int param_get_mode(char *buffer, struct kernel_param *kp)
- 	return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]);
- }
- 
--static int param_set_mode(const char *val, struct kernel_param *kp)
-+static int param_set_mode(const char *val, const struct kernel_param *kp)
- {
- 	int i;
- 	if (!capable(CAP_MAC_ADMIN))
-diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
-index 705c287..81257f1 100644
---- a/security/apparmor/policy.c
-+++ b/security/apparmor/policy.c
-@@ -298,7 +298,7 @@ static struct aa_namespace *alloc_namespace(const char *prefix,
- 	/* ns and ns->unconfined share ns->unconfined refcount */
- 	ns->unconfined->ns = ns;
- 
--	atomic_set(&ns->uniq_null, 0);
-+	atomic_set_unchecked(&ns->uniq_null, 0);
- 
- 	return ns;
- 
-@@ -689,7 +689,7 @@ struct aa_profile *aa_new_null_profile(struct aa_profile *parent, int hat)
- {
- 	struct aa_profile *profile = NULL;
- 	char *name;
--	int uniq = atomic_inc_return(&parent->ns->uniq_null);
-+	int uniq = atomic_inc_return_unchecked(&parent->ns->uniq_null);
- 
- 	/* freed below */
- 	name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, GFP_KERNEL);
-diff --git a/security/commoncap.c b/security/commoncap.c
-index 48071ed..b805e0f 100644
---- a/security/commoncap.c
-+++ b/security/commoncap.c
-@@ -438,6 +438,32 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
- 	return 0;
- }
- 
-+/* returns:
-+	1 for suid privilege
-+	2 for sgid privilege
-+	3 for fscap privilege
-+*/
-+int is_privileged_binary(const struct dentry *dentry)
++	constifiable(type, &cinfo);
++	if ((cinfo.has_fptr_field && !cinfo.has_writable_field && !cinfo.has_no_const_field) || lookup_attribute("do_const", TYPE_ATTRIBUTES(type))) {
++		if (enabled) {
++			if TYPE_P(*node)
++				deconstify_type(*node);
++			else
++				deconstify_tree(*node);
++		}
++		if (TYPE_P(*node))
++			TYPE_CONSTIFY_VISITED(*node) = 1;
++		else
++			TYPE_CONSTIFY_VISITED(TREE_TYPE(*node)) = 1;
++		return NULL_TREE;
++	}
++
++	if (enabled && TYPE_FIELDS(type))
++		error("%qE attribute used on type %qT that is not constified", name, type);
++	return NULL_TREE;
++}
++
++static void constify_type(tree type)
 +{
-+	struct cpu_vfs_cap_data capdata;
-+	struct inode *inode = dentry->d_inode;
++	TYPE_READONLY(type) = 1;
++	C_TYPE_FIELDS_READONLY(type) = 1;
++	TYPE_CONSTIFY_VISITED(type) = 1;
++//	TYPE_ATTRIBUTES(type) = copy_list(TYPE_ATTRIBUTES(type));
++//	TYPE_ATTRIBUTES(type) = tree_cons(get_identifier("do_const"), NULL_TREE, TYPE_ATTRIBUTES(type));
++}
 +
-+	if (!inode || S_ISDIR(inode->i_mode))
-+		return 0;
++static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
++{
++	*no_add_attrs = true;
++	if (!TYPE_P(*node)) {
++		error("%qE attribute applies to types only (%qD)", name, *node);
++		return NULL_TREE;
++	}
 +
-+	if (inode->i_mode & S_ISUID)
++	if (TREE_CODE(*node) != RECORD_TYPE && TREE_CODE(*node) != UNION_TYPE) {
++		error("%qE attribute used on %qT applies to struct and union types only", name, *node);
++		return NULL_TREE;
++	}
++
++	if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(*node))) {
++		error("%qE attribute used on %qT is already applied to the type", name, *node);
++		return NULL_TREE;
++	}
++
++	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(*node))) {
++		error("%qE attribute used on %qT is incompatible with 'no_const'", name, *node);
++		return NULL_TREE;
++	}
++
++	*no_add_attrs = false;
++	return NULL_TREE;
++}
++
++static struct attribute_spec no_const_attr = {
++	.name			= "no_const",
++	.min_length		= 0,
++	.max_length		= 0,
++	.decl_required		= false,
++	.type_required		= false,
++	.function_type_required	= false,
++	.handler		= handle_no_const_attribute,
++#if BUILDING_GCC_VERSION >= 4007
++	.affects_type_identity	= true
++#endif
++};
++
++static struct attribute_spec do_const_attr = {
++	.name			= "do_const",
++	.min_length		= 0,
++	.max_length		= 0,
++	.decl_required		= false,
++	.type_required		= false,
++	.function_type_required	= false,
++	.handler		= handle_do_const_attribute,
++#if BUILDING_GCC_VERSION >= 4007
++	.affects_type_identity	= true
++#endif
++};
++
++static void register_attributes(void *event_data, void *data)
++{
++	register_attribute(&no_const_attr);
++	register_attribute(&do_const_attr);
++}
++
++static void finish_type(void *event_data, void *data)
++{
++	tree type = (tree)event_data;
++	constify_info cinfo = {
++		.has_fptr_field = false,
++		.has_writable_field = false,
++		.has_do_const_field = false,
++		.has_no_const_field = false
++	};
++
++	if (type == NULL_TREE || type == error_mark_node)
++		return;
++
++#if BUILDING_GCC_VERSION >= 5000
++	if (TREE_CODE(type) == ENUMERAL_TYPE)
++		return;
++#endif
++
++	if (TYPE_FIELDS(type) == NULL_TREE || TYPE_CONSTIFY_VISITED(type))
++		return;
++
++	constifiable(type, &cinfo);
++
++	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type))) {
++		if ((cinfo.has_fptr_field && !cinfo.has_writable_field && !cinfo.has_no_const_field) || cinfo.has_do_const_field) {
++			deconstify_type(type);
++			TYPE_CONSTIFY_VISITED(type) = 1;
++		} else
++			error("'no_const' attribute used on type %qT that is not constified", type);
++		return;
++	}
++
++	if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type))) {
++		if (!cinfo.has_writable_field && !cinfo.has_no_const_field) {
++			error("'do_const' attribute used on type %qT that is%sconstified", type, cinfo.has_fptr_field ? " " : " not ");
++			return;
++		}
++		constify_type(type);
++		return;
++	}
++
++	if (cinfo.has_fptr_field && !cinfo.has_writable_field && !cinfo.has_no_const_field) {
++		if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type))) {
++			error("'do_const' attribute used on type %qT that is constified", type);
++			return;
++		}
++		constify_type(type);
++		return;
++	}
++
++	deconstify_type(type);
++	TYPE_CONSTIFY_VISITED(type) = 1;
++}
++
++static void check_global_variables(void *event_data, void *data)
++{
++	varpool_node_ptr node;
++
++	FOR_EACH_VARIABLE(node) {
++		tree var = NODE_DECL(node);
++		tree type = TREE_TYPE(var);
++
++		if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
++			continue;
++
++		if (!TYPE_READONLY(type) || !C_TYPE_FIELDS_READONLY(type))
++			continue;
++
++		if (!TYPE_CONSTIFY_VISITED(type))
++			continue;
++
++		if (DECL_EXTERNAL(var))
++			continue;
++
++		if (DECL_INITIAL(var))
++			continue;
++
++		// this works around a gcc bug/feature where uninitialized globals
++		// are moved into the .bss section regardless of any constification
++		DECL_INITIAL(var) = build_constructor(type, NULL);
++//		inform(DECL_SOURCE_LOCATION(var), "constified variable %qE moved into .rodata", var);
++	}
++}
++
++static unsigned int check_local_variables_execute(void)
++{
++	unsigned int ret = 0;
++	tree var;
++
++	unsigned int i;
++
++	FOR_EACH_LOCAL_DECL(cfun, i, var) {
++		tree type = TREE_TYPE(var);
++
++		gcc_assert(DECL_P(var));
++		if (is_global_var(var))
++			continue;
++
++		if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
++			continue;
++
++		if (!TYPE_READONLY(type) || !C_TYPE_FIELDS_READONLY(type))
++			continue;
++
++		if (!TYPE_CONSTIFY_VISITED(type))
++			continue;
++
++		error_at(DECL_SOURCE_LOCATION(var), "constified variable %qE cannot be local", var);
++		ret = 1;
++	}
++	return ret;
++}
++
++#define PASS_NAME check_local_variables
++#define NO_GATE
++#include "gcc-generate-gimple-pass.h"
++
++static struct {
++	const char *name;
++	const char *asm_op;
++} sections[] = {
++	{".init.rodata",     "\t.section\t.init.rodata,\"a\""},
++	{".ref.rodata",      "\t.section\t.ref.rodata,\"a\""},
++	{".devinit.rodata",  "\t.section\t.devinit.rodata,\"a\""},
++	{".devexit.rodata",  "\t.section\t.devexit.rodata,\"a\""},
++	{".cpuinit.rodata",  "\t.section\t.cpuinit.rodata,\"a\""},
++	{".cpuexit.rodata",  "\t.section\t.cpuexit.rodata,\"a\""},
++	{".meminit.rodata",  "\t.section\t.meminit.rodata,\"a\""},
++	{".memexit.rodata",  "\t.section\t.memexit.rodata,\"a\""},
++	{".data..read_only", "\t.section\t.data..read_only,\"a\""},
++};
++
++static unsigned int (*old_section_type_flags)(tree decl, const char *name, int reloc);
++
++static unsigned int constify_section_type_flags(tree decl, const char *name, int reloc)
++{
++	size_t i;
++
++	for (i = 0; i < ARRAY_SIZE(sections); i++)
++		if (!strcmp(sections[i].name, name))
++			return 0;
++	return old_section_type_flags(decl, name, reloc);
++}
++
++static void constify_start_unit(void *gcc_data, void *user_data)
++{
++//	size_t i;
++
++//	for (i = 0; i < ARRAY_SIZE(sections); i++)
++//		sections[i].section = get_unnamed_section(0, output_section_asm_op, sections[i].asm_op);
++//		sections[i].section = get_section(sections[i].name, 0, NULL);
++
++	old_section_type_flags = targetm.section_type_flags;
++	targetm.section_type_flags = constify_section_type_flags;
++}
++
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++	const char * const plugin_name = plugin_info->base_name;
++	const int argc = plugin_info->argc;
++	const struct plugin_argument * const argv = plugin_info->argv;
++	int i;
++
++	struct register_pass_info check_local_variables_pass_info;
++
++	check_local_variables_pass_info.pass				= make_check_local_variables_pass();
++	check_local_variables_pass_info.reference_pass_name		= "ssa";
++	check_local_variables_pass_info.ref_pass_instance_number	= 1;
++	check_local_variables_pass_info.pos_op				= PASS_POS_INSERT_BEFORE;
++
++	if (!plugin_default_version_check(version, &gcc_version)) {
++		error(G_("incompatible gcc/plugin versions"));
 +		return 1;
-+	if ((inode->i_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
-+		return 2;
++	}
 +
-+	if (!get_vfs_caps_from_disk(dentry, &capdata)) {
-+		if (!cap_isclear(capdata.inheritable) || !cap_isclear(capdata.permitted))
-+			return 3;
++	for (i = 0; i < argc; ++i) {
++		if (!(strcmp(argv[i].key, "disable"))) {
++			enabled = false;
++			continue;
++		}
++		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++	}
++
++	if (strncmp(lang_hooks.name, "GNU C", 5) && !strncmp(lang_hooks.name, "GNU C+", 6)) {
++		inform(UNKNOWN_LOCATION, G_("%s supports C only, not %s"), plugin_name, lang_hooks.name);
++		enabled = false;
++	}
++
++	register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
++	if (enabled) {
++		register_callback(plugin_name, PLUGIN_ALL_IPA_PASSES_START, check_global_variables, NULL);
++		register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
++		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &check_local_variables_pass_info);
++		register_callback(plugin_name, PLUGIN_START_UNIT, constify_start_unit, NULL);
 +	}
++	register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
 +
 +	return 0;
 +}
+diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h
+new file mode 100644
+index 0000000..0c0b842
+--- /dev/null
++++ b/scripts/gcc-plugins/gcc-common.h
+@@ -0,0 +1,879 @@
++#ifndef GCC_COMMON_H_INCLUDED
++#define GCC_COMMON_H_INCLUDED
 +
- /*
-  * Attempt to get the on-exec apply capability sets for an executable file from
-  * its xattrs and, if present, apply them to the proposed credentials being
-@@ -628,6 +654,9 @@ int cap_bprm_secureexec(struct linux_binprm *bprm)
- 	const struct cred *cred = current_cred();
- 	kuid_t root_uid = make_kuid(cred->user_ns, 0);
- 
-+	if (gr_acl_enable_at_secure())
-+		return 1;
++#include "bversion.h"
++#if BUILDING_GCC_VERSION >= 6000
++#include "gcc-plugin.h"
++#else
++#include "plugin.h"
++#endif
++#include "plugin-version.h"
++#include "config.h"
++#include "system.h"
++#include "coretypes.h"
++#include "tm.h"
++#include "line-map.h"
++#include "input.h"
++#include "tree.h"
 +
- 	if (!uid_eq(cred->uid, root_uid)) {
- 		if (bprm->cap_effective)
- 			return 1;
-diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
-index 585af61..b7d35ff 100644
---- a/security/integrity/ima/ima.h
-+++ b/security/integrity/ima/ima.h
-@@ -125,8 +125,8 @@ int ima_init_template(void);
- extern spinlock_t ima_queue_lock;
- 
- struct ima_h_table {
--	atomic_long_t len;	/* number of stored measurements in the list */
--	atomic_long_t violations;
-+	atomic_long_unchecked_t len;	/* number of stored measurements in the list */
-+	atomic_long_unchecked_t violations;
- 	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
- };
- extern struct ima_h_table ima_htable;
-diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
-index 1d950fb..a8f4eab 100644
---- a/security/integrity/ima/ima_api.c
-+++ b/security/integrity/ima/ima_api.c
-@@ -137,7 +137,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
- 	int result;
- 
- 	/* can overflow, only indicator */
--	atomic_long_inc(&ima_htable.violations);
-+	atomic_long_inc_unchecked(&ima_htable.violations);
- 
- 	result = ima_alloc_init_template(&event_data, &entry);
- 	if (result < 0) {
-diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
-index f355231..c71f640 100644
---- a/security/integrity/ima/ima_fs.c
-+++ b/security/integrity/ima/ima_fs.c
-@@ -30,12 +30,12 @@ static DEFINE_MUTEX(ima_write_mutex);
- static int valid_policy = 1;
- #define TMPBUFLEN 12
- static ssize_t ima_show_htable_value(char __user *buf, size_t count,
--				     loff_t *ppos, atomic_long_t *val)
-+				     loff_t *ppos, atomic_long_unchecked_t *val)
- {
- 	char tmpbuf[TMPBUFLEN];
- 	ssize_t len;
- 
--	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
-+	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
- 	return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
- }
- 
-diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
-index 552705d..9920f4fb 100644
---- a/security/integrity/ima/ima_queue.c
-+++ b/security/integrity/ima/ima_queue.c
-@@ -83,7 +83,7 @@ static int ima_add_digest_entry(struct ima_template_entry *entry)
- 	INIT_LIST_HEAD(&qe->later);
- 	list_add_tail_rcu(&qe->later, &ima_measurements);
- 
--	atomic_long_inc(&ima_htable.len);
-+	atomic_long_inc_unchecked(&ima_htable.len);
- 	key = ima_hash_key(entry->digest);
- 	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
- 	return 0;
-diff --git a/security/keys/internal.h b/security/keys/internal.h
-index 5105c2c..a5010e6 100644
---- a/security/keys/internal.h
-+++ b/security/keys/internal.h
-@@ -90,12 +90,16 @@ extern void key_type_put(struct key_type *ktype);
- 
- extern int __key_link_begin(struct key *keyring,
- 			    const struct keyring_index_key *index_key,
--			    struct assoc_array_edit **_edit);
-+			    struct assoc_array_edit **_edit)
-+			    __acquires(&keyring->sem)
-+			    __acquires(&keyring_serialise_link_sem);
- extern int __key_link_check_live_key(struct key *keyring, struct key *key);
- extern void __key_link(struct key *key, struct assoc_array_edit **_edit);
- extern void __key_link_end(struct key *keyring,
- 			   const struct keyring_index_key *index_key,
--			   struct assoc_array_edit *edit);
-+			   struct assoc_array_edit *edit)
-+			   __releases(&keyring->sem)
-+			   __releases(&keyring_serialise_link_sem);
- 
- extern key_ref_t find_key_to_update(key_ref_t keyring_ref,
- 				    const struct keyring_index_key *index_key);
-@@ -191,7 +195,7 @@ struct request_key_auth {
- 	void			*callout_info;
- 	size_t			callout_len;
- 	pid_t			pid;
--};
-+} __randomize_layout;
- 
- extern struct key_type key_type_request_key_auth;
- extern struct key *request_key_auth_new(struct key *target,
-diff --git a/security/keys/key.c b/security/keys/key.c
-index 09ef276..ab2894f 100644
---- a/security/keys/key.c
-+++ b/security/keys/key.c
-@@ -283,7 +283,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
- 
- 	atomic_set(&key->usage, 1);
- 	init_rwsem(&key->sem);
--	lockdep_set_class(&key->sem, &type->lock_class);
-+	lockdep_set_class(&key->sem, (struct lock_class_key *)&type->lock_class);
- 	key->index_key.type = type;
- 	key->user = user;
- 	key->quotalen = quotalen;
-@@ -1077,7 +1077,9 @@ int register_key_type(struct key_type *ktype)
- 	struct key_type *p;
- 	int ret;
- 
--	memset(&ktype->lock_class, 0, sizeof(ktype->lock_class));
-+	pax_open_kernel();
-+	memset((void *)&ktype->lock_class, 0, sizeof(ktype->lock_class));
-+	pax_close_kernel();
- 
- 	ret = -EEXIST;
- 	down_write(&key_types_sem);
-@@ -1089,7 +1091,7 @@ int register_key_type(struct key_type *ktype)
- 	}
- 
- 	/* store the type */
--	list_add(&ktype->link, &key_types_list);
-+	pax_list_add((struct list_head *)&ktype->link, &key_types_list);
- 
- 	pr_notice("Key type %s registered\n", ktype->name);
- 	ret = 0;
-@@ -1111,7 +1113,7 @@ EXPORT_SYMBOL(register_key_type);
- void unregister_key_type(struct key_type *ktype)
- {
- 	down_write(&key_types_sem);
--	list_del_init(&ktype->link);
-+	pax_list_del_init((struct list_head *)&ktype->link);
- 	downgrade_write(&key_types_sem);
- 	key_gc_keytype(ktype);
- 	pr_notice("Key type %s unregistered\n", ktype->name);
-@@ -1129,10 +1131,10 @@ void __init key_init(void)
- 			0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
- 
- 	/* add the special key types */
--	list_add_tail(&key_type_keyring.link, &key_types_list);
--	list_add_tail(&key_type_dead.link, &key_types_list);
--	list_add_tail(&key_type_user.link, &key_types_list);
--	list_add_tail(&key_type_logon.link, &key_types_list);
-+	pax_list_add_tail((struct list_head *)&key_type_keyring.link, &key_types_list);
-+	pax_list_add_tail((struct list_head *)&key_type_dead.link, &key_types_list);
-+	pax_list_add_tail((struct list_head *)&key_type_user.link, &key_types_list);
-+	pax_list_add_tail((struct list_head *)&key_type_logon.link, &key_types_list);
- 
- 	/* record the root user tracking */
- 	rb_link_node(&root_key_user.node,
-diff --git a/security/keys/keyring.c b/security/keys/keyring.c
-index f931ccf..ed9cd36 100644
---- a/security/keys/keyring.c
-+++ b/security/keys/keyring.c
-@@ -1071,8 +1071,6 @@ static int keyring_detect_cycle(struct key *A, struct key *B)
- int __key_link_begin(struct key *keyring,
- 		     const struct keyring_index_key *index_key,
- 		     struct assoc_array_edit **_edit)
--	__acquires(&keyring->sem)
--	__acquires(&keyring_serialise_link_sem)
- {
- 	struct assoc_array_edit *edit;
- 	int ret;
-@@ -1172,8 +1170,6 @@ void __key_link(struct key *key, struct assoc_array_edit **_edit)
- void __key_link_end(struct key *keyring,
- 		    const struct keyring_index_key *index_key,
- 		    struct assoc_array_edit *edit)
--	__releases(&keyring->sem)
--	__releases(&keyring_serialise_link_sem)
- {
- 	BUG_ON(index_key->type == NULL);
- 	kenter("%d,%s,", keyring->serial, index_key->type->name);
-diff --git a/security/min_addr.c b/security/min_addr.c
-index f728728..6457a0c 100644
---- a/security/min_addr.c
-+++ b/security/min_addr.c
-@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
-  */
- static void update_mmap_min_addr(void)
- {
-+#ifndef SPARC
- #ifdef CONFIG_LSM_MMAP_MIN_ADDR
- 	if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
- 		mmap_min_addr = dac_mmap_min_addr;
-@@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
- #else
- 	mmap_min_addr = dac_mmap_min_addr;
- #endif
-+#endif
- }
- 
- /*
-diff --git a/security/selinux/avc.c b/security/selinux/avc.c
-index e60c79d..41fb721 100644
---- a/security/selinux/avc.c
-+++ b/security/selinux/avc.c
-@@ -71,7 +71,7 @@ struct avc_xperms_node {
- struct avc_cache {
- 	struct hlist_head	slots[AVC_CACHE_SLOTS]; /* head for avc_node->list */
- 	spinlock_t		slots_lock[AVC_CACHE_SLOTS]; /* lock for writes */
--	atomic_t		lru_hint;	/* LRU hint for reclaim scan */
-+	atomic_unchecked_t	lru_hint;	/* LRU hint for reclaim scan */
- 	atomic_t		active_nodes;
- 	u32			latest_notif;	/* latest revocation notification */
- };
-@@ -183,7 +183,7 @@ void __init avc_init(void)
- 		spin_lock_init(&avc_cache.slots_lock[i]);
- 	}
- 	atomic_set(&avc_cache.active_nodes, 0);
--	atomic_set(&avc_cache.lru_hint, 0);
-+	atomic_set_unchecked(&avc_cache.lru_hint, 0);
- 
- 	avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node),
- 					0, SLAB_PANIC, NULL);
-@@ -521,7 +521,7 @@ static inline int avc_reclaim_node(void)
- 	spinlock_t *lock;
- 
- 	for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) {
--		hvalue = atomic_inc_return(&avc_cache.lru_hint) & (AVC_CACHE_SLOTS - 1);
-+		hvalue = atomic_inc_return_unchecked(&avc_cache.lru_hint) & (AVC_CACHE_SLOTS - 1);
- 		head = &avc_cache.slots[hvalue];
- 		lock = &avc_cache.slots_lock[hvalue];
- 
-diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
-index 1450f85..a91e0bc 100644
---- a/security/selinux/include/xfrm.h
-+++ b/security/selinux/include/xfrm.h
-@@ -48,7 +48,7 @@ static inline void selinux_xfrm_notify_policyload(void)
- 
- 	rtnl_lock();
- 	for_each_net(net) {
--		atomic_inc(&net->xfrm.flow_cache_genid);
-+		atomic_inc_unchecked(&net->xfrm.flow_cache_genid);
- 		rt_genid_bump_all(net);
- 	}
- 	rtnl_unlock();
-diff --git a/security/tomoyo/file.c b/security/tomoyo/file.c
-index 2367b10..a0c3c51 100644
---- a/security/tomoyo/file.c
-+++ b/security/tomoyo/file.c
-@@ -692,7 +692,7 @@ int tomoyo_path_number_perm(const u8 type, struct path *path,
- {
- 	struct tomoyo_request_info r;
- 	struct tomoyo_obj_info obj = {
--		.path1 = *path,
-+		.path1 = { .mnt = path->mnt, .dentry = path->dentry },
- 	};
- 	int error = -ENOMEM;
- 	struct tomoyo_path_info buf;
-@@ -740,7 +740,7 @@ int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
- 	struct tomoyo_path_info buf;
- 	struct tomoyo_request_info r;
- 	struct tomoyo_obj_info obj = {
--		.path1 = *path,
-+		.path1 = { .mnt = path->mnt, .dentry = path->dentry },
- 	};
- 	int idx;
- 
-@@ -786,7 +786,7 @@ int tomoyo_path_perm(const u8 operation, const struct path *path, const char *ta
- {
- 	struct tomoyo_request_info r;
- 	struct tomoyo_obj_info obj = {
--		.path1 = *path,
-+		.path1 = { .mnt = path->mnt, .dentry = path->dentry },
- 	};
- 	int error;
- 	struct tomoyo_path_info buf;
-@@ -843,7 +843,7 @@ int tomoyo_mkdev_perm(const u8 operation, struct path *path,
- {
- 	struct tomoyo_request_info r;
- 	struct tomoyo_obj_info obj = {
--		.path1 = *path,
-+		.path1 = { .mnt = path->mnt, .dentry = path->dentry },
- 	};
- 	int error = -ENOMEM;
- 	struct tomoyo_path_info buf;
-@@ -890,8 +890,8 @@ int tomoyo_path2_perm(const u8 operation, struct path *path1,
- 	struct tomoyo_path_info buf2;
- 	struct tomoyo_request_info r;
- 	struct tomoyo_obj_info obj = {
--		.path1 = *path1,
--		.path2 = *path2,
-+		.path1 = { .mnt = path1->mnt, .dentry = path1->dentry },
-+		.path2 = { .mnt = path2->mnt, .dentry = path2->dentry }
- 	};
- 	int idx;
- 
-diff --git a/security/tomoyo/mount.c b/security/tomoyo/mount.c
-index 390c646..f2f8db3 100644
---- a/security/tomoyo/mount.c
-+++ b/security/tomoyo/mount.c
-@@ -118,6 +118,10 @@ static int tomoyo_mount_acl(struct tomoyo_request_info *r,
- 		   type == tomoyo_mounts[TOMOYO_MOUNT_MOVE]) {
- 		need_dev = -1; /* dev_name is a directory */
- 	} else {
-+		if (!capable(CAP_SYS_ADMIN)) {
-+			error = -EPERM;
-+			goto out;
-+		}
- 		fstype = get_fs_type(type);
- 		if (!fstype) {
- 			error = -ENODEV;
-diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
-index cbf3df4..22b11df 100644
---- a/security/tomoyo/tomoyo.c
-+++ b/security/tomoyo/tomoyo.c
-@@ -165,7 +165,7 @@ static int tomoyo_path_truncate(struct path *path)
-  */
- static int tomoyo_path_unlink(struct path *parent, struct dentry *dentry)
- {
--	struct path path = { parent->mnt, dentry };
-+	struct path path = { .mnt = parent->mnt, .dentry = dentry };
- 	return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL);
- }
- 
-@@ -181,7 +181,7 @@ static int tomoyo_path_unlink(struct path *parent, struct dentry *dentry)
- static int tomoyo_path_mkdir(struct path *parent, struct dentry *dentry,
- 			     umode_t mode)
- {
--	struct path path = { parent->mnt, dentry };
-+	struct path path = { .mnt = parent->mnt, .dentry = dentry };
- 	return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path,
- 				       mode & S_IALLUGO);
- }
-@@ -196,7 +196,7 @@ static int tomoyo_path_mkdir(struct path *parent, struct dentry *dentry,
-  */
- static int tomoyo_path_rmdir(struct path *parent, struct dentry *dentry)
- {
--	struct path path = { parent->mnt, dentry };
-+	struct path path = { .mnt = parent->mnt, .dentry = dentry };
- 	return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL);
- }
- 
-@@ -212,7 +212,7 @@ static int tomoyo_path_rmdir(struct path *parent, struct dentry *dentry)
- static int tomoyo_path_symlink(struct path *parent, struct dentry *dentry,
- 			       const char *old_name)
- {
--	struct path path = { parent->mnt, dentry };
-+	struct path path = { .mnt = parent->mnt, .dentry = dentry };
- 	return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name);
- }
- 
-@@ -229,7 +229,7 @@ static int tomoyo_path_symlink(struct path *parent, struct dentry *dentry,
- static int tomoyo_path_mknod(struct path *parent, struct dentry *dentry,
- 			     umode_t mode, unsigned int dev)
- {
--	struct path path = { parent->mnt, dentry };
-+	struct path path = { .mnt = parent->mnt, .dentry = dentry };
- 	int type = TOMOYO_TYPE_CREATE;
- 	const unsigned int perm = mode & S_IALLUGO;
- 
-@@ -268,8 +268,8 @@ static int tomoyo_path_mknod(struct path *parent, struct dentry *dentry,
- static int tomoyo_path_link(struct dentry *old_dentry, struct path *new_dir,
- 			    struct dentry *new_dentry)
- {
--	struct path path1 = { new_dir->mnt, old_dentry };
--	struct path path2 = { new_dir->mnt, new_dentry };
-+	struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry };
-+	struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry };
- 	return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2);
- }
- 
-@@ -288,8 +288,8 @@ static int tomoyo_path_rename(struct path *old_parent,
- 			      struct path *new_parent,
- 			      struct dentry *new_dentry)
- {
--	struct path path1 = { old_parent->mnt, old_dentry };
--	struct path path2 = { new_parent->mnt, new_dentry };
-+	struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry };
-+	struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry };
- 	return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2);
- }
- 
-@@ -417,7 +417,7 @@ static int tomoyo_sb_mount(const char *dev_name, struct path *path,
-  */
- static int tomoyo_sb_umount(struct vfsmount *mnt, int flags)
- {
--	struct path path = { mnt, mnt->mnt_root };
-+	struct path path = { .mnt = mnt, .dentry = mnt->mnt_root };
- 	return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL);
- }
- 
-diff --git a/security/yama/Kconfig b/security/yama/Kconfig
-index 90c605e..bf3a29a 100644
---- a/security/yama/Kconfig
-+++ b/security/yama/Kconfig
-@@ -1,6 +1,6 @@
- config SECURITY_YAMA
- 	bool "Yama support"
--	depends on SECURITY
-+	depends on SECURITY && !GRKERNSEC
- 	default n
- 	help
- 	  This selects Yama, which extends DAC support with additional
-diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
-index cb6ed10..fb00554 100644
---- a/security/yama/yama_lsm.c
-+++ b/security/yama/yama_lsm.c
-@@ -357,7 +357,7 @@ static struct security_hook_list yama_hooks[] = {
- static int yama_dointvec_minmax(struct ctl_table *table, int write,
- 				void __user *buffer, size_t *lenp, loff_t *ppos)
- {
--	struct ctl_table table_copy;
-+	ctl_table_no_const table_copy;
- 
- 	if (write && !capable(CAP_SYS_PTRACE))
- 		return -EPERM;
-diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
-index a04edff..6811b91 100644
---- a/sound/aoa/codecs/onyx.c
-+++ b/sound/aoa/codecs/onyx.c
-@@ -54,7 +54,7 @@ struct onyx {
- 				spdif_locked:1,
- 				analog_locked:1,
- 				original_mute:2;
--	int			open_count;
-+	local_t			open_count;
- 	struct codec_info	*codec_info;
- 
- 	/* mutex serializes concurrent access to the device
-@@ -747,7 +747,7 @@ static int onyx_open(struct codec_info_item *cii,
- 	struct onyx *onyx = cii->codec_data;
- 
- 	mutex_lock(&onyx->mutex);
--	onyx->open_count++;
-+	local_inc(&onyx->open_count);
- 	mutex_unlock(&onyx->mutex);
- 
- 	return 0;
-@@ -759,8 +759,7 @@ static int onyx_close(struct codec_info_item *cii,
- 	struct onyx *onyx = cii->codec_data;
- 
- 	mutex_lock(&onyx->mutex);
--	onyx->open_count--;
--	if (!onyx->open_count)
-+	if (local_dec_and_test(&onyx->open_count))
- 		onyx->spdif_locked = onyx->analog_locked = 0;
- 	mutex_unlock(&onyx->mutex);
- 
-diff --git a/sound/aoa/codecs/onyx.h b/sound/aoa/codecs/onyx.h
-index ffd2025..df062c9 100644
---- a/sound/aoa/codecs/onyx.h
-+++ b/sound/aoa/codecs/onyx.h
-@@ -11,6 +11,7 @@
- #include <linux/i2c.h>
- #include <asm/pmac_low_i2c.h>
- #include <asm/prom.h>
-+#include <asm/local.h>
- 
- /* PCM3052 register definitions */
- 
-diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
-index ebc9fdf..61f491e 100644
---- a/sound/core/oss/pcm_oss.c
-+++ b/sound/core/oss/pcm_oss.c
-@@ -1193,10 +1193,10 @@ snd_pcm_sframes_t snd_pcm_oss_write3(struct snd_pcm_substream *substream, const
- 		if (in_kernel) {
- 			mm_segment_t fs;
- 			fs = snd_enter_user();
--			ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
-+			ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
- 			snd_leave_user(fs);
- 		} else {
--			ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
-+			ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
- 		}
- 		if (ret != -EPIPE && ret != -ESTRPIPE)
- 			break;
-@@ -1236,10 +1236,10 @@ snd_pcm_sframes_t snd_pcm_oss_read3(struct snd_pcm_substream *substream, char *p
- 		if (in_kernel) {
- 			mm_segment_t fs;
- 			fs = snd_enter_user();
--			ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
-+			ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
- 			snd_leave_user(fs);
- 		} else {
--			ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
-+			ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
- 		}
- 		if (ret == -EPIPE) {
- 			if (runtime->status->state == SNDRV_PCM_STATE_DRAINING) {
-@@ -1335,7 +1335,7 @@ static ssize_t snd_pcm_oss_write2(struct snd_pcm_substream *substream, const cha
- 		struct snd_pcm_plugin_channel *channels;
- 		size_t oss_frame_bytes = (runtime->oss.plugin_first->src_width * runtime->oss.plugin_first->src_format.channels) / 8;
- 		if (!in_kernel) {
--			if (copy_from_user(runtime->oss.buffer, (const char __force __user *)buf, bytes))
-+			if (copy_from_user(runtime->oss.buffer, (const char __force_user *)buf, bytes))
- 				return -EFAULT;
- 			buf = runtime->oss.buffer;
- 		}
-@@ -1405,7 +1405,7 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
- 			}
- 		} else {
- 			tmp = snd_pcm_oss_write2(substream,
--						 (const char __force *)buf,
-+						 (const char __force_kernel *)buf,
- 						 runtime->oss.period_bytes, 0);
- 			if (tmp <= 0)
- 				goto err;
-@@ -1431,7 +1431,7 @@ static ssize_t snd_pcm_oss_read2(struct snd_pcm_substream *substream, char *buf,
- 	struct snd_pcm_runtime *runtime = substream->runtime;
- 	snd_pcm_sframes_t frames, frames1;
- #ifdef CONFIG_SND_PCM_OSS_PLUGINS
--	char __user *final_dst = (char __force __user *)buf;
-+	char __user *final_dst = (char __force_user *)buf;
- 	if (runtime->oss.plugin_first) {
- 		struct snd_pcm_plugin_channel *channels;
- 		size_t oss_frame_bytes = (runtime->oss.plugin_last->dst_width * runtime->oss.plugin_last->dst_format.channels) / 8;
-@@ -1493,7 +1493,7 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
- 			xfer += tmp;
- 			runtime->oss.buffer_used -= tmp;
- 		} else {
--			tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
-+			tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf,
- 						runtime->oss.period_bytes, 0);
- 			if (tmp <= 0)
- 				goto err;
-@@ -1662,7 +1662,7 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
- 								   size1);
- 					size1 /= runtime->channels; /* frames */
- 					fs = snd_enter_user();
--					snd_pcm_lib_write(substream, (void __force __user *)runtime->oss.buffer, size1);
-+					snd_pcm_lib_write(substream, (void __force_user *)runtime->oss.buffer, size1);
- 					snd_leave_user(fs);
- 				}
- 			} else if (runtime->access == SNDRV_PCM_ACCESS_RW_NONINTERLEAVED) {
-diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
-index 1f64ab0..26a7233 100644
---- a/sound/core/pcm_compat.c
-+++ b/sound/core/pcm_compat.c
-@@ -31,7 +31,7 @@ static int snd_pcm_ioctl_delay_compat(struct snd_pcm_substream *substream,
- 	int err;
- 
- 	fs = snd_enter_user();
--	err = snd_pcm_delay(substream, &delay);
-+	err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay);
- 	snd_leave_user(fs);
- 	if (err < 0)
- 		return err;
-diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
-index 3a9b66c..2b38b21 100644
---- a/sound/core/pcm_lib.c
-+++ b/sound/core/pcm_lib.c
-@@ -1867,8 +1867,9 @@ EXPORT_SYMBOL(snd_pcm_lib_ioctl);
-  * Even if more than one periods have elapsed since the last call, you
-  * have to call this only once.
-  */
--void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
-+void snd_pcm_period_elapsed(void *_substream)
- {
-+	struct snd_pcm_substream *substream = _substream;
- 	struct snd_pcm_runtime *runtime;
- 	unsigned long flags;
- 
-diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
-index 9106d8e..e7e2e3c 100644
---- a/sound/core/pcm_native.c
-+++ b/sound/core/pcm_native.c
-@@ -3014,11 +3014,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
- 	switch (substream->stream) {
- 	case SNDRV_PCM_STREAM_PLAYBACK:
- 		result = snd_pcm_playback_ioctl1(NULL, substream, cmd,
--						 (void __user *)arg);
-+						 (void __force_user *)arg);
- 		break;
- 	case SNDRV_PCM_STREAM_CAPTURE:
- 		result = snd_pcm_capture_ioctl1(NULL, substream, cmd,
--						(void __user *)arg);
-+						(void __force_user *)arg);
- 		break;
- 	default:
- 		result = -EINVAL;
-diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
-index 795437b..3650746 100644
---- a/sound/core/rawmidi.c
-+++ b/sound/core/rawmidi.c
-@@ -871,9 +871,10 @@ static int snd_rawmidi_control_ioctl(struct snd_card *card,
-  *
-  * Return: The size of read data, or a negative error code on failure.
-  */
--int snd_rawmidi_receive(struct snd_rawmidi_substream *substream,
--			const unsigned char *buffer, int count)
-+int snd_rawmidi_receive(void *_substream, const void *_buffer, int count)
- {
-+	struct snd_rawmidi_substream *substream = _substream;
-+	const unsigned char *buffer = _buffer;
- 	unsigned long flags;
- 	int result = 0, count1;
- 	struct snd_rawmidi_runtime *runtime = substream->runtime;
-diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
-index b16dbef04..8eb05a4 100644
---- a/sound/core/seq/oss/seq_oss_synth.c
-+++ b/sound/core/seq/oss/seq_oss_synth.c
-@@ -653,8 +653,8 @@ snd_seq_oss_synth_info_read(struct snd_info_buffer *buf)
- 			    rec->synth_type, rec->synth_subtype,
- 			    rec->nr_voices);
- 		snd_iprintf(buf, "  capabilities : ioctl %s / load_patch %s\n",
--			    enabled_str((long)rec->oper.ioctl),
--			    enabled_str((long)rec->oper.load_patch));
-+			    enabled_str(!!rec->oper.ioctl),
-+			    enabled_str(!!rec->oper.load_patch));
- 		snd_use_lock_free(&rec->use_lock);
- 	}
- }
-diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
-index 58e79e0..19751d1 100644
---- a/sound/core/seq/seq_clientmgr.c
-+++ b/sound/core/seq/seq_clientmgr.c
-@@ -416,7 +416,7 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count,
- 	if (!client->accept_input || (fifo = client->data.user.fifo) == NULL)
- 		return -ENXIO;
- 
--	if (atomic_read(&fifo->overflow) > 0) {
-+	if (atomic_read_unchecked(&fifo->overflow) > 0) {
- 		/* buffer overflow is detected */
- 		snd_seq_fifo_clear(fifo);
- 		/* return error code */
-@@ -446,7 +446,7 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count,
- 			count -= sizeof(struct snd_seq_event);
- 			buf += sizeof(struct snd_seq_event);
- 			err = snd_seq_expand_var_event(&cell->event, count,
--						       (char __force *)buf, 0,
-+						       (char __force_kernel *)buf, 0,
- 						       sizeof(struct snd_seq_event));
- 			if (err < 0)
- 				break;
-@@ -1062,13 +1062,13 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
- 			}
- 			/* set user space pointer */
- 			event.data.ext.len = extlen | SNDRV_SEQ_EXT_USRPTR;
--			event.data.ext.ptr = (char __force *)buf
-+			event.data.ext.ptr = (char __force_kernel *)buf
- 						+ sizeof(struct snd_seq_event);
- 			len += extlen; /* increment data length */
- 		} else {
- #ifdef CONFIG_COMPAT
- 			if (client->convert32 && snd_seq_ev_is_varusr(&event)) {
--				void *ptr = (void __force *)compat_ptr(event.data.raw32.d[1]);
-+				void *ptr = (void __force_kernel *)compat_ptr(event.data.raw32.d[1]);
- 				event.data.ext.ptr = ptr;
- 			}
- #endif
-@@ -2423,7 +2423,7 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg)
- 	if (client == NULL)
- 		return -ENXIO;
- 	fs = snd_enter_user();
--	result = snd_seq_do_ioctl(client, cmd, (void __force __user *)arg);
-+	result = snd_seq_do_ioctl(client, cmd, (void __force_user *)arg);
- 	snd_leave_user(fs);
- 	return result;
- }
-diff --git a/sound/core/seq/seq_compat.c b/sound/core/seq/seq_compat.c
-index 6517590..9905cee 100644
---- a/sound/core/seq/seq_compat.c
-+++ b/sound/core/seq/seq_compat.c
-@@ -60,7 +60,7 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned
- 	data->kernel = NULL;
- 
- 	fs = snd_enter_user();
--	err = snd_seq_do_ioctl(client, cmd, data);
-+	err = snd_seq_do_ioctl(client, cmd, (void __force_user *)data);
- 	snd_leave_user(fs);
- 	if (err < 0)
- 		goto error;
-diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
-index 1d5acbe..5f55223 100644
---- a/sound/core/seq/seq_fifo.c
-+++ b/sound/core/seq/seq_fifo.c
-@@ -50,7 +50,7 @@ struct snd_seq_fifo *snd_seq_fifo_new(int poolsize)
- 	spin_lock_init(&f->lock);
- 	snd_use_lock_init(&f->use_lock);
- 	init_waitqueue_head(&f->input_sleep);
--	atomic_set(&f->overflow, 0);
-+	atomic_set_unchecked(&f->overflow, 0);
- 
- 	f->head = NULL;
- 	f->tail = NULL;
-@@ -96,7 +96,7 @@ void snd_seq_fifo_clear(struct snd_seq_fifo *f)
- 	unsigned long flags;
- 
- 	/* clear overflow flag */
--	atomic_set(&f->overflow, 0);
-+	atomic_set_unchecked(&f->overflow, 0);
- 
- 	snd_use_lock_sync(&f->use_lock);
- 	spin_lock_irqsave(&f->lock, flags);
-@@ -123,7 +123,7 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f,
- 	err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL); /* always non-blocking */
- 	if (err < 0) {
- 		if ((err == -ENOMEM) || (err == -EAGAIN))
--			atomic_inc(&f->overflow);
-+			atomic_inc_unchecked(&f->overflow);
- 		snd_use_lock_free(&f->use_lock);
- 		return err;
- 	}
-diff --git a/sound/core/seq/seq_fifo.h b/sound/core/seq/seq_fifo.h
-index 062c446..a4b6f4c 100644
---- a/sound/core/seq/seq_fifo.h
-+++ b/sound/core/seq/seq_fifo.h
-@@ -35,7 +35,7 @@ struct snd_seq_fifo {
- 	spinlock_t lock;
- 	snd_use_lock_t use_lock;
- 	wait_queue_head_t input_sleep;
--	atomic_t overflow;
-+	atomic_unchecked_t overflow;
- 
- };
- 
-diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
-index c850345..ec0a853 100644
---- a/sound/core/seq/seq_memory.c
-+++ b/sound/core/seq/seq_memory.c
-@@ -87,7 +87,7 @@ int snd_seq_dump_var_event(const struct snd_seq_event *event,
- 
- 	if (event->data.ext.len & SNDRV_SEQ_EXT_USRPTR) {
- 		char buf[32];
--		char __user *curptr = (char __force __user *)event->data.ext.ptr;
-+		char __user *curptr = (char __force_user *)event->data.ext.ptr;
- 		while (len > 0) {
- 			int size = sizeof(buf);
- 			if (len < size)
-@@ -126,15 +126,19 @@ EXPORT_SYMBOL(snd_seq_dump_var_event);
-  * expand the variable length event to linear buffer space.
-  */
- 
--static int seq_copy_in_kernel(char **bufptr, const void *src, int size)
-+static int seq_copy_in_kernel(void *_bufptr, const void *src, int size)
- {
-+	char **bufptr = (char **)_bufptr;
-+
- 	memcpy(*bufptr, src, size);
- 	*bufptr += size;
- 	return 0;
- }
- 
--static int seq_copy_in_user(char __user **bufptr, const void *src, int size)
-+static int seq_copy_in_user(void *_bufptr, const void *src, int size)
- {
-+	char __user **bufptr = (char __user **)_bufptr;
-+
- 	if (copy_to_user(*bufptr, src, size))
- 		return -EFAULT;
- 	*bufptr += size;
-@@ -158,13 +162,13 @@ int snd_seq_expand_var_event(const struct snd_seq_event *event, int count, char
- 	if (event->data.ext.len & SNDRV_SEQ_EXT_USRPTR) {
- 		if (! in_kernel)
- 			return -EINVAL;
--		if (copy_from_user(buf, (void __force __user *)event->data.ext.ptr, len))
-+		if (copy_from_user(buf, (void __force_user *)event->data.ext.ptr, len))
- 			return -EFAULT;
- 		return newlen;
- 	}
- 	err = snd_seq_dump_var_event(event,
--				     in_kernel ? (snd_seq_dump_func_t)seq_copy_in_kernel :
--				     (snd_seq_dump_func_t)seq_copy_in_user,
-+				     in_kernel ? seq_copy_in_kernel :
-+				     seq_copy_in_user,
- 				     &buf);
- 	return err < 0 ? err : newlen;
- }
-@@ -344,7 +348,7 @@ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
- 				tmp->event = src->event;
- 				src = src->next;
- 			} else if (is_usrptr) {
--				if (copy_from_user(&tmp->event, (char __force __user *)buf, size)) {
-+				if (copy_from_user(&tmp->event, (char __force_user *)buf, size)) {
- 					err = -EFAULT;
- 					goto __error;
- 				}
-diff --git a/sound/core/seq/seq_midi.c b/sound/core/seq/seq_midi.c
-index 5dd0ee2..0208e35 100644
---- a/sound/core/seq/seq_midi.c
-+++ b/sound/core/seq/seq_midi.c
-@@ -111,8 +111,9 @@ static void snd_midi_input_event(struct snd_rawmidi_substream *substream)
- 	}
- }
- 
--static int dump_midi(struct snd_rawmidi_substream *substream, const char *buf, int count)
-+static int dump_midi(void *_substream, const void *buf, int count)
- {
-+	struct snd_rawmidi_substream *substream = _substream;
- 	struct snd_rawmidi_runtime *runtime;
- 	int tmp;
- 
-@@ -148,7 +149,7 @@ static int event_process_midi(struct snd_seq_event *ev, int direct,
- 			pr_debug("ALSA: seq_midi: invalid sysex event flags = 0x%x\n", ev->flags);
- 			return 0;
- 		}
--		snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)dump_midi, substream);
-+		snd_seq_dump_var_event(ev, dump_midi, substream);
- 		snd_midi_event_reset_decode(msynth->parser);
- 	} else {
- 		if (msynth->parser == NULL)
-diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
-index c82ed3e..e11d039 100644
---- a/sound/core/seq/seq_virmidi.c
-+++ b/sound/core/seq/seq_virmidi.c
-@@ -90,7 +90,7 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
- 		if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
- 			if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
- 				continue;
--			snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream);
-+			snd_seq_dump_var_event(ev, snd_rawmidi_receive, vmidi->substream);
- 		} else {
- 			len = snd_midi_event_decode(vmidi->parser, msg, sizeof(msg), ev);
- 			if (len > 0)
-diff --git a/sound/core/sound.c b/sound/core/sound.c
-index 175f9e4..3518d31 100644
---- a/sound/core/sound.c
-+++ b/sound/core/sound.c
-@@ -86,7 +86,7 @@ static void snd_request_other(int minor)
- 	case SNDRV_MINOR_TIMER:		str = "snd-timer";	break;
- 	default:			return;
- 	}
--	request_module(str);
-+	request_module("%s", str);
- }
- 
- #endif	/* modular kernel */
-diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
-index 2a008a9..a1efb3f 100644
---- a/sound/drivers/mts64.c
-+++ b/sound/drivers/mts64.c
-@@ -29,6 +29,7 @@
- #include <sound/initval.h>
- #include <sound/rawmidi.h>
- #include <sound/control.h>
-+#include <asm/local.h>
- 
- #define CARD_NAME "Miditerminal 4140"
- #define DRIVER_NAME "MTS64"
-@@ -67,7 +68,7 @@ struct mts64 {
- 	struct pardevice *pardev;
- 	int pardev_claimed;
- 
--	int open_count;
-+	local_t open_count;
- 	int current_midi_output_port;
- 	int current_midi_input_port;
- 	u8 mode[MTS64_NUM_INPUT_PORTS];
-@@ -687,7 +688,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
- {
- 	struct mts64 *mts = substream->rmidi->private_data;
- 
--	if (mts->open_count == 0) {
-+	if (local_read(&mts->open_count) == 0) {
- 		/* We don't need a spinlock here, because this is just called 
- 		   if the device has not been opened before. 
- 		   So there aren't any IRQs from the device */
-@@ -695,7 +696,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
- 
- 		msleep(50);
- 	}
--	++(mts->open_count);
-+	local_inc(&mts->open_count);
- 
- 	return 0;
- }
-@@ -705,8 +706,7 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
- 	struct mts64 *mts = substream->rmidi->private_data;
- 	unsigned long flags;
- 
--	--(mts->open_count);
--	if (mts->open_count == 0) {
-+	if (local_dec_return(&mts->open_count) == 0) {
- 		/* We need the spinlock_irqsave here because we can still
- 		   have IRQs at this point */
- 		spin_lock_irqsave(&mts->lock, flags);
-@@ -715,8 +715,8 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
- 
- 		msleep(500);
- 
--	} else if (mts->open_count < 0)
--		mts->open_count = 0;
-+	} else if (local_read(&mts->open_count) < 0)
-+		local_set(&mts->open_count, 0);
- 
- 	return 0;
- }
-diff --git a/sound/drivers/opl4/opl4_lib.c b/sound/drivers/opl4/opl4_lib.c
-index 89c7aa0..6d75e49 100644
---- a/sound/drivers/opl4/opl4_lib.c
-+++ b/sound/drivers/opl4/opl4_lib.c
-@@ -29,7 +29,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@×××××××.de>");
- MODULE_DESCRIPTION("OPL4 driver");
- MODULE_LICENSE("GPL");
- 
--static void inline snd_opl4_wait(struct snd_opl4 *opl4)
-+static inline void snd_opl4_wait(struct snd_opl4 *opl4)
- {
- 	int timeout = 10;
- 	while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
-diff --git a/sound/drivers/portman2x4.c b/sound/drivers/portman2x4.c
-index 464385a..46ab3f6 100644
---- a/sound/drivers/portman2x4.c
-+++ b/sound/drivers/portman2x4.c
-@@ -48,6 +48,7 @@
- #include <sound/initval.h>
- #include <sound/rawmidi.h>
- #include <sound/control.h>
-+#include <asm/local.h>
- 
- #define CARD_NAME "Portman 2x4"
- #define DRIVER_NAME "portman"
-@@ -85,7 +86,7 @@ struct portman {
- 	struct pardevice *pardev;
- 	int pardev_claimed;
- 
--	int open_count;
-+	local_t open_count;
- 	int mode[PORTMAN_NUM_INPUT_PORTS];
- 	struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
- };
-diff --git a/sound/firewire/amdtp-am824.c b/sound/firewire/amdtp-am824.c
-index bebddc6..f5976be 100644
---- a/sound/firewire/amdtp-am824.c
-+++ b/sound/firewire/amdtp-am824.c
-@@ -314,7 +314,7 @@ void amdtp_am824_midi_trigger(struct amdtp_stream *s, unsigned int port,
- 	struct amdtp_am824 *p = s->protocol;
- 
- 	if (port < p->midi_ports)
--		ACCESS_ONCE(p->midi[port]) = midi;
-+		ACCESS_ONCE_RW(p->midi[port]) = midi;
- }
- EXPORT_SYMBOL_GPL(amdtp_am824_midi_trigger);
- 
-diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c
-index ed29026..933d2ae 100644
---- a/sound/firewire/amdtp-stream.c
-+++ b/sound/firewire/amdtp-stream.c
-@@ -344,7 +344,7 @@ static void update_pcm_pointers(struct amdtp_stream *s,
- 	ptr = s->pcm_buffer_pointer + frames;
- 	if (ptr >= pcm->runtime->buffer_size)
- 		ptr -= pcm->runtime->buffer_size;
--	ACCESS_ONCE(s->pcm_buffer_pointer) = ptr;
-+	ACCESS_ONCE_RW(s->pcm_buffer_pointer) = ptr;
- 
- 	s->pcm_period_pointer += frames;
- 	if (s->pcm_period_pointer >= pcm->runtime->period_size) {
-@@ -811,7 +811,7 @@ EXPORT_SYMBOL(amdtp_stream_pcm_pointer);
- void amdtp_stream_update(struct amdtp_stream *s)
- {
- 	/* Precomputing. */
--	ACCESS_ONCE(s->source_node_id_field) =
-+	ACCESS_ONCE_RW(s->source_node_id_field) =
- 		(fw_parent_device(s->unit)->card->node_id << CIP_SID_SHIFT) &
- 								CIP_SID_MASK;
- }
-diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h
-index 8775704..8fea566 100644
---- a/sound/firewire/amdtp-stream.h
-+++ b/sound/firewire/amdtp-stream.h
-@@ -215,7 +215,7 @@ static inline bool amdtp_stream_pcm_running(struct amdtp_stream *s)
- static inline void amdtp_stream_pcm_trigger(struct amdtp_stream *s,
- 					    struct snd_pcm_substream *pcm)
- {
--	ACCESS_ONCE(s->pcm) = pcm;
-+	ACCESS_ONCE_RW(s->pcm) = pcm;
- }
- 
- static inline bool cip_sfc_is_base_44100(enum cip_sfc sfc)
-diff --git a/sound/firewire/digi00x/amdtp-dot.c b/sound/firewire/digi00x/amdtp-dot.c
-index 0ac92ab..a2081aa 100644
---- a/sound/firewire/digi00x/amdtp-dot.c
-+++ b/sound/firewire/digi00x/amdtp-dot.c
-@@ -365,7 +365,7 @@ void amdtp_dot_midi_trigger(struct amdtp_stream *s, unsigned int port,
- 	struct amdtp_dot *p = s->protocol;
- 
- 	if (port < p->midi_ports)
--		ACCESS_ONCE(p->midi[port]) = midi;
-+		ACCESS_ONCE_RW(p->midi[port]) = midi;
- }
- 
- static unsigned int process_tx_data_blocks(struct amdtp_stream *s,
-diff --git a/sound/firewire/isight.c b/sound/firewire/isight.c
-index 48d6dca..a0266c23 100644
---- a/sound/firewire/isight.c
-+++ b/sound/firewire/isight.c
-@@ -96,7 +96,7 @@ static void isight_update_pointers(struct isight *isight, unsigned int count)
- 	ptr += count;
- 	if (ptr >= runtime->buffer_size)
- 		ptr -= runtime->buffer_size;
--	ACCESS_ONCE(isight->buffer_pointer) = ptr;
-+	ACCESS_ONCE_RW(isight->buffer_pointer) = ptr;
- 
- 	isight->period_counter += count;
- 	if (isight->period_counter >= runtime->period_size) {
-@@ -293,7 +293,7 @@ static int isight_hw_params(struct snd_pcm_substream *substream,
- 	if (err < 0)
- 		return err;
- 
--	ACCESS_ONCE(isight->pcm_active) = true;
-+	ACCESS_ONCE_RW(isight->pcm_active) = true;
- 
- 	return 0;
- }
-@@ -331,7 +331,7 @@ static int isight_hw_free(struct snd_pcm_substream *substream)
- {
- 	struct isight *isight = substream->private_data;
- 
--	ACCESS_ONCE(isight->pcm_active) = false;
-+	ACCESS_ONCE_RW(isight->pcm_active) = false;
- 
- 	mutex_lock(&isight->mutex);
- 	isight_stop_streaming(isight);
-@@ -424,10 +424,10 @@ static int isight_trigger(struct snd_pcm_substream *substream, int cmd)
- 
- 	switch (cmd) {
- 	case SNDRV_PCM_TRIGGER_START:
--		ACCESS_ONCE(isight->pcm_running) = true;
-+		ACCESS_ONCE_RW(isight->pcm_running) = true;
- 		break;
- 	case SNDRV_PCM_TRIGGER_STOP:
--		ACCESS_ONCE(isight->pcm_running) = false;
-+		ACCESS_ONCE_RW(isight->pcm_running) = false;
- 		break;
- 	default:
- 		return -EINVAL;
-diff --git a/sound/firewire/oxfw/oxfw-scs1x.c b/sound/firewire/oxfw/oxfw-scs1x.c
-index bb53eb3..670cd89 100644
---- a/sound/firewire/oxfw/oxfw-scs1x.c
-+++ b/sound/firewire/oxfw/oxfw-scs1x.c
-@@ -278,9 +278,9 @@ static void midi_capture_trigger(struct snd_rawmidi_substream *stream, int up)
- 
- 	if (up) {
- 		scs->input_escape_count = 0;
--		ACCESS_ONCE(scs->input) = stream;
-+		ACCESS_ONCE_RW(scs->input) = stream;
- 	} else {
--		ACCESS_ONCE(scs->input) = NULL;
-+		ACCESS_ONCE_RW(scs->input) = NULL;
- 	}
- }
- 
-@@ -310,10 +310,10 @@ static void midi_playback_trigger(struct snd_rawmidi_substream *stream, int up)
- 		scs->output_escaped = false;
- 		scs->output_idle = false;
- 
--		ACCESS_ONCE(scs->output) = stream;
-+		ACCESS_ONCE_RW(scs->output) = stream;
- 		tasklet_schedule(&scs->tasklet);
- 	} else {
--		ACCESS_ONCE(scs->output) = NULL;
-+		ACCESS_ONCE_RW(scs->output) = NULL;
- 	}
- }
- static void midi_playback_drain(struct snd_rawmidi_substream *stream)
-diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c
-index dc91072..d85a10a 100644
---- a/sound/oss/sb_audio.c
-+++ b/sound/oss/sb_audio.c
-@@ -900,7 +900,7 @@ sb16_copy_from_user(int dev,
- 		buf16 = (signed short *)(localbuf + localoffs);
- 		while (c)
- 		{
--			locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
-+			locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
- 			if (copy_from_user(lbuf8,
- 					   userbuf+useroffs + p,
- 					   locallen))
-diff --git a/sound/oss/swarm_cs4297a.c b/sound/oss/swarm_cs4297a.c
-index 213a416..aeab5c9 100644
---- a/sound/oss/swarm_cs4297a.c
-+++ b/sound/oss/swarm_cs4297a.c
-@@ -2623,7 +2623,6 @@ static int __init cs4297a_init(void)
- {
- 	struct cs4297a_state *s;
- 	u32 pwr, id;
--	mm_segment_t fs;
- 	int rval;
- 	u64 cfg;
- 	int mdio_val;
-@@ -2709,22 +2708,23 @@ static int __init cs4297a_init(void)
-         if (!rval) {
- 		char *sb1250_duart_present;
- 
-+#if 0
-+                mm_segment_t fs;
-                 fs = get_fs();
-                 set_fs(KERNEL_DS);
--#if 0
-                 val = SOUND_MASK_LINE;
-                 mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
-                 for (i = 0; i < ARRAY_SIZE(initvol); i++) {
-                         val = initvol[i].vol;
-                         mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
-                 }
-+                set_fs(fs);
- //                cs4297a_write_ac97(s, 0x18, 0x0808);
- #else
-                 //                cs4297a_write_ac97(s, 0x5e, 0x180);
-                 cs4297a_write_ac97(s, 0x02, 0x0808);
-                 cs4297a_write_ac97(s, 0x18, 0x0808);
- #endif
--                set_fs(fs);
- 
-                 list_add(&s->list, &cs4297a_devs);
- 
-diff --git a/sound/pci/als300.c b/sound/pci/als300.c
-index add3176..c9394d9 100644
---- a/sound/pci/als300.c
-+++ b/sound/pci/als300.c
-@@ -647,7 +647,7 @@ static int snd_als300_create(struct snd_card *card,
- 			     struct snd_als300 **rchip)
- {
- 	struct snd_als300 *chip;
--	void *irq_handler;
-+	irq_handler_t irq_handler;
- 	int err;
- 
- 	static struct snd_device_ops ops = {
-diff --git a/sound/pci/aw2/aw2-alsa.c b/sound/pci/aw2/aw2-alsa.c
-index 1677143..85aca1d 100644
---- a/sound/pci/aw2/aw2-alsa.c
-+++ b/sound/pci/aw2/aw2-alsa.c
-@@ -458,7 +458,6 @@ static int snd_aw2_pcm_prepare_playback(struct snd_pcm_substream *substream)
- 
- 	/* Define Interrupt callback */
- 	snd_aw2_saa7146_define_it_playback_callback(pcm_device->stream_number,
--						    (snd_aw2_saa7146_it_cb)
- 						    snd_pcm_period_elapsed,
- 						    (void *)substream);
- 
-@@ -487,7 +486,6 @@ static int snd_aw2_pcm_prepare_capture(struct snd_pcm_substream *substream)
- 
- 	/* Define Interrupt callback */
- 	snd_aw2_saa7146_define_it_capture_callback(pcm_device->stream_number,
--						   (snd_aw2_saa7146_it_cb)
- 						   snd_pcm_period_elapsed,
- 						   (void *)substream);
- 
-diff --git a/sound/pci/aw2/aw2-saa7146.c b/sound/pci/aw2/aw2-saa7146.c
-index 1d78904..d9c1056 100644
---- a/sound/pci/aw2/aw2-saa7146.c
-+++ b/sound/pci/aw2/aw2-saa7146.c
-@@ -262,7 +262,7 @@ void snd_aw2_saa7146_define_it_playback_callback(unsigned int stream_number,
- {
- 	if (stream_number < NB_STREAM_PLAYBACK) {
- 		arr_substream_it_playback_cb[stream_number].p_it_callback =
--		    (snd_aw2_saa7146_it_cb) p_it_callback;
-+		    p_it_callback;
- 		arr_substream_it_playback_cb[stream_number].p_callback_param =
- 		    (void *)p_callback_param;
- 	}
-@@ -275,7 +275,7 @@ void snd_aw2_saa7146_define_it_capture_callback(unsigned int stream_number,
- {
- 	if (stream_number < NB_STREAM_CAPTURE) {
- 		arr_substream_it_capture_cb[stream_number].p_it_callback =
--		    (snd_aw2_saa7146_it_cb) p_it_callback;
-+		    p_it_callback;
- 		arr_substream_it_capture_cb[stream_number].p_callback_param =
- 		    (void *)p_callback_param;
- 	}
-diff --git a/sound/pci/ctxfi/ctamixer.c b/sound/pci/ctxfi/ctamixer.c
-index 5fcbb06..f4b85df 100644
---- a/sound/pci/ctxfi/ctamixer.c
-+++ b/sound/pci/ctxfi/ctamixer.c
-@@ -297,8 +297,9 @@ static int put_amixer_rsc(struct amixer_mgr *mgr, struct amixer *amixer)
- 	return 0;
- }
- 
--int amixer_mgr_create(struct hw *hw, struct amixer_mgr **ramixer_mgr)
-+int amixer_mgr_create(struct hw *hw, void **_ramixer_mgr)
- {
-+	struct amixer_mgr **ramixer_mgr = (struct amixer_mgr **)_ramixer_mgr;
- 	int err;
- 	struct amixer_mgr *amixer_mgr;
- 
-@@ -326,8 +327,10 @@ error:
- 	return err;
- }
- 
--int amixer_mgr_destroy(struct amixer_mgr *amixer_mgr)
-+int amixer_mgr_destroy(void *_amixer_mgr)
- {
-+	struct amixer_mgr *amixer_mgr = _amixer_mgr;
-+
- 	rsc_mgr_uninit(&amixer_mgr->mgr);
- 	kfree(amixer_mgr);
- 	return 0;
-@@ -452,8 +455,9 @@ static int put_sum_rsc(struct sum_mgr *mgr, struct sum *sum)
- 	return 0;
- }
- 
--int sum_mgr_create(struct hw *hw, struct sum_mgr **rsum_mgr)
-+int sum_mgr_create(struct hw *hw, void **_rsum_mgr)
- {
-+	struct sum_mgr **rsum_mgr = (struct sum_mgr **)_rsum_mgr;
- 	int err;
- 	struct sum_mgr *sum_mgr;
- 
-@@ -481,8 +485,10 @@ error:
- 	return err;
- }
- 
--int sum_mgr_destroy(struct sum_mgr *sum_mgr)
-+int sum_mgr_destroy(void *_sum_mgr)
- {
-+	struct sum_mgr *sum_mgr = _sum_mgr;
-+
- 	rsc_mgr_uninit(&sum_mgr->mgr);
- 	kfree(sum_mgr);
- 	return 0;
-diff --git a/sound/pci/ctxfi/ctamixer.h b/sound/pci/ctxfi/ctamixer.h
-index 2de18aa..2fbd01b 100644
---- a/sound/pci/ctxfi/ctamixer.h
-+++ b/sound/pci/ctxfi/ctamixer.h
-@@ -47,8 +47,8 @@ struct sum_mgr {
- };
- 
- /* Constructor and destructor of daio resource manager */
--int sum_mgr_create(struct hw *hw, struct sum_mgr **rsum_mgr);
--int sum_mgr_destroy(struct sum_mgr *sum_mgr);
-+int sum_mgr_create(struct hw *hw, void **rsum_mgr);
-+int sum_mgr_destroy(void *sum_mgr);
- 
- /* Define the descriptor of a amixer resource */
- struct amixer_rsc_ops;
-@@ -93,7 +93,7 @@ struct amixer_mgr {
- };
- 
- /* Constructor and destructor of amixer resource manager */
--int amixer_mgr_create(struct hw *hw, struct amixer_mgr **ramixer_mgr);
--int amixer_mgr_destroy(struct amixer_mgr *amixer_mgr);
-+int amixer_mgr_create(struct hw *hw, void **ramixer_mgr);
-+int amixer_mgr_destroy(void *amixer_mgr);
- 
- #endif /* CTAMIXER_H */
-diff --git a/sound/pci/ctxfi/ctatc.c b/sound/pci/ctxfi/ctatc.c
-index 977a598..a787004 100644
---- a/sound/pci/ctxfi/ctatc.c
-+++ b/sound/pci/ctxfi/ctatc.c
-@@ -113,16 +113,16 @@ static struct {
- 	int (*create)(struct hw *hw, void **rmgr);
- 	int (*destroy)(void *mgr);
- } rsc_mgr_funcs[NUM_RSCTYP] = {
--	[SRC] 		= { .create 	= (create_t)src_mgr_create,
--			    .destroy 	= (destroy_t)src_mgr_destroy	},
--	[SRCIMP] 	= { .create 	= (create_t)srcimp_mgr_create,
--			    .destroy 	= (destroy_t)srcimp_mgr_destroy	},
--	[AMIXER]	= { .create	= (create_t)amixer_mgr_create,
--			    .destroy	= (destroy_t)amixer_mgr_destroy	},
--	[SUM]		= { .create	= (create_t)sum_mgr_create,
--			    .destroy	= (destroy_t)sum_mgr_destroy	},
--	[DAIO]		= { .create	= (create_t)daio_mgr_create,
--			    .destroy	= (destroy_t)daio_mgr_destroy	}
-+	[SRC] 		= { .create 	= src_mgr_create,
-+			    .destroy 	= src_mgr_destroy	},
-+	[SRCIMP] 	= { .create 	= srcimp_mgr_create,
-+			    .destroy 	= srcimp_mgr_destroy	},
-+	[AMIXER]	= { .create	= amixer_mgr_create,
-+			    .destroy	= amixer_mgr_destroy	},
-+	[SUM]		= { .create	= sum_mgr_create,
-+			    .destroy	= sum_mgr_destroy	},
-+	[DAIO]		= { .create	= daio_mgr_create,
-+			    .destroy	= daio_mgr_destroy	}
- };
- 
- static int
-diff --git a/sound/pci/ctxfi/ctdaio.c b/sound/pci/ctxfi/ctdaio.c
-index 7f089cb..6bea28e 100644
---- a/sound/pci/ctxfi/ctdaio.c
-+++ b/sound/pci/ctxfi/ctdaio.c
-@@ -687,8 +687,9 @@ static int daio_mgr_commit_write(struct daio_mgr *mgr)
- 	return 0;
- }
- 
--int daio_mgr_create(struct hw *hw, struct daio_mgr **rdaio_mgr)
-+int daio_mgr_create(struct hw *hw, void **_rdaio_mgr)
- {
-+	struct daio_mgr **rdaio_mgr = (struct daio_mgr **)_rdaio_mgr;
- 	int err, i;
- 	struct daio_mgr *daio_mgr;
- 	struct imapper *entry;
-@@ -741,8 +742,9 @@ error1:
- 	return err;
- }
- 
--int daio_mgr_destroy(struct daio_mgr *daio_mgr)
-+int daio_mgr_destroy(void *_daio_mgr)
- {
-+	struct daio_mgr *daio_mgr = _daio_mgr;
- 	unsigned long flags;
- 
- 	/* free daio input mapper list */
-diff --git a/sound/pci/ctxfi/ctdaio.h b/sound/pci/ctxfi/ctdaio.h
-index a30be73..91b8dbd 100644
---- a/sound/pci/ctxfi/ctdaio.h
-+++ b/sound/pci/ctxfi/ctdaio.h
-@@ -119,7 +119,7 @@ struct daio_mgr {
- };
- 
- /* Constructor and destructor of daio resource manager */
--int daio_mgr_create(struct hw *hw, struct daio_mgr **rdaio_mgr);
--int daio_mgr_destroy(struct daio_mgr *daio_mgr);
-+int daio_mgr_create(struct hw *hw, void **rdaio_mgr);
-+int daio_mgr_destroy(void *daio_mgr);
- 
- #endif /* CTDAIO_H */
-diff --git a/sound/pci/ctxfi/ctsrc.c b/sound/pci/ctxfi/ctsrc.c
-index a5a72df..f86edb8 100644
---- a/sound/pci/ctxfi/ctsrc.c
-+++ b/sound/pci/ctxfi/ctsrc.c
-@@ -544,8 +544,9 @@ static int src_mgr_commit_write(struct src_mgr *mgr)
- 	return 0;
- }
- 
--int src_mgr_create(struct hw *hw, struct src_mgr **rsrc_mgr)
-+int src_mgr_create(struct hw *hw, void **_rsrc_mgr)
- {
-+	struct src_mgr **rsrc_mgr = (struct src_mgr **)_rsrc_mgr;
- 	int err, i;
- 	struct src_mgr *src_mgr;
- 
-@@ -584,8 +585,10 @@ error1:
- 	return err;
- }
- 
--int src_mgr_destroy(struct src_mgr *src_mgr)
-+int src_mgr_destroy(void *_src_mgr)
- {
-+	struct src_mgr *src_mgr = _src_mgr;
-+
- 	rsc_mgr_uninit(&src_mgr->mgr);
- 	kfree(src_mgr);
- 
-@@ -828,8 +831,9 @@ static int srcimp_imap_delete(struct srcimp_mgr *mgr, struct imapper *entry)
- 	return err;
- }
- 
--int srcimp_mgr_create(struct hw *hw, struct srcimp_mgr **rsrcimp_mgr)
-+int srcimp_mgr_create(struct hw *hw, void **_rsrcimp_mgr)
- {
-+	struct srcimp_mgr **rsrcimp_mgr = (struct srcimp_mgr **)_rsrcimp_mgr;
- 	int err;
- 	struct srcimp_mgr *srcimp_mgr;
- 	struct imapper *entry;
-@@ -873,8 +877,9 @@ error1:
- 	return err;
- }
- 
--int srcimp_mgr_destroy(struct srcimp_mgr *srcimp_mgr)
-+int srcimp_mgr_destroy(void *_srcimp_mgr)
- {
-+	struct srcimp_mgr *srcimp_mgr = _srcimp_mgr;
- 	unsigned long flags;
- 
- 	/* free src input mapper list */
-diff --git a/sound/pci/ctxfi/ctsrc.h b/sound/pci/ctxfi/ctsrc.h
-index 92944a0..fc78ed4 100644
---- a/sound/pci/ctxfi/ctsrc.h
-+++ b/sound/pci/ctxfi/ctsrc.h
-@@ -143,10 +143,10 @@ struct srcimp_mgr {
- };
- 
- /* Constructor and destructor of SRC resource manager */
--int src_mgr_create(struct hw *hw, struct src_mgr **rsrc_mgr);
--int src_mgr_destroy(struct src_mgr *src_mgr);
-+int src_mgr_create(struct hw *hw, void **rsrc_mgr);
-+int src_mgr_destroy(void *src_mgr);
- /* Constructor and destructor of SRCIMP resource manager */
--int srcimp_mgr_create(struct hw *hw, struct srcimp_mgr **rsrc_mgr);
--int srcimp_mgr_destroy(struct srcimp_mgr *srcimp_mgr);
-+int srcimp_mgr_create(struct hw *hw, void **rsrc_mgr);
-+int srcimp_mgr_destroy(void *srcimp_mgr);
- 
- #endif /* CTSRC_H */
-diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
-index 8374188..f073778 100644
---- a/sound/pci/hda/hda_codec.c
-+++ b/sound/pci/hda/hda_codec.c
-@@ -1743,7 +1743,7 @@ static int get_kctl_0dB_offset(struct hda_codec *codec,
- 		/* FIXME: set_fs() hack for obtaining user-space TLV data */
- 		mm_segment_t fs = get_fs();
- 		set_fs(get_ds());
--		if (!kctl->tlv.c(kctl, 0, sizeof(_tlv), _tlv))
-+		if (!kctl->tlv.c(kctl, 0, sizeof(_tlv), (unsigned int __force_user *)_tlv))
- 			tlv = _tlv;
- 		set_fs(fs);
- 	} else if (kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_TLV_READ)
-diff --git a/sound/pci/ymfpci/ymfpci.h b/sound/pci/ymfpci/ymfpci.h
-index 149d4cb..7784769 100644
---- a/sound/pci/ymfpci/ymfpci.h
-+++ b/sound/pci/ymfpci/ymfpci.h
-@@ -358,7 +358,7 @@ struct snd_ymfpci {
- 	spinlock_t reg_lock;
- 	spinlock_t voice_lock;
- 	wait_queue_head_t interrupt_sleep;
--	atomic_t interrupt_sleep_count;
-+	atomic_unchecked_t interrupt_sleep_count;
- 	struct snd_info_entry *proc_entry;
- 	const struct firmware *dsp_microcode;
- 	const struct firmware *controller_microcode;
-diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
-index 4c26076..a13f370 100644
---- a/sound/pci/ymfpci/ymfpci_main.c
-+++ b/sound/pci/ymfpci/ymfpci_main.c
-@@ -204,8 +204,8 @@ static void snd_ymfpci_hw_stop(struct snd_ymfpci *chip)
- 		if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
- 			break;
- 	}
--	if (atomic_read(&chip->interrupt_sleep_count)) {
--		atomic_set(&chip->interrupt_sleep_count, 0);
-+	if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
-+		atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
- 		wake_up(&chip->interrupt_sleep);
- 	}
-       __end:
-@@ -789,7 +789,7 @@ static void snd_ymfpci_irq_wait(struct snd_ymfpci *chip)
- 		 	continue;
- 		init_waitqueue_entry(&wait, current);
- 		add_wait_queue(&chip->interrupt_sleep, &wait);
--		atomic_inc(&chip->interrupt_sleep_count);
-+		atomic_inc_unchecked(&chip->interrupt_sleep_count);
- 		schedule_timeout_uninterruptible(msecs_to_jiffies(50));
- 		remove_wait_queue(&chip->interrupt_sleep, &wait);
- 	}
-@@ -827,8 +827,8 @@ static irqreturn_t snd_ymfpci_interrupt(int irq, void *dev_id)
- 		snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
- 		spin_unlock(&chip->reg_lock);
- 
--		if (atomic_read(&chip->interrupt_sleep_count)) {
--			atomic_set(&chip->interrupt_sleep_count, 0);
-+		if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
-+			atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
- 			wake_up(&chip->interrupt_sleep);
- 		}
- 	}
-@@ -2384,7 +2384,7 @@ int snd_ymfpci_create(struct snd_card *card,
- 	spin_lock_init(&chip->reg_lock);
- 	spin_lock_init(&chip->voice_lock);
- 	init_waitqueue_head(&chip->interrupt_sleep);
--	atomic_set(&chip->interrupt_sleep_count, 0);
-+	atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
- 	chip->card = card;
- 	chip->pci = pci;
- 	chip->irq = -1;
-diff --git a/sound/soc/codecs/cx20442.c b/sound/soc/codecs/cx20442.c
-index d6f4abb..5d59f0c 100644
---- a/sound/soc/codecs/cx20442.c
-+++ b/sound/soc/codecs/cx20442.c
-@@ -263,6 +263,12 @@ static int v253_hangup(struct tty_struct *tty)
- 	return 0;
- }
- 
-+static int v253_hw_write(void *client, const char *buf, int count)
-+{
-+	struct tty_struct *tty = client;
-+	return tty->ops->write(client, buf, count);
-+}
-+
- /* Line discipline .receive_buf() */
- static void v253_receive(struct tty_struct *tty,
- 				const unsigned char *cp, char *fp, int count)
-@@ -280,7 +286,7 @@ static void v253_receive(struct tty_struct *tty,
- 
- 		/* Set up codec driver access to modem controls */
- 		cx20442->control_data = tty;
--		codec->hw_write = (hw_write_t)tty->ops->write;
-+		codec->hw_write = v253_hw_write;
- 		codec->component.card->pop_time = 1;
- 	}
- }
-diff --git a/sound/soc/codecs/sti-sas.c b/sound/soc/codecs/sti-sas.c
-index 160d61a..10bfd63 100644
---- a/sound/soc/codecs/sti-sas.c
-+++ b/sound/soc/codecs/sti-sas.c
-@@ -591,11 +591,13 @@ static int sti_sas_driver_probe(struct platform_device *pdev)
- 	sti_sas_dai[STI_SAS_DAI_ANALOG_OUT].ops = drvdata->dev_data->dac_ops;
- 
- 	/* Set dapms*/
--	sti_sas_driver.dapm_widgets = drvdata->dev_data->dapm_widgets;
--	sti_sas_driver.num_dapm_widgets = drvdata->dev_data->num_dapm_widgets;
-+	pax_open_kernel();
-+	*(const void **)&sti_sas_driver.dapm_widgets = drvdata->dev_data->dapm_widgets;
-+	*(int *)&sti_sas_driver.num_dapm_widgets = drvdata->dev_data->num_dapm_widgets;
- 
--	sti_sas_driver.dapm_routes = drvdata->dev_data->dapm_routes;
--	sti_sas_driver.num_dapm_routes = drvdata->dev_data->num_dapm_routes;
-+	*(const void **)&sti_sas_driver.dapm_routes = drvdata->dev_data->dapm_routes;
-+	*(int *)&sti_sas_driver.num_dapm_routes = drvdata->dev_data->num_dapm_routes;
-+	pax_close_kernel();
- 
- 	/* Store context */
- 	dev_set_drvdata(&pdev->dev, drvdata);
-diff --git a/sound/soc/codecs/tlv320dac33.c b/sound/soc/codecs/tlv320dac33.c
-index f7a6ce7..82310c8 100644
---- a/sound/soc/codecs/tlv320dac33.c
-+++ b/sound/soc/codecs/tlv320dac33.c
-@@ -1375,13 +1375,18 @@ static int dac33_set_dai_fmt(struct snd_soc_dai *codec_dai,
- 	return 0;
- }
- 
-+static int dac33_hw_write(void *client, const char *buf, int count)
-+{
-+	return i2c_master_send(client, buf, count);
-+}
-+
- static int dac33_soc_probe(struct snd_soc_codec *codec)
- {
- 	struct tlv320dac33_priv *dac33 = snd_soc_codec_get_drvdata(codec);
- 	int ret = 0;
- 
- 	codec->control_data = dac33->control_data;
--	codec->hw_write = (hw_write_t) i2c_master_send;
-+	codec->hw_write = dac33_hw_write;
- 	dac33->codec = codec;
- 
- 	/* Read the tlv320dac33 ID registers */
-diff --git a/sound/soc/codecs/uda1380.c b/sound/soc/codecs/uda1380.c
-index 35f0469..7c25cd5 100644
---- a/sound/soc/codecs/uda1380.c
-+++ b/sound/soc/codecs/uda1380.c
-@@ -687,6 +687,11 @@ static struct snd_soc_dai_driver uda1380_dai[] = {
- },
- };
- 
-+static int uda1380_hw_write(void *client, const char *buf, int count)
-+{
-+	return i2c_master_send(client, buf, count);
-+}
-+
- static int uda1380_probe(struct snd_soc_codec *codec)
- {
- 	struct uda1380_platform_data *pdata =codec->dev->platform_data;
-@@ -695,7 +700,7 @@ static int uda1380_probe(struct snd_soc_codec *codec)
- 
- 	uda1380->codec = codec;
- 
--	codec->hw_write = (hw_write_t)i2c_master_send;
-+	codec->hw_write = uda1380_hw_write;
- 	codec->control_data = uda1380->control_data;
- 
- 	if (!pdata)
-diff --git a/sound/soc/intel/skylake/skl-sst-dsp.h b/sound/soc/intel/skylake/skl-sst-dsp.h
-index cbb4075..edda3dd 100644
---- a/sound/soc/intel/skylake/skl-sst-dsp.h
-+++ b/sound/soc/intel/skylake/skl-sst-dsp.h
-@@ -117,14 +117,14 @@ struct skl_dsp_fw_ops {
- 	int (*load_mod)(struct sst_dsp *ctx, u16 mod_id, char *mod_name);
- 	int (*unload_mod)(struct sst_dsp *ctx, u16 mod_id);
- 
--};
-+} __no_const;
- 
- struct skl_dsp_loader_ops {
- 	int (*alloc_dma_buf)(struct device *dev,
- 		struct snd_dma_buffer *dmab, size_t size);
- 	int (*free_dma_buf)(struct device *dev,
- 		struct snd_dma_buffer *dmab);
--};
-+} __no_const;
- 
- struct skl_load_module_info {
- 	u16 mod_id;
-diff --git a/sound/soc/soc-ac97.c b/sound/soc/soc-ac97.c
-index 7e0acd8..7fe0f65 100644
---- a/sound/soc/soc-ac97.c
-+++ b/sound/soc/soc-ac97.c
-@@ -416,8 +416,10 @@ int snd_soc_set_ac97_ops_of_reset(struct snd_ac97_bus_ops *ops,
- 	if (ret)
- 		return ret;
- 
--	ops->warm_reset = snd_soc_ac97_warm_reset;
--	ops->reset = snd_soc_ac97_reset;
-+	pax_open_kernel();
-+	*(void **)&ops->warm_reset = snd_soc_ac97_warm_reset;
-+	*(void **)&ops->reset = snd_soc_ac97_reset;
-+	pax_close_kernel();
- 
- 	snd_ac97_rst_cfg = cfg;
- 	return 0;
-diff --git a/sound/soc/xtensa/xtfpga-i2s.c b/sound/soc/xtensa/xtfpga-i2s.c
-index 8382ffa..86af7d0 100644
---- a/sound/soc/xtensa/xtfpga-i2s.c
-+++ b/sound/soc/xtensa/xtfpga-i2s.c
-@@ -437,7 +437,7 @@ static int xtfpga_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
- 	case SNDRV_PCM_TRIGGER_START:
- 	case SNDRV_PCM_TRIGGER_RESUME:
- 	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
--		ACCESS_ONCE(i2s->tx_ptr) = 0;
-+		ACCESS_ONCE_RW(i2s->tx_ptr) = 0;
- 		rcu_assign_pointer(i2s->tx_substream, substream);
- 		xtfpga_pcm_refill_fifo(i2s);
- 		break;
-diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
-index a020920..55579f6 100644
---- a/sound/synth/emux/emux_seq.c
-+++ b/sound/synth/emux/emux_seq.c
-@@ -33,13 +33,13 @@ static int snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *inf
-  * MIDI emulation operators
-  */
- static struct snd_midi_op emux_ops = {
--	snd_emux_note_on,
--	snd_emux_note_off,
--	snd_emux_key_press,
--	snd_emux_terminate_note,
--	snd_emux_control,
--	snd_emux_nrpn,
--	snd_emux_sysex,
-+	.note_on = snd_emux_note_on,
-+	.note_off = snd_emux_note_off,
-+	.key_press = snd_emux_key_press,
-+	.note_terminate = snd_emux_terminate_note,
-+	.control = snd_emux_control,
-+	.nrpn = snd_emux_nrpn,
-+	.sysex = snd_emux_sysex,
- };
- 
- 
-diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
-index 81b7da8..bb2676f 100644
---- a/sound/usb/line6/driver.c
-+++ b/sound/usb/line6/driver.c
-@@ -307,7 +307,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
- {
- 	struct usb_device *usbdev = line6->usbdev;
- 	int ret;
--	unsigned char len;
-+	unsigned char *plen;
- 	unsigned count;
- 
- 	if (address > 0xffff || datalen > 0xff)
-@@ -324,6 +324,10 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
- 		return ret;
- 	}
- 
-+	plen = kmalloc(1, GFP_KERNEL);
-+	if (plen == NULL)
-+		return -ENOMEM;
-+
- 	/* Wait for data length. We'll get 0xff until length arrives. */
- 	for (count = 0; count < LINE6_READ_WRITE_MAX_RETRIES; count++) {
- 		mdelay(LINE6_READ_WRITE_STATUS_DELAY);
-@@ -331,30 +335,35 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
- 		ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67,
- 				      USB_TYPE_VENDOR | USB_RECIP_DEVICE |
- 				      USB_DIR_IN,
--				      0x0012, 0x0000, &len, 1,
-+				      0x0012, 0x0000, plen, 1,
- 				      LINE6_TIMEOUT * HZ);
- 		if (ret < 0) {
- 			dev_err(line6->ifcdev,
- 				"receive length failed (error %d)\n", ret);
-+			kfree(plen);
- 			return ret;
- 		}
- 
--		if (len != 0xff)
-+		if (*plen != 0xff)
- 			break;
- 	}
- 
--	if (len == 0xff) {
-+	if (*plen == 0xff) {
- 		dev_err(line6->ifcdev, "read failed after %d retries\n",
- 			count);
-+		kfree(plen);
- 		return -EIO;
--	} else if (len != datalen) {
-+	} else if (*plen != datalen) {
- 		/* should be equal or something went wrong */
- 		dev_err(line6->ifcdev,
- 			"length mismatch (expected %d, got %d)\n",
--			(int)datalen, (int)len);
-+			(int)datalen, (int)*plen);
-+		kfree(plen);
- 		return -EIO;
- 	}
- 
-+	kfree(plen);
-+
- 	/* receive the result: */
- 	ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67,
- 			      USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
-@@ -378,7 +387,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
- {
- 	struct usb_device *usbdev = line6->usbdev;
- 	int ret;
--	unsigned char status;
-+	unsigned char *status;
- 	int count;
- 
- 	if (address > 0xffff || datalen > 0xffff)
-@@ -395,6 +404,10 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
- 		return ret;
- 	}
- 
-+	status = kmalloc(1, GFP_KERNEL);
-+	if (status == NULL)
-+		return -ENOMEM;
-+
- 	for (count = 0; count < LINE6_READ_WRITE_MAX_RETRIES; count++) {
- 		mdelay(LINE6_READ_WRITE_STATUS_DELAY);
- 
-@@ -403,27 +416,32 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
- 				      USB_TYPE_VENDOR | USB_RECIP_DEVICE |
- 				      USB_DIR_IN,
- 				      0x0012, 0x0000,
--				      &status, 1, LINE6_TIMEOUT * HZ);
-+				      status, 1, LINE6_TIMEOUT * HZ);
- 
- 		if (ret < 0) {
- 			dev_err(line6->ifcdev,
- 				"receiving status failed (error %d)\n", ret);
-+			kfree(status);
- 			return ret;
- 		}
- 
--		if (status != 0xff)
-+		if (*status != 0xff)
- 			break;
- 	}
- 
--	if (status == 0xff) {
-+	if (*status == 0xff) {
- 		dev_err(line6->ifcdev, "write failed after %d retries\n",
- 			count);
-+		kfree(status);
- 		return -EIO;
--	} else if (status != 0) {
-+	} else if (*status != 0) {
- 		dev_err(line6->ifcdev, "write failed (error %d)\n", ret);
-+		kfree(status);
- 		return -EIO;
- 	}
- 
-+	kfree(status);
-+
- 	return 0;
- }
- EXPORT_SYMBOL_GPL(line6_write_data);
-diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c
-index 6d4c50c..aa658c8 100644
---- a/sound/usb/line6/toneport.c
-+++ b/sound/usb/line6/toneport.c
-@@ -367,13 +367,19 @@ static bool toneport_has_source_select(struct usb_line6_toneport *toneport)
- */
- static void toneport_setup(struct usb_line6_toneport *toneport)
- {
--	int ticks;
-+	int *ticks;
- 	struct usb_line6 *line6 = &toneport->line6;
- 	struct usb_device *usbdev = line6->usbdev;
- 
-+	ticks = kmalloc(sizeof(int), GFP_KERNEL);
-+	if (ticks == NULL)
-+		return;
-+
- 	/* sync time on device with host: */
--	ticks = (int)get_seconds();
--	line6_write_data(line6, 0x80c6, &ticks, 4);
-+	*ticks = (int)get_seconds();
-+	line6_write_data(line6, 0x80c6, ticks, sizeof(int));
-+
-+	kfree(ticks);
- 
- 	/* enable device: */
- 	toneport_send_cmd(usbdev, 0x0301, 0x0000);
-diff --git a/tools/gcc/.gitignore b/tools/gcc/.gitignore
-new file mode 100644
-index 0000000..de92ed9
---- /dev/null
-+++ b/tools/gcc/.gitignore
-@@ -0,0 +1 @@
-+randomize_layout_seed.h
-diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
-new file mode 100644
-index 0000000..f1db084
---- /dev/null
-+++ b/tools/gcc/Makefile
-@@ -0,0 +1,58 @@
-+#CC := gcc
-+#PLUGIN_SOURCE_FILES := pax_plugin.c
-+#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
-+GCCPLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
-+#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W -std=gnu99
-+
-+ifeq ($(PLUGINCC),$(HOSTCC))
-+HOSTLIBS := hostlibs
-+HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(src) -std=gnu99 -ggdb -Wall -W
-+export HOST_EXTRACFLAGS
-+else
-+HOSTLIBS := hostcxxlibs
-+HOST_EXTRACXXFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(src) -std=gnu++98 -fno-rtti -fno-exceptions -fasynchronous-unwind-tables -ggdb -Wall -W -Wno-unused-parameter -Wno-narrowing -Wno-unused-variable
-+export HOST_EXTRACXXFLAGS
-+endif
-+
-+export GCCPLUGINS_DIR HOSTLIBS
-+
-+$(HOSTLIBS)-$(CONFIG_PAX_CONSTIFY_PLUGIN) := constify_plugin.so
-+$(HOSTLIBS)-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
-+$(HOSTLIBS)-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so
-+$(HOSTLIBS)-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so
-+$(HOSTLIBS)-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
-+$(HOSTLIBS)-y += colorize_plugin.so
-+$(HOSTLIBS)-$(CONFIG_PAX_LATENT_ENTROPY) += latent_entropy_plugin.so
-+$(HOSTLIBS)-$(CONFIG_PAX_MEMORY_STRUCTLEAK) += structleak_plugin.so
-+$(HOSTLIBS)-y += initify_plugin.so
-+$(HOSTLIBS)-$(CONFIG_GRKERNSEC_RANDSTRUCT) += randomize_layout_plugin.so
-+
-+subdir-$(CONFIG_PAX_SIZE_OVERFLOW) := size_overflow_plugin
-+subdir- += size_overflow_plugin
-+
-+subdir-$(CONFIG_PAX_RAP) += rap_plugin
-+subdir- += rap_plugin
-+
-+always := $($(HOSTLIBS)-y)
-+
-+constify_plugin-objs := constify_plugin.o
-+stackleak_plugin-objs := stackleak_plugin.o
-+kallocstat_plugin-objs := kallocstat_plugin.o
-+kernexec_plugin-objs := kernexec_plugin.o
-+checker_plugin-objs := checker_plugin.o
-+colorize_plugin-objs := colorize_plugin.o
-+latent_entropy_plugin-objs := latent_entropy_plugin.o
-+structleak_plugin-objs := structleak_plugin.o
-+initify_plugin-objs := initify_plugin.o
-+rap_plugin-objs := rap_plugin.o sip.o
-+randomize_layout_plugin-objs := randomize_layout_plugin.o
-+
-+$(obj)/randomize_layout_plugin.o: $(objtree)/$(obj)/randomize_layout_seed.h
-+
-+quiet_cmd_create_randomize_layout_seed = GENSEED  $@
-+      cmd_create_randomize_layout_seed = \
-+	$(CONFIG_SHELL) $(srctree)/$(src)/gen-random-seed.sh $@ $(objtree)/include/generated/randomize_layout_hash.h
-+$(objtree)/$(obj)/randomize_layout_seed.h: FORCE
-+	$(call if_changed,create_randomize_layout_seed)
-+
-+targets += randomize_layout_seed.h randomize_layout_hash.h
-diff --git a/tools/gcc/checker_plugin.c b/tools/gcc/checker_plugin.c
-new file mode 100644
-index 0000000..efaf576
---- /dev/null
-+++ b/tools/gcc/checker_plugin.c
-@@ -0,0 +1,496 @@
-+/*
-+ * Copyright 2011-2016 by the PaX Team <pageexec@××××××××.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ *       NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ *       but for the kernel it doesn't matter since it doesn't link against
-+ *       any of the gcc libraries
-+ *
-+ * gcc plugin to implement various sparse (source code checker) features
-+ *
-+ * TODO:
-+ * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch)
-+ *
-+ * BUGS:
-+ * - none known
-+ */
-+
-+#include "gcc-common.h"
-+
-+extern void c_register_addr_space (const char *str, addr_space_t as);
-+extern enum machine_mode default_addr_space_pointer_mode (addr_space_t);
-+extern enum machine_mode default_addr_space_address_mode (addr_space_t);
-+extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as);
-+extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as);
-+extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as);
-+
-+int plugin_is_GPL_compatible;
-+
-+static struct plugin_info checker_plugin_info = {
-+	.version	= "201602181345",
-+	.help		= "user\tturn on user/kernel address space checking\n"
-+			  "context\tturn on locking context checking\n"
-+};
-+
-+#define ADDR_SPACE_KERNEL		0
-+#define ADDR_SPACE_FORCE_KERNEL		1
-+#define ADDR_SPACE_USER			2
-+#define ADDR_SPACE_FORCE_USER		3
-+#define ADDR_SPACE_IOMEM		0
-+#define ADDR_SPACE_FORCE_IOMEM		0
-+#define ADDR_SPACE_PERCPU		0
-+#define ADDR_SPACE_FORCE_PERCPU		0
-+#define ADDR_SPACE_RCU			0
-+#define ADDR_SPACE_FORCE_RCU		0
-+
-+static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace)
-+{
-+	return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC);
-+}
-+
-+static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace)
-+{
-+	return default_addr_space_address_mode(ADDR_SPACE_GENERIC);
-+}
-+
-+static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as)
-+{
-+	return default_addr_space_valid_pointer_mode(mode, as);
-+}
-+
-+static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as)
-+{
-+	return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC);
-+}
-+
-+static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as)
-+{
-+	return default_addr_space_legitimize_address(x, oldx, mode, as);
-+}
-+
-+static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset)
-+{
-+	if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL)
-+		return true;
-+
-+	if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER)
-+		return true;
-+
-+	if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM)
-+		return true;
-+
-+	if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER)
-+		return true;
-+
-+	if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM)
-+		return true;
-+
-+	if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL)
-+		return true;
-+
-+	if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL)
-+		return true;
-+
-+	return subset == superset;
-+}
-+
-+static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type)
-+{
-+//	addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type));
-+//	addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type));
-+
-+	return op;
-+}
-+
-+static void register_checker_address_spaces(void *event_data, void *data)
-+{
-+	c_register_addr_space("__kernel", ADDR_SPACE_KERNEL);
-+	c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL);
-+	c_register_addr_space("__user", ADDR_SPACE_USER);
-+	c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER);
-+//	c_register_addr_space("__iomem", ADDR_SPACE_IOMEM);
-+//	c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM);
-+//	c_register_addr_space("__percpu", ADDR_SPACE_PERCPU);
-+//	c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU);
-+//	c_register_addr_space("__rcu", ADDR_SPACE_RCU);
-+//	c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU);
-+
-+	targetm.addr_space.pointer_mode		= checker_addr_space_pointer_mode;
-+	targetm.addr_space.address_mode		= checker_addr_space_address_mode;
-+	targetm.addr_space.valid_pointer_mode	= checker_addr_space_valid_pointer_mode;
-+	targetm.addr_space.legitimate_address_p	= checker_addr_space_legitimate_address_p;
-+//	targetm.addr_space.legitimize_address	= checker_addr_space_legitimize_address;
-+	targetm.addr_space.subset_p		= checker_addr_space_subset_p;
-+	targetm.addr_space.convert		= checker_addr_space_convert;
-+}
-+
-+static bool split_context_attribute(tree args, tree *lock, tree *in, tree *out)
-+{
-+	*in = TREE_VALUE(args);
-+
-+	if (TREE_CODE(*in) != INTEGER_CST) {
-+		*lock = *in;
-+		args = TREE_CHAIN(args);
-+		*in = TREE_VALUE(args);
-+	} else
-+		*lock = NULL_TREE;
-+
-+	args = TREE_CHAIN(args);
-+	if (*lock && !args)
-+		return false;
-+
-+	*out = TREE_VALUE(args);
-+	return true;
-+}
-+
-+static tree handle_context_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
-+{
-+	*no_add_attrs = true;
-+	tree lock, in, out;
-+
-+	if (TREE_CODE(*node) != FUNCTION_DECL) {
-+		error("%qE attribute applies to functions only (%qD)", name, *node);
-+		return NULL_TREE;
-+	}
-+
-+	if (!split_context_attribute(args, &lock, &in, &out)) {
-+		error("%qE attribute needs two integers after the lock expression", name);
-+		return NULL_TREE;
-+	}
-+
-+	if (TREE_CODE(in) != INTEGER_CST) {
-+		error("the 'in' argument of the %qE attribute must be an integer (%qE)", name, in);
-+		return NULL_TREE;
-+	}
-+
-+	if (TREE_CODE(out) != INTEGER_CST) {
-+		error("the 'out' argument of the %qE attribute must be an integer (%qE)", name, out);
-+		return NULL_TREE;
-+	}
-+
-+	*no_add_attrs = false;
-+	return NULL_TREE;
-+}
-+
-+static struct attribute_spec context_attr = {
-+	.name			= "context",
-+	.min_length		= 2,
-+	.max_length		= 3,
-+	.decl_required		= true,
-+	.type_required		= false,
-+	.function_type_required	= false,
-+	.handler		= handle_context_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+	.affects_type_identity	= true
-+#endif
-+};
-+
-+static void register_attributes(void *event_data, void *data)
-+{
-+	register_attribute(&context_attr);
-+}
-+
-+static const char context_function[] = "__context__";
-+static GTY(()) tree context_function_decl;
-+
-+static const char context_error[] = "__context_error__";
-+static GTY(()) tree context_error_decl;
-+
-+static void context_start_unit(void __unused *gcc_data, void __unused *user_data)
-+{
-+	tree fntype, attr;
-+
-+	// void __context__(void *, int);
-+	fntype = build_function_type_list(void_type_node, ptr_type_node, integer_type_node, NULL_TREE);
-+	context_function_decl = build_fn_decl(context_function, fntype);
-+
-+	TREE_PUBLIC(context_function_decl) = 1;
-+	TREE_USED(context_function_decl) = 1;
-+	DECL_EXTERNAL(context_function_decl) = 1;
-+	DECL_ARTIFICIAL(context_function_decl) = 1;
-+	DECL_PRESERVE_P(context_function_decl) = 1;
-+//	TREE_NOTHROW(context_function_decl) = 1;
-+//	DECL_UNINLINABLE(context_function_decl) = 1;
-+	DECL_ASSEMBLER_NAME(context_function_decl); // for LTO
-+	lang_hooks.decls.pushdecl(context_function_decl);
-+
-+	// void __context_error__(const void *, int) __attribute__((error("context error")));
-+	fntype = build_function_type_list(void_type_node, const_ptr_type_node, integer_type_node, NULL_TREE);
-+	context_error_decl = build_fn_decl(context_error, fntype);
-+
-+	TREE_PUBLIC(context_error_decl) = 1;
-+	TREE_USED(context_error_decl) = 1;
-+	DECL_EXTERNAL(context_error_decl) = 1;
-+	DECL_ARTIFICIAL(context_error_decl) = 1;
-+	DECL_PRESERVE_P(context_error_decl) = 1;
-+//	TREE_NOTHROW(context_error_decl) = 1;
-+//	DECL_UNINLINABLE(context_error_decl) = 1;
-+	TREE_THIS_VOLATILE(context_error_decl) = 1;
-+	DECL_ASSEMBLER_NAME(context_error_decl);
-+
-+	attr = tree_cons(NULL, build_string(14, "context error"), NULL);
-+	attr = tree_cons(get_identifier("error"), attr, NULL);
-+	decl_attributes(&context_error_decl, attr, 0);
-+}
-+
-+static bool context_gate(void)
-+{
-+	tree context_attr;
-+
-+return true;
-+
-+	context_attr = lookup_attribute("context", DECL_ATTRIBUTES(current_function_decl));
-+	return context_attr != NULL_TREE;
-+}
-+
-+static basic_block verify_context_before(gimple_stmt_iterator *gsi, tree context, tree inout, tree error)
-+{
-+	gimple stmt;
-+	basic_block cond_bb, join_bb, true_bb;
-+	edge e;
-+	location_t loc;
-+	const char *file;
-+	int line;
-+	size_t len;
-+	tree filename;
-+
-+	stmt = gsi_stmt(*gsi);
-+	if (gimple_has_location(stmt)) {
-+		loc = gimple_location(stmt);
-+		file = gimple_filename(stmt);
-+		line = gimple_lineno(stmt);
-+	} else {
-+		loc = DECL_SOURCE_LOCATION(current_function_decl);
-+		file = DECL_SOURCE_FILE(current_function_decl);
-+		line = DECL_SOURCE_LINE(current_function_decl);
-+	}
-+	gcc_assert(file);
-+
-+	// if (context != count) __context_error__(__FILE__, __LINE__);
-+	stmt = gimple_build_cond(NE_EXPR, context, inout, NULL_TREE, NULL_TREE);
-+	gimple_set_location(stmt, loc);
-+	gsi_insert_before(gsi, stmt, GSI_NEW_STMT);
-+
-+	cond_bb = gsi_bb(*gsi);
-+	gcc_assert(!gsi_end_p(*gsi));
-+	gcc_assert(stmt == gsi_stmt(*gsi));
-+
-+	e = split_block(cond_bb, gsi_stmt(*gsi));
-+	cond_bb = e->src;
-+	join_bb = e->dest;
-+	e->flags = EDGE_FALSE_VALUE;
-+	e->probability = REG_BR_PROB_BASE;
-+
-+	true_bb = create_empty_bb(EXIT_BLOCK_PTR_FOR_FN(cfun)->prev_bb);
-+	make_edge(cond_bb, true_bb, EDGE_TRUE_VALUE);
-+	make_edge(true_bb, join_bb, EDGE_FALLTHRU);
-+
-+	set_immediate_dominator(CDI_DOMINATORS, true_bb, cond_bb);
-+	set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
-+
-+	gcc_assert(cond_bb->loop_father == join_bb->loop_father);
-+	add_bb_to_loop(true_bb, cond_bb->loop_father);
-+
-+	// insert call to builtin_trap or __context_error__
-+	*gsi = gsi_start_bb(true_bb);
-+
-+//	stmt = gimple_build_call(builtin_decl_implicit(BUILT_IN_TRAP), 0);
-+	len = strlen(file) + 1;
-+	filename = build_string(len, file);
-+	TREE_TYPE(filename) = build_array_type(unsigned_char_type_node, build_index_type(size_int(len)));
-+	filename = build1(ADDR_EXPR, const_ptr_type_node, filename);
-+	stmt = gimple_build_call(error, 2, filename, build_int_cst(NULL_TREE, line));
-+	gimple_set_location(stmt, loc);
-+	gsi_insert_after(gsi, stmt, GSI_CONTINUE_LINKING);
-+
-+	*gsi = gsi_start_nondebug_bb(join_bb);
-+	return join_bb;
-+}
-+
-+static void update_context(gimple_stmt_iterator *gsi, tree context, int diff)
-+{
-+	gimple assign;
-+	tree op;
-+
-+	op = fold_build2_loc(UNKNOWN_LOCATION, PLUS_EXPR, integer_type_node, context, build_int_cst(integer_type_node, diff));
-+	assign = gimple_build_assign(context, op);
-+	gsi_insert_after(gsi, assign, GSI_NEW_STMT);
-+	update_stmt(assign);
-+}
-+
-+static basic_block track_context(basic_block bb, tree context)
-+{
-+	gimple_stmt_iterator gsi;
-+	gimple assign;
-+
-+	// adjust context according to the context information on any call stmt
-+	for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+		gimple stmt = gsi_stmt(gsi);
-+		tree fndecl, context_attr;
-+		tree lock, in, out;
-+		int incount, outcount;
-+
-+		if (!is_gimple_call(stmt))
-+			continue;
-+
-+		fndecl = gimple_call_fndecl(stmt);
-+		if (!fndecl)
-+			continue;
-+
-+		if (fndecl == context_function_decl) {
-+			unsigned int num_ops = gimple_num_ops(stmt);
-+			int diff = tree_to_shwi(gimple_op(stmt, num_ops - 1));
-+
-+			gcc_assert(diff);
-+			update_context(&gsi, context, diff);
-+			continue;
-+		}
-+
-+		context_attr = lookup_attribute("context", DECL_ATTRIBUTES(fndecl));
-+		if (!context_attr)
-+			continue;
-+
-+		gcc_assert(split_context_attribute(TREE_VALUE(context_attr), &lock, &in, &out));
-+		incount = tree_to_shwi(in);
-+		outcount = tree_to_shwi(out);
-+		bb = verify_context_before(&gsi, context, in, context_error_decl);
-+		update_context(&gsi, context, outcount - incount);
-+	}
-+
-+	return bb;
-+}
-+
-+static bool bb_any_loop(basic_block bb)
-+{
-+	return bb_loop_depth(bb) || (bb->flags & BB_IRREDUCIBLE_LOOP);
-+}
-+
-+static unsigned int context_execute(void)
-+{
-+	basic_block bb;
-+	gimple assign;
-+	gimple_stmt_iterator gsi;
-+	tree context_attr, context;
-+	tree lock, in, out;
-+
-+	loop_optimizer_init(LOOPS_NORMAL | LOOPS_HAVE_RECORDED_EXITS);
-+	gcc_assert(current_loops);
-+
-+	calculate_dominance_info(CDI_DOMINATORS);
-+	calculate_dominance_info(CDI_POST_DOMINATORS);
-+
-+	context_attr = lookup_attribute("context", DECL_ATTRIBUTES(current_function_decl));
-+	if (context_attr) {
-+		gcc_assert(split_context_attribute(TREE_VALUE(context_attr), &lock, &in, &out));
-+	} else {
-+		in = out = integer_zero_node;
-+	}
-+
-+	// 1. create local context variable
-+	context = create_tmp_var(integer_type_node, "context");
-+	add_referenced_var(context);
-+	mark_sym_for_renaming(context);
-+
-+	// 2. initialize local context variable
-+	gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
-+	bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
-+	if (!single_pred_p(bb)) {
-+		gcc_assert(bb_any_loop(bb));
-+		split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
-+		bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
-+	}
-+	gsi = gsi_start_bb(bb);
-+	assign = gimple_build_assign(context, in);
-+	gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
-+	update_stmt(assign);
-+
-+	// 3. instrument each BB to track the local context variable
-+	FOR_EACH_BB_FN(bb, cfun) {
-+		bb = track_context(bb, context);
-+	}
-+
-+	// 4. verify the local context variable against the expected state
-+	if (EDGE_COUNT(EXIT_BLOCK_PTR_FOR_FN(cfun)->preds)) {
-+		gcc_assert(single_pred_p(EXIT_BLOCK_PTR_FOR_FN(cfun)));
-+		gsi = gsi_last_nondebug_bb(single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun)));
-+		verify_context_before(&gsi, context, out, context_error_decl);
-+	}
-+
-+	free_dominance_info(CDI_DOMINATORS);
-+	free_dominance_info(CDI_POST_DOMINATORS);
-+	loop_optimizer_finalize();
-+	return 0;
-+}
-+
-+#define PASS_NAME context
-+#define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
-+//#define TODO_FLAGS_START TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts
-+#define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_verify_flow | TODO_update_ssa
-+#include "gcc-generate-gimple-pass.h"
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+	const char * const plugin_name = plugin_info->base_name;
-+	const int argc = plugin_info->argc;
-+	const struct plugin_argument * const argv = plugin_info->argv;
-+	int i;
-+	bool enable_user, enable_context;
-+	struct register_pass_info context_pass_info;
-+
-+	static const struct ggc_root_tab gt_ggc_r_gt_checker[] = {
-+		{
-+			.base = &context_function_decl,
-+			.nelt = 1,
-+			.stride = sizeof(context_function_decl),
-+			.cb = &gt_ggc_mx_tree_node,
-+			.pchw = &gt_pch_nx_tree_node
-+		},
-+		{
-+			.base = &context_error_decl,
-+			.nelt = 1,
-+			.stride = sizeof(context_error_decl),
-+			.cb = &gt_ggc_mx_tree_node,
-+			.pchw = &gt_pch_nx_tree_node
-+		},
-+		LAST_GGC_ROOT_TAB
-+	};
-+
-+	context_pass_info.pass				= make_context_pass();
-+//	context_pass_info.reference_pass_name		= "ssa";
-+	context_pass_info.reference_pass_name		= "phiprop";
-+	context_pass_info.ref_pass_instance_number	= 1;
-+	context_pass_info.pos_op 			= PASS_POS_INSERT_AFTER;
-+
-+	if (!plugin_default_version_check(version, &gcc_version)) {
-+		error(G_("incompatible gcc/plugin versions"));
-+		return 1;
-+	}
-+
-+	register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info);
-+
-+	enable_user = false;
-+	enable_context = false;
-+	for (i = 0; i < argc; ++i) {
-+		if (!strcmp(argv[i].key, "user")) {
-+			enable_user = true;
-+			continue;
-+		}
-+		if (!strcmp(argv[i].key, "context")) {
-+			enable_context = true;
-+			continue;
-+		}
-+		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+	}
-+
-+	if (enable_user)
-+		register_callback(plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL);
-+	if (enable_context) {
-+		register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
-+		register_callback(plugin_name, PLUGIN_START_UNIT, context_start_unit, NULL);
-+		register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_checker);
-+		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &context_pass_info);
-+	}
-+
-+	return 0;
-+}
-diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
-new file mode 100644
-index 0000000..ffe60f6
---- /dev/null
-+++ b/tools/gcc/colorize_plugin.c
-@@ -0,0 +1,162 @@
-+/*
-+ * Copyright 2012-2016 by PaX Team <pageexec@××××××××.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ *       NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ *       but for the kernel it doesn't matter since it doesn't link against
-+ *       any of the gcc libraries
-+ *
-+ * gcc plugin to colorize diagnostic output
-+ *
-+ */
-+
-+#include "gcc-common.h"
-+
-+int plugin_is_GPL_compatible;
-+
-+static struct plugin_info colorize_plugin_info = {
-+	.version	= "201602181345",
-+	.help		= "color=[never|always|auto]\tdetermine when to colorize\n",
-+};
-+
-+#define GREEN		"\033[32m\033[K"
-+#define LIGHTGREEN	"\033[1;32m\033[K"
-+#define YELLOW		"\033[33m\033[K"
-+#define LIGHTYELLOW	"\033[1;33m\033[K"
-+#define RED		"\033[31m\033[K"
-+#define LIGHTRED	"\033[1;31m\033[K"
-+#define BLUE		"\033[34m\033[K"
-+#define LIGHTBLUE	"\033[1;34m\033[K"
-+#define BRIGHT		"\033[1;m\033[K"
-+#define NORMAL		"\033[m\033[K"
-+
-+static diagnostic_starter_fn old_starter;
-+static diagnostic_finalizer_fn old_finalizer;
-+
-+static void start_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
-+{
-+	const char *color;
-+	char *newprefix;
-+
-+	switch (diagnostic->kind) {
-+	case DK_NOTE:
-+		color = LIGHTBLUE;
-+		break;
-+
-+	case DK_PEDWARN:
-+	case DK_WARNING:
-+		color = LIGHTYELLOW;
-+		break;
-+
-+	case DK_ERROR:
-+	case DK_FATAL:
-+	case DK_ICE:
-+	case DK_PERMERROR:
-+	case DK_SORRY:
-+		color = LIGHTRED;
-+		break;
-+
-+	default:
-+		color = NORMAL;
-+	}
-+
-+	old_starter(context, diagnostic);
-+	if (-1 == asprintf(&newprefix, "%s%s" NORMAL, color, context->printer->prefix))
-+		return;
-+	pp_destroy_prefix(context->printer);
-+	pp_set_prefix(context->printer, newprefix);
-+}
-+
-+static void finalize_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
-+{
-+	old_finalizer(context, diagnostic);
-+}
-+
-+static void colorize_arm(void)
-+{
-+	old_starter = diagnostic_starter(global_dc);
-+	old_finalizer = diagnostic_finalizer(global_dc);
-+
-+	diagnostic_starter(global_dc) = start_colorize;
-+	diagnostic_finalizer(global_dc) = finalize_colorize;
-+}
-+
-+static unsigned int colorize_rearm_execute(void)
-+{
-+	if (diagnostic_starter(global_dc) == start_colorize)
-+		return 0;
-+
-+	colorize_arm();
-+	return 0;
-+}
-+
-+#define PASS_NAME colorize_rearm
-+#define NO_GATE
-+#include "gcc-generate-simple_ipa-pass.h"
-+
-+static void colorize_start_unit(void *gcc_data, void *user_data)
-+{
-+	colorize_arm();
-+}
-+
-+static bool should_colorize(void)
-+{
-+#if BUILDING_GCC_VERSION >= 4009
-+	return false;
-+#else
-+	char const *t = getenv("TERM");
-+
-+	return t && strcmp(t, "dumb") && isatty(STDERR_FILENO);
-+#endif
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+	const char * const plugin_name = plugin_info->base_name;
-+	const int argc = plugin_info->argc;
-+	const struct plugin_argument * const argv = plugin_info->argv;
-+	int i;
-+	struct register_pass_info colorize_rearm_pass_info;
-+	bool colorize;
-+
-+	colorize_rearm_pass_info.pass				= make_colorize_rearm_pass();
-+	colorize_rearm_pass_info.reference_pass_name		= "*free_lang_data";
-+	colorize_rearm_pass_info.ref_pass_instance_number	= 1;
-+	colorize_rearm_pass_info.pos_op 			= PASS_POS_INSERT_AFTER;
-+
-+	if (!plugin_default_version_check(version, &gcc_version)) {
-+		error(G_("incompatible gcc/plugin versions"));
-+		return 1;
-+	}
-+
-+	register_callback(plugin_name, PLUGIN_INFO, NULL, &colorize_plugin_info);
-+
-+	colorize = getenv("GCC_COLORS") ? should_colorize() : false;
-+
-+	for (i = 0; i < argc; ++i) {
-+		if (!strcmp(argv[i].key, "color")) {
-+			if (!argv[i].value) {
-+				error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+				continue;
-+			}
-+			if (!strcmp(argv[i].value, "always"))
-+				colorize = true;
-+			else if (!strcmp(argv[i].value, "never"))
-+				colorize = false;
-+			else if (!strcmp(argv[i].value, "auto"))
-+				colorize = should_colorize();
-+			else
-+				error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
-+			continue;
-+		}
-+		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+	}
-+
-+	if (colorize) {
-+		// TODO: parse GCC_COLORS as used by gcc 4.9+
-+		register_callback(plugin_name, PLUGIN_START_UNIT, &colorize_start_unit, NULL);
-+		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &colorize_rearm_pass_info);
-+	}
-+	return 0;
-+}
-diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
-new file mode 100644
-index 0000000..b52a700
---- /dev/null
-+++ b/tools/gcc/constify_plugin.c
-@@ -0,0 +1,521 @@
-+/*
-+ * Copyright 2011 by Emese Revfy <re.emese@×××××.com>
-+ * Copyright 2011-2016 by PaX Team <pageexec@××××××××.hu>
-+ * Licensed under the GPL v2, or (at your option) v3
-+ *
-+ * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
-+ *
-+ * Homepage:
-+ * http://www.grsecurity.net/~ephox/const_plugin/
-+ *
-+ * Usage:
-+ * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
-+ * $ gcc -fplugin=constify_plugin.so test.c -O2
-+ */
-+
-+#include "gcc-common.h"
-+
-+// unused C type flag in all versions 4.5-6
-+#define TYPE_CONSTIFY_VISITED(TYPE) TYPE_LANG_FLAG_4(TYPE)
-+
-+int plugin_is_GPL_compatible;
-+
-+static bool constify = true;
-+
-+static struct plugin_info const_plugin_info = {
-+	.version	= "201602181345",
-+	.help		= "no-constify\tturn off constification\n",
-+};
-+
-+typedef struct {
-+	bool has_fptr_field;
-+	bool has_writable_field;
-+	bool has_do_const_field;
-+	bool has_no_const_field;
-+} constify_info;
-+
-+static const_tree get_field_type(const_tree field)
-+{
-+	return strip_array_types(TREE_TYPE(field));
-+}
-+
-+static bool is_fptr(const_tree field)
-+{
-+	const_tree ptr = get_field_type(field);
-+
-+	if (TREE_CODE(ptr) != POINTER_TYPE)
-+		return false;
-+
-+	return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
-+}
-+
-+/*
-+ * determine whether the given structure type meets the requirements for automatic constification,
-+ * including the constification attributes on nested structure types
-+ */
-+static void constifiable(const_tree node, constify_info *cinfo)
-+{
-+	const_tree field;
-+
-+	gcc_assert(TREE_CODE(node) == RECORD_TYPE || TREE_CODE(node) == UNION_TYPE);
-+
-+	// e.g., pointer to structure fields while still constructing the structure type
-+	if (TYPE_FIELDS(node) == NULL_TREE)
-+		return;
-+
-+	for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
-+		const_tree type = get_field_type(field);
-+		enum tree_code code = TREE_CODE(type);
-+
-+		if (node == type)
-+			continue;
-+
-+		if (is_fptr(field))
-+			cinfo->has_fptr_field = true;
-+		else if (code == RECORD_TYPE || code == UNION_TYPE) {
-+			if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type)))
-+				cinfo->has_do_const_field = true;
-+			else if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type)))
-+				cinfo->has_no_const_field = true;
-+			else
-+				constifiable(type, cinfo);
-+		} else if (!TREE_READONLY(field))
-+			cinfo->has_writable_field = true;
-+	}
-+}
-+
-+static bool constified(const_tree node)
-+{
-+	constify_info cinfo = {
-+		.has_fptr_field = false,
-+		.has_writable_field = false,
-+		.has_do_const_field = false,
-+		.has_no_const_field = false
-+	};
-+
-+	gcc_assert(TREE_CODE(node) == RECORD_TYPE || TREE_CODE(node) == UNION_TYPE);
-+
-+	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node))) {
-+//		gcc_assert(!TYPE_READONLY(node));
-+		return false;
-+	}
-+
-+	if (lookup_attribute("do_const", TYPE_ATTRIBUTES(node))) {
-+		gcc_assert(TYPE_READONLY(node));
-+		return true;
-+	}
-+
-+	constifiable(node, &cinfo);
-+	if ((!cinfo.has_fptr_field || cinfo.has_writable_field || cinfo.has_no_const_field) && !cinfo.has_do_const_field)
-+		return false;
-+
-+	return TYPE_READONLY(node);
-+}
-+
-+static void deconstify_tree(tree node);
-+
-+static void deconstify_type(tree type)
-+{
-+	tree field;
-+
-+	gcc_assert(TREE_CODE(type) == RECORD_TYPE || TREE_CODE(type) == UNION_TYPE);
-+
-+	for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
-+		const_tree fieldtype = get_field_type(field);
-+
-+		// special case handling of simple ptr-to-same-array-type members
-+		if (TREE_CODE(TREE_TYPE(field)) == POINTER_TYPE) {
-+			tree ptrtype = TREE_TYPE(TREE_TYPE(field));
-+
-+			if (TREE_TYPE(TREE_TYPE(field)) == type)
-+				continue;
-+			if (TREE_CODE(ptrtype) != RECORD_TYPE && TREE_CODE(ptrtype) != UNION_TYPE)
-+				continue;
-+			if (!constified(ptrtype))
-+				continue;
-+			if (TYPE_MAIN_VARIANT(ptrtype) == TYPE_MAIN_VARIANT(type)) {
-+				TREE_TYPE(field) = copy_node(TREE_TYPE(field));
-+				TREE_TYPE(TREE_TYPE(field)) = build_qualified_type(type, TYPE_QUALS(ptrtype) & ~TYPE_QUAL_CONST);
-+			}
-+			continue;
-+		}
-+		if (TREE_CODE(fieldtype) != RECORD_TYPE && TREE_CODE(fieldtype) != UNION_TYPE)
-+			continue;
-+		if (!constified(fieldtype))
-+			continue;
-+
-+		deconstify_tree(field);
-+		TREE_READONLY(field) = 0;
-+	}
-+	TYPE_READONLY(type) = 0;
-+	C_TYPE_FIELDS_READONLY(type) = 0;
-+	if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type))) {
-+		TYPE_ATTRIBUTES(type) = copy_list(TYPE_ATTRIBUTES(type));
-+		TYPE_ATTRIBUTES(type) = remove_attribute("do_const", TYPE_ATTRIBUTES(type));
-+	}
-+}
-+
-+static void deconstify_tree(tree node)
-+{
-+	tree old_type, new_type, field;
-+
-+	old_type = TREE_TYPE(node);
-+	while (TREE_CODE(old_type) == ARRAY_TYPE && TREE_CODE(TREE_TYPE(old_type)) != ARRAY_TYPE) {
-+		node = TREE_TYPE(node) = copy_node(old_type);
-+		old_type = TREE_TYPE(old_type);
-+	}
-+
-+	gcc_assert(TREE_CODE(old_type) == RECORD_TYPE || TREE_CODE(old_type) == UNION_TYPE);
-+	gcc_assert(TYPE_READONLY(old_type) && (TYPE_QUALS(old_type) & TYPE_QUAL_CONST));
-+
-+	new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
-+	TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
-+	for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
-+		DECL_FIELD_CONTEXT(field) = new_type;
-+
-+	deconstify_type(new_type);
-+
-+	TREE_TYPE(node) = new_type;
-+}
-+
-+static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
-+{
-+	tree type;
-+	constify_info cinfo = {
-+		.has_fptr_field = false,
-+		.has_writable_field = false,
-+		.has_do_const_field = false,
-+		.has_no_const_field = false
-+	};
-+
-+	*no_add_attrs = true;
-+	if (TREE_CODE(*node) == FUNCTION_DECL) {
-+		error("%qE attribute does not apply to functions (%qF)", name, *node);
-+		return NULL_TREE;
-+	}
-+
-+	if (TREE_CODE(*node) == PARM_DECL) {
-+		error("%qE attribute does not apply to function parameters (%qD)", name, *node);
-+		return NULL_TREE;
-+	}
-+
-+	if (TREE_CODE(*node) == VAR_DECL) {
-+		error("%qE attribute does not apply to variables (%qD)", name, *node);
-+		return NULL_TREE;
-+	}
-+
-+	if (TYPE_P(*node)) {
-+		type = *node;
-+	} else {
-+		if (TREE_CODE(*node) != TYPE_DECL) {
-+			error("%qE attribute does not apply to %qD (%qT)", name, *node, TREE_TYPE(*node));
-+			return NULL_TREE;
-+		}
-+		type = TREE_TYPE(*node);
-+	}
-+
-+	if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE) {
-+		error("%qE attribute used on %qT applies to struct and union types only", name, type);
-+		return NULL_TREE;
-+	}
-+
-+	if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
-+		error("%qE attribute is already applied to the type %qT", name, type);
-+		return NULL_TREE;
-+	}
-+
-+	if (TYPE_P(*node)) {
-+		if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type)))
-+			error("%qE attribute used on type %qT is incompatible with 'do_const'", name, type);
-+		else
-+			*no_add_attrs = false;
-+		return NULL_TREE;
-+	}
-+
-+	constifiable(type, &cinfo);
-+	if ((cinfo.has_fptr_field && !cinfo.has_writable_field && !cinfo.has_no_const_field) || lookup_attribute("do_const", TYPE_ATTRIBUTES(type))) {
-+		if (constify) {
-+			if TYPE_P(*node)
-+				deconstify_type(*node);
-+			else
-+				deconstify_tree(*node);
-+		}
-+		if (TYPE_P(*node))
-+			TYPE_CONSTIFY_VISITED(*node) = 1;
-+		else
-+			TYPE_CONSTIFY_VISITED(TREE_TYPE(*node)) = 1;
-+		return NULL_TREE;
-+	}
-+
-+	if (constify && TYPE_FIELDS(type))
-+		error("%qE attribute used on type %qT that is not constified", name, type);
-+	return NULL_TREE;
-+}
-+
-+static void constify_type(tree type)
-+{
-+	TYPE_READONLY(type) = 1;
-+	C_TYPE_FIELDS_READONLY(type) = 1;
-+	TYPE_CONSTIFY_VISITED(type) = 1;
-+//	TYPE_ATTRIBUTES(type) = copy_list(TYPE_ATTRIBUTES(type));
-+//	TYPE_ATTRIBUTES(type) = tree_cons(get_identifier("do_const"), NULL_TREE, TYPE_ATTRIBUTES(type));
-+}
-+
-+static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
-+{
-+	*no_add_attrs = true;
-+	if (!TYPE_P(*node)) {
-+		error("%qE attribute applies to types only (%qD)", name, *node);
-+		return NULL_TREE;
-+	}
-+
-+	if (TREE_CODE(*node) != RECORD_TYPE && TREE_CODE(*node) != UNION_TYPE) {
-+		error("%qE attribute used on %qT applies to struct and union types only", name, *node);
-+		return NULL_TREE;
-+	}
-+
-+	if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(*node))) {
-+		error("%qE attribute used on %qT is already applied to the type", name, *node);
-+		return NULL_TREE;
-+	}
-+
-+	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(*node))) {
-+		error("%qE attribute used on %qT is incompatible with 'no_const'", name, *node);
-+		return NULL_TREE;
-+	}
-+
-+	*no_add_attrs = false;
-+	return NULL_TREE;
-+}
-+
-+static struct attribute_spec no_const_attr = {
-+	.name			= "no_const",
-+	.min_length		= 0,
-+	.max_length		= 0,
-+	.decl_required		= false,
-+	.type_required		= false,
-+	.function_type_required	= false,
-+	.handler		= handle_no_const_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+	.affects_type_identity	= true
-+#endif
-+};
-+
-+static struct attribute_spec do_const_attr = {
-+	.name			= "do_const",
-+	.min_length		= 0,
-+	.max_length		= 0,
-+	.decl_required		= false,
-+	.type_required		= false,
-+	.function_type_required	= false,
-+	.handler		= handle_do_const_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+	.affects_type_identity	= true
-+#endif
-+};
-+
-+static void register_attributes(void *event_data, void *data)
-+{
-+	register_attribute(&no_const_attr);
-+	register_attribute(&do_const_attr);
-+}
-+
-+static void finish_type(void *event_data, void *data)
-+{
-+	tree type = (tree)event_data;
-+	constify_info cinfo = {
-+		.has_fptr_field = false,
-+		.has_writable_field = false,
-+		.has_do_const_field = false,
-+		.has_no_const_field = false
-+	};
-+
-+	if (type == NULL_TREE || type == error_mark_node)
-+		return;
-+
-+#if BUILDING_GCC_VERSION >= 5000
-+	if (TREE_CODE(type) == ENUMERAL_TYPE)
-+		return;
-+#endif
-+
-+	if (TYPE_FIELDS(type) == NULL_TREE || TYPE_CONSTIFY_VISITED(type))
-+		return;
-+
-+	constifiable(type, &cinfo);
-+
-+	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type))) {
-+		if ((cinfo.has_fptr_field && !cinfo.has_writable_field && !cinfo.has_no_const_field) || cinfo.has_do_const_field) {
-+			deconstify_type(type);
-+			TYPE_CONSTIFY_VISITED(type) = 1;
-+		} else
-+			error("'no_const' attribute used on type %qT that is not constified", type);
-+		return;
-+	}
-+
-+	if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type))) {
-+		if (!cinfo.has_writable_field && !cinfo.has_no_const_field) {
-+			error("'do_const' attribute used on type %qT that is%sconstified", type, cinfo.has_fptr_field ? " " : " not ");
-+			return;
-+		}
-+		constify_type(type);
-+		return;
-+	}
-+
-+	if (cinfo.has_fptr_field && !cinfo.has_writable_field && !cinfo.has_no_const_field) {
-+		if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type))) {
-+			error("'do_const' attribute used on type %qT that is constified", type);
-+			return;
-+		}
-+		constify_type(type);
-+		return;
-+	}
-+
-+	deconstify_type(type);
-+	TYPE_CONSTIFY_VISITED(type) = 1;
-+}
-+
-+static void check_global_variables(void *event_data, void *data)
-+{
-+	varpool_node_ptr node;
-+
-+	FOR_EACH_VARIABLE(node) {
-+		tree var = NODE_DECL(node);
-+		tree type = TREE_TYPE(var);
-+
-+		if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
-+			continue;
-+
-+		if (!TYPE_READONLY(type) || !C_TYPE_FIELDS_READONLY(type))
-+			continue;
-+
-+		if (!TYPE_CONSTIFY_VISITED(type))
-+			continue;
-+
-+		if (DECL_EXTERNAL(var))
-+			continue;
-+
-+		if (DECL_INITIAL(var))
-+			continue;
-+
-+		// this works around a gcc bug/feature where uninitialized globals
-+		// are moved into the .bss section regardless of any constification
-+		DECL_INITIAL(var) = build_constructor(type, NULL);
-+//		inform(DECL_SOURCE_LOCATION(var), "constified variable %qE moved into .rodata", var);
-+	}
-+}
-+
-+static unsigned int check_local_variables_execute(void)
-+{
-+	unsigned int ret = 0;
-+	tree var;
-+
-+	unsigned int i;
-+
-+	FOR_EACH_LOCAL_DECL(cfun, i, var) {
-+		tree type = TREE_TYPE(var);
-+
-+		gcc_assert(DECL_P(var));
-+		if (is_global_var(var))
-+			continue;
-+
-+		if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
-+			continue;
-+
-+		if (!TYPE_READONLY(type) || !C_TYPE_FIELDS_READONLY(type))
-+			continue;
-+
-+		if (!TYPE_CONSTIFY_VISITED(type))
-+			continue;
-+
-+		error_at(DECL_SOURCE_LOCATION(var), "constified variable %qE cannot be local", var);
-+		ret = 1;
-+	}
-+	return ret;
-+}
-+
-+#define PASS_NAME check_local_variables
-+#define NO_GATE
-+#include "gcc-generate-gimple-pass.h"
-+
-+static struct {
-+	const char *name;
-+	const char *asm_op;
-+} sections[] = {
-+	{".init.rodata",     "\t.section\t.init.rodata,\"a\""},
-+	{".ref.rodata",      "\t.section\t.ref.rodata,\"a\""},
-+	{".devinit.rodata",  "\t.section\t.devinit.rodata,\"a\""},
-+	{".devexit.rodata",  "\t.section\t.devexit.rodata,\"a\""},
-+	{".cpuinit.rodata",  "\t.section\t.cpuinit.rodata,\"a\""},
-+	{".cpuexit.rodata",  "\t.section\t.cpuexit.rodata,\"a\""},
-+	{".meminit.rodata",  "\t.section\t.meminit.rodata,\"a\""},
-+	{".memexit.rodata",  "\t.section\t.memexit.rodata,\"a\""},
-+	{".data..read_only", "\t.section\t.data..read_only,\"a\""},
-+};
-+
-+static unsigned int (*old_section_type_flags)(tree decl, const char *name, int reloc);
-+
-+static unsigned int constify_section_type_flags(tree decl, const char *name, int reloc)
-+{
-+	size_t i;
-+
-+	for (i = 0; i < ARRAY_SIZE(sections); i++)
-+		if (!strcmp(sections[i].name, name))
-+			return 0;
-+	return old_section_type_flags(decl, name, reloc);
-+}
-+
-+static void constify_start_unit(void *gcc_data, void *user_data)
-+{
-+//	size_t i;
-+
-+//	for (i = 0; i < ARRAY_SIZE(sections); i++)
-+//		sections[i].section = get_unnamed_section(0, output_section_asm_op, sections[i].asm_op);
-+//		sections[i].section = get_section(sections[i].name, 0, NULL);
-+
-+	old_section_type_flags = targetm.section_type_flags;
-+	targetm.section_type_flags = constify_section_type_flags;
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+	const char * const plugin_name = plugin_info->base_name;
-+	const int argc = plugin_info->argc;
-+	const struct plugin_argument * const argv = plugin_info->argv;
-+	int i;
-+
-+	struct register_pass_info check_local_variables_pass_info;
-+
-+	check_local_variables_pass_info.pass				= make_check_local_variables_pass();
-+	check_local_variables_pass_info.reference_pass_name		= "ssa";
-+	check_local_variables_pass_info.ref_pass_instance_number	= 1;
-+	check_local_variables_pass_info.pos_op				= PASS_POS_INSERT_BEFORE;
-+
-+	if (!plugin_default_version_check(version, &gcc_version)) {
-+		error(G_("incompatible gcc/plugin versions"));
-+		return 1;
-+	}
-+
-+	for (i = 0; i < argc; ++i) {
-+		if (!(strcmp(argv[i].key, "no-constify"))) {
-+			constify = false;
-+			continue;
-+		}
-+		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+	}
-+
-+	if (strncmp(lang_hooks.name, "GNU C", 5) && !strncmp(lang_hooks.name, "GNU C+", 6)) {
-+		inform(UNKNOWN_LOCATION, G_("%s supports C only, not %s"), plugin_name, lang_hooks.name);
-+		constify = false;
-+	}
-+
-+	register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
-+	if (constify) {
-+		register_callback(plugin_name, PLUGIN_ALL_IPA_PASSES_START, check_global_variables, NULL);
-+		register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
-+		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &check_local_variables_pass_info);
-+		register_callback(plugin_name, PLUGIN_START_UNIT, constify_start_unit, NULL);
-+	}
-+	register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
-+
-+	return 0;
-+}
-diff --git a/tools/gcc/gcc-common.h b/tools/gcc/gcc-common.h
-new file mode 100644
-index 0000000..0c0b842
---- /dev/null
-+++ b/tools/gcc/gcc-common.h
-@@ -0,0 +1,879 @@
-+#ifndef GCC_COMMON_H_INCLUDED
-+#define GCC_COMMON_H_INCLUDED
-+
-+#include "bversion.h"
-+#if BUILDING_GCC_VERSION >= 6000
-+#include "gcc-plugin.h"
-+#else
-+#include "plugin.h"
-+#endif
-+#include "plugin-version.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tm.h"
-+#include "line-map.h"
-+#include "input.h"
-+#include "tree.h"
-+
-+#include "tree-inline.h"
-+#include "version.h"
-+#include "rtl.h"
-+#include "tm_p.h"
-+#include "flags.h"
-+//#include "insn-attr.h"
-+//#include "insn-config.h"
-+//#include "insn-flags.h"
-+#include "hard-reg-set.h"
-+//#include "recog.h"
-+#include "output.h"
-+#include "except.h"
-+#include "function.h"
-+#include "toplev.h"
-+//#include "expr.h"
-+#include "basic-block.h"
-+#include "intl.h"
-+#include "ggc.h"
-+//#include "regs.h"
-+#include "timevar.h"
-+
-+#include "params.h"
-+
-+#if BUILDING_GCC_VERSION <= 4009
-+#include "pointer-set.h"
-+#else
-+#include "hash-map.h"
++#include "tree-inline.h"
++#include "version.h"
++#include "rtl.h"
++#include "tm_p.h"
++#include "flags.h"
++//#include "insn-attr.h"
++//#include "insn-config.h"
++//#include "insn-flags.h"
++#include "hard-reg-set.h"
++//#include "recog.h"
++#include "output.h"
++#include "except.h"
++#include "function.h"
++#include "toplev.h"
++//#include "expr.h"
++#include "basic-block.h"
++#include "intl.h"
++#include "ggc.h"
++//#include "regs.h"
++#include "timevar.h"
++
++#include "params.h"
++
++#if BUILDING_GCC_VERSION <= 4009
++#include "pointer-set.h"
++#else
++#include "hash-map.h"
 +#endif
 +
 +#include "emit-rtl.h"
@@ -166240,11 +163512,11 @@ index 0000000..0c0b842
 +#endif
 +
 +#endif
-diff --git a/tools/gcc/gcc-generate-gimple-pass.h b/tools/gcc/gcc-generate-gimple-pass.h
+diff --git a/scripts/gcc-plugins/gcc-generate-gimple-pass.h b/scripts/gcc-plugins/gcc-generate-gimple-pass.h
 new file mode 100644
 index 0000000..0b081fe
 --- /dev/null
-+++ b/tools/gcc/gcc-generate-gimple-pass.h
++++ b/scripts/gcc-plugins/gcc-generate-gimple-pass.h
 @@ -0,0 +1,175 @@
 +/*
 + * Generator for GIMPLE pass related boilerplate code/data
@@ -166421,11 +163693,11 @@ index 0000000..0b081fe
 +#undef __PASS_NAME_PASS_DATA
 +
 +#endif /* PASS_NAME */
-diff --git a/tools/gcc/gcc-generate-ipa-pass.h b/tools/gcc/gcc-generate-ipa-pass.h
+diff --git a/scripts/gcc-plugins/gcc-generate-ipa-pass.h b/scripts/gcc-plugins/gcc-generate-ipa-pass.h
 new file mode 100644
 index 0000000..9bd926e
 --- /dev/null
-+++ b/tools/gcc/gcc-generate-ipa-pass.h
++++ b/scripts/gcc-plugins/gcc-generate-ipa-pass.h
 @@ -0,0 +1,289 @@
 +/*
 + * Generator for IPA pass related boilerplate code/data
@@ -166716,11 +163988,11 @@ index 0000000..9bd926e
 +#undef __WRITE_SUMMARY
 +
 +#endif /* PASS_NAME */
-diff --git a/tools/gcc/gcc-generate-rtl-pass.h b/tools/gcc/gcc-generate-rtl-pass.h
+diff --git a/scripts/gcc-plugins/gcc-generate-rtl-pass.h b/scripts/gcc-plugins/gcc-generate-rtl-pass.h
 new file mode 100644
 index 0000000..1dc67a5
 --- /dev/null
-+++ b/tools/gcc/gcc-generate-rtl-pass.h
++++ b/scripts/gcc-plugins/gcc-generate-rtl-pass.h
 @@ -0,0 +1,175 @@
 +/*
 + * Generator for RTL pass related boilerplate code/data
@@ -166897,11 +164169,11 @@ index 0000000..1dc67a5
 +#undef __PASS_NAME_PASS_DATA
 +
 +#endif /* PASS_NAME */
-diff --git a/tools/gcc/gcc-generate-simple_ipa-pass.h b/tools/gcc/gcc-generate-simple_ipa-pass.h
+diff --git a/scripts/gcc-plugins/gcc-generate-simple_ipa-pass.h b/scripts/gcc-plugins/gcc-generate-simple_ipa-pass.h
 new file mode 100644
 index 0000000..a27e2b3
 --- /dev/null
-+++ b/tools/gcc/gcc-generate-simple_ipa-pass.h
++++ b/scripts/gcc-plugins/gcc-generate-simple_ipa-pass.h
 @@ -0,0 +1,175 @@
 +/*
 + * Generator for SIMPLE_IPA pass related boilerplate code/data
@@ -167078,11 +164350,11 @@ index 0000000..a27e2b3
 +#undef __PASS_NAME_PASS_DATA
 +
 +#endif /* PASS_NAME */
-diff --git a/tools/gcc/gen-random-seed.sh b/tools/gcc/gen-random-seed.sh
+diff --git a/scripts/gcc-plugins/gen-random-seed.sh b/scripts/gcc-plugins/gen-random-seed.sh
 new file mode 100644
 index 0000000..7514850
 --- /dev/null
-+++ b/tools/gcc/gen-random-seed.sh
++++ b/scripts/gcc-plugins/gen-random-seed.sh
 @@ -0,0 +1,8 @@
 +#!/bin/sh
 +
@@ -167092,11 +164364,11 @@ index 0000000..7514850
 +	HASH=`echo -n "$SEED" | sha256sum | cut -d" " -f1 | tr -d ' \n'`
 +	echo "#define RANDSTRUCT_HASHED_SEED \"$HASH\"" > "$2"
 +fi
-diff --git a/tools/gcc/initify_plugin.c b/tools/gcc/initify_plugin.c
+diff --git a/scripts/gcc-plugins/initify_plugin.c b/scripts/gcc-plugins/initify_plugin.c
 new file mode 100644
 index 0000000..bf3eb6c
 --- /dev/null
-+++ b/tools/gcc/initify_plugin.c
++++ b/scripts/gcc-plugins/initify_plugin.c
 @@ -0,0 +1,536 @@
 +/*
 + * Copyright 2015-2016 by Emese Revfy <re.emese@×××××.com>
@@ -167634,11 +164906,11 @@ index 0000000..bf3eb6c
 +
 +	return 0;
 +}
-diff --git a/tools/gcc/kallocstat_plugin.c b/tools/gcc/kallocstat_plugin.c
+diff --git a/scripts/gcc-plugins/kallocstat_plugin.c b/scripts/gcc-plugins/kallocstat_plugin.c
 new file mode 100644
 index 0000000..30ecc9a
 --- /dev/null
-+++ b/tools/gcc/kallocstat_plugin.c
++++ b/scripts/gcc-plugins/kallocstat_plugin.c
 @@ -0,0 +1,135 @@
 +/*
 + * Copyright 2011-2016 by the PaX Team <pageexec@××××××××.hu>
@@ -167775,11 +165047,11 @@ index 0000000..30ecc9a
 +
 +	return 0;
 +}
-diff --git a/tools/gcc/kernexec_plugin.c b/tools/gcc/kernexec_plugin.c
+diff --git a/scripts/gcc-plugins/kernexec_plugin.c b/scripts/gcc-plugins/kernexec_plugin.c
 new file mode 100644
 index 0000000..e31e92f
 --- /dev/null
-+++ b/tools/gcc/kernexec_plugin.c
++++ b/scripts/gcc-plugins/kernexec_plugin.c
 @@ -0,0 +1,407 @@
 +/*
 + * Copyright 2011-2016 by the PaX Team <pageexec@××××××××.hu>
@@ -168188,12 +165460,12 @@ index 0000000..e31e92f
 +
 +	return 0;
 +}
-diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
+diff --git a/scripts/gcc-plugins/latent_entropy_plugin.c b/scripts/gcc-plugins/latent_entropy_plugin.c
 new file mode 100644
-index 0000000..50d373c
+index 0000000..f08a221
 --- /dev/null
-+++ b/tools/gcc/latent_entropy_plugin.c
-@@ -0,0 +1,422 @@
++++ b/scripts/gcc-plugins/latent_entropy_plugin.c
+@@ -0,0 +1,438 @@
 +/*
 + * Copyright 2012-2016 by the PaX Team <pageexec@××××××××.hu>
 + * Licensed under the GPL v2
@@ -168219,11 +165491,13 @@ index 0000000..50d373c
 +
 +int plugin_is_GPL_compatible;
 +
++static bool enabled = true;
++
 +static GTY(()) tree latent_entropy_decl;
 +
 +static struct plugin_info latent_entropy_plugin_info = {
-+	.version	= "201604022010",
-+	.help		= NULL
++	.version	= "201605212030",
++	.help		= "disable\tturn off latent entropy instrumentation\n",
 +};
 +
 +static unsigned HOST_WIDE_INT seed;
@@ -168586,6 +165860,10 @@ index 0000000..50d373c
 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
 +{
 +	const char * const plugin_name = plugin_info->base_name;
++	const int argc = plugin_info->argc;
++	const struct plugin_argument * const argv = plugin_info->argv;
++	int i;
++
 +	struct register_pass_info latent_entropy_pass_info;
 +
 +	latent_entropy_pass_info.pass				= make_latent_entropy_pass();
@@ -168608,19 +165886,29 @@ index 0000000..50d373c
 +		return 1;
 +	}
 +
++	for (i = 0; i < argc; ++i) {
++		if (!(strcmp(argv[i].key, "disable"))) {
++			enabled = false;
++			continue;
++		}
++		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++	}
++
 +	register_callback(plugin_name, PLUGIN_INFO, NULL, &latent_entropy_plugin_info);
-+	register_callback(plugin_name, PLUGIN_START_UNIT, &latent_entropy_start_unit, NULL);
-+	register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_latent_entropy);
-+	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &latent_entropy_pass_info);
++	if (enabled) {
++		register_callback(plugin_name, PLUGIN_START_UNIT, &latent_entropy_start_unit, NULL);
++		register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_latent_entropy);
++		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &latent_entropy_pass_info);
++	}
 +	register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
 +
 +	return 0;
 +}
-diff --git a/tools/gcc/randomize_layout_plugin.c b/tools/gcc/randomize_layout_plugin.c
+diff --git a/scripts/gcc-plugins/randomize_layout_plugin.c b/scripts/gcc-plugins/randomize_layout_plugin.c
 new file mode 100644
 index 0000000..a716d7a
 --- /dev/null
-+++ b/tools/gcc/randomize_layout_plugin.c
++++ b/scripts/gcc-plugins/randomize_layout_plugin.c
 @@ -0,0 +1,940 @@
 +/*
 + * Copyright 2014-2016 by Open Source Security, Inc., Brad Spengler <spender@××××××××××.net>
@@ -169562,21 +166850,21 @@ index 0000000..a716d7a
 +
 +	return 0;
 +}
-diff --git a/tools/gcc/rap_plugin/Makefile b/tools/gcc/rap_plugin/Makefile
+diff --git a/scripts/gcc-plugins/rap_plugin/Makefile b/scripts/gcc-plugins/rap_plugin/Makefile
 new file mode 100644
 index 0000000..8171be8
 --- /dev/null
-+++ b/tools/gcc/rap_plugin/Makefile
++++ b/scripts/gcc-plugins/rap_plugin/Makefile
 @@ -0,0 +1,4 @@
 +$(HOSTLIBS)-$(CONFIG_PAX_RAP) += rap_plugin.so
 +always := $($(HOSTLIBS)-y)
 +
 +rap_plugin-objs := $(patsubst $(srctree)/$(src)/%.c,%.o,$(wildcard $(srctree)/$(src)/*.c))
-diff --git a/tools/gcc/rap_plugin/rap.h b/tools/gcc/rap_plugin/rap.h
+diff --git a/scripts/gcc-plugins/rap_plugin/rap.h b/scripts/gcc-plugins/rap_plugin/rap.h
 new file mode 100644
 index 0000000..f6a284d
 --- /dev/null
-+++ b/tools/gcc/rap_plugin/rap.h
++++ b/scripts/gcc-plugins/rap_plugin/rap.h
 @@ -0,0 +1,36 @@
 +#ifndef RAP_H_INCLUDED
 +#define RAP_H_INCLUDED
@@ -169614,11 +166902,11 @@ index 0000000..f6a284d
 +#endif
 +
 +#endif
-diff --git a/tools/gcc/rap_plugin/rap_fptr_pass.c b/tools/gcc/rap_plugin/rap_fptr_pass.c
+diff --git a/scripts/gcc-plugins/rap_plugin/rap_fptr_pass.c b/scripts/gcc-plugins/rap_plugin/rap_fptr_pass.c
 new file mode 100644
 index 0000000..2f53f14
 --- /dev/null
-+++ b/tools/gcc/rap_plugin/rap_fptr_pass.c
++++ b/scripts/gcc-plugins/rap_plugin/rap_fptr_pass.c
 @@ -0,0 +1,220 @@
 +/*
 + * Copyright 2012-2016 by PaX Team <pageexec@××××××××.hu>
@@ -169840,11 +167128,11 @@ index 0000000..2f53f14
 +#define PASS_NAME rap_fptr
 +#define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa | TODO_cleanup_cfg | TODO_rebuild_cgraph_edges | TODO_verify_flow
 +#include "gcc-generate-gimple-pass.h"
-diff --git a/tools/gcc/rap_plugin/rap_hash.c b/tools/gcc/rap_plugin/rap_hash.c
+diff --git a/scripts/gcc-plugins/rap_plugin/rap_hash.c b/scripts/gcc-plugins/rap_plugin/rap_hash.c
 new file mode 100644
 index 0000000..7c59f38
 --- /dev/null
-+++ b/tools/gcc/rap_plugin/rap_hash.c
++++ b/scripts/gcc-plugins/rap_plugin/rap_hash.c
 @@ -0,0 +1,382 @@
 +/*
 + * Copyright 2012-2016 by PaX Team <pageexec@××××××××.hu>
@@ -170228,11 +167516,11 @@ index 0000000..7c59f38
 +		gcc_assert(rap_imprecise_hashes[uid].hash);
 +	}
 +}
-diff --git a/tools/gcc/rap_plugin/rap_plugin.c b/tools/gcc/rap_plugin/rap_plugin.c
+diff --git a/scripts/gcc-plugins/rap_plugin/rap_plugin.c b/scripts/gcc-plugins/rap_plugin/rap_plugin.c
 new file mode 100644
 index 0000000..bca74dc
 --- /dev/null
-+++ b/tools/gcc/rap_plugin/rap_plugin.c
++++ b/scripts/gcc-plugins/rap_plugin/rap_plugin.c
 @@ -0,0 +1,511 @@
 +/*
 + * Copyright 2012-2016 by PaX Team <pageexec@××××××××.hu>
@@ -170745,11 +168033,11 @@ index 0000000..bca74dc
 +
 +	return 0;
 +}
-diff --git a/tools/gcc/rap_plugin/sip.c b/tools/gcc/rap_plugin/sip.c
+diff --git a/scripts/gcc-plugins/rap_plugin/sip.c b/scripts/gcc-plugins/rap_plugin/sip.c
 new file mode 100644
 index 0000000..65bc1cd
 --- /dev/null
-+++ b/tools/gcc/rap_plugin/sip.c
++++ b/scripts/gcc-plugins/rap_plugin/sip.c
 @@ -0,0 +1,96 @@
 +// SipHash-2-4 adapted by the PaX Team from the public domain version written by
 +//   Jean-Philippe Aumasson <jeanphilippe.aumasson@×××××.com>
@@ -170847,20 +168135,20 @@ index 0000000..65bc1cd
 +	b = v0 ^ v1 ^ v2 ^ v3;
 +	U64TO8_LE(out, b);
 +}
-diff --git a/tools/gcc/size_overflow_plugin/.gitignore b/tools/gcc/size_overflow_plugin/.gitignore
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/.gitignore b/scripts/gcc-plugins/size_overflow_plugin/.gitignore
 new file mode 100644
 index 0000000..c4b24b9
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/.gitignore
++++ b/scripts/gcc-plugins/size_overflow_plugin/.gitignore
 @@ -0,0 +1,3 @@
 +disable_size_overflow_hash.h
 +size_overflow_hash.h
 +size_overflow_hash_aux.h
-diff --git a/tools/gcc/size_overflow_plugin/Makefile b/tools/gcc/size_overflow_plugin/Makefile
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/Makefile b/scripts/gcc-plugins/size_overflow_plugin/Makefile
 new file mode 100644
 index 0000000..f74d85a
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/Makefile
++++ b/scripts/gcc-plugins/size_overflow_plugin/Makefile
 @@ -0,0 +1,28 @@
 +HOST_EXTRACXXFLAGS += $(call hostcc-option, -fno-ipa-icf)
 +
@@ -170890,11 +168178,11 @@ index 0000000..f74d85a
 +	$(call if_changed,build_disable_size_overflow_hash)
 +
 +targets += size_overflow_hash.h size_overflow_hash_aux.h disable_size_overflow_hash.h
-diff --git a/tools/gcc/size_overflow_plugin/disable_size_overflow_hash.data b/tools/gcc/size_overflow_plugin/disable_size_overflow_hash.data
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/disable_size_overflow_hash.data b/scripts/gcc-plugins/size_overflow_plugin/disable_size_overflow_hash.data
 new file mode 100644
 index 0000000..2a420f3
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/disable_size_overflow_hash.data
++++ b/scripts/gcc-plugins/size_overflow_plugin/disable_size_overflow_hash.data
 @@ -0,0 +1,12444 @@
 +disable_so_interrupt_pnode_gru_message_queue_desc_4 interrupt_pnode gru_message_queue_desc 0 4 NULL
 +disable_so_bch_btree_insert_fndecl_12 bch_btree_insert fndecl 0 12 NULL
@@ -183340,11 +180628,11 @@ index 0000000..2a420f3
 +enable_so_inofree_iagctl_5194 inofree iagctl 0 5194 NULL
 +enable_so_inofreefwd_iag_4921 inofreefwd iag 0 4921 NULL
 +enable_so_iagnum_iag_23227 iagnum iag 0 23227 NULL
-diff --git a/tools/gcc/size_overflow_plugin/generate_size_overflow_hash.sh b/tools/gcc/size_overflow_plugin/generate_size_overflow_hash.sh
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/generate_size_overflow_hash.sh b/scripts/gcc-plugins/size_overflow_plugin/generate_size_overflow_hash.sh
 new file mode 100644
 index 0000000..be9724d
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/generate_size_overflow_hash.sh
++++ b/scripts/gcc-plugins/size_overflow_plugin/generate_size_overflow_hash.sh
 @@ -0,0 +1,103 @@
 +#!/bin/bash
 +
@@ -183449,11 +180737,11 @@ index 0000000..be9724d
 +create_array_elements
 +
 +exit 0
-diff --git a/tools/gcc/size_overflow_plugin/insert_size_overflow_asm.c b/tools/gcc/size_overflow_plugin/insert_size_overflow_asm.c
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/insert_size_overflow_asm.c b/scripts/gcc-plugins/size_overflow_plugin/insert_size_overflow_asm.c
 new file mode 100644
 index 0000000..ee987da
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/insert_size_overflow_asm.c
++++ b/scripts/gcc-plugins/size_overflow_plugin/insert_size_overflow_asm.c
 @@ -0,0 +1,369 @@
 +/*
 + * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
@@ -183824,11 +181112,11 @@ index 0000000..ee987da
 +#define TODO_FLAGS_FINISH TODO_dump_func | TODO_verify_ssa | TODO_verify_stmts | TODO_remove_unused_locals | TODO_update_ssa_no_phi | TODO_cleanup_cfg | TODO_ggc_collect | TODO_verify_flow
 +
 +#include "gcc-generate-gimple-pass.h"
-diff --git a/tools/gcc/size_overflow_plugin/intentional_overflow.c b/tools/gcc/size_overflow_plugin/intentional_overflow.c
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/intentional_overflow.c b/scripts/gcc-plugins/size_overflow_plugin/intentional_overflow.c
 new file mode 100644
-index 0000000..6fcc436
+index 0000000..f29aac6
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/intentional_overflow.c
++++ b/scripts/gcc-plugins/size_overflow_plugin/intentional_overflow.c
 @@ -0,0 +1,1166 @@
 +/*
 + * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
@@ -184963,7 +182251,7 @@ index 0000000..6fcc436
 +{
 +	const_tree rhs, lhs_type, rhs_type;
 +	const_tree def_rhs1, def_rhs2;
-+	gimple def_stmt;
++	const_gimple def_stmt;
 +	gimple def_def_stmt = NULL;
 +
 +	if (!gimple_assign_cast_p(stmt))
@@ -184996,11 +182284,11 @@ index 0000000..6fcc436
 +	// _36 = (signed short) _35;
 +	return def_def_stmt && gimple_assign_cast_p(def_def_stmt);
 +}
-diff --git a/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c b/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/remove_unnecessary_dup.c b/scripts/gcc-plugins/size_overflow_plugin/remove_unnecessary_dup.c
 new file mode 100644
 index 0000000..c910983
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c
++++ b/scripts/gcc-plugins/size_overflow_plugin/remove_unnecessary_dup.c
 @@ -0,0 +1,137 @@
 +/*
 + * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
@@ -185139,11 +182427,11 @@ index 0000000..c910983
 +	}
 +}
 +
-diff --git a/tools/gcc/size_overflow_plugin/size_overflow.h b/tools/gcc/size_overflow_plugin/size_overflow.h
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/size_overflow.h b/scripts/gcc-plugins/size_overflow_plugin/size_overflow.h
 new file mode 100644
 index 0000000..4bd2e7f
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/size_overflow.h
++++ b/scripts/gcc-plugins/size_overflow_plugin/size_overflow.h
 @@ -0,0 +1,331 @@
 +#ifndef SIZE_OVERFLOW_H
 +#define SIZE_OVERFLOW_H
@@ -185476,11 +182764,11 @@ index 0000000..4bd2e7f
 +extern const char * __unused print_intentional_mark_name(enum intentional_mark mark);
 +
 +#endif
-diff --git a/tools/gcc/size_overflow_plugin/size_overflow_debug.c b/tools/gcc/size_overflow_plugin/size_overflow_debug.c
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/size_overflow_debug.c b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_debug.c
 new file mode 100644
 index 0000000..4098952
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/size_overflow_debug.c
++++ b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_debug.c
 @@ -0,0 +1,194 @@
 +/*
 + * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
@@ -185676,11 +182964,11 @@ index 0000000..4098952
 +
 +	gcc_unreachable();
 +}
-diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/size_overflow_hash.data b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
 index 0000000..cbb8a80
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
++++ b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_hash.data
 @@ -0,0 +1,21645 @@
 +enable_so_recv_ctrl_pipe_us_data_0 recv_ctrl_pipe us_data 0 0 NULL
 +enable_so___earlyonly_bootmem_alloc_fndecl_3 __earlyonly_bootmem_alloc fndecl 2-3-4 3 NULL
@@ -207327,11 +204615,11 @@ index 0000000..cbb8a80
 +enable_so_write_page_nocow_fndecl_65527 write_page_nocow fndecl 2 65527 NULL
 +enable_so_size_mei_msg_data_65529 size mei_msg_data 0 65529 NULL
 +enable_so_connector_write_fndecl_65534 connector_write fndecl 3 65534 NULL
-diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash_aux.data b/tools/gcc/size_overflow_plugin/size_overflow_hash_aux.data
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/size_overflow_hash_aux.data b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_hash_aux.data
 new file mode 100644
 index 0000000..17bc0d8
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/size_overflow_hash_aux.data
++++ b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_hash_aux.data
 @@ -0,0 +1,92 @@
 +enable_so_spa_set_aux_vdevs_fndecl_746 spa_set_aux_vdevs fndecl 3 746 NULL
 +enable_so_zfs_lookup_fndecl_2144 zfs_lookup fndecl 0 2144 NULL
@@ -207425,11 +204713,11 @@ index 0000000..17bc0d8
 +enable_so_proc_copyin_string_fndecl_62019 proc_copyin_string fndecl 4 62019 NULL
 +enable_so_random_get_pseudo_bytes_fndecl_64611 random_get_pseudo_bytes fndecl 2 64611 NULL
 +enable_so_zpios_read_fndecl_64734 zpios_read fndecl 3 64734 NULL
-diff --git a/tools/gcc/size_overflow_plugin/size_overflow_ipa.c b/tools/gcc/size_overflow_plugin/size_overflow_ipa.c
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/size_overflow_ipa.c b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_ipa.c
 new file mode 100644
 index 0000000..0a679f8
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/size_overflow_ipa.c
++++ b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_ipa.c
 @@ -0,0 +1,1163 @@
 +/*
 + * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
@@ -207445,1161 +204733,2326 @@ index 0000000..0a679f8
 + * with double integer precision (DImode/TImode for 32/64 bit integer types).
 + * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
 + *
-+ * Usage:
-+ * $ make
-+ * $ make run
++ * Usage:
++ * $ make
++ * $ make run
++ */
++
++#include "size_overflow.h"
++#include <libgen.h>
++
++static void walk_use_def_next_functions(struct walk_use_def_data *use_def_data, tree lhs);
++
++next_interesting_function_t global_next_interesting_function[GLOBAL_NIFN_LEN];
++static bool global_changed;
++#define PRINT_DATA_FLOW true
++#define NO_PRINT_DATA_FLOW false
++
++static struct cgraph_node_hook_list *function_insertion_hook_holder;
++static struct cgraph_2node_hook_list *node_duplication_hook_holder;
++
++struct cgraph_node *get_cnode(const_tree fndecl)
++{
++	gcc_assert(TREE_CODE(fndecl) == FUNCTION_DECL);
++#if BUILDING_GCC_VERSION <= 4005
++	return cgraph_get_node(CONST_CAST_TREE(fndecl));
++#else
++	return cgraph_get_node(fndecl);
++#endif
++}
++
++static bool compare_next_interesting_functions(next_interesting_function_t cur_node, const char *decl_name, const char *context, unsigned int num)
++{
++	// Ignore num without a value
++	if (num != NONE_ARGNUM && cur_node->num != num)
++		return false;
++	if (strcmp(cur_node->context, context))
++		return false;
++	return !strcmp(cur_node->decl_name, decl_name);
++}
++
++// Return the context of vardecl. If it is in a file scope then the context is vardecl_filebasename
++static const char* get_vardecl_context(const_tree decl)
++{
++	expanded_location xloc;
++	char *buf, *path;
++	const char *bname;
++	int len;
++
++	xloc = expand_location(DECL_SOURCE_LOCATION(decl));
++	gcc_assert(xloc.file);
++	path = xstrdup(xloc.file);
++	bname = basename(path);
++
++	len = asprintf(&buf, "vardecl_%s", bname);
++	gcc_assert(len > 0);
++	return buf;
++}
++
++// Return the type name for a function pointer (or "fielddecl" if the type has no name), otherwise either "vardecl" or "fndecl"
++const char* get_decl_context(const_tree decl)
++{
++	switch (TREE_CODE(decl)) {
++	case FUNCTION_DECL:
++		return "fndecl";
++		// TODO: Ignore anonymous types for now
++	case FIELD_DECL:
++		return get_type_name_from_field(decl);
++	case VAR_DECL:
++		if (TREE_PUBLIC(decl) || DECL_EXTERNAL(decl))
++			return "vardecl";
++		if (TREE_STATIC(decl) && !TREE_PUBLIC(decl))
++			return get_vardecl_context(decl);
++		// ignore local variable
++		if (!TREE_STATIC(decl) && !DECL_EXTERNAL(decl))
++			return NULL;
++	default:
++		debug_tree(decl);
++		gcc_unreachable();
++	}
++}
++
++// Find the function with the specified argument in the list
++next_interesting_function_t get_global_next_interesting_function_entry(struct fn_raw_data *raw_data)
++{
++	next_interesting_function_t cur_node, head;
++
++	head = global_next_interesting_function[raw_data->hash];
++	for (cur_node = head; cur_node; cur_node = cur_node->next) {
++		if (raw_data->marked != ASM_STMT_SO_MARK && cur_node->marked == ASM_STMT_SO_MARK)
++			continue;
++		if (compare_next_interesting_functions(cur_node, raw_data->decl_str, raw_data->context, raw_data->num))
++			return cur_node;
++	}
++	return NULL;
++}
++
++next_interesting_function_t get_global_next_interesting_function_entry_with_hash(struct fn_raw_data *raw_data)
++{
++	raw_data->hash = get_decl_hash(raw_data->decl, raw_data->decl_str);
++	if (raw_data->hash == NO_HASH)
++		return NULL;
++
++	raw_data->context = get_decl_context(raw_data->decl);
++	if (!raw_data->context)
++		return NULL;
++	return get_global_next_interesting_function_entry(raw_data);
++}
++
++next_interesting_function_t create_new_next_interesting_entry(struct fn_raw_data *raw_data, next_interesting_function_t orig_next_node)
++{
++	next_interesting_function_t new_node;
++
++	new_node = (next_interesting_function_t)xmalloc(sizeof(*new_node));
++	new_node->decl_name = xstrdup(raw_data->decl_str);
++
++	gcc_assert(raw_data->context);
++	new_node->context = xstrdup(raw_data->context);
++	new_node->hash = raw_data->hash;
++	new_node->num = raw_data->num;
++	new_node->next = NULL;
++	new_node->children = NULL;
++	new_node->marked = raw_data->marked;
++	new_node->orig_next_node = orig_next_node;
++	return new_node;
++}
++
++// Ignore these functions to not explode coverage (+strncmp+fndecl+3+35130+)
++static bool temporary_skip_these_functions(struct fn_raw_data *raw_data)
++{
++	if (raw_data->hash == 35130 && !strcmp(raw_data->decl_str, "strncmp"))
++		return true;
++	if (raw_data->hash == 46193 && !strcmp(raw_data->decl_str, "strnlen"))
++		return true;
++	if (raw_data->hash == 43267 && !strcmp(raw_data->decl_str, "strncpy"))
++		return true;
++	if (raw_data->hash == 10300 && !strcmp(raw_data->decl_str, "strncpy_from_user"))
++		return true;
++	if (raw_data->hash == 26117 && !strcmp(raw_data->decl_str, "memchr"))
++		return true;
++	if (raw_data->hash == 16203 && !strcmp(raw_data->decl_str, "memchr_inv"))
++		return true;
++	if (raw_data->hash == 24269 && !strcmp(raw_data->decl_str, "memcmp"))
++		return true;
++	if (raw_data->hash == 60390 && !strcmp(raw_data->decl_str, "memcpy"))
++		return true;
++	if (raw_data->hash == 25040 && !strcmp(raw_data->decl_str, "memmove"))
++		return true;
++	if (raw_data->hash == 29763 && !strcmp(raw_data->decl_str, "memset"))
++		return true;
++	return false;
++}
++
++// Create the main data structure
++next_interesting_function_t create_new_next_interesting_decl(struct fn_raw_data *raw_data, next_interesting_function_t orig_next_node)
++{
++	enum tree_code decl_code = TREE_CODE(raw_data->decl);
++
++	gcc_assert(decl_code == FIELD_DECL || decl_code == FUNCTION_DECL || decl_code == VAR_DECL);
++
++	if (is_vararg(raw_data->decl, raw_data->num))
++		return NULL;
++
++	raw_data->hash = get_decl_hash(raw_data->decl, raw_data->decl_str);
++	if (raw_data->hash == NO_HASH)
++		return NULL;
++	if (get_size_overflow_hash_entry_tree(raw_data->decl, raw_data->num, DISABLE_SIZE_OVERFLOW))
++		return NULL;
++	if (temporary_skip_these_functions(raw_data))
++		return NULL;
++
++	gcc_assert(raw_data->num <= MAX_PARAM);
++	// Clones must have an orig_next_node
++	gcc_assert(!made_by_compiler(raw_data->decl) || orig_next_node);
++
++	raw_data->context = get_decl_context(raw_data->decl);
++	if (!raw_data->context)
++		return NULL;
++	return create_new_next_interesting_entry(raw_data, orig_next_node);
++}
++
++void add_to_global_next_interesting_function(next_interesting_function_t new_entry)
++{
++	next_interesting_function_t cur_global_head, cur_global, cur_global_end = NULL;
++
++	// new_entry is appended to the end of a list
++	new_entry->next = NULL;
++
++	cur_global_head = global_next_interesting_function[new_entry->hash];
++	if (!cur_global_head) {
++		global_next_interesting_function[new_entry->hash] = new_entry;
++		return;
++	}
++
++
++	for (cur_global = cur_global_head; cur_global; cur_global = cur_global->next) {
++		if (!cur_global->next)
++			cur_global_end = cur_global;
++
++		if (compare_next_interesting_functions(cur_global, new_entry->decl_name, new_entry->context, new_entry->num))
++			return;
++	}
++
++	gcc_assert(cur_global_end);
++	cur_global_end->next = new_entry;
++}
++
++/* If the interesting function is a clone then find or create its original next_interesting_function_t node
++ * and add it to global_next_interesting_function
++ */
++static next_interesting_function_t create_orig_next_node_for_a_clone(struct fn_raw_data *clone_raw_data)
++{
++	struct fn_raw_data orig_raw_data;
++	next_interesting_function_t orig_next_node;
++	enum tree_code decl_code;
++
++	orig_raw_data.decl = get_orig_fndecl(clone_raw_data->decl);
++
++	if (DECL_BUILT_IN(orig_raw_data.decl) || DECL_BUILT_IN_CLASS(orig_raw_data.decl) == BUILT_IN_NORMAL)
++		return NULL;
++
++	if (made_by_compiler(orig_raw_data.decl))
++		return NULL;
++
++	decl_code = TREE_CODE(orig_raw_data.decl);
++	if (decl_code == FIELD_DECL || decl_code == VAR_DECL)
++		orig_raw_data.num = clone_raw_data->num;
++	else
++		orig_raw_data.num = get_correct_argnum(clone_raw_data->decl, orig_raw_data.decl, clone_raw_data->num);
++
++	// Skip over ISRA.162 parm decls
++	if (orig_raw_data.num == CANNOT_FIND_ARG)
++		return NULL;
++
++	orig_raw_data.decl_str = get_orig_decl_name(orig_raw_data.decl);
++	orig_raw_data.marked = NO_SO_MARK;
++	orig_next_node = get_global_next_interesting_function_entry_with_hash(&orig_raw_data);
++	if (orig_next_node)
++		return orig_next_node;
++
++	orig_raw_data.marked = clone_raw_data->marked;
++	orig_next_node = create_new_next_interesting_decl(&orig_raw_data, NULL);
++	if (!orig_next_node)
++		return NULL;
++
++	add_to_global_next_interesting_function(orig_next_node);
++	return orig_next_node;
++}
++
++// Find or create the next_interesting_function_t node for decl and num
++next_interesting_function_t get_and_create_next_node_from_global_next_nodes(struct fn_raw_data *raw_data, next_interesting_function_t orig_next_node)
++{
++	next_interesting_function_t cur_next_cnode;
++
++	if (DECL_NAME(raw_data->decl) == NULL_TREE)
++		return NULL;
++	raw_data->decl_str = DECL_NAME_POINTER(raw_data->decl);
++
++	cur_next_cnode = get_global_next_interesting_function_entry_with_hash(raw_data);
++	if (cur_next_cnode)
++		goto out;
++
++	if (!orig_next_node && made_by_compiler(raw_data->decl)) {
++		orig_next_node = create_orig_next_node_for_a_clone(raw_data);
++		if (!orig_next_node)
++			return NULL;
++	}
++
++	cur_next_cnode = create_new_next_interesting_decl(raw_data, orig_next_node);
++	if (!cur_next_cnode)
++		return NULL;
++
++	add_to_global_next_interesting_function(cur_next_cnode);
++out:
++	if (cur_next_cnode->marked != raw_data->marked && cur_next_cnode->marked != NO_SO_MARK)
++		return cur_next_cnode;
++
++	if (raw_data->marked != NO_SO_MARK && cur_next_cnode->marked == NO_SO_MARK)
++		cur_next_cnode->marked = raw_data->marked;
++
++	return cur_next_cnode;
++}
++
++static bool has_next_interesting_function_chain_node(next_interesting_function_t next_cnodes_head, struct fn_raw_data *raw_data)
++{
++	next_interesting_function_t cur_node;
++
++	raw_data->decl_str = DECL_NAME_POINTER(raw_data->decl);
++	raw_data->context = get_decl_context(raw_data->decl);
++	// Ignore function if there is no context
++	if (!raw_data->context)
++		return true;
++
++	for (cur_node = next_cnodes_head; cur_node; cur_node = cur_node->next) {
++		if (compare_next_interesting_functions(cur_node, raw_data->decl_str, raw_data->context, raw_data->num))
++			return true;
++	}
++	return false;
++}
++
++static void handle_function(struct walk_use_def_data *use_def_data, tree fndecl, const_tree arg)
++{
++	struct fn_raw_data raw_data;
++	next_interesting_function_t orig_next_node, new_node;
++
++	gcc_assert(fndecl != NULL_TREE);
++
++	// ignore builtins to not explode coverage (e.g., memcpy)
++	if (DECL_BUILT_IN(fndecl) || DECL_BUILT_IN_CLASS(fndecl) == BUILT_IN_NORMAL)
++		return;
++
++	if (get_intentional_attr_type(fndecl) == MARK_TURN_OFF)
++		return;
++
++	raw_data.decl = fndecl;
++	raw_data.decl_str = DECL_NAME_POINTER(fndecl);
++	raw_data.marked = NO_SO_MARK;
++
++	// convert arg into its position
++	if (arg == NULL_TREE)
++		raw_data.num = 0;
++	else
++		raw_data.num = find_arg_number_tree(arg, raw_data.decl);
++	if (raw_data.num == CANNOT_FIND_ARG)
++		return;
++
++	if (has_next_interesting_function_chain_node(use_def_data->next_cnodes_head, &raw_data))
++		return;
++
++	if (made_by_compiler(raw_data.decl)) {
++		orig_next_node = create_orig_next_node_for_a_clone(&raw_data);
++		if (!orig_next_node)
++			return;
++	} else
++		orig_next_node = NULL;
++
++	new_node = create_new_next_interesting_decl(&raw_data, orig_next_node);
++	if (!new_node)
++		return;
++	new_node->next = use_def_data->next_cnodes_head;
++	use_def_data->next_cnodes_head = new_node;
++}
++
++static void walk_use_def_next_functions_phi(struct walk_use_def_data *use_def_data, const_tree result)
++{
++	gphi *phi = as_a_gphi(get_def_stmt(result));
++	unsigned int i, n = gimple_phi_num_args(phi);
++
++	pointer_set_insert(use_def_data->visited, phi);
++	for (i = 0; i < n; i++) {
++		tree arg = gimple_phi_arg_def(phi, i);
++
++		walk_use_def_next_functions(use_def_data, arg);
++	}
++}
++
++static void walk_use_def_next_functions_binary(struct walk_use_def_data *use_def_data, const_tree lhs)
++{
++	gassign *def_stmt = as_a_gassign(get_def_stmt(lhs));
++	tree rhs1, rhs2;
++
++	rhs1 = gimple_assign_rhs1(def_stmt);
++	rhs2 = gimple_assign_rhs2(def_stmt);
++
++	walk_use_def_next_functions(use_def_data, rhs1);
++	walk_use_def_next_functions(use_def_data, rhs2);
++}
++
++static void walk_use_def_next_functions_unary(struct walk_use_def_data *use_def_data, const gassign *stmt)
++{
++	tree rhs1 = gimple_assign_rhs1(stmt);
++
++	walk_use_def_next_functions(use_def_data, rhs1);
++}
++
++void __attribute__((weak)) handle_function_ptr_ret(struct walk_use_def_data *use_def_data __unused, const_tree fn_ptr __unused)
++{
++}
++
++static void create_and_append_new_next_interesting_field_var_decl(struct walk_use_def_data *use_def_data, struct fn_raw_data *raw_data)
++{
++	next_interesting_function_t new_node;
++
++	if (raw_data->decl == NULL_TREE)
++		return;
++
++	if (DECL_NAME(raw_data->decl) == NULL_TREE)
++		return;
++
++	raw_data->decl_str = DECL_NAME_POINTER(raw_data->decl);
++	raw_data->num = 0;
++	raw_data->marked = NO_SO_MARK;
++
++	new_node = create_new_next_interesting_decl(raw_data, NULL);
++	if (!new_node)
++		return;
++	new_node->next = use_def_data->next_cnodes_head;
++	use_def_data->next_cnodes_head = new_node;
++}
++
++static void handle_struct_fields(struct walk_use_def_data *use_def_data, const_tree node)
++{
++	struct fn_raw_data raw_data;
++
++	switch (TREE_CODE(node)) {
++	case ARRAY_REF:
++#if BUILDING_GCC_VERSION >= 4006
++	case MEM_REF:
++#endif
++	case INDIRECT_REF:
++	case COMPONENT_REF:
++		raw_data.decl = get_ref_field(node);
++		break;
++	// TODO
++	case BIT_FIELD_REF:
++	case VIEW_CONVERT_EXPR:
++	case REALPART_EXPR:
++	case IMAGPART_EXPR:
++		return;
++	default:
++		debug_tree(node);
++		gcc_unreachable();
++	}
++
++	if (get_intentional_attr_type(raw_data.decl) == MARK_TURN_OFF)
++		return;
++
++	create_and_append_new_next_interesting_field_var_decl(use_def_data, &raw_data);
++}
++
++static void handle_vardecl(struct walk_use_def_data *use_def_data, tree node)
++{
++	struct fn_raw_data raw_data;
++
++	raw_data.decl = node;
++	create_and_append_new_next_interesting_field_var_decl(use_def_data, &raw_data);
++}
++
++/* Find all functions that influence lhs
++ *
++ * Encountered functions are added to the children vector (next_interesting_function_t).
 + */
++static void walk_use_def_next_functions(struct walk_use_def_data *use_def_data, tree lhs)
++{
++	enum tree_code code;
++	const_gimple def_stmt;
 +
-+#include "size_overflow.h"
-+#include <libgen.h>
++	if (skip_types(lhs))
++		return;
 +
-+static void walk_use_def_next_functions(struct walk_use_def_data *use_def_data, tree lhs);
++	if (VAR_P(lhs)) {
++		handle_vardecl(use_def_data, lhs);
++		return;
++	}
 +
-+next_interesting_function_t global_next_interesting_function[GLOBAL_NIFN_LEN];
-+static bool global_changed;
-+#define PRINT_DATA_FLOW true
-+#define NO_PRINT_DATA_FLOW false
++	code = TREE_CODE(lhs);
++	if (code == PARM_DECL) {
++		handle_function(use_def_data, current_function_decl, lhs);
++		return;
++	}
 +
-+static struct cgraph_node_hook_list *function_insertion_hook_holder;
-+static struct cgraph_2node_hook_list *node_duplication_hook_holder;
++	if (TREE_CODE_CLASS(code) == tcc_reference) {
++		handle_struct_fields(use_def_data, lhs);
++		return;
++	}
 +
-+struct cgraph_node *get_cnode(const_tree fndecl)
++	if (code != SSA_NAME)
++		return;
++
++	def_stmt = get_def_stmt(lhs);
++	if (!def_stmt)
++		return;
++
++	if (pointer_set_insert(use_def_data->visited, def_stmt))
++		return;
++
++	switch (gimple_code(def_stmt)) {
++	case GIMPLE_NOP:
++		walk_use_def_next_functions(use_def_data, SSA_NAME_VAR(lhs));
++		return;
++	case GIMPLE_ASM:
++		if (!is_size_overflow_asm(def_stmt))
++			return;
++		walk_use_def_next_functions(use_def_data, get_size_overflow_asm_input(as_a_const_gasm(def_stmt)));
++		return;
++	case GIMPLE_CALL: {
++		tree fndecl = gimple_call_fndecl(def_stmt);
++
++		if (fndecl != NULL_TREE) {
++			handle_function(use_def_data, fndecl, NULL_TREE);
++			return;
++		}
++		fndecl = gimple_call_fn(def_stmt);
++		handle_function_ptr_ret(use_def_data, fndecl);
++		return;
++	}
++	case GIMPLE_PHI:
++		walk_use_def_next_functions_phi(use_def_data, lhs);
++		return;
++	case GIMPLE_ASSIGN:
++		switch (gimple_num_ops(def_stmt)) {
++		case 2:
++			walk_use_def_next_functions_unary(use_def_data, as_a_const_gassign(def_stmt));
++			return;
++		case 3:
++			walk_use_def_next_functions_binary(use_def_data, lhs);
++			return;
++		}
++	default:
++		debug_gimple_stmt((gimple)def_stmt);
++		error("%s: unknown gimple code", __func__);
++		gcc_unreachable();
++	}
++}
++
++// Start the search for next_interesting_function_t children based on the (next_interesting_function_t) parent node
++static next_interesting_function_t search_next_functions(tree node, next_interesting_function_t parent)
 +{
-+	gcc_assert(TREE_CODE(fndecl) == FUNCTION_DECL);
-+#if BUILDING_GCC_VERSION <= 4005
-+	return cgraph_get_node(CONST_CAST_TREE(fndecl));
++	struct walk_use_def_data use_def_data;
++
++	use_def_data.parent = parent;
++	use_def_data.next_cnodes_head = NULL;
++	use_def_data.visited = pointer_set_create();
++
++	walk_use_def_next_functions(&use_def_data, node);
++
++	pointer_set_destroy(use_def_data.visited);
++	return use_def_data.next_cnodes_head;
++}
++
++// True if child already exists in the next_interesting_function_t children vector
++bool has_next_interesting_function_vec(next_interesting_function_t target, next_interesting_function_t next_node)
++{
++	unsigned int i;
++	next_interesting_function_t cur;
++
++	gcc_assert(next_node);
++	// handle recursion
++	if (!strcmp(target->decl_name, next_node->decl_name) && target->num == next_node->num)
++		return true;
++
++#if BUILDING_GCC_VERSION <= 4007
++	if (VEC_empty(next_interesting_function_t, target->children))
++		return false;
++	FOR_EACH_VEC_ELT(next_interesting_function_t, target->children, i, cur) {
 +#else
-+	return cgraph_get_node(fndecl);
++	FOR_EACH_VEC_SAFE_ELT(target->children, i, cur) {
 +#endif
++		if (compare_next_interesting_functions(cur, next_node->decl_name, next_node->context, next_node->num))
++			return true;
++	}
++	return false;
 +}
 +
-+static bool compare_next_interesting_functions(next_interesting_function_t cur_node, const char *decl_name, const char *context, unsigned int num)
++void push_child(next_interesting_function_t parent, next_interesting_function_t child)
 +{
-+	// Ignore num without a value
-+	if (num != NONE_ARGNUM && cur_node->num != num)
-+		return false;
-+	if (strcmp(cur_node->context, context))
-+		return false;
-+	return !strcmp(cur_node->decl_name, decl_name);
++	if (!has_next_interesting_function_vec(parent, child)) {
++#if BUILDING_GCC_VERSION <= 4007
++		VEC_safe_push(next_interesting_function_t, heap, parent->children, child);
++#else
++		vec_safe_push(parent->children, child);
++#endif
++	}
 +}
 +
-+// Return the context of vardecl. If it is in a file scope then the context is vardecl_filebasename
-+static const char* get_vardecl_context(const_tree decl)
++void __attribute__((weak)) check_local_variables(next_interesting_function_t next_node __unused) {}
++
++// Add children to parent and global_next_interesting_function
++static void collect_data_for_execute(next_interesting_function_t parent, next_interesting_function_t children)
 +{
-+	expanded_location xloc;
-+	char *buf, *path;
-+	const char *bname;
-+	int len;
++	next_interesting_function_t cur = children;
 +
-+	xloc = expand_location(DECL_SOURCE_LOCATION(decl));
-+	gcc_assert(xloc.file);
-+	path = xstrdup(xloc.file);
-+	bname = basename(path);
++	gcc_assert(parent);
 +
-+	len = asprintf(&buf, "vardecl_%s", bname);
-+	gcc_assert(len > 0);
-+	return buf;
++	while (cur) {
++		struct fn_raw_data child_raw_data;
++		next_interesting_function_t next, child;
++
++		next = cur->next;
++
++		child_raw_data.decl_str = cur->decl_name;
++		child_raw_data.context = cur->context;
++		child_raw_data.hash = cur->hash;
++		child_raw_data.num = cur->num;
++		child_raw_data.marked = NO_SO_MARK;
++		child = get_global_next_interesting_function_entry(&child_raw_data);
++		if (!child) {
++			add_to_global_next_interesting_function(cur);
++			child = cur;
++		}
++
++		check_local_variables(child);
++
++		push_child(parent, child);
++
++		cur = next;
++	}
++
++	check_local_variables(parent);
 +}
 +
-+// Return the type name for a function pointer (or "fielddecl" if the type has no name), otherwise either "vardecl" or "fndecl"
-+const char* get_decl_context(const_tree decl)
++next_interesting_function_t __attribute__((weak)) get_and_create_next_node_from_global_next_nodes_fnptr(const_tree fn_ptr __unused, struct fn_raw_data *raw_data __unused)
 +{
-+	switch (TREE_CODE(decl)) {
-+	case FUNCTION_DECL:
-+		return "fndecl";
-+		// TODO: Ignore anonymous types for now
-+	case FIELD_DECL:
-+		return get_type_name_from_field(decl);
-+	case VAR_DECL:
-+		if (TREE_PUBLIC(decl) || DECL_EXTERNAL(decl))
-+			return "vardecl";
-+		if (TREE_STATIC(decl) && !TREE_PUBLIC(decl))
-+			return get_vardecl_context(decl);
-+		// ignore local variable
-+		if (!TREE_STATIC(decl) && !DECL_EXTERNAL(decl))
++	return NULL;
++}
++
++static next_interesting_function_t create_parent_next_cnode(const_gimple stmt, unsigned int num)
++{
++	struct fn_raw_data raw_data;
++
++	raw_data.num = num;
++	raw_data.marked = NO_SO_MARK;
++
++	switch (gimple_code(stmt)) {
++	case GIMPLE_ASM:
++		raw_data.decl = current_function_decl;
++		raw_data.marked = ASM_STMT_SO_MARK;
++		return get_and_create_next_node_from_global_next_nodes(&raw_data, NULL);
++	case GIMPLE_CALL:
++		raw_data.decl = gimple_call_fndecl(stmt);
++		if (raw_data.decl != NULL_TREE)
++			return get_and_create_next_node_from_global_next_nodes(&raw_data, NULL);
++		raw_data.decl = gimple_call_fn(stmt);
++		return get_and_create_next_node_from_global_next_nodes_fnptr(raw_data.decl, &raw_data);
++	case GIMPLE_RETURN:
++		raw_data.decl = current_function_decl;
++		return get_and_create_next_node_from_global_next_nodes(&raw_data, NULL);
++	case GIMPLE_ASSIGN: {
++		tree lhs = gimple_assign_lhs(stmt);
++
++		if (VAR_P(lhs))
++			raw_data.decl = lhs;
++		else
++			raw_data.decl = get_ref_field(lhs);
++		if (raw_data.decl == NULL_TREE)
 +			return NULL;
++		return get_and_create_next_node_from_global_next_nodes(&raw_data, NULL);
++	}
 +	default:
-+		debug_tree(decl);
++		debug_gimple_stmt((gimple)stmt);
 +		gcc_unreachable();
 +	}
 +}
 +
-+// Find the function with the specified argument in the list
-+next_interesting_function_t get_global_next_interesting_function_entry(struct fn_raw_data *raw_data)
++// Handle potential next_interesting_function_t parent if its argument has an integer type
++static void collect_all_possible_size_overflow_fns(const_gimple stmt, tree start_var, unsigned int num)
 +{
-+	next_interesting_function_t cur_node, head;
++	next_interesting_function_t children_next_cnode, parent_next_cnode;
 +
-+	head = global_next_interesting_function[raw_data->hash];
-+	for (cur_node = head; cur_node; cur_node = cur_node->next) {
-+		if (raw_data->marked != ASM_STMT_SO_MARK && cur_node->marked == ASM_STMT_SO_MARK)
++	// skip void return values
++	if (start_var == NULL_TREE)
++		return;
++
++	if (skip_types(start_var))
++		return;
++
++	// handle intentional MARK_TURN_OFF
++	if (check_intentional_size_overflow_asm_and_attribute(start_var) == MARK_TURN_OFF)
++		return;
++
++	parent_next_cnode = create_parent_next_cnode(stmt, num);
++	if (!parent_next_cnode)
++		return;
++
++	children_next_cnode = search_next_functions(start_var, parent_next_cnode);
++	collect_data_for_execute(parent_next_cnode, children_next_cnode);
++}
++
++static void collect_all_possible_size_overflow_fields_and_vars(const gassign *assign)
++{
++	tree start_var, decl, lhs = gimple_assign_lhs(assign);
++
++	if (VAR_P(lhs))
++		decl = lhs;
++	else
++		decl = get_ref_field(lhs);
++	if (decl == NULL_TREE)
++		return;
++
++	if (get_intentional_attr_type(decl) == MARK_TURN_OFF)
++		return;
++
++	start_var = gimple_assign_rhs1(assign);
++	collect_all_possible_size_overflow_fns(assign, start_var, 0);
++
++	start_var = gimple_assign_rhs2(assign);
++	collect_all_possible_size_overflow_fns(assign, start_var, 0);
++
++#if BUILDING_GCC_VERSION >= 4006
++	start_var = gimple_assign_rhs3(assign);
++	collect_all_possible_size_overflow_fns(assign, start_var, 0);
++#endif
++}
++
++// Find potential next_interesting_function_t parents
++static void handle_cgraph_node(struct cgraph_node *node)
++{
++	basic_block bb;
++	tree cur_fndecl = NODE_DECL(node);
++
++	set_current_function_decl(cur_fndecl);
++
++	FOR_EACH_BB_FN(bb, cfun) {
++		gimple_stmt_iterator gsi;
++
++		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
++			tree start_var;
++			gimple stmt = gsi_stmt(gsi);
++
++			switch (gimple_code(stmt)) {
++			case GIMPLE_RETURN: {
++				const greturn *return_stmt = as_a_const_greturn(stmt);
++
++				start_var = gimple_return_retval(return_stmt);
++				collect_all_possible_size_overflow_fns(return_stmt, start_var, 0);
++				break;
++			}
++			case GIMPLE_ASM: {
++				const gasm *asm_stmt = as_a_const_gasm(stmt);
++
++				if (!is_size_overflow_insert_check_asm(asm_stmt))
++					break;
++				start_var = get_size_overflow_asm_input(asm_stmt);
++				collect_all_possible_size_overflow_fns(asm_stmt, start_var, 0);
++				break;
++			}
++			case GIMPLE_CALL: {
++				unsigned int i, len;
++				const gcall *call = as_a_const_gcall(stmt);
++				tree fndecl = gimple_call_fndecl(call);
++
++				if (fndecl != NULL_TREE && (DECL_BUILT_IN(fndecl) || DECL_BUILT_IN_CLASS(fndecl) == BUILT_IN_NORMAL))
++					break;
++
++				len = gimple_call_num_args(call);
++				for (i = 0; i < len; i++) {
++					start_var = gimple_call_arg(call, i);
++					collect_all_possible_size_overflow_fns(call, start_var, i + 1);
++				}
++				break;
++			}
++			case GIMPLE_ASSIGN:
++				collect_all_possible_size_overflow_fields_and_vars(as_a_const_gassign(stmt));
++				break;
++			default:
++				break;
++			}
++		}
++	}
++
++	unset_current_function_decl();
++}
++
++/* Collect all potentially interesting function parameters and return values of integer types
++ * and store their data flow dependencies
++ */
++static void size_overflow_generate_summary(void)
++{
++	struct cgraph_node *node;
++
++	size_overflow_register_hooks();
++
++	FOR_EACH_FUNCTION(node) {
++		if (is_valid_cgraph_node(node))
++			handle_cgraph_node(node);
++	}
++}
++
++static void size_overflow_function_insertion_hook(struct cgraph_node *node __unused, void *data __unused)
++{
++	debug_cgraph_node(node);
++	gcc_unreachable();
++}
++
++/* Handle dst if src is in the global_next_interesting_function list.
++ * If src is a clone then dst inherits the orig_next_node of src otherwise
++ * src will become the orig_next_node of dst.
++ */
++static void size_overflow_node_duplication_hook(struct cgraph_node *src, struct cgraph_node *dst, void *data __unused)
++{
++	next_interesting_function_t head, cur;
++	struct fn_raw_data src_raw_data;
++
++	src_raw_data.decl = NODE_DECL(src);
++	src_raw_data.decl_str = DECL_NAME_POINTER(src_raw_data.decl);
++	src_raw_data.context = get_decl_context(src_raw_data.decl);
++	if (!src_raw_data.context)
++		return;
++
++	src_raw_data.num = NONE_ARGNUM;
++	src_raw_data.marked = NO_SO_MARK;
++
++	head = get_global_next_interesting_function_entry_with_hash(&src_raw_data);
++	if (!head)
++		return;
++
++	for (cur = head; cur; cur = cur->next) {
++		struct fn_raw_data dst_raw_data;
++		next_interesting_function_t orig_next_node, next_node;
++
++		if (!compare_next_interesting_functions(cur, src_raw_data.decl_str, src_raw_data.context, src_raw_data.num))
 +			continue;
-+		if (compare_next_interesting_functions(cur_node, raw_data->decl_str, raw_data->context, raw_data->num))
-+			return cur_node;
++
++		dst_raw_data.decl = NODE_DECL(dst);
++		dst_raw_data.decl_str = cgraph_node_name(dst);
++		dst_raw_data.marked = cur->marked;
++
++		if (!made_by_compiler(dst_raw_data.decl))
++			break;
++
++		// For clones use the original node instead
++		if (cur->orig_next_node)
++			orig_next_node = cur->orig_next_node;
++		else
++			orig_next_node = cur;
++
++		dst_raw_data.num = get_correct_argnum_fndecl(src_raw_data.decl, dst_raw_data.decl, cur->num);
++		if (dst_raw_data.num == CANNOT_FIND_ARG)
++			continue;
++
++		next_node = create_new_next_interesting_decl(&dst_raw_data, orig_next_node);
++		if (next_node)
++			add_to_global_next_interesting_function(next_node);
 +	}
-+	return NULL;
 +}
 +
-+next_interesting_function_t get_global_next_interesting_function_entry_with_hash(struct fn_raw_data *raw_data)
++void size_overflow_register_hooks(void)
 +{
-+	raw_data->hash = get_decl_hash(raw_data->decl, raw_data->decl_str);
-+	if (raw_data->hash == NO_HASH)
-+		return NULL;
++	static bool init_p = false;
 +
-+	raw_data->context = get_decl_context(raw_data->decl);
-+	if (!raw_data->context)
-+		return NULL;
-+	return get_global_next_interesting_function_entry(raw_data);
++	if (init_p)
++		return;
++	init_p = true;
++
++	function_insertion_hook_holder = cgraph_add_function_insertion_hook(&size_overflow_function_insertion_hook, NULL);
++	node_duplication_hook_holder = cgraph_add_node_duplication_hook(&size_overflow_node_duplication_hook, NULL);
 +}
 +
-+next_interesting_function_t create_new_next_interesting_entry(struct fn_raw_data *raw_data, next_interesting_function_t orig_next_node)
++static void set_yes_so_mark(next_interesting_function_t next_node)
 +{
-+	next_interesting_function_t new_node;
++	if (next_node->marked == NO_SO_MARK) {
++		next_node->marked = YES_SO_MARK;
++		global_changed = true;
++	}
++	// Mark the orig decl as well if it's a clone
++	if (next_node->orig_next_node && next_node->orig_next_node->marked == NO_SO_MARK) {
++		next_node->orig_next_node->marked = YES_SO_MARK;
++		global_changed = true;
++	}
++}
 +
-+	new_node = (next_interesting_function_t)xmalloc(sizeof(*new_node));
-+	new_node->decl_name = xstrdup(raw_data->decl_str);
++// Determine whether node or orig node is part of a tracked data flow
++static bool marked_fn(next_interesting_function_t next_node)
++{
++	bool is_marked_fn, is_marked_orig = false;
 +
-+	gcc_assert(raw_data->context);
-+	new_node->context = xstrdup(raw_data->context);
-+	new_node->hash = raw_data->hash;
-+	new_node->num = raw_data->num;
-+	new_node->next = NULL;
-+	new_node->children = NULL;
-+	new_node->marked = raw_data->marked;
-+	new_node->orig_next_node = orig_next_node;
-+	return new_node;
++	is_marked_fn = next_node->marked != NO_SO_MARK;
++
++	if (next_node->orig_next_node)
++		is_marked_orig = next_node->orig_next_node->marked != NO_SO_MARK;
++
++	return is_marked_fn || is_marked_orig;
 +}
 +
-+// Ignore these functions to not explode coverage (+strncmp+fndecl+3+35130+)
-+static bool temporary_skip_these_functions(struct fn_raw_data *raw_data)
++// Determine whether node or orig node is in the hash table already
++static bool already_in_the_hashtable(next_interesting_function_t next_node)
 +{
-+	if (raw_data->hash == 35130 && !strcmp(raw_data->decl_str, "strncmp"))
-+		return true;
-+	if (raw_data->hash == 46193 && !strcmp(raw_data->decl_str, "strnlen"))
-+		return true;
-+	if (raw_data->hash == 43267 && !strcmp(raw_data->decl_str, "strncpy"))
-+		return true;
-+	if (raw_data->hash == 10300 && !strcmp(raw_data->decl_str, "strncpy_from_user"))
-+		return true;
-+	if (raw_data->hash == 26117 && !strcmp(raw_data->decl_str, "memchr"))
-+		return true;
-+	if (raw_data->hash == 16203 && !strcmp(raw_data->decl_str, "memchr_inv"))
-+		return true;
-+	if (raw_data->hash == 24269 && !strcmp(raw_data->decl_str, "memcmp"))
-+		return true;
-+	if (raw_data->hash == 60390 && !strcmp(raw_data->decl_str, "memcpy"))
-+		return true;
-+	if (raw_data->hash == 25040 && !strcmp(raw_data->decl_str, "memmove"))
-+		return true;
-+	if (raw_data->hash == 29763 && !strcmp(raw_data->decl_str, "memset"))
-+		return true;
-+	return false;
++	if (next_node->orig_next_node)
++		next_node = next_node->orig_next_node;
++	return get_size_overflow_hash_entry(next_node->hash, next_node->decl_name, next_node->context, next_node->num) != NULL;
 +}
 +
-+// Create the main data structure
-+next_interesting_function_t create_new_next_interesting_decl(struct fn_raw_data *raw_data, next_interesting_function_t orig_next_node)
++// Propagate the size_overflow marks up the use-def chains
++static bool has_marked_child(next_interesting_function_t next_node)
 +{
-+	enum tree_code decl_code = TREE_CODE(raw_data->decl);
++	bool ret = false;
++	unsigned int i;
++	next_interesting_function_t child;
 +
-+	gcc_assert(decl_code == FIELD_DECL || decl_code == FUNCTION_DECL || decl_code == VAR_DECL);
++#if BUILDING_GCC_VERSION <= 4007
++	if (VEC_empty(next_interesting_function_t, next_node->children))
++		return false;
++	FOR_EACH_VEC_ELT(next_interesting_function_t, next_node->children, i, child) {
++#else
++	FOR_EACH_VEC_SAFE_ELT(next_node->children, i, child) {
++#endif
++		if (marked_fn(child) || already_in_the_hashtable(child))
++			ret = true;
++	}
 +
-+	if (is_vararg(raw_data->decl, raw_data->num))
-+		return NULL;
++	return ret;
++}
 +
-+	raw_data->hash = get_decl_hash(raw_data->decl, raw_data->decl_str);
-+	if (raw_data->hash == NO_HASH)
-+		return NULL;
-+	if (get_size_overflow_hash_entry_tree(raw_data->decl, raw_data->num, DISABLE_SIZE_OVERFLOW))
-+		return NULL;
-+	if (temporary_skip_these_functions(raw_data))
-+		return NULL;
++/* Set YES_SO_MARK on the function, its orig node and children if:
++ *      * the function or its orig node or one of its children is in the hash table already
++ *      * the function's orig node is marked with YES_SO_MARK or ASM_STMT_SO_MARK
++ *      * one of the children is marked with YES_SO_MARK or ASM_STMT_SO_MARK
++ */
++static bool set_fn_so_mark(next_interesting_function_t next_node)
++{
++	bool so_fn, so_hashtable, so_child;
 +
-+	gcc_assert(raw_data->num <= MAX_PARAM);
-+	// Clones must have an orig_next_node
-+	gcc_assert(!made_by_compiler(raw_data->decl) || orig_next_node);
++	so_hashtable = already_in_the_hashtable(next_node);
++	so_fn = marked_fn(next_node);
++	so_child = has_marked_child(next_node);
 +
-+	raw_data->context = get_decl_context(raw_data->decl);
-+	if (!raw_data->context)
++	if (!so_fn && !so_hashtable && !so_child)
++		return false;
++	set_yes_so_mark(next_node);
++	return true;
++}
++
++// Determine if any of the function pointer targets have data flow between the return value and one of the arguments
++static next_interesting_function_t get_same_not_ret_child(next_interesting_function_t parent)
++{
++	unsigned int i;
++	next_interesting_function_t child;
++
++#if BUILDING_GCC_VERSION <= 4007
++	if (VEC_empty(next_interesting_function_t, parent->children))
 +		return NULL;
-+	return create_new_next_interesting_entry(raw_data, orig_next_node);
++	FOR_EACH_VEC_ELT(next_interesting_function_t, parent->children, i, child) {
++#else
++	FOR_EACH_VEC_SAFE_ELT(parent->children, i, child) {
++#endif
++		if (child->num == 0)
++			continue;
++		if (strcmp(parent->decl_name, child->decl_name))
++			continue;
++		if (!strcmp(child->context, "fndecl"))
++			return child;
++	}
++	return NULL;
 +}
 +
-+void add_to_global_next_interesting_function(next_interesting_function_t new_entry)
++/* Trace a return value of function pointer type back to an argument via a concrete function
++   fnptr 0 && fn 0 && (fn 0 -> fn 2) => fnptr 2 */
++static void search_missing_fptr_arg(next_interesting_function_t parent)
 +{
-+	next_interesting_function_t cur_global_head, cur_global, cur_global_end = NULL;
++	next_interesting_function_t child;
++	unsigned int i;
++#if BUILDING_GCC_VERSION <= 4007
++	VEC(next_interesting_function_t, heap) *new_children = NULL;
++#else
++	vec<next_interesting_function_t, va_heap, vl_embed> *new_children = NULL;
++#endif
 +
-+	// new_entry is appended to the end of a list
-+	new_entry->next = NULL;
++	if (parent->num != 0)
++		return;
++	if (!strcmp(parent->context, "fndecl"))
++		return;
++	if (!strncmp(parent->context, "vardecl", sizeof("vardecl") - 1))
++		return;
 +
-+	cur_global_head = global_next_interesting_function[new_entry->hash];
-+	if (!cur_global_head) {
-+		global_next_interesting_function[new_entry->hash] = new_entry;
++	// fnptr 0 && fn 0
++#if BUILDING_GCC_VERSION <= 4007
++	if (VEC_empty(next_interesting_function_t, parent->children))
 +		return;
++	FOR_EACH_VEC_ELT(next_interesting_function_t, parent->children, i, child) {
++#else
++	FOR_EACH_VEC_SAFE_ELT(parent->children, i, child) {
++#endif
++		next_interesting_function_t cur_next_node, tracked_fn;
++
++		if (child->num != 0)
++			continue;
++		// (fn 0 -> fn 2)
++		tracked_fn = get_same_not_ret_child(child);
++		if (!tracked_fn)
++			continue;
++
++		// fn 2 => fnptr 2
++		for (cur_next_node = global_next_interesting_function[parent->hash]; cur_next_node; cur_next_node = cur_next_node->next) {
++			if (cur_next_node->num != tracked_fn->num)
++				continue;
++
++			if (strcmp(parent->decl_name, cur_next_node->decl_name))
++				continue;
++
++			if (!has_next_interesting_function_vec(parent, cur_next_node)) {
++#if BUILDING_GCC_VERSION <= 4007
++				VEC_safe_push(next_interesting_function_t, heap, new_children, cur_next_node);
++#else
++				vec_safe_push(new_children, cur_next_node);
++#endif
++			}
++		}
 +	}
 +
++#if BUILDING_GCC_VERSION == 4005
++	if (VEC_empty(next_interesting_function_t, new_children))
++		return;
++	FOR_EACH_VEC_ELT(next_interesting_function_t, new_children, i, child)
++		VEC_safe_push(next_interesting_function_t, heap, parent->children, child);
++#elif BUILDING_GCC_VERSION <= 4007
++	VEC_safe_splice(next_interesting_function_t, heap, parent->children, new_children);
++#else
++	vec_safe_splice(parent->children, new_children);
++#endif
++}
++
++static void walk_so_marked_fns(next_interesting_function_set *visited, next_interesting_function_t parent, bool debug)
++{
++	unsigned int i;
++	next_interesting_function_t child;
 +
-+	for (cur_global = cur_global_head; cur_global; cur_global = cur_global->next) {
-+		if (!cur_global->next)
-+			cur_global_end = cur_global;
++	gcc_assert(parent);
++	if (!set_fn_so_mark(parent))
++		return;
 +
-+		if (compare_next_interesting_functions(cur_global, new_entry->decl_name, new_entry->context, new_entry->num))
-+			return;
++#if BUILDING_GCC_VERSION <= 4007
++	if (VEC_empty(next_interesting_function_t, parent->children))
++		return;
++	FOR_EACH_VEC_ELT(next_interesting_function_t, parent->children, i, child) {
++#else
++	FOR_EACH_VEC_SAFE_ELT(parent->children, i, child) {
++#endif
++		set_yes_so_mark(child);
++
++		if (in_lto_p && debug == PRINT_DATA_FLOW) {
++			fprintf(stderr, " PARENT: decl: %s-%u context: %s %p\n", parent->decl_name, parent->num, parent->context, parent);
++			fprintf(stderr, " \tCHILD: decl: %s-%u context: %s %p\n", child->decl_name, child->num, child->context, child);
++		}
++
++		if (!pointer_set_insert(visited, child))
++			walk_so_marked_fns(visited, child, debug);
 +	}
++}
 +
-+	gcc_assert(cur_global_end);
-+	cur_global_end->next = new_entry;
++// Do a depth-first recursive dump of the next_interesting_function_t children vector
++static void print_missing_functions(next_interesting_function_set *visited, next_interesting_function_t parent)
++{
++	unsigned int i;
++	next_interesting_function_t child;
++
++	gcc_assert(parent);
++	gcc_assert(parent->marked != NO_SO_MARK);
++	print_missing_function(parent);
++
++#if BUILDING_GCC_VERSION <= 4007
++	if (VEC_empty(next_interesting_function_t, parent->children))
++		return;
++	FOR_EACH_VEC_ELT(next_interesting_function_t, parent->children, i, child) {
++#else
++	FOR_EACH_VEC_SAFE_ELT(parent->children, i, child) {
++#endif
++		gcc_assert(child->marked != NO_SO_MARK);
++		if (!pointer_set_insert(visited, child))
++			print_missing_functions(visited, child);
++	}
 +}
 +
-+/* If the interesting function is a clone then find or create its original next_interesting_function_t node
-+ * and add it to global_next_interesting_function
++// Set YES_SO_MARK on functions that will be emitted into the hash table
++static void search_so_marked_fns(bool debug)
++{
++
++	unsigned int i;
++	next_interesting_function_set *visited;
++	next_interesting_function_t cur_global;
++
++	visited = next_interesting_function_pointer_set_create();
++	for (i = 0; i < GLOBAL_NIFN_LEN; i++) {
++		for (cur_global = global_next_interesting_function[i]; cur_global; cur_global = cur_global->next) {
++			if (cur_global->marked == NO_SO_MARK || pointer_set_insert(visited, cur_global))
++				continue;
++
++			if  (in_lto_p && debug == PRINT_DATA_FLOW)
++				fprintf(stderr, "Data flow: decl: %s-%u context: %s %p\n", cur_global->decl_name, cur_global->num, cur_global->context, cur_global);
++
++			walk_so_marked_fns(visited, cur_global, debug);
++
++			if  (in_lto_p && debug == PRINT_DATA_FLOW)
++				fprintf(stderr, "\n");
++		}
++	}
++	pointer_set_destroy(visited);
++}
++
++// Print functions missing from the hash table
++static void print_so_marked_fns(void)
++{
++	unsigned int i;
++	next_interesting_function_set *visited;
++	next_interesting_function_t cur_global;
++
++	visited = next_interesting_function_pointer_set_create();
++	for (i = 0; i < GLOBAL_NIFN_LEN; i++) {
++		for (cur_global = global_next_interesting_function[i]; cur_global; cur_global = cur_global->next) {
++			if (cur_global->marked != NO_SO_MARK && !pointer_set_insert(visited, cur_global))
++				print_missing_functions(visited, cur_global);
++		}
++	}
++	pointer_set_destroy(visited);
++}
++
++void __attribute__((weak)) check_global_variables(next_interesting_function_t cur_global __unused) {}
++
++// Print all missing interesting functions
++static unsigned int size_overflow_execute(void)
++{
++	unsigned int i;
++	next_interesting_function_t cur_global;
++
++	if (flag_lto && !in_lto_p)
++		return 0;
++
++	// Collect vardecls and funtions reachable by function pointers
++	for (i = 0; i < GLOBAL_NIFN_LEN; i++) {
++		for (cur_global = global_next_interesting_function[i]; cur_global; cur_global = cur_global->next) {
++			check_global_variables(cur_global);
++			search_missing_fptr_arg(cur_global);
++		}
++	}
++
++	search_so_marked_fns(PRINT_DATA_FLOW);
++	while (global_changed) {
++		global_changed = false;
++		search_so_marked_fns(NO_PRINT_DATA_FLOW);
++	}
++
++	print_so_marked_fns();
++
++	if (in_lto_p) {
++		fprintf(stderr, "%s: SIZE_OVERFLOW EXECUTE\n", __func__);
++		print_global_next_interesting_functions();
++	}
++
++	return 0;
++}
++
++// Omit the IPA/LTO callbacks until https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61311 gets fixed (license concerns)
++#if BUILDING_GCC_VERSION >= 4008
++void __attribute__((weak)) size_overflow_write_summary(void) {}
++void __attribute__((weak)) size_overflow_write_optimization_summary(void) {}
++#elif BUILDING_GCC_VERSION >= 4006
++void __attribute__((weak)) size_overflow_write_summary(cgraph_node_set set __unused, varpool_node_set vset __unused) {}
++void __attribute__((weak)) size_overflow_write_optimization_summary(cgraph_node_set set __unused, varpool_node_set vset __unused) {}
++#else
++void __attribute__((weak)) size_overflow_write_summary(cgraph_node_set set __unused) {}
++void __attribute__((weak)) size_overflow_write_optimization_summary(cgraph_node_set set __unused) {}
++#endif
++
++void __attribute__((weak)) size_overflow_read_summary(void);
++void __attribute__((weak)) size_overflow_read_optimization_summary(void);
++
++#define PASS_NAME size_overflow
++
++#define NO_STMT_FIXUP
++#define NO_VARIABLE_TRANSFORM
++#define NO_GATE
++
++#include "gcc-generate-ipa-pass.h"
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/size_overflow_misc.c b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_misc.c
+new file mode 100644
+index 0000000..7f459ed
+--- /dev/null
++++ b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_misc.c
+@@ -0,0 +1,505 @@
++/*
++ * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
++ * Licensed under the GPL v2, or (at your option) v3
++ *
++ * Homepage:
++ * https://github.com/ephox-gcc-plugins/size_overflow
++ *
++ * Documentation:
++ * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
++ *
++ * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
++ * with double integer precision (DImode/TImode for 32/64 bit integer types).
++ * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
++ *
++ * Usage:
++ * $ make
++ * $ make run
 + */
-+static next_interesting_function_t create_orig_next_node_for_a_clone(struct fn_raw_data *clone_raw_data)
++
++#include "size_overflow.h"
++
++bool is_vararg(const_tree fn, unsigned int num)
 +{
-+	struct fn_raw_data orig_raw_data;
-+	next_interesting_function_t orig_next_node;
-+	enum tree_code decl_code;
++	tree arg_list;
 +
-+	orig_raw_data.decl = get_orig_fndecl(clone_raw_data->decl);
++	if (num == 0)
++		return false;
++	if (fn == NULL_TREE)
++		return false;
++	if (TREE_CODE(fn) != FUNCTION_DECL)
++		return false;
 +
-+	if (DECL_BUILT_IN(orig_raw_data.decl) || DECL_BUILT_IN_CLASS(orig_raw_data.decl) == BUILT_IN_NORMAL)
-+		return NULL;
++	arg_list = TYPE_ARG_TYPES(TREE_TYPE(fn));
++	if (arg_list == NULL_TREE)
++		return false;
 +
-+	if (made_by_compiler(orig_raw_data.decl))
-+		return NULL;
++	if (tree_last(arg_list) == void_list_node)
++		return false;
 +
-+	decl_code = TREE_CODE(orig_raw_data.decl);
-+	if (decl_code == FIELD_DECL || decl_code == VAR_DECL)
-+		orig_raw_data.num = clone_raw_data->num;
-+	else
-+		orig_raw_data.num = get_correct_argnum(clone_raw_data->decl, orig_raw_data.decl, clone_raw_data->num);
++	return num >= (unsigned int)list_length(arg_list);
++}
 +
-+	// Skip over ISRA.162 parm decls
-+	if (orig_raw_data.num == CANNOT_FIND_ARG)
-+		return NULL;
++// Extract the field decl from memory references
++tree get_ref_field(const_tree ref)
++{
++	tree field;
 +
-+	orig_raw_data.decl_str = get_orig_decl_name(orig_raw_data.decl);
-+	orig_raw_data.marked = NO_SO_MARK;
-+	orig_next_node = get_global_next_interesting_function_entry_with_hash(&orig_raw_data);
-+	if (orig_next_node)
-+		return orig_next_node;
++	// TODO: handle nested memory references
++	switch (TREE_CODE(ref)) {
++	case ARRAY_REF:
++		return NULL_TREE;
++#if BUILDING_GCC_VERSION >= 4006
++	case MEM_REF:
++#endif
++	case INDIRECT_REF:
++		field = TREE_OPERAND(ref, 0);
++		break;
++	case COMPONENT_REF:
++		field = TREE_OPERAND(ref, 1);
++		break;
++	default:
++		return NULL_TREE;
++	}
 +
-+	orig_raw_data.marked = clone_raw_data->marked;
-+	orig_next_node = create_new_next_interesting_decl(&orig_raw_data, NULL);
-+	if (!orig_next_node)
-+		return NULL;
++	// TODO
++	if (TREE_CODE(field) == SSA_NAME)
++		return NULL_TREE;
++	// TODO
++	if (TREE_CODE(field) != FIELD_DECL)
++		return NULL_TREE;
++	// TODO
++	if (TREE_CODE(field) == ADDR_EXPR)
++		return NULL_TREE;
 +
-+	add_to_global_next_interesting_function(orig_next_node);
-+	return orig_next_node;
++	return field;
 +}
 +
-+// Find or create the next_interesting_function_t node for decl and num
-+next_interesting_function_t get_and_create_next_node_from_global_next_nodes(struct fn_raw_data *raw_data, next_interesting_function_t orig_next_node)
++const char *get_type_name_from_field(const_tree field_decl)
 +{
-+	next_interesting_function_t cur_next_cnode;
++	const_tree context, type_name;
 +
-+	if (DECL_NAME(raw_data->decl) == NULL_TREE)
++	if (TREE_CODE(field_decl) != FIELD_DECL)
 +		return NULL;
-+	raw_data->decl_str = DECL_NAME_POINTER(raw_data->decl);
 +
-+	cur_next_cnode = get_global_next_interesting_function_entry_with_hash(raw_data);
-+	if (cur_next_cnode)
-+		goto out;
++	context = DECL_CONTEXT(field_decl);
++	// TODO
++	if (TREE_CODE(context) != RECORD_TYPE)
++		return NULL;
++	gcc_assert(TREE_CODE(context) == RECORD_TYPE);
++	type_name = TYPE_NAME(TYPE_MAIN_VARIANT(context));
++	if (type_name == NULL_TREE)
++		return NULL;
 +
-+	if (!orig_next_node && made_by_compiler(raw_data->decl)) {
-+		orig_next_node = create_orig_next_node_for_a_clone(raw_data);
-+		if (!orig_next_node)
-+			return NULL;
++	if (TREE_CODE(type_name) == IDENTIFIER_NODE)
++		return IDENTIFIER_POINTER(type_name);
++	else if (TREE_CODE(type_name) == TYPE_DECL)
++		return DECL_NAME_POINTER(type_name);
++
++	debug_tree(field_decl);
++	debug_tree(type_name);
++	gcc_unreachable();
++}
++
++// Was the function created by the compiler itself?
++bool made_by_compiler(const_tree decl)
++{
++	enum tree_code decl_code;
++	struct cgraph_node *node;
++
++	if (FUNCTION_PTR_P(decl))
++		return false;
++	decl_code = TREE_CODE(decl);
++	if (decl_code == VAR_DECL || decl_code == FIELD_DECL)
++		return false;
++
++	gcc_assert(decl_code == FUNCTION_DECL);
++	if (DECL_ABSTRACT_ORIGIN(decl) != NULL_TREE && DECL_ABSTRACT_ORIGIN(decl) != decl)
++		return true;
++	if (DECL_ARTIFICIAL(decl))
++		return true;
++
++	node = get_cnode(decl);
++	if (!node)
++		return false;
++	return node->clone_of != NULL;
++}
++
++bool skip_types(const_tree var)
++{
++	const_tree type;
++
++	type = TREE_TYPE(var);
++	if (type == NULL_TREE)
++		return true;
++
++	switch (TREE_CODE(type)) {
++		case INTEGER_TYPE:
++		case ENUMERAL_TYPE:
++			return false;
++		default:
++			return true;
 +	}
++}
 +
-+	cur_next_cnode = create_new_next_interesting_decl(raw_data, orig_next_node);
-+	if (!cur_next_cnode)
++gimple get_fnptr_def_stmt(const_tree fn_ptr)
++{
++	gimple def_stmt;
++
++	gcc_assert(fn_ptr != NULL_TREE);
++	gcc_assert(FUNCTION_PTR_P(fn_ptr));
++
++	if (is_gimple_constant(fn_ptr))
 +		return NULL;
 +
-+	add_to_global_next_interesting_function(cur_next_cnode);
-+out:
-+	if (cur_next_cnode->marked != raw_data->marked && cur_next_cnode->marked != NO_SO_MARK)
-+		return cur_next_cnode;
++	def_stmt = get_def_stmt(fn_ptr);
++	gcc_assert(def_stmt);
++	return def_stmt;
++}
 +
-+	if (raw_data->marked != NO_SO_MARK && cur_next_cnode->marked == NO_SO_MARK)
-+		cur_next_cnode->marked = raw_data->marked;
++gimple get_def_stmt(const_tree node)
++{
++	gcc_assert(node != NULL_TREE);
 +
-+	return cur_next_cnode;
++	if (TREE_CODE(node) != SSA_NAME)
++		return NULL;
++	return SSA_NAME_DEF_STMT(node);
 +}
 +
-+static bool has_next_interesting_function_chain_node(next_interesting_function_t next_cnodes_head, struct fn_raw_data *raw_data)
++tree create_new_var(tree type)
 +{
-+	next_interesting_function_t cur_node;
-+
-+	raw_data->decl_str = DECL_NAME_POINTER(raw_data->decl);
-+	raw_data->context = get_decl_context(raw_data->decl);
-+	// Ignore function if there is no context
-+	if (!raw_data->context)
-+		return true;
++	tree new_var = create_tmp_var(type, "cicus");
 +
-+	for (cur_node = next_cnodes_head; cur_node; cur_node = cur_node->next) {
-+		if (compare_next_interesting_functions(cur_node, raw_data->decl_str, raw_data->context, raw_data->num))
-+			return true;
-+	}
-+	return false;
++	add_referenced_var(new_var);
++	return new_var;
 +}
 +
-+static void handle_function(struct walk_use_def_data *use_def_data, tree fndecl, const_tree arg)
++static bool skip_cast(tree dst_type, const_tree rhs, bool force)
 +{
-+	struct fn_raw_data raw_data;
-+	next_interesting_function_t orig_next_node, new_node;
++	const_gimple def_stmt = get_def_stmt(rhs);
 +
-+	gcc_assert(fndecl != NULL_TREE);
++	if (force)
++		return false;
 +
-+	// ignore builtins to not explode coverage (e.g., memcpy)
-+	if (DECL_BUILT_IN(fndecl) || DECL_BUILT_IN_CLASS(fndecl) == BUILT_IN_NORMAL)
-+		return;
++	if (is_gimple_constant(rhs))
++		return false;
 +
-+	if (get_intentional_attr_type(fndecl) == MARK_TURN_OFF)
-+		return;
++	if (!def_stmt || gimple_code(def_stmt) == GIMPLE_NOP)
++		return false;
 +
-+	raw_data.decl = fndecl;
-+	raw_data.decl_str = DECL_NAME_POINTER(fndecl);
-+	raw_data.marked = NO_SO_MARK;
++	if (!types_compatible_p(dst_type, TREE_TYPE(rhs)))
++		return false;
 +
-+	// convert arg into its position
-+	if (arg == NULL_TREE)
-+		raw_data.num = 0;
-+	else
-+		raw_data.num = find_arg_number_tree(arg, raw_data.decl);
-+	if (raw_data.num == CANNOT_FIND_ARG)
-+		return;
++	// DI type can be on 32 bit (from create_assign) but overflow type stays DI
++	if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode))
++		return false;
 +
-+	if (has_next_interesting_function_chain_node(use_def_data->next_cnodes_head, &raw_data))
-+		return;
++	return true;
++}
 +
-+	if (made_by_compiler(raw_data.decl)) {
-+		orig_next_node = create_orig_next_node_for_a_clone(&raw_data);
-+		if (!orig_next_node)
-+			return;
-+	} else
-+		orig_next_node = NULL;
++tree cast_a_tree(tree type, tree var)
++{
++	gcc_assert(type != NULL_TREE);
++	gcc_assert(var != NULL_TREE);
++	gcc_assert(fold_convertible_p(type, var));
 +
-+	new_node = create_new_next_interesting_decl(&raw_data, orig_next_node);
-+	if (!new_node)
-+		return;
-+	new_node->next = use_def_data->next_cnodes_head;
-+	use_def_data->next_cnodes_head = new_node;
++	return fold_convert(type, var);
 +}
 +
-+static void walk_use_def_next_functions_phi(struct walk_use_def_data *use_def_data, const_tree result)
++gimple build_cast_stmt(struct visited *visited, tree dst_type, tree rhs, tree lhs, gimple_stmt_iterator *gsi, bool before, bool force)
 +{
-+	gphi *phi = as_a_gphi(get_def_stmt(result));
-+	unsigned int i, n = gimple_phi_num_args(phi);
++	gassign *assign;
++	gimple def_stmt;
 +
-+	pointer_set_insert(use_def_data->visited, phi);
-+	for (i = 0; i < n; i++) {
-+		tree arg = gimple_phi_arg_def(phi, i);
++	gcc_assert(dst_type != NULL_TREE && rhs != NULL_TREE);
++	gcc_assert(!is_gimple_constant(rhs));
++	if (gsi_end_p(*gsi) && before == AFTER_STMT)
++		gcc_unreachable();
 +
-+		walk_use_def_next_functions(use_def_data, arg);
++	def_stmt = get_def_stmt(rhs);
++	if (def_stmt && gimple_code(def_stmt) != GIMPLE_NOP && skip_cast(dst_type, rhs, force) && pointer_set_contains(visited->my_stmts, def_stmt))
++		return def_stmt;
++
++	if (lhs == CREATE_NEW_VAR)
++		lhs = create_new_var(dst_type);
++
++	assign = gimple_build_assign(lhs, cast_a_tree(dst_type, rhs));
++
++	if (!gsi_end_p(*gsi)) {
++		location_t loc = gimple_location(gsi_stmt(*gsi));
++		gimple_set_location(assign, loc);
 +	}
++
++	gimple_assign_set_lhs(assign, make_ssa_name(lhs, assign));
++
++	if (before)
++		gsi_insert_before(gsi, assign, GSI_NEW_STMT);
++	else
++		gsi_insert_after(gsi, assign, GSI_NEW_STMT);
++	update_stmt(assign);
++	return assign;
 +}
 +
-+static void walk_use_def_next_functions_binary(struct walk_use_def_data *use_def_data, const_tree lhs)
++bool is_size_overflow_type(const_tree var)
 +{
-+	gassign *def_stmt = as_a_gassign(get_def_stmt(lhs));
-+	tree rhs1, rhs2;
++	const char *name;
++	const_tree type_name, type;
 +
-+	rhs1 = gimple_assign_rhs1(def_stmt);
-+	rhs2 = gimple_assign_rhs2(def_stmt);
++	if (var == NULL_TREE)
++		return false;
 +
-+	walk_use_def_next_functions(use_def_data, rhs1);
-+	walk_use_def_next_functions(use_def_data, rhs2);
-+}
++	type = TREE_TYPE(var);
++	type_name = TYPE_NAME(type);
++	if (type_name == NULL_TREE)
++		return false;
 +
-+static void walk_use_def_next_functions_unary(struct walk_use_def_data *use_def_data, const gassign *stmt)
-+{
-+	tree rhs1 = gimple_assign_rhs1(stmt);
++	if (DECL_P(type_name))
++		name = DECL_NAME_POINTER(type_name);
++	else
++		name = IDENTIFIER_POINTER(type_name);
 +
-+	walk_use_def_next_functions(use_def_data, rhs1);
++	if (!strncmp(name, "size_overflow_type", 18))
++		return true;
++	return false;
 +}
 +
-+void __attribute__((weak)) handle_function_ptr_ret(struct walk_use_def_data *use_def_data __unused, const_tree fn_ptr __unused)
++// Determine if a cloned function has all the original arguments
++static bool unchanged_arglist(struct cgraph_node *new_node, struct cgraph_node *old_node)
 +{
++	const_tree new_decl_list, old_decl_list;
++
++	if (new_node->clone_of && new_node->clone.tree_map)
++		return !new_node->clone.args_to_skip;
++
++	new_decl_list = DECL_ARGUMENTS(NODE_DECL(new_node));
++	old_decl_list = DECL_ARGUMENTS(NODE_DECL(old_node));
++	if (new_decl_list != NULL_TREE && old_decl_list != NULL_TREE)
++		gcc_assert(list_length(new_decl_list) == list_length(old_decl_list));
++
++	return true;
 +}
 +
-+static void create_and_append_new_next_interesting_field_var_decl(struct walk_use_def_data *use_def_data, struct fn_raw_data *raw_data)
++unsigned int get_correct_argnum_fndecl(const_tree fndecl, const_tree correct_argnum_of_fndecl, unsigned int num)
 +{
-+	next_interesting_function_t new_node;
-+
-+	if (raw_data->decl == NULL_TREE)
-+		return;
++	unsigned int new_num;
++	const_tree fndecl_arg;
++	tree fndecl_arglist = DECL_ARGUMENTS(fndecl);
++	const_tree arg, target_fndecl_arglist;
 +
-+	if (DECL_NAME(raw_data->decl) == NULL_TREE)
-+		return;
++	if (num == 0)
++		return num;
 +
-+	raw_data->decl_str = DECL_NAME_POINTER(raw_data->decl);
-+	raw_data->num = 0;
-+	raw_data->marked = NO_SO_MARK;
++	if (fndecl == correct_argnum_of_fndecl && !DECL_ARTIFICIAL(fndecl))
++		return num;
++	else if (fndecl == correct_argnum_of_fndecl && DECL_ARTIFICIAL(fndecl))
++		return CANNOT_FIND_ARG;
 +
-+	new_node = create_new_next_interesting_decl(raw_data, NULL);
-+	if (!new_node)
-+		return;
-+	new_node->next = use_def_data->next_cnodes_head;
-+	use_def_data->next_cnodes_head = new_node;
-+}
++	target_fndecl_arglist = DECL_ARGUMENTS(correct_argnum_of_fndecl);
++	if (fndecl_arglist == NULL_TREE || target_fndecl_arglist == NULL_TREE)
++		return CANNOT_FIND_ARG;
 +
-+static void handle_struct_fields(struct walk_use_def_data *use_def_data, const_tree node)
-+{
-+	struct fn_raw_data raw_data;
++	fndecl_arg = chain_index(num - 1, fndecl_arglist);
++	if (fndecl_arg == NULL_TREE)
++		return CANNOT_FIND_ARG;
 +
-+	switch (TREE_CODE(node)) {
-+	case ARRAY_REF:
-+#if BUILDING_GCC_VERSION >= 4006
-+	case MEM_REF:
-+#endif
-+	case INDIRECT_REF:
-+	case COMPONENT_REF:
-+		raw_data.decl = get_ref_field(node);
-+		break;
-+	// TODO
-+	case BIT_FIELD_REF:
-+	case VIEW_CONVERT_EXPR:
-+	case REALPART_EXPR:
-+	case IMAGPART_EXPR:
-+		return;
-+	default:
-+		debug_tree(node);
-+		gcc_unreachable();
++	for (arg = target_fndecl_arglist, new_num = 1; arg; arg = TREE_CHAIN(arg), new_num++) {
++		if (arg == fndecl_arg || !strcmp(DECL_NAME_POINTER(arg), DECL_NAME_POINTER(fndecl_arg)))
++			return new_num;
 +	}
 +
-+	if (get_intentional_attr_type(raw_data.decl) == MARK_TURN_OFF)
-+		return;
-+
-+	create_and_append_new_next_interesting_field_var_decl(use_def_data, &raw_data);
++	return CANNOT_FIND_ARG;
 +}
 +
-+static void handle_vardecl(struct walk_use_def_data *use_def_data, tree node)
++// Find the specified argument in the originally cloned function
++static unsigned int clone_argnum_on_orig(struct cgraph_node *new_node, struct cgraph_node *old_node, unsigned int clone_argnum)
 +{
-+	struct fn_raw_data raw_data;
++	bitmap args_to_skip;
++	unsigned int i, new_argnum = clone_argnum;
 +
-+	raw_data.decl = node;
-+	create_and_append_new_next_interesting_field_var_decl(use_def_data, &raw_data);
++	if (unchanged_arglist(new_node, old_node))
++		return clone_argnum;
++
++	gcc_assert(new_node->clone_of && new_node->clone.tree_map);
++	args_to_skip = new_node->clone.args_to_skip;
++	for (i = 0; i < clone_argnum; i++) {
++		if (bitmap_bit_p(args_to_skip, i))
++			new_argnum++;
++	}
++	return new_argnum;
 +}
 +
-+/* Find all functions that influence lhs
-+ *
-+ * Encountered functions are added to the children vector (next_interesting_function_t).
-+ */
-+static void walk_use_def_next_functions(struct walk_use_def_data *use_def_data, tree lhs)
++// Find the specified argument in the clone
++static unsigned int orig_argnum_on_clone(struct cgraph_node *new_node, struct cgraph_node *old_node, unsigned int orig_argnum)
 +{
-+	enum tree_code code;
-+	const_gimple def_stmt;
++	bitmap args_to_skip;
++	unsigned int i, new_argnum = orig_argnum;
 +
-+	if (skip_types(lhs))
-+		return;
++	if (unchanged_arglist(new_node, old_node))
++		return orig_argnum;
 +
-+	if (VAR_P(lhs)) {
-+		handle_vardecl(use_def_data, lhs);
-+		return;
-+	}
++	gcc_assert(new_node->clone_of && new_node->clone.tree_map);
++	args_to_skip = new_node->clone.args_to_skip;
++	if (bitmap_bit_p(args_to_skip, orig_argnum - 1))
++		// XXX torolni kellene a nodeot
++		return CANNOT_FIND_ARG;
 +
-+	code = TREE_CODE(lhs);
-+	if (code == PARM_DECL) {
-+		handle_function(use_def_data, current_function_decl, lhs);
-+		return;
++	for (i = 0; i < orig_argnum; i++) {
++		if (bitmap_bit_p(args_to_skip, i))
++			new_argnum--;
 +	}
++	return new_argnum;
++}
 +
-+	if (TREE_CODE_CLASS(code) == tcc_reference) {
-+		handle_struct_fields(use_def_data, lhs);
-+		return;
-+	}
++// Associate the argument between a clone and a cloned function
++static unsigned int get_correct_argnum_cnode(struct cgraph_node *node, struct cgraph_node *correct_argnum_of_node, unsigned int argnum)
++{
++	bool node_clone, correct_argnum_of_node_clone;
++	const_tree correct_argnum_of_node_decl, node_decl;
 +
-+	if (code != SSA_NAME)
-+		return;
++	if (node == correct_argnum_of_node)
++		return argnum;
++	if (argnum == 0)
++		return argnum;
 +
-+	def_stmt = get_def_stmt(lhs);
-+	if (!def_stmt)
-+		return;
++	correct_argnum_of_node_decl = NODE_DECL(correct_argnum_of_node);
++	gcc_assert(correct_argnum_of_node_decl != NULL_TREE);
++	gcc_assert(correct_argnum_of_node && !DECL_ARTIFICIAL(correct_argnum_of_node_decl));
 +
-+	if (pointer_set_insert(use_def_data->visited, def_stmt))
-+		return;
++	if (node) {
++		node_decl = NODE_DECL(node);
++		gcc_assert(!DECL_ARTIFICIAL(node_decl));
++		node_clone = made_by_compiler(node_decl);
++	} else {
++		node_decl = NULL_TREE;
++		node_clone = false;
++	}
 +
-+	switch (gimple_code(def_stmt)) {
-+	case GIMPLE_NOP:
-+		walk_use_def_next_functions(use_def_data, SSA_NAME_VAR(lhs));
-+		return;
-+	case GIMPLE_ASM:
-+		if (!is_size_overflow_asm(def_stmt))
-+			return;
-+		walk_use_def_next_functions(use_def_data, get_size_overflow_asm_input(as_a_const_gasm(def_stmt)));
-+		return;
-+	case GIMPLE_CALL: {
-+		tree fndecl = gimple_call_fndecl(def_stmt);
++	if (correct_argnum_of_node_decl == node_decl)
++		return argnum;
 +
-+		if (fndecl != NULL_TREE) {
-+			handle_function(use_def_data, fndecl, NULL_TREE);
-+			return;
-+		}
-+		fndecl = gimple_call_fn(def_stmt);
-+		handle_function_ptr_ret(use_def_data, fndecl);
-+		return;
-+	}
-+	case GIMPLE_PHI:
-+		walk_use_def_next_functions_phi(use_def_data, lhs);
-+		return;
-+	case GIMPLE_ASSIGN:
-+		switch (gimple_num_ops(def_stmt)) {
-+		case 2:
-+			walk_use_def_next_functions_unary(use_def_data, as_a_const_gassign(def_stmt));
-+			return;
-+		case 3:
-+			walk_use_def_next_functions_binary(use_def_data, lhs);
-+			return;
-+		}
-+	default:
-+		debug_gimple_stmt((gimple)def_stmt);
-+		error("%s: unknown gimple code", __func__);
-+		gcc_unreachable();
++	correct_argnum_of_node_clone = made_by_compiler(correct_argnum_of_node_decl);
++	// the original decl is lost if both nodes are clones
++	if (node_clone && correct_argnum_of_node_clone) {
++		gcc_assert(unchanged_arglist(node, correct_argnum_of_node));
++		return argnum;
 +	}
++
++	if (node_clone && !correct_argnum_of_node_clone)
++		return clone_argnum_on_orig(correct_argnum_of_node, node, argnum);
++	else if (!node_clone && correct_argnum_of_node_clone)
++		return orig_argnum_on_clone(correct_argnum_of_node, node, argnum);
++
++	if (node)
++		debug_tree(NODE_DECL(node));
++	debug_tree(correct_argnum_of_node_decl);
++	gcc_unreachable();
 +}
 +
-+// Start the search for next_interesting_function_t children based on the (next_interesting_function_t) parent node
-+static next_interesting_function_t search_next_functions(tree node, next_interesting_function_t parent)
++unsigned int get_correct_argnum(const_tree decl, const_tree correct_argnum_of_decl, unsigned int argnum)
 +{
-+	struct walk_use_def_data use_def_data;
++	struct cgraph_node *node, *correct_argnum_of_node;
 +
-+	use_def_data.parent = parent;
-+	use_def_data.next_cnodes_head = NULL;
-+	use_def_data.visited = pointer_set_create();
++	gcc_assert(decl != NULL_TREE);
++	gcc_assert(correct_argnum_of_decl != NULL_TREE);
 +
-+	walk_use_def_next_functions(&use_def_data, node);
++	correct_argnum_of_node = get_cnode(correct_argnum_of_decl);
++	if (!correct_argnum_of_node || DECL_ARTIFICIAL(decl) || DECL_ARTIFICIAL(correct_argnum_of_decl))
++		return get_correct_argnum_fndecl(decl, correct_argnum_of_decl, argnum);
 +
-+	pointer_set_destroy(use_def_data.visited);
-+	return use_def_data.next_cnodes_head;
++	node = get_cnode(decl);
++	return get_correct_argnum_cnode(node, correct_argnum_of_node, argnum);
 +}
 +
-+// True if child already exists in the next_interesting_function_t children vector
-+bool has_next_interesting_function_vec(next_interesting_function_t target, next_interesting_function_t next_node)
++// Find the original cloned function
++tree get_orig_fndecl(const_tree clone_fndecl)
 +{
-+	unsigned int i;
-+	next_interesting_function_t cur;
++	struct cgraph_node *node;
 +
-+	gcc_assert(next_node);
-+	// handle recursion
-+	if (!strcmp(target->decl_name, next_node->decl_name) && target->num == next_node->num)
-+		return true;
++	gcc_assert(TREE_CODE(clone_fndecl) == FUNCTION_DECL);
 +
-+#if BUILDING_GCC_VERSION <= 4007
-+	if (VEC_empty(next_interesting_function_t, target->children))
-+		return false;
-+	FOR_EACH_VEC_ELT(next_interesting_function_t, target->children, i, cur) {
-+#else
-+	FOR_EACH_VEC_SAFE_ELT(target->children, i, cur) {
-+#endif
-+		if (compare_next_interesting_functions(cur, next_node->decl_name, next_node->context, next_node->num))
-+			return true;
-+	}
-+	return false;
++	if (DECL_ABSTRACT_ORIGIN(clone_fndecl))
++		return CONST_CAST_TREE(DECL_ABSTRACT_ORIGIN(clone_fndecl));
++	node = get_cnode(clone_fndecl);
++	if (!node)
++		return CONST_CAST_TREE(clone_fndecl);
++
++	while (node->clone_of)
++		node = node->clone_of;
++	if (!made_by_compiler(NODE_DECL(node)))
++		return NODE_DECL(node);
++	// Return the cloned decl because it is needed for the transform callback
++	return CONST_CAST_TREE(clone_fndecl);
 +}
 +
-+void push_child(next_interesting_function_t parent, next_interesting_function_t child)
++static tree get_interesting_fndecl_from_stmt(const gcall *stmt)
 +{
-+	if (!has_next_interesting_function_vec(parent, child)) {
-+#if BUILDING_GCC_VERSION <= 4007
-+		VEC_safe_push(next_interesting_function_t, heap, parent->children, child);
-+#else
-+		vec_safe_push(parent->children, child);
-+#endif
-+	}
++	if (gimple_call_num_args(stmt) == 0)
++		return NULL_TREE;
++	return gimple_call_fndecl(stmt);
 +}
 +
-+void __attribute__((weak)) check_local_variables(next_interesting_function_t next_node __unused) {}
-+
-+// Add children to parent and global_next_interesting_function
-+static void collect_data_for_execute(next_interesting_function_t parent, next_interesting_function_t children)
++tree get_interesting_orig_fndecl_from_stmt(const gcall *stmt)
 +{
-+	next_interesting_function_t cur = children;
-+
-+	gcc_assert(parent);
-+
-+	while (cur) {
-+		struct fn_raw_data child_raw_data;
-+		next_interesting_function_t next, child;
-+
-+		next = cur->next;
++	tree fndecl;
 +
-+		child_raw_data.decl_str = cur->decl_name;
-+		child_raw_data.context = cur->context;
-+		child_raw_data.hash = cur->hash;
-+		child_raw_data.num = cur->num;
-+		child_raw_data.marked = NO_SO_MARK;
-+		child = get_global_next_interesting_function_entry(&child_raw_data);
-+		if (!child) {
-+			add_to_global_next_interesting_function(cur);
-+			child = cur;
-+		}
++	fndecl = get_interesting_fndecl_from_stmt(stmt);
++	if (fndecl == NULL_TREE)
++		return NULL_TREE;
++	return get_orig_fndecl(fndecl);
++}
 +
-+		check_local_variables(child);
++void set_dominance_info(void)
++{
++	calculate_dominance_info(CDI_DOMINATORS);
++	calculate_dominance_info(CDI_POST_DOMINATORS);
++}
 +
-+		push_child(parent, child);
++void unset_dominance_info(void)
++{
++	free_dominance_info(CDI_DOMINATORS);
++	free_dominance_info(CDI_POST_DOMINATORS);
++}
 +
-+		cur = next;
-+	}
++void set_current_function_decl(tree fndecl)
++{
++	gcc_assert(fndecl != NULL_TREE);
 +
-+	check_local_variables(parent);
++	push_cfun(DECL_STRUCT_FUNCTION(fndecl));
++#if BUILDING_GCC_VERSION <= 4007
++	current_function_decl = fndecl;
++#endif
++	set_dominance_info();
 +}
 +
-+next_interesting_function_t __attribute__((weak)) get_and_create_next_node_from_global_next_nodes_fnptr(const_tree fn_ptr __unused, struct fn_raw_data *raw_data __unused)
++void unset_current_function_decl(void)
 +{
-+	return NULL;
++	unset_dominance_info();
++#if BUILDING_GCC_VERSION <= 4007
++	current_function_decl = NULL_TREE;
++#endif
++	pop_cfun();
 +}
 +
-+static next_interesting_function_t create_parent_next_cnode(const_gimple stmt, unsigned int num)
++bool is_valid_cgraph_node(struct cgraph_node *node)
 +{
-+	struct fn_raw_data raw_data;
-+
-+	raw_data.num = num;
-+	raw_data.marked = NO_SO_MARK;
++	if (cgraph_function_body_availability(node) == AVAIL_NOT_AVAILABLE)
++		return false;
++	if (node->thunk.thunk_p || node->alias)
++		return false;
++	return true;
++}
 +
++tree get_lhs(const_gimple stmt)
++{
 +	switch (gimple_code(stmt)) {
-+	case GIMPLE_ASM:
-+		raw_data.decl = current_function_decl;
-+		raw_data.marked = ASM_STMT_SO_MARK;
-+		return get_and_create_next_node_from_global_next_nodes(&raw_data, NULL);
++	case GIMPLE_ASSIGN:
 +	case GIMPLE_CALL:
-+		raw_data.decl = gimple_call_fndecl(stmt);
-+		if (raw_data.decl != NULL_TREE)
-+			return get_and_create_next_node_from_global_next_nodes(&raw_data, NULL);
-+		raw_data.decl = gimple_call_fn(stmt);
-+		return get_and_create_next_node_from_global_next_nodes_fnptr(raw_data.decl, &raw_data);
-+	case GIMPLE_RETURN:
-+		raw_data.decl = current_function_decl;
-+		return get_and_create_next_node_from_global_next_nodes(&raw_data, NULL);
-+	case GIMPLE_ASSIGN: {
-+		tree lhs = gimple_assign_lhs(stmt);
-+
-+		if (VAR_P(lhs))
-+			raw_data.decl = lhs;
-+		else
-+			raw_data.decl = get_ref_field(lhs);
-+		if (raw_data.decl == NULL_TREE)
-+			return NULL;
-+		return get_and_create_next_node_from_global_next_nodes(&raw_data, NULL);
-+	}
++		return gimple_get_lhs(stmt);
++	case GIMPLE_PHI:
++		return gimple_phi_result(stmt);
 +	default:
 +		debug_gimple_stmt((gimple)stmt);
 +		gcc_unreachable();
 +	}
 +}
 +
-+// Handle potential next_interesting_function_t parent if its argument has an integer type
-+static void collect_all_possible_size_overflow_fns(const_gimple stmt, tree start_var, unsigned int num)
-+{
-+	next_interesting_function_t children_next_cnode, parent_next_cnode;
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/size_overflow_plugin.c b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_plugin.c
+new file mode 100644
+index 0000000..3f8f032
+--- /dev/null
++++ b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_plugin.c
+@@ -0,0 +1,290 @@
++/*
++ * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
++ * Licensed under the GPL v2, or (at your option) v3
++ *
++ * Homepage:
++ * https://github.com/ephox-gcc-plugins/size_overflow
++ *
++ * Documentation:
++ * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
++ *
++ * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
++ * with double integer precision (DImode/TImode for 32/64 bit integer types).
++ * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
++ *
++ * Usage:
++ * $ make
++ * $ make run
++ */
 +
-+	// skip void return values
-+	if (start_var == NULL_TREE)
-+		return;
++#include "size_overflow.h"
 +
-+	if (skip_types(start_var))
-+		return;
++int plugin_is_GPL_compatible;
 +
-+	// handle intentional MARK_TURN_OFF
-+	if (check_intentional_size_overflow_asm_and_attribute(start_var) == MARK_TURN_OFF)
-+		return;
++tree report_size_overflow_decl;
 +
-+	parent_next_cnode = create_parent_next_cnode(stmt, num);
-+	if (!parent_next_cnode)
-+		return;
++tree size_overflow_type_HI;
++tree size_overflow_type_SI;
++tree size_overflow_type_DI;
++tree size_overflow_type_TI;
 +
-+	children_next_cnode = search_next_functions(start_var, parent_next_cnode);
-+	collect_data_for_execute(parent_next_cnode, children_next_cnode);
-+}
++static struct plugin_info size_overflow_plugin_info = {
++	.version	= "20160521",
++	.help		= "no-size-overflow\tturn off size overflow checking\n",
++};
 +
-+static void collect_all_possible_size_overflow_fields_and_vars(const gassign *assign)
++static tree handle_size_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
 +{
-+	tree start_var, decl, lhs = gimple_assign_lhs(assign);
-+
-+	if (VAR_P(lhs))
-+		decl = lhs;
-+	else
-+		decl = get_ref_field(lhs);
-+	if (decl == NULL_TREE)
-+		return;
++	unsigned int arg_count;
++	enum tree_code code = TREE_CODE(*node);
 +
-+	if (get_intentional_attr_type(decl) == MARK_TURN_OFF)
-+		return;
++	switch (code) {
++	case FUNCTION_DECL:
++		arg_count = type_num_arguments(TREE_TYPE(*node));
++		break;
++	case FUNCTION_TYPE:
++	case METHOD_TYPE:
++		arg_count = type_num_arguments(*node);
++		break;
++	default:
++		*no_add_attrs = true;
++		debug_tree(*node);
++		error("%s: %qE attribute only applies to functions", __func__, name);
++		return NULL_TREE;
++	}
 +
-+	start_var = gimple_assign_rhs1(assign);
-+	collect_all_possible_size_overflow_fns(assign, start_var, 0);
++	for (; args; args = TREE_CHAIN(args)) {
++		int cur_val;
++		tree position = TREE_VALUE(args);
 +
-+	start_var = gimple_assign_rhs2(assign);
-+	collect_all_possible_size_overflow_fns(assign, start_var, 0);
++		if (TREE_CODE(position) != INTEGER_CST) {
++			error("%s: parameter isn't an integer", __func__);
++			debug_tree(args);
++			*no_add_attrs = true;
++			return NULL_TREE;
++		}
 +
-+#if BUILDING_GCC_VERSION >= 4006
-+	start_var = gimple_assign_rhs3(assign);
-+	collect_all_possible_size_overflow_fns(assign, start_var, 0);
-+#endif
++		cur_val = tree_to_shwi(position);
++		if (cur_val < 0 || arg_count < (unsigned int)cur_val) {
++			error("%s: parameter %d is outside range.", __func__, cur_val);
++			*no_add_attrs = true;
++			return NULL_TREE;
++		}
++	}
++	return NULL_TREE;
 +}
 +
-+// Find potential next_interesting_function_t parents
-+static void handle_cgraph_node(struct cgraph_node *node)
++static tree handle_intentional_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
 +{
-+	basic_block bb;
-+	tree cur_fndecl = NODE_DECL(node);
-+
-+	set_current_function_decl(cur_fndecl);
-+
-+	FOR_EACH_BB_FN(bb, cfun) {
-+		gimple_stmt_iterator gsi;
-+
-+		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+			tree start_var;
-+			gimple stmt = gsi_stmt(gsi);
++	unsigned int arg_count;
++	HOST_WIDE_INT s_first_arg;
++	enum tree_code code = TREE_CODE(*node);
 +
-+			switch (gimple_code(stmt)) {
-+			case GIMPLE_RETURN: {
-+				const greturn *return_stmt = as_a_const_greturn(stmt);
++	switch (code) {
++	case FUNCTION_DECL:
++		arg_count = type_num_arguments(TREE_TYPE(*node));
++		break;
++	case FUNCTION_TYPE:
++	case METHOD_TYPE:
++		arg_count = type_num_arguments(*node);
++		break;
++	case VAR_DECL:
++	case FIELD_DECL:
++		return NULL_TREE;
++	default:
++		*no_add_attrs = true;
++		debug_tree(*node);
++		error("%qE attribute only applies to functions, fields or vars", name);
++		return NULL_TREE;
++	}
 +
-+				start_var = gimple_return_retval(return_stmt);
-+				collect_all_possible_size_overflow_fns(return_stmt, start_var, 0);
-+				break;
-+			}
-+			case GIMPLE_ASM: {
-+				const gasm *asm_stmt = as_a_const_gasm(stmt);
++	s_first_arg = tree_to_shwi(TREE_VALUE(args));
++	if (s_first_arg == -1)
++		return NULL_TREE;
++	if (s_first_arg < -1)
++		error("%s: parameter %d is outside range.", __func__, (int)s_first_arg);
 +
-+				if (!is_size_overflow_insert_check_asm(asm_stmt))
-+					break;
-+				start_var = get_size_overflow_asm_input(asm_stmt);
-+				collect_all_possible_size_overflow_fns(asm_stmt, start_var, 0);
-+				break;
-+			}
-+			case GIMPLE_CALL: {
-+				unsigned int i, len;
-+				const gcall *call = as_a_const_gcall(stmt);
-+				tree fndecl = gimple_call_fndecl(call);
++	for (; args; args = TREE_CHAIN(args)) {
++		unsigned int cur_val;
 +
-+				if (fndecl != NULL_TREE && (DECL_BUILT_IN(fndecl) || DECL_BUILT_IN_CLASS(fndecl) == BUILT_IN_NORMAL))
-+					break;
++		if (TREE_CODE(TREE_VALUE(args)) != INTEGER_CST) {
++			error("%s: parameter isn't an integer", __func__);
++			debug_tree(args);
++			*no_add_attrs = true;
++			return NULL_TREE;
++		}
 +
-+				len = gimple_call_num_args(call);
-+				for (i = 0; i < len; i++) {
-+					start_var = gimple_call_arg(call, i);
-+					collect_all_possible_size_overflow_fns(call, start_var, i + 1);
-+				}
-+				break;
-+			}
-+			case GIMPLE_ASSIGN:
-+				collect_all_possible_size_overflow_fields_and_vars(as_a_const_gassign(stmt));
-+				break;
-+			default:
-+				break;
-+			}
++		cur_val = (unsigned int)tree_to_uhwi(TREE_VALUE(args));
++		if (cur_val > arg_count ) {
++			error("%s: parameter %u is outside range. (arg_count: %u)", __func__, cur_val, arg_count);
++			*no_add_attrs = true;
++			return NULL_TREE;
 +		}
 +	}
-+
-+	unset_current_function_decl();
++	return NULL_TREE;
 +}
 +
-+/* Collect all potentially interesting function parameters and return values of integer types
-+ * and store their data flow dependencies
-+ */
-+static void size_overflow_generate_summary(void)
++static struct attribute_spec size_overflow_attr = {
++	.name				= "size_overflow",
++	.min_length			= 1,
++	.max_length			= -1,
++	.decl_required			= true,
++	.type_required			= false,
++	.function_type_required		= false,
++	.handler			= handle_size_overflow_attribute,
++#if BUILDING_GCC_VERSION >= 4007
++	.affects_type_identity		= false
++#endif
++};
++
++static struct attribute_spec intentional_overflow_attr = {
++	.name				= "intentional_overflow",
++	.min_length			= 1,
++	.max_length			= -1,
++	.decl_required			= true,
++	.type_required			= false,
++	.function_type_required		= false,
++	.handler			= handle_intentional_overflow_attribute,
++#if BUILDING_GCC_VERSION >= 4007
++	.affects_type_identity		= false
++#endif
++};
++
++static void register_attributes(void __unused *event_data, void __unused *data)
 +{
-+	struct cgraph_node *node;
++	register_attribute(&size_overflow_attr);
++	register_attribute(&intentional_overflow_attr);
++}
 +
-+	size_overflow_register_hooks();
++static tree create_typedef(tree type, const char* ident)
++{
++	tree new_type, decl;
 +
-+	FOR_EACH_FUNCTION(node) {
-+		if (is_valid_cgraph_node(node))
-+			handle_cgraph_node(node);
-+	}
++	new_type = build_variant_type_copy(type);
++	decl = build_decl(BUILTINS_LOCATION, TYPE_DECL, get_identifier(ident), new_type);
++	DECL_ORIGINAL_TYPE(decl) = type;
++	TYPE_NAME(new_type) = decl;
++	return new_type;
 +}
 +
-+static void size_overflow_function_insertion_hook(struct cgraph_node *node __unused, void *data __unused)
++// Create the noreturn report_size_overflow() function decl.
++static void size_overflow_start_unit(void __unused *gcc_data, void __unused *user_data)
 +{
-+	debug_cgraph_node(node);
-+	gcc_unreachable();
++	tree const_char_ptr_type_node;
++	tree fntype;
++
++	const_char_ptr_type_node = build_pointer_type(build_type_variant(char_type_node, 1, 0));
++
++	size_overflow_type_HI = create_typedef(intHI_type_node, "size_overflow_type_HI");
++	size_overflow_type_SI = create_typedef(intSI_type_node, "size_overflow_type_SI");
++	size_overflow_type_DI = create_typedef(intDI_type_node, "size_overflow_type_DI");
++	size_overflow_type_TI = create_typedef(intTI_type_node, "size_overflow_type_TI");
++
++	// void report_size_overflow(const char *loc_file, unsigned int loc_line, const char *current_func, const char *ssa_var)
++	fntype = build_function_type_list(void_type_node,
++					  const_char_ptr_type_node,
++					  unsigned_type_node,
++					  const_char_ptr_type_node,
++					  const_char_ptr_type_node,
++					  NULL_TREE);
++	report_size_overflow_decl = build_fn_decl("report_size_overflow", fntype);
++
++	DECL_ASSEMBLER_NAME(report_size_overflow_decl);
++	TREE_PUBLIC(report_size_overflow_decl) = 1;
++	DECL_EXTERNAL(report_size_overflow_decl) = 1;
++	DECL_ARTIFICIAL(report_size_overflow_decl) = 1;
++//	TREE_THIS_VOLATILE(report_size_overflow_decl) = 1;
++// !!!
++	DECL_PRESERVE_P(report_size_overflow_decl) = 1;
++	DECL_UNINLINABLE(report_size_overflow_decl) = 1;
++	TREE_USED(report_size_overflow_decl) = 1;
++	TREE_NOTHROW(report_size_overflow_decl) = 1;
 +}
 +
-+/* Handle dst if src is in the global_next_interesting_function list.
-+ * If src is a clone then dst inherits the orig_next_node of src otherwise
-+ * src will become the orig_next_node of dst.
-+ */
-+static void size_overflow_node_duplication_hook(struct cgraph_node *src, struct cgraph_node *dst, void *data __unused)
++static bool disable_ubsan_si_overflow_gate(void)
 +{
-+	next_interesting_function_t head, cur;
-+	struct fn_raw_data src_raw_data;
++#if BUILDING_GCC_VERSION >= 4009
++	flag_sanitize &= ~SANITIZE_SI_OVERFLOW;
++#endif
++	return true;
++}
 +
-+	src_raw_data.decl = NODE_DECL(src);
-+	src_raw_data.decl_str = DECL_NAME_POINTER(src_raw_data.decl);
-+	src_raw_data.context = get_decl_context(src_raw_data.decl);
-+	if (!src_raw_data.context)
-+		return;
++#define PASS_NAME disable_ubsan_si_overflow
 +
-+	src_raw_data.num = NONE_ARGNUM;
-+	src_raw_data.marked = NO_SO_MARK;
++#define NO_EXECUTE
 +
-+	head = get_global_next_interesting_function_entry_with_hash(&src_raw_data);
-+	if (!head)
-+		return;
++#include "gcc-generate-gimple-pass.h"
 +
-+	for (cur = head; cur; cur = cur->next) {
-+		struct fn_raw_data dst_raw_data;
-+		next_interesting_function_t orig_next_node, next_node;
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++	int i;
++	const char * const plugin_name = plugin_info->base_name;
++	const int argc = plugin_info->argc;
++	const struct plugin_argument * const argv = plugin_info->argv;
++	bool enable = true;
++	struct register_pass_info insert_size_overflow_asm_pass_info;
++	struct register_pass_info size_overflow_pass_info;
++#if BUILDING_GCC_VERSION >= 4009
++	struct register_pass_info disable_ubsan_si_overflow_pass_info;
++#endif
 +
-+		if (!compare_next_interesting_functions(cur, src_raw_data.decl_str, src_raw_data.context, src_raw_data.num))
-+			continue;
++	static const struct ggc_root_tab gt_ggc_r_gt_size_overflow[] = {
++		{
++			.base = &report_size_overflow_decl,
++			.nelt = 1,
++			.stride = sizeof(report_size_overflow_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		LAST_GGC_ROOT_TAB
++	};
 +
-+		dst_raw_data.decl = NODE_DECL(dst);
-+		dst_raw_data.decl_str = cgraph_node_name(dst);
-+		dst_raw_data.marked = cur->marked;
++	insert_size_overflow_asm_pass_info.pass				= make_insert_size_overflow_asm_pass();
++	insert_size_overflow_asm_pass_info.reference_pass_name		= "ssa";
++	insert_size_overflow_asm_pass_info.ref_pass_instance_number	= 1;
++	insert_size_overflow_asm_pass_info.pos_op			= PASS_POS_INSERT_AFTER;
 +
-+		if (!made_by_compiler(dst_raw_data.decl))
-+			break;
++	size_overflow_pass_info.pass			= make_size_overflow_pass();
++	size_overflow_pass_info.reference_pass_name	= "inline";
++	size_overflow_pass_info.ref_pass_instance_number	= 1;
++	size_overflow_pass_info.pos_op			= PASS_POS_INSERT_AFTER;
 +
-+		// For clones use the original node instead
-+		if (cur->orig_next_node)
-+			orig_next_node = cur->orig_next_node;
-+		else
-+			orig_next_node = cur;
++	if (!plugin_default_version_check(version, &gcc_version)) {
++		error(G_("incompatible gcc/plugin versions"));
++		return 1;
++	}
 +
-+		dst_raw_data.num = get_correct_argnum_fndecl(src_raw_data.decl, dst_raw_data.decl, cur->num);
-+		if (dst_raw_data.num == CANNOT_FIND_ARG)
++	for (i = 0; i < argc; ++i) {
++		if (!strcmp(argv[i].key, "no-size-overflow")) {
++			enable = false;
 +			continue;
++		}
++		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++	}
 +
-+		next_node = create_new_next_interesting_decl(&dst_raw_data, orig_next_node);
-+		if (next_node)
-+			add_to_global_next_interesting_function(next_node);
++	register_callback(plugin_name, PLUGIN_INFO, NULL, &size_overflow_plugin_info);
++	if (enable) {
++#if BUILDING_GCC_VERSION >= 4009
++		if (flag_sanitize & SANITIZE_SI_OVERFLOW) {
++			error(G_("ubsan SANITIZE_SI_OVERFLOW option is unsupported"));
++			return 1;
++		}
++#endif
++		register_callback(plugin_name, PLUGIN_START_UNIT, &size_overflow_start_unit, NULL);
++		register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_size_overflow);
++#if BUILDING_GCC_VERSION >= 4009
++		flag_sanitize |= SANITIZE_SI_OVERFLOW;
++		disable_ubsan_si_overflow_pass_info.pass			= make_disable_ubsan_si_overflow_pass();
++		disable_ubsan_si_overflow_pass_info.reference_pass_name		= "ubsan";
++		disable_ubsan_si_overflow_pass_info.ref_pass_instance_number	= 1;
++		disable_ubsan_si_overflow_pass_info.pos_op			= PASS_POS_REPLACE;
++
++		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &disable_ubsan_si_overflow_pass_info);
++#endif
++		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &insert_size_overflow_asm_pass_info);
++		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &size_overflow_pass_info);
 +	}
++	register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
++
++	return 0;
 +}
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/size_overflow_plugin_hash.c b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_plugin_hash.c
+new file mode 100644
+index 0000000..87af656
+--- /dev/null
++++ b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_plugin_hash.c
+@@ -0,0 +1,352 @@
++/*
++ * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
++ * Licensed under the GPL v2, or (at your option) v3
++ *
++ * Homepage:
++ * https://github.com/ephox-gcc-plugins/size_overflow
++ *
++ * Documentation:
++ * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
++ *
++ * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
++ * with double integer precision (DImode/TImode for 32/64 bit integer types).
++ * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
++ *
++ * Usage:
++ * $ make
++ * $ make run
++ */
 +
-+void size_overflow_register_hooks(void)
-+{
-+	static bool init_p = false;
++#include "size_overflow.h"
 +
-+	if (init_p)
-+		return;
-+	init_p = true;
++#include "size_overflow_hash.h"
++#include "disable_size_overflow_hash.h"
++#include "size_overflow_hash_aux.h"
 +
-+	function_insertion_hook_holder = cgraph_add_function_insertion_hook(&size_overflow_function_insertion_hook, NULL);
-+	node_duplication_hook_holder = cgraph_add_node_duplication_hook(&size_overflow_node_duplication_hook, NULL);
++static const_tree get_function_type(const_tree decl)
++{
++	if (FUNCTION_PTR_P(decl))
++		return TREE_TYPE(TREE_TYPE(decl));
++	gcc_assert(TREE_CODE(decl) == FUNCTION_DECL);
++	return TREE_TYPE(decl);
 +}
 +
-+static void set_yes_so_mark(next_interesting_function_t next_node)
++static unsigned char get_tree_code(const_tree type)
 +{
-+	if (next_node->marked == NO_SO_MARK) {
-+		next_node->marked = YES_SO_MARK;
-+		global_changed = true;
++	switch (TREE_CODE(type)) {
++	case ARRAY_TYPE:
++		return 0;
++	case BOOLEAN_TYPE:
++		return 1;
++	case ENUMERAL_TYPE:
++		return 2;
++	case FUNCTION_TYPE:
++		return 3;
++	case INTEGER_TYPE:
++		return 4;
++	case POINTER_TYPE:
++		return 5;
++	case RECORD_TYPE:
++		return 6;
++	case UNION_TYPE:
++		return 7;
++	case VOID_TYPE:
++		return 8;
++	case REAL_TYPE:
++		return 9;
++	case VECTOR_TYPE:
++		return 10;
++	case REFERENCE_TYPE:
++		return 11;
++	case OFFSET_TYPE:
++		return 12;
++	case COMPLEX_TYPE:
++		return 13;
++	default:
++		debug_tree(type);
++		gcc_unreachable();
 +	}
-+	// Mark the orig decl as well if it's a clone
-+	if (next_node->orig_next_node && next_node->orig_next_node->marked == NO_SO_MARK) {
-+		next_node->orig_next_node->marked = YES_SO_MARK;
-+		global_changed = true;
++}
++
++// http://www.team5150.com/~andrew/noncryptohashzoo2~/CrapWow.html
++static unsigned int CrapWow(const char *key, unsigned int len, unsigned int seed)
++{
++#define cwfold( a, b, lo, hi ) { p = (unsigned int)(a) * (unsigned long long)(b); lo ^= (unsigned int)p; hi ^= (unsigned int)(p >> 32); }
++#define cwmixa( in ) { cwfold( in, m, k, h ); }
++#define cwmixb( in ) { cwfold( in, n, h, k ); }
++
++	unsigned int m = 0x57559429;
++	unsigned int n = 0x5052acdb;
++	const unsigned int *key4 = (const unsigned int *)key;
++	unsigned int h = len;
++	unsigned int k = len + seed + n;
++	unsigned long long p;
++
++	while (len >= 8) {
++		cwmixb(key4[0]) cwmixa(key4[1]) key4 += 2;
++		len -= 8;
++	}
++	if (len >= 4) {
++		cwmixb(key4[0]) key4 += 1;
++		len -= 4;
 +	}
++	if (len)
++		cwmixa(key4[0] & ((1 << (len * 8)) - 1 ));
++	cwmixb(h ^ (k + n));
++	return k ^ h;
++
++#undef cwfold
++#undef cwmixa
++#undef cwmixb
 +}
 +
-+// Determine whether node or orig node is part of a tracked data flow
-+static bool marked_fn(next_interesting_function_t next_node)
++static void set_hash(struct decl_hash *decl_hash_data)
 +{
-+	bool is_marked_fn, is_marked_orig = false;
-+
-+	is_marked_fn = next_node->marked != NO_SO_MARK;
-+
-+	if (next_node->orig_next_node)
-+		is_marked_orig = next_node->orig_next_node->marked != NO_SO_MARK;
++	unsigned int fn, type, codes, seed = 0;
 +
-+	return is_marked_fn || is_marked_orig;
++	fn = CrapWow(decl_hash_data->fn_name, strlen(decl_hash_data->fn_name), seed) & 0xffff;
++	codes = CrapWow((const char*)decl_hash_data->tree_codes, decl_hash_data->tree_codes_len, seed) & 0xffff;
++	type = CrapWow(decl_hash_data->context, strlen(decl_hash_data->context), 0) & 0xffff;
++	decl_hash_data->hash = type ^ fn ^ codes;
 +}
 +
-+// Determine whether node or orig node is in the hash table already
-+static bool already_in_the_hashtable(next_interesting_function_t next_node)
++static void set_decl_type_codes(const_tree type, struct decl_hash *decl_hash_data)
 +{
-+	if (next_node->orig_next_node)
-+		next_node = next_node->orig_next_node;
-+	return get_size_overflow_hash_entry(next_node->hash, next_node->decl_name, next_node->context, next_node->num) != NULL;
++	gcc_assert(type != NULL_TREE);
++	gcc_assert(TREE_CODE_CLASS(TREE_CODE(type)) == tcc_type);
++
++	while (type && decl_hash_data->tree_codes_len < CODES_LIMIT) {
++		decl_hash_data->tree_codes[decl_hash_data->tree_codes_len] = get_tree_code(type);
++		decl_hash_data->tree_codes_len++;
++		type = TREE_TYPE(type);
++	}
 +}
 +
-+// Propagate the size_overflow marks up the use-def chains
-+static bool has_marked_child(next_interesting_function_t next_node)
++static void set_result_codes(const_tree node, struct decl_hash *decl_hash_data)
 +{
-+	bool ret = false;
-+	unsigned int i;
-+	next_interesting_function_t child;
++	const_tree result;
 +
-+#if BUILDING_GCC_VERSION <= 4007
-+	if (VEC_empty(next_interesting_function_t, next_node->children))
-+		return false;
-+	FOR_EACH_VEC_ELT(next_interesting_function_t, next_node->children, i, child) {
-+#else
-+	FOR_EACH_VEC_SAFE_ELT(next_node->children, i, child) {
-+#endif
-+		if (marked_fn(child) || already_in_the_hashtable(child))
-+			ret = true;
++	gcc_assert(node != NULL_TREE);
++
++	if (DECL_P(node)) {
++		result = DECL_RESULT(node);
++		if (result != NULL_TREE)
++			return set_decl_type_codes(TREE_TYPE(result), decl_hash_data);
++		return set_result_codes(TREE_TYPE(node), decl_hash_data);
 +	}
 +
-+	return ret;
++	gcc_assert(TYPE_P(node));
++
++	if (TREE_CODE(node) == FUNCTION_TYPE)
++		return set_result_codes(TREE_TYPE(node), decl_hash_data);
++
++	return set_decl_type_codes(node, decl_hash_data);
 +}
 +
-+/* Set YES_SO_MARK on the function, its orig node and children if:
-+ *      * the function or its orig node or one of its children is in the hash table already
-+ *      * the function's orig node is marked with YES_SO_MARK or ASM_STMT_SO_MARK
-+ *      * one of the children is marked with YES_SO_MARK or ASM_STMT_SO_MARK
-+ */
-+static bool set_fn_so_mark(next_interesting_function_t next_node)
++static void set_decl_codes(struct decl_hash *decl_hash_data)
 +{
-+	bool so_fn, so_hashtable, so_child;
++	const_tree arg, type;
++	enum tree_code code;
 +
-+	so_hashtable = already_in_the_hashtable(next_node);
-+	so_fn = marked_fn(next_node);
-+	so_child = has_marked_child(next_node);
++	if (TREE_CODE(decl_hash_data->decl) == VAR_DECL || TREE_CODE(decl_hash_data->decl) == FIELD_DECL) {
++		set_decl_type_codes(TREE_TYPE(decl_hash_data->decl), decl_hash_data);
++		return;
++	}
 +
-+	if (!so_fn && !so_hashtable && !so_child)
-+		return false;
-+	set_yes_so_mark(next_node);
-+	return true;
++	type = get_function_type(decl_hash_data->decl);
++	code = TREE_CODE(type);
++	gcc_assert(code == FUNCTION_TYPE || code == METHOD_TYPE);
++
++	if (FUNCTION_PTR_P(decl_hash_data->decl))
++		set_result_codes(type, decl_hash_data);
++	else
++		set_result_codes(decl_hash_data->decl, decl_hash_data);
++
++	for (arg = TYPE_ARG_TYPES(type); arg != NULL_TREE && decl_hash_data->tree_codes_len < CODES_LIMIT; arg = TREE_CHAIN(arg))
++		set_decl_type_codes(TREE_VALUE(arg), decl_hash_data);
 +}
 +
-+// Determine if any of the function pointer targets have data flow between the return value and one of the arguments
-+static next_interesting_function_t get_same_not_ret_child(next_interesting_function_t parent)
++static const struct size_overflow_hash *get_proper_hash_chain(const struct size_overflow_hash *entry, const char *func_name, const char *context)
 +{
-+	unsigned int i;
-+	next_interesting_function_t child;
-+
-+#if BUILDING_GCC_VERSION <= 4007
-+	if (VEC_empty(next_interesting_function_t, parent->children))
-+		return NULL;
-+	FOR_EACH_VEC_ELT(next_interesting_function_t, parent->children, i, child) {
-+#else
-+	FOR_EACH_VEC_SAFE_ELT(parent->children, i, child) {
-+#endif
-+		if (child->num == 0)
-+			continue;
-+		if (strcmp(parent->decl_name, child->decl_name))
++	for (; entry; entry = entry->next) {
++		if (strcmp(entry->name, func_name))
 +			continue;
-+		if (!strcmp(child->context, "fndecl"))
-+			return child;
++		if (!strcmp(entry->context, context))
++			return entry;
 +	}
 +	return NULL;
 +}
 +
-+/* Trace a return value of function pointer type back to an argument via a concrete function
-+   fnptr 0 && fn 0 && (fn 0 -> fn 2) => fnptr 2 */
-+static void search_missing_fptr_arg(next_interesting_function_t parent)
++unsigned int get_decl_hash(const_tree decl, const char *decl_name)
 +{
-+	next_interesting_function_t child;
-+	unsigned int i;
-+#if BUILDING_GCC_VERSION <= 4007
-+	VEC(next_interesting_function_t, heap) *new_children = NULL;
-+#else
-+	vec<next_interesting_function_t, va_heap, vl_embed> *new_children = NULL;
-+#endif
-+
-+	if (parent->num != 0)
-+		return;
-+	if (!strcmp(parent->context, "fndecl"))
-+		return;
-+	if (!strncmp(parent->context, "vardecl", sizeof("vardecl") - 1))
-+		return;
-+
-+	// fnptr 0 && fn 0
-+#if BUILDING_GCC_VERSION <= 4007
-+	if (VEC_empty(next_interesting_function_t, parent->children))
-+		return;
-+	FOR_EACH_VEC_ELT(next_interesting_function_t, parent->children, i, child) {
-+#else
-+	FOR_EACH_VEC_SAFE_ELT(parent->children, i, child) {
-+#endif
-+		next_interesting_function_t cur_next_node, tracked_fn;
-+
-+		if (child->num != 0)
-+			continue;
-+		// (fn 0 -> fn 2)
-+		tracked_fn = get_same_not_ret_child(child);
-+		if (!tracked_fn)
-+			continue;
++	struct decl_hash decl_hash_data;
++	enum tree_code code = TREE_CODE(decl);
 +
-+		// fn 2 => fnptr 2
-+		for (cur_next_node = global_next_interesting_function[parent->hash]; cur_next_node; cur_next_node = cur_next_node->next) {
-+			if (cur_next_node->num != tracked_fn->num)
-+				continue;
++	gcc_assert(code == FIELD_DECL || code == FUNCTION_DECL || code == VAR_DECL);
 +
-+			if (strcmp(parent->decl_name, cur_next_node->decl_name))
-+				continue;
++	// skip builtins __builtin_constant_p
++	if (code == FUNCTION_DECL && (DECL_BUILT_IN(decl) || DECL_BUILT_IN_CLASS(decl) == BUILT_IN_NORMAL))
++		return NO_HASH;
 +
-+			if (!has_next_interesting_function_vec(parent, cur_next_node)) {
-+#if BUILDING_GCC_VERSION <= 4007
-+				VEC_safe_push(next_interesting_function_t, heap, new_children, cur_next_node);
-+#else
-+				vec_safe_push(new_children, cur_next_node);
-+#endif
-+			}
-+		}
-+	}
++	decl_hash_data.fn_name = decl_name;
++	decl_hash_data.decl = decl;
++	decl_hash_data.context = get_decl_context(decl);
++	if (!decl_hash_data.context)
++		return NO_HASH;
++	decl_hash_data.tree_codes_len = 0;
 +
-+#if BUILDING_GCC_VERSION == 4005
-+	if (VEC_empty(next_interesting_function_t, new_children))
-+		return;
-+	FOR_EACH_VEC_ELT(next_interesting_function_t, new_children, i, child)
-+		VEC_safe_push(next_interesting_function_t, heap, parent->children, child);
-+#elif BUILDING_GCC_VERSION <= 4007
-+	VEC_safe_splice(next_interesting_function_t, heap, parent->children, new_children);
-+#else
-+	vec_safe_splice(parent->children, new_children);
-+#endif
++	set_decl_codes(&decl_hash_data);
++	gcc_assert(decl_hash_data.tree_codes_len != 0);
++	set_hash(&decl_hash_data);
++	return decl_hash_data.hash;
 +}
 +
-+static void walk_so_marked_fns(next_interesting_function_set *visited, next_interesting_function_t parent, bool debug)
++const char *get_orig_decl_name(const_tree decl)
 +{
-+	unsigned int i;
-+	next_interesting_function_t child;
++	const char *name;
++	unsigned int len;
++	const void *end;
++	const_tree orig_decl;
 +
-+	gcc_assert(parent);
-+	if (!set_fn_so_mark(parent))
-+		return;
++	if (TREE_CODE(decl) == FUNCTION_DECL)
++		orig_decl = DECL_ORIGIN(decl);
++	else
++		orig_decl = decl;
 +
-+#if BUILDING_GCC_VERSION <= 4007
-+	if (VEC_empty(next_interesting_function_t, parent->children))
-+		return;
-+	FOR_EACH_VEC_ELT(next_interesting_function_t, parent->children, i, child) {
-+#else
-+	FOR_EACH_VEC_SAFE_ELT(parent->children, i, child) {
-+#endif
-+		set_yes_so_mark(child);
++	len = DECL_NAME_LENGTH(orig_decl);
++	name = DECL_NAME_POINTER(orig_decl);
 +
-+		if (in_lto_p && debug == PRINT_DATA_FLOW) {
-+			fprintf(stderr, " PARENT: decl: %s-%u context: %s %p\n", parent->decl_name, parent->num, parent->context, parent);
-+			fprintf(stderr, " \tCHILD: decl: %s-%u context: %s %p\n", child->decl_name, child->num, child->context, child);
-+		}
++	/* Sometimes gcc loses the original cgraph node leaving only clones behind.
++	 * In such cases we will extract the name from the clone and use it in the hash table
++	 * without checking the parameter number on the original (unavailable) decl.
++	 */
 +
-+		if (!pointer_set_insert(visited, child))
-+			walk_so_marked_fns(visited, child, debug);
++	if (made_by_compiler(orig_decl)) {
++		end = memchr(name, '.', len);
++		if (!end)
++			return xstrndup(name, len);
++		len = (long)end - (long)name;
++		gcc_assert(len > 0);
 +	}
++
++	return xstrndup(name, len);
 +}
 +
-+// Do a depth-first recursive dump of the next_interesting_function_t children vector
-+static void print_missing_functions(next_interesting_function_set *visited, next_interesting_function_t parent)
++const struct size_overflow_hash *get_disable_size_overflow_hash_entry(unsigned int hash, const char *decl_name, const char *context, unsigned int argnum)
 +{
-+	unsigned int i;
-+	next_interesting_function_t child;
-+
-+	gcc_assert(parent);
-+	gcc_assert(parent->marked != NO_SO_MARK);
-+	print_missing_function(parent);
++	const struct size_overflow_hash *entry, *entry_node;
 +
-+#if BUILDING_GCC_VERSION <= 4007
-+	if (VEC_empty(next_interesting_function_t, parent->children))
-+		return;
-+	FOR_EACH_VEC_ELT(next_interesting_function_t, parent->children, i, child) {
-+#else
-+	FOR_EACH_VEC_SAFE_ELT(parent->children, i, child) {
-+#endif
-+		gcc_assert(child->marked != NO_SO_MARK);
-+		if (!pointer_set_insert(visited, child))
-+			print_missing_functions(visited, child);
-+	}
++	entry = disable_size_overflow_hash[hash];
++	entry_node = get_proper_hash_chain(entry, decl_name, context);
++	if (entry_node && entry_node->param & (1U << argnum))
++		return entry_node;
++	return NULL;
 +}
 +
-+// Set YES_SO_MARK on functions that will be emitted into the hash table
-+static void search_so_marked_fns(bool debug)
++const struct size_overflow_hash *get_size_overflow_hash_entry(unsigned int hash, const char *decl_name, const char *context, unsigned int argnum)
 +{
++	const struct size_overflow_hash *entry, *entry_node;
 +
-+	unsigned int i;
-+	next_interesting_function_set *visited;
-+	next_interesting_function_t cur_global;
-+
-+	visited = next_interesting_function_pointer_set_create();
-+	for (i = 0; i < GLOBAL_NIFN_LEN; i++) {
-+		for (cur_global = global_next_interesting_function[i]; cur_global; cur_global = cur_global->next) {
-+			if (cur_global->marked == NO_SO_MARK || pointer_set_insert(visited, cur_global))
-+				continue;
-+
-+			if  (in_lto_p && debug == PRINT_DATA_FLOW)
-+				fprintf(stderr, "Data flow: decl: %s-%u context: %s %p\n", cur_global->decl_name, cur_global->num, cur_global->context, cur_global);
-+
-+			walk_so_marked_fns(visited, cur_global, debug);
++	entry = size_overflow_hash[hash];
++	entry_node = get_proper_hash_chain(entry, decl_name, context);
++	if (entry_node && entry_node->param & (1U << argnum))
++		return entry_node;
 +
-+			if  (in_lto_p && debug == PRINT_DATA_FLOW)
-+				fprintf(stderr, "\n");
-+		}
-+	}
-+	pointer_set_destroy(visited);
++	entry = size_overflow_hash_aux[hash];
++	entry_node = get_proper_hash_chain(entry, decl_name, context);
++	if (entry_node && entry_node->param & (1U << argnum))
++		return entry_node;
++	return NULL;
 +}
 +
-+// Print functions missing from the hash table
-+static void print_so_marked_fns(void)
++const struct size_overflow_hash *get_size_overflow_hash_entry_tree(const_tree fndecl, unsigned int argnum, bool hash_table)
 +{
-+	unsigned int i;
-+	next_interesting_function_set *visited;
-+	next_interesting_function_t cur_global;
++	const_tree orig_decl;
++	unsigned int orig_argnum, hash;
++	const char *decl_name, *context;
 +
-+	visited = next_interesting_function_pointer_set_create();
-+	for (i = 0; i < GLOBAL_NIFN_LEN; i++) {
-+		for (cur_global = global_next_interesting_function[i]; cur_global; cur_global = cur_global->next) {
-+			if (cur_global->marked != NO_SO_MARK && !pointer_set_insert(visited, cur_global))
-+				print_missing_functions(visited, cur_global);
-+		}
++	if (made_by_compiler(fndecl)) {
++		orig_decl = get_orig_fndecl(fndecl);
++		orig_argnum = get_correct_argnum(fndecl, orig_decl, argnum);
++	} else {
++		orig_decl = fndecl;
++		orig_argnum = argnum;
 +	}
-+	pointer_set_destroy(visited);
-+}
 +
-+void __attribute__((weak)) check_global_variables(next_interesting_function_t cur_global __unused) {}
++	if (orig_argnum == CANNOT_FIND_ARG)
++		return NULL;
 +
-+// Print all missing interesting functions
-+static unsigned int size_overflow_execute(void)
-+{
-+	unsigned int i;
-+	next_interesting_function_t cur_global;
++	decl_name = get_orig_decl_name(orig_decl);
++	hash = get_decl_hash(orig_decl, decl_name);
++	if (hash == NO_HASH)
++		return NULL;
 +
-+	if (flag_lto && !in_lto_p)
-+		return 0;
++	context = get_decl_context(orig_decl);
++	if (!context)
++		return NULL;
 +
-+	// Collect vardecls and funtions reachable by function pointers
-+	for (i = 0; i < GLOBAL_NIFN_LEN; i++) {
-+		for (cur_global = global_next_interesting_function[i]; cur_global; cur_global = cur_global->next) {
-+			check_global_variables(cur_global);
-+			search_missing_fptr_arg(cur_global);
-+		}
-+	}
++	if (hash_table == SIZE_OVERFLOW)
++		return get_size_overflow_hash_entry(hash, decl_name, context, orig_argnum);
++	return get_disable_size_overflow_hash_entry(hash, decl_name, context, orig_argnum);
++}
 +
-+	search_so_marked_fns(PRINT_DATA_FLOW);
-+	while (global_changed) {
-+		global_changed = false;
-+		search_so_marked_fns(NO_PRINT_DATA_FLOW);
-+	}
++unsigned int find_arg_number_tree(const_tree arg, const_tree func)
++{
++	tree var;
++	unsigned int argnum = 1;
 +
-+	print_so_marked_fns();
++	if (DECL_ARGUMENTS(func) == NULL_TREE)
++		return CANNOT_FIND_ARG;
 +
-+	if (in_lto_p) {
-+		fprintf(stderr, "%s: SIZE_OVERFLOW EXECUTE\n", __func__);
-+		print_global_next_interesting_functions();
++	if (TREE_CODE(arg) == SSA_NAME)
++		arg = SSA_NAME_VAR(arg);
++
++	for (var = DECL_ARGUMENTS(func); var; var = TREE_CHAIN(var), argnum++) {
++		if (!operand_equal_p(arg, var, 0) && strcmp(DECL_NAME_POINTER(var), DECL_NAME_POINTER(arg)))
++			continue;
++		if (!skip_types(var))
++			return argnum;
 +	}
 +
-+	return 0;
++	return CANNOT_FIND_ARG;
 +}
 +
-+// Omit the IPA/LTO callbacks until https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61311 gets fixed (license concerns)
-+#if BUILDING_GCC_VERSION >= 4008
-+void __attribute__((weak)) size_overflow_write_summary(void) {}
-+void __attribute__((weak)) size_overflow_write_optimization_summary(void) {}
-+#elif BUILDING_GCC_VERSION >= 4006
-+void __attribute__((weak)) size_overflow_write_summary(cgraph_node_set set __unused, varpool_node_set vset __unused) {}
-+void __attribute__((weak)) size_overflow_write_optimization_summary(cgraph_node_set set __unused, varpool_node_set vset __unused) {}
-+#else
-+void __attribute__((weak)) size_overflow_write_summary(cgraph_node_set set __unused) {}
-+void __attribute__((weak)) size_overflow_write_optimization_summary(cgraph_node_set set __unused) {}
-+#endif
++const_tree get_attribute(const char* attr_name, const_tree decl)
++{
++	const_tree attr = lookup_attribute(attr_name, DECL_ATTRIBUTES(decl));
++	if (attr && TREE_VALUE(attr))
++		return attr;
++	return NULL_TREE;
++}
 +
-+void __attribute__((weak)) size_overflow_read_summary(void);
-+void __attribute__((weak)) size_overflow_read_optimization_summary(void);
++/* Check if the function has a size_overflow attribute or it is in the size_overflow hash table.
++ * If the function is missing everywhere then print the missing message into stderr.
++ */
++void print_missing_function(next_interesting_function_t node)
++{
++	unsigned int argnum, hash;
++	const struct size_overflow_hash *entry;
++	const char *decl_name;
 +
-+#define PASS_NAME size_overflow
++	if (node->marked == ASM_STMT_SO_MARK)
++		return;
 +
-+#define NO_STMT_FIXUP
-+#define NO_VARIABLE_TRANSFORM
-+#define NO_GATE
++	if (node->orig_next_node) {
++		hash = node->orig_next_node->hash;
++		decl_name = node->orig_next_node->decl_name;
++		argnum = node->orig_next_node->num;
++		gcc_assert(!strcmp(node->context, node->orig_next_node->context));
++	} else {
++		hash = node->hash;
++		decl_name = node->decl_name;
++		argnum = node->num;
++	}
 +
-+#include "gcc-generate-ipa-pass.h"
-diff --git a/tools/gcc/size_overflow_plugin/size_overflow_misc.c b/tools/gcc/size_overflow_plugin/size_overflow_misc.c
++	entry = get_size_overflow_hash_entry(hash, decl_name, node->context, argnum);
++	if (entry)
++		return;
++
++	// inform() would be too slow
++	fprintf(stderr, "Function %s is missing from the size_overflow hash table +%s+%s+%u+%u+\n", decl_name, decl_name, node->context, argnum, hash);
++}
++
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/size_overflow_transform.c b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_transform.c
 new file mode 100644
-index 0000000..7f459ed
+index 0000000..eebcf4c
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/size_overflow_misc.c
-@@ -0,0 +1,505 @@
++++ b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_transform.c
+@@ -0,0 +1,743 @@
 +/*
 + * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -208621,496 +207074,734 @@ index 0000000..7f459ed
 +
 +#include "size_overflow.h"
 +
-+bool is_vararg(const_tree fn, unsigned int num)
++static tree cast_to_orig_type(struct visited *visited, gimple stmt, const_tree orig_node, tree new_node)
 +{
-+	tree arg_list;
++	gimple def_stmt;
++	const_gimple assign;
++	tree result, orig_type = TREE_TYPE(orig_node);
++	gimple_stmt_iterator gsi;
 +
-+	if (num == 0)
-+		return false;
-+	if (fn == NULL_TREE)
-+		return false;
-+	if (TREE_CODE(fn) != FUNCTION_DECL)
-+		return false;
++	if (gimple_code(stmt) != GIMPLE_PHI) {
++		gsi = gsi_for_stmt(stmt);
++		assign = build_cast_stmt(visited, orig_type, new_node, CREATE_NEW_VAR, &gsi, BEFORE_STMT, false);
++		return get_lhs(assign);
++	}
 +
-+	arg_list = TYPE_ARG_TYPES(TREE_TYPE(fn));
-+	if (arg_list == NULL_TREE)
-+		return false;
++	def_stmt = get_def_stmt(new_node);
++	if (gimple_code(def_stmt) == GIMPLE_PHI)
++		gsi = gsi_after_labels(gimple_bb(def_stmt));
++	else
++		gsi = gsi_for_stmt(def_stmt);
 +
-+	if (tree_last(arg_list) == void_list_node)
-+		return false;
++	result = gimple_phi_result(stmt);
++	assign = build_cast_stmt(visited, orig_type, new_node, SSA_NAME_VAR(result), &gsi, AFTER_STMT, false);
++	return get_lhs(assign);
++}
 +
-+	return num >= (unsigned int)list_length(arg_list);
++static void change_size_overflow_asm_input(gasm *stmt, tree new_input)
++{
++	tree list;
++
++	gcc_assert(is_size_overflow_insert_check_asm(stmt));
++
++	list = build_tree_list(NULL_TREE, build_string(3, "rm"));
++	list = chainon(NULL_TREE, build_tree_list(list, new_input));
++	gimple_asm_set_input_op(stmt, 0, list);
 +}
 +
-+// Extract the field decl from memory references
-+tree get_ref_field(const_tree ref)
++static void change_field_write_rhs(gassign *assign, const_tree orig_rhs, tree new_rhs)
 +{
-+	tree field;
++	const_tree rhs1, rhs2, rhs3 = NULL_TREE;
++
++	rhs1 = gimple_assign_rhs1(assign);
++	if (rhs1 == orig_rhs) {
++		gimple_assign_set_rhs1(assign, new_rhs);
++		return;
++	}
++
++	rhs2 = gimple_assign_rhs2(assign);
++	if (rhs2 == orig_rhs) {
++		gimple_assign_set_rhs2(assign, new_rhs);
++		return;
++	}
 +
-+	// TODO: handle nested memory references
-+	switch (TREE_CODE(ref)) {
-+	case ARRAY_REF:
-+		return NULL_TREE;
 +#if BUILDING_GCC_VERSION >= 4006
-+	case MEM_REF:
++	rhs3 = gimple_assign_rhs3(assign);
++	if (rhs3 == orig_rhs) {
++		gimple_assign_set_rhs3(assign, new_rhs);
++		return;
++	}
 +#endif
-+	case INDIRECT_REF:
-+		field = TREE_OPERAND(ref, 0);
++
++	debug_gimple_stmt(assign);
++	fprintf(stderr, "orig_rhs:\n");
++	debug_tree(orig_rhs);
++	fprintf(stderr, "rhs1:\n");
++	debug_tree(rhs1);
++	fprintf(stderr, "rhs2:\n");
++	debug_tree(rhs2);
++	fprintf(stderr, "rhs3:\n");
++	debug_tree(rhs3);
++	gcc_unreachable();
++}
++
++static void change_phi_arg(gphi *phi, tree new_node, unsigned int num)
++{
++	unsigned int i;
++	location_t loc = gimple_location(phi);
++
++	for (i = 0; i < gimple_phi_num_args(phi); i++) {
++		if (i == num)
++			add_phi_arg(phi, new_node, gimple_phi_arg_edge(phi, i), loc);
++	}
++}
++
++static void change_orig_node(struct visited *visited, gimple stmt, const_tree orig_node, tree new_node, unsigned int num)
++{
++	tree cast_lhs = cast_to_orig_type(visited, stmt, orig_node, new_node);
++
++	switch (gimple_code(stmt)) {
++	case GIMPLE_RETURN:
++		gimple_return_set_retval(as_a_greturn(stmt), cast_lhs);
 +		break;
-+	case COMPONENT_REF:
-+		field = TREE_OPERAND(ref, 1);
++	case GIMPLE_CALL:
++		gimple_call_set_arg(as_a_gcall(stmt), num - 1, cast_lhs);
++		break;
++	case GIMPLE_ASM:
++		change_size_overflow_asm_input(as_a_gasm(stmt), cast_lhs);
++		break;
++	case GIMPLE_ASSIGN:
++		change_field_write_rhs(as_a_gassign(stmt), orig_node, cast_lhs);
++		break;
++	case GIMPLE_PHI:
++		change_phi_arg(as_a_gphi(stmt), cast_lhs, num);
 +		break;
 +	default:
-+		return NULL_TREE;
++		debug_gimple_stmt(stmt);
++		gcc_unreachable();
 +	}
 +
-+	// TODO
-+	if (TREE_CODE(field) == SSA_NAME)
-+		return NULL_TREE;
-+	// TODO
-+	if (TREE_CODE(field) != FIELD_DECL)
-+		return NULL_TREE;
-+	// TODO
-+	if (TREE_CODE(field) == ADDR_EXPR)
-+		return NULL_TREE;
++	update_stmt(stmt);
++}
 +
-+	return field;
++// e.g., 3.8.2, 64, arch/x86/ia32/ia32_signal.c copy_siginfo_from_user32(): compat_ptr() u32 max
++static bool skip_asm_cast(const_tree arg)
++{
++	gimple def_stmt = get_def_stmt(arg);
++
++	if (!def_stmt || !gimple_assign_cast_p(def_stmt))
++		return false;
++
++	def_stmt = get_def_stmt(gimple_assign_rhs1(def_stmt));
++	if (is_size_overflow_asm(def_stmt))
++		return false;
++	return def_stmt && gimple_code(def_stmt) == GIMPLE_ASM;
 +}
 +
-+const char *get_type_name_from_field(const_tree field_decl)
++static interesting_stmts_t create_interesting_stmts(interesting_stmts_t head, next_interesting_function_t next_node, tree orig_node, gimple first_stmt, unsigned int num)
 +{
-+	const_tree context, type_name;
++	interesting_stmts_t new_node;
 +
-+	if (TREE_CODE(field_decl) != FIELD_DECL)
-+		return NULL;
++	new_node = (interesting_stmts_t )xmalloc(sizeof(*new_node));
++	new_node->first_stmt = first_stmt;
++	new_node->num = num;
++	new_node->orig_node = orig_node;
++	new_node->next = head;
++	new_node->next_node = next_node;
++	return new_node;
++}
 +
-+	context = DECL_CONTEXT(field_decl);
-+	// TODO
-+	if (TREE_CODE(context) != RECORD_TYPE)
-+		return NULL;
-+	gcc_assert(TREE_CODE(context) == RECORD_TYPE);
-+	type_name = TYPE_NAME(TYPE_MAIN_VARIANT(context));
-+	if (type_name == NULL_TREE)
-+		return NULL;
++static void free_interesting_stmts(interesting_stmts_t head)
++{
++	while (head) {
++		interesting_stmts_t cur = head->next;
++		free(head);
++		head = cur;
++	}
++}
 +
-+	if (TREE_CODE(type_name) == IDENTIFIER_NODE)
-+		return IDENTIFIER_POINTER(type_name);
-+	else if (TREE_CODE(type_name) == TYPE_DECL)
-+		return DECL_NAME_POINTER(type_name);
++/* This function calls the main recursion function (expand) that duplicates the stmts. Before that it checks the intentional_overflow attribute,
++ * it decides whether the duplication is necessary or not. After expand() it changes the orig node to the duplicated node
++ * in the original stmt (first stmt) and it inserts the overflow check for the arg of the callee or for the return value.
++ */
++static interesting_stmts_t search_interesting_stmt(interesting_stmts_t head, next_interesting_function_t next_node, gimple first_stmt, tree orig_node, unsigned int num)
++{
++	enum tree_code orig_code;
 +
-+	debug_tree(field_decl);
-+	debug_tree(type_name);
-+	gcc_unreachable();
++	gcc_assert(orig_node != NULL_TREE);
++
++	if (is_gimple_constant(orig_node))
++		return head;
++
++	orig_code = TREE_CODE(orig_node);
++	gcc_assert(orig_code != FIELD_DECL && orig_code != FUNCTION_DECL);
++
++	if (skip_types(orig_node))
++		return head;
++
++	// find a defining marked caller argument or struct field for arg
++	if (check_intentional_size_overflow_asm_and_attribute(orig_node) != MARK_NO)
++		return head;
++
++	if (skip_asm_cast(orig_node))
++		return head;
++
++	return create_interesting_stmts(head, next_node, orig_node, first_stmt, num);
 +}
 +
-+// Was the function created by the compiler itself?
-+bool made_by_compiler(const_tree decl)
++static bool is_signed_error_code_const(const_tree node)
 +{
-+	enum tree_code decl_code;
-+	struct cgraph_node *node;
++	HOST_WIDE_INT constant = tree_to_shwi(node);
 +
-+	if (FUNCTION_PTR_P(decl))
-+		return false;
-+	decl_code = TREE_CODE(decl);
-+	if (decl_code == VAR_DECL || decl_code == FIELD_DECL)
-+		return false;
++	return constant >= -4095 && constant <= -1;
++}
 +
-+	gcc_assert(decl_code == FUNCTION_DECL);
-+	if (DECL_ABSTRACT_ORIGIN(decl) != NULL_TREE && DECL_ABSTRACT_ORIGIN(decl) != decl)
-+		return true;
-+	if (DECL_ARTIFICIAL(decl))
++static bool is_unsigned_error_code_const(const_tree node)
++{
++	unsigned HOST_WIDE_INT constant = tree_to_uhwi(node);
++
++	// ulong -4095
++	if (constant >= 0xfffffffffffff001)
 +		return true;
++	// uint -4095
++	return constant >= 0xfffff001;
++}
 +
-+	node = get_cnode(decl);
-+	if (!node)
++static bool is_error_code_const(const_tree node)
++{
++	enum machine_mode mode;
++
++	if (!is_gimple_constant(node))
 +		return false;
-+	return node->clone_of != NULL;
++	mode = TYPE_MODE(TREE_TYPE(node));
++	if (mode != SImode && mode != DImode)
++		return false;
++
++	if (!TYPE_UNSIGNED(TREE_TYPE(node)) && is_signed_error_code_const(node))
++		return true;
++	return TYPE_UNSIGNED(TREE_TYPE(node)) && is_unsigned_error_code_const(node);
 +}
 +
-+bool skip_types(const_tree var)
++static bool has_error_code(gphi *phi)
 +{
-+	const_tree type;
++	unsigned int i, len = gimple_phi_num_args(phi);
 +
-+	type = TREE_TYPE(var);
-+	if (type == NULL_TREE)
-+		return true;
++	for (i = 0; i < len; i++) {
++		const_tree arg = gimple_phi_arg_def(phi, i);
 +
-+	switch (TREE_CODE(type)) {
-+		case INTEGER_TYPE:
-+		case ENUMERAL_TYPE:
-+			return false;
-+		default:
++		if (is_error_code_const(arg))
 +			return true;
 +	}
++
++	return false;
 +}
 +
-+gimple get_fnptr_def_stmt(const_tree fn_ptr)
++static interesting_stmts_t search_interesting_rets(interesting_stmts_t head, next_interesting_function_t next_node_ret, greturn *ret)
 +{
-+	gimple def_stmt;
++	tree first_node;
 +
-+	gcc_assert(fn_ptr != NULL_TREE);
-+	gcc_assert(FUNCTION_PTR_P(fn_ptr));
++	if (!next_node_ret || next_node_ret->marked == ASM_STMT_SO_MARK)
++		return head;
 +
-+	if (is_gimple_constant(fn_ptr))
-+		return NULL;
++	first_node = gimple_return_retval(ret);
++	if (first_node == NULL_TREE)
++		return head;
 +
-+	def_stmt = get_def_stmt(fn_ptr);
-+	gcc_assert(def_stmt);
-+	return def_stmt;
++	return search_interesting_stmt(head, next_node_ret, ret, first_node, 0);
 +}
 +
-+gimple get_def_stmt(const_tree node)
++static void handle_binary_assign(interesting_stmts_t expand_from, gassign *assign, tree rhs)
 +{
-+	gcc_assert(node != NULL_TREE);
++	tree new_node;
++	gimple def_orig_node;
 +
-+	if (TREE_CODE(node) != SSA_NAME)
-+		return NULL;
-+	return SSA_NAME_DEF_STMT(node);
++	new_node = expand(expand_from, rhs);
++	if (new_node == NULL_TREE)
++		return;
++
++	def_orig_node = get_def_stmt(rhs);
++	if (pointer_set_contains(expand_from->visited->no_cast_check, def_orig_node))
++		return;
++	change_orig_node(expand_from->visited, assign, rhs, new_node, 0);
++	check_size_overflow(expand_from, assign, TREE_TYPE(new_node), new_node, rhs, BEFORE_STMT);
 +}
 +
-+tree create_new_var(tree type)
++static bool search_error_codes(gimple_set *visited_error_codes, interesting_stmts_t expand_from, tree lhs, bool error_code)
 +{
-+	tree new_var = create_tmp_var(type, "cicus");
++	gimple def_stmt;
 +
-+	add_referenced_var(new_var);
-+	return new_var;
++	def_stmt = get_def_stmt(lhs);
++	if (!def_stmt || gimple_code(def_stmt) == GIMPLE_NOP)
++		return error_code;
++
++	if (pointer_set_insert(visited_error_codes, def_stmt))
++		return error_code;
++
++	if (is_gimple_constant(lhs))
++		return error_code;
++	if (skip_types(lhs))
++		return is_error_code_const(lhs);
++
++	switch (gimple_code(def_stmt)) {
++	case GIMPLE_CALL:
++	case GIMPLE_ASM:
++		return error_code;
++	case GIMPLE_ASSIGN: {
++		tree rhs1, rhs2;
++		gassign *assign = as_a_gassign(def_stmt);
++
++		switch (gimple_num_ops(assign)) {
++		case 2:
++			return search_error_codes(visited_error_codes, expand_from, gimple_assign_rhs1(def_stmt), error_code);
++		case 3:
++			if (!error_code)
++				return error_code;
++
++			/* Run stmt duplication from the binary assignment ops (rhs1 and rhs2)
++			 * so that size_overflow checking skips the lhs of the last binary assignment
++			 * before the error code PHI.
++			 */
++			rhs1 = gimple_assign_rhs1(assign);
++			handle_binary_assign(expand_from, assign, rhs1);
++			rhs2 = gimple_assign_rhs2(assign);
++			handle_binary_assign(expand_from, assign, rhs2);
++			return error_code;
++		}
++		gcc_unreachable();
++	}
++	case GIMPLE_PHI: {
++		unsigned int i;
++
++		error_code = has_error_code(as_a_gphi(def_stmt));
++		for (i = 0; i < gimple_phi_num_args(def_stmt); i++) {
++			error_code = search_error_codes(visited_error_codes, expand_from, gimple_phi_arg_def(def_stmt, i), error_code);
++		}
++		return error_code;
++	}
++	default:
++		debug_gimple_stmt(def_stmt);
++		error("%s: unknown gimple code", __func__);
++		gcc_unreachable();
++	}
 +}
 +
-+static bool skip_cast(tree dst_type, const_tree rhs, bool force)
++static bool handle_error_codes(interesting_stmts_t expand_from)
 +{
-+	const_gimple def_stmt = get_def_stmt(rhs);
++	bool error_code;
++	gimple_set *visited_error_codes;
 +
-+	if (force)
++	// expand the data flow from a return stmt
++	if (expand_from->next_node->num != 0 || strcmp(expand_from->next_node->context, "fndecl"))
 +		return false;
 +
-+	if (is_gimple_constant(rhs))
-+		return false;
++	visited_error_codes = pointer_set_create();
++	error_code = search_error_codes(visited_error_codes, expand_from, expand_from->orig_node, false);
++	pointer_set_destroy(visited_error_codes);
 +
-+	if (!def_stmt || gimple_code(def_stmt) == GIMPLE_NOP)
-+		return false;
++	return error_code;
++}
 +
-+	if (!types_compatible_p(dst_type, TREE_TYPE(rhs)))
-+		return false;
++static void handle_interesting_stmt(struct visited *visited, interesting_stmts_t head)
++{
++	interesting_stmts_t cur;
 +
-+	// DI type can be on 32 bit (from create_assign) but overflow type stays DI
-+	if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode))
-+		return false;
++	for (cur = head; cur; cur = cur->next) {
++		tree new_node;
++		gimple orig_def_stmt;
 +
-+	return true;
++		cur->visited = visited;
++		if (handle_error_codes(cur))
++			continue;
++
++		new_node = expand(cur, cur->orig_node);
++		if (new_node == NULL_TREE)
++			continue;
++
++		orig_def_stmt = get_def_stmt(cur->orig_node);
++		if (pointer_set_contains(visited->no_cast_check, orig_def_stmt))
++			continue;
++		change_orig_node(visited, cur->first_stmt, cur->orig_node, new_node, cur->num);
++		check_size_overflow(cur, cur->first_stmt, TREE_TYPE(new_node), new_node, cur->orig_node, BEFORE_STMT);
++	}
 +}
 +
-+tree cast_a_tree(tree type, tree var)
++static next_interesting_function_t get_interesting_function_next_node(tree decl, unsigned int num)
 +{
-+	gcc_assert(type != NULL_TREE);
-+	gcc_assert(var != NULL_TREE);
-+	gcc_assert(fold_convertible_p(type, var));
++	next_interesting_function_t next_node;
++	const struct size_overflow_hash *so_hash;
++	struct fn_raw_data raw_data;
 +
-+	return fold_convert(type, var);
++	raw_data.decl = decl;
++	raw_data.decl_str = DECL_NAME_POINTER(decl);
++	raw_data.num = num;
++	raw_data.marked = YES_SO_MARK;
++
++	next_node = get_global_next_interesting_function_entry_with_hash(&raw_data);
++	if (next_node && next_node->marked != NO_SO_MARK)
++		return next_node;
++
++	so_hash = get_size_overflow_hash_entry_tree(raw_data.decl, raw_data.num, SIZE_OVERFLOW);
++	if (so_hash)
++		return get_and_create_next_node_from_global_next_nodes(&raw_data, NULL);
++	return NULL;
 +}
 +
-+gimple build_cast_stmt(struct visited *visited, tree dst_type, tree rhs, tree lhs, gimple_stmt_iterator *gsi, bool before, bool force)
++tree handle_fnptr_assign(const_gimple stmt)
 +{
-+	gassign *assign;
-+	gimple def_stmt;
++	tree field, rhs, op0;
++	const_tree op0_type;
++	enum tree_code rhs_code;
 +
-+	gcc_assert(dst_type != NULL_TREE && rhs != NULL_TREE);
-+	gcc_assert(!is_gimple_constant(rhs));
-+	if (gsi_end_p(*gsi) && before == AFTER_STMT)
-+		gcc_unreachable();
++	// TODO skip binary assignments for now (fs/sync.c _591 = __bpf_call_base + _590;)
++	if (gimple_num_ops(stmt) != 2)
++		return NULL_TREE;
 +
-+	def_stmt = get_def_stmt(rhs);
-+	if (def_stmt && gimple_code(def_stmt) != GIMPLE_NOP && skip_cast(dst_type, rhs, force) && pointer_set_contains(visited->my_stmts, def_stmt))
-+		return def_stmt;
++	gcc_assert(gimple_num_ops(stmt) == 2);
++	// TODO skip asm_stmt for now
++	if (gimple_code(stmt) == GIMPLE_ASM)
++		return NULL_TREE;
++	rhs = gimple_assign_rhs1(stmt);
++	if (is_gimple_constant(rhs))
++		return NULL_TREE;
 +
-+	if (lhs == CREATE_NEW_VAR)
-+		lhs = create_new_var(dst_type);
++	rhs_code = TREE_CODE(rhs);
++	if (rhs_code == VAR_DECL)
++		return rhs;
 +
-+	assign = gimple_build_assign(lhs, cast_a_tree(dst_type, rhs));
++	switch (rhs_code) {
++	case ADDR_EXPR:
++		op0 = TREE_OPERAND(rhs, 0);
++		gcc_assert(TREE_CODE(op0) == FUNCTION_DECL);
++		return op0;
++	case COMPONENT_REF:
++		break;
++	// TODO skip array_ref for now
++	case ARRAY_REF:
++		return NULL_TREE;
++	// TODO skip ssa_name because it can lead to parm_decl
++	case SSA_NAME:
++		return NULL_TREE;
++	// TODO skip mem_ref and indirect_ref for now
++#if BUILDING_GCC_VERSION >= 4006
++	case MEM_REF:
++#endif
++	case INDIRECT_REF:
++		return NULL_TREE;
++	default:
++		debug_tree(rhs);
++		debug_gimple_stmt((gimple)stmt);
++		gcc_unreachable();
++	}
 +
-+	if (!gsi_end_p(*gsi)) {
-+		location_t loc = gimple_location(gsi_stmt(*gsi));
-+		gimple_set_location(assign, loc);
++	op0 = TREE_OPERAND(rhs, 0);
++	switch (TREE_CODE(op0)) {
++	// TODO skip array_ref and parm_decl for now
++	case ARRAY_REF:
++	case PARM_DECL:
++		return NULL_TREE;
++	case COMPONENT_REF:
++#if BUILDING_GCC_VERSION >= 4006
++	case MEM_REF:
++#endif
++	case INDIRECT_REF:
++	case VAR_DECL:
++		break;
++	default:
++		debug_tree(op0);
++		gcc_unreachable();
 +	}
 +
-+	gimple_assign_set_lhs(assign, make_ssa_name(lhs, assign));
++	op0_type = TREE_TYPE(op0);
++	// TODO skip unions for now
++	if (TREE_CODE(op0_type) == UNION_TYPE)
++		return NULL_TREE;
++	gcc_assert(TREE_CODE(op0_type) == RECORD_TYPE);
 +
-+	if (before)
-+		gsi_insert_before(gsi, assign, GSI_NEW_STMT);
-+	else
-+		gsi_insert_after(gsi, assign, GSI_NEW_STMT);
-+	update_stmt(assign);
-+	return assign;
++	field = TREE_OPERAND(rhs, 1);
++	gcc_assert(TREE_CODE(field) == FIELD_DECL);
++	return field;
 +}
 +
-+bool is_size_overflow_type(const_tree var)
++static tree get_fn_or_fnptr_decl(const gcall *call_stmt)
 +{
-+	const char *name;
-+	const_tree type_name, type;
-+
-+	if (var == NULL_TREE)
-+		return false;
++	const_tree fnptr;
++	const_gimple def_stmt;
++	tree decl = gimple_call_fndecl(call_stmt);
 +
-+	type = TREE_TYPE(var);
-+	type_name = TYPE_NAME(type);
-+	if (type_name == NULL_TREE)
-+		return false;
++	if (decl != NULL_TREE)
++		return decl;
 +
-+	if (DECL_P(type_name))
-+		name = DECL_NAME_POINTER(type_name);
-+	else
-+		name = IDENTIFIER_POINTER(type_name);
++	fnptr = gimple_call_fn(call_stmt);
++	if (fnptr == NULL_TREE)
++		return NULL_TREE;
 +
-+	if (!strncmp(name, "size_overflow_type", 18))
-+		return true;
-+	return false;
++	// !!! assertot kell irni 0-ra, mert csak az lehet ott
++	if (is_gimple_constant(fnptr))
++		return NULL_TREE;
++	def_stmt = get_fnptr_def_stmt(fnptr);
++	return handle_fnptr_assign(def_stmt);
 +}
 +
-+// Determine if a cloned function has all the original arguments
-+static bool unchanged_arglist(struct cgraph_node *new_node, struct cgraph_node *old_node)
++// Start stmt duplication on marked function parameters
++static interesting_stmts_t search_interesting_calls(interesting_stmts_t head, gcall *call_stmt)
 +{
-+	const_tree new_decl_list, old_decl_list;
++	tree decl;
++	unsigned int i, len;
 +
-+	if (new_node->clone_of && new_node->clone.tree_map)
-+		return !new_node->clone.args_to_skip;
++	len = gimple_call_num_args(call_stmt);
++	if (len == 0)
++		return head;
 +
-+	new_decl_list = DECL_ARGUMENTS(NODE_DECL(new_node));
-+	old_decl_list = DECL_ARGUMENTS(NODE_DECL(old_node));
-+	if (new_decl_list != NULL_TREE && old_decl_list != NULL_TREE)
-+		gcc_assert(list_length(new_decl_list) == list_length(old_decl_list));
++	decl = get_fn_or_fnptr_decl(call_stmt);
++	if (decl == NULL_TREE)
++		return head;
 +
-+	return true;
++	for (i = 0; i < len; i++) {
++		tree arg;
++		next_interesting_function_t next_node;
++
++		arg = gimple_call_arg(call_stmt, i);
++		if (is_gimple_constant(arg))
++			continue;
++		if (skip_types(arg))
++			continue;
++		next_node = get_interesting_function_next_node(decl, i + 1);
++		if (next_node)
++			head = search_interesting_stmt(head, next_node, call_stmt, arg, i + 1);
++	}
++
++	return head;
 +}
 +
-+unsigned int get_correct_argnum_fndecl(const_tree fndecl, const_tree correct_argnum_of_fndecl, unsigned int num)
++// Find assignements to structure fields and vardecls
++static interesting_stmts_t search_interesting_structs_vardecls(interesting_stmts_t head, gassign *assign)
 +{
-+	unsigned int new_num;
-+	const_tree fndecl_arg;
-+	tree fndecl_arglist = DECL_ARGUMENTS(fndecl);
-+	const_tree arg, target_fndecl_arglist;
-+
-+	if (num == 0)
-+		return num;
++	enum intentional_mark mark;
++	next_interesting_function_t next_node;
++	tree rhs1, rhs2, lhs, decl;
++#if BUILDING_GCC_VERSION >= 4006
++	tree rhs3;
++#endif
 +
-+	if (fndecl == correct_argnum_of_fndecl && !DECL_ARTIFICIAL(fndecl))
-+		return num;
-+	else if (fndecl == correct_argnum_of_fndecl && DECL_ARTIFICIAL(fndecl))
-+		return CANNOT_FIND_ARG;
++	lhs = gimple_assign_lhs(assign);
 +
-+	target_fndecl_arglist = DECL_ARGUMENTS(correct_argnum_of_fndecl);
-+	if (fndecl_arglist == NULL_TREE || target_fndecl_arglist == NULL_TREE)
-+		return CANNOT_FIND_ARG;
++	if (VAR_P(lhs))
++		decl = lhs;
++	else
++		decl = get_ref_field(lhs);
++	if (decl == NULL_TREE)
++		return head;
++	if (DECL_NAME(decl) == NULL_TREE)
++		return head;
 +
-+	fndecl_arg = chain_index(num - 1, fndecl_arglist);
-+	if (fndecl_arg == NULL_TREE)
-+		return CANNOT_FIND_ARG;
++	if (is_bitfield_unnamed_cast(decl, assign))
++		return head;
 +
-+	for (arg = target_fndecl_arglist, new_num = 1; arg; arg = TREE_CHAIN(arg), new_num++) {
-+		if (arg == fndecl_arg || !strcmp(DECL_NAME_POINTER(arg), DECL_NAME_POINTER(fndecl_arg)))
-+			return new_num;
-+	}
++	next_node = get_interesting_function_next_node(decl, 0);
++	if (!next_node)
++		return head;
 +
-+	return CANNOT_FIND_ARG;
-+}
++	mark = get_intentional_attr_type(decl);
++	if (mark != MARK_NO)
++		return head;
 +
-+// Find the specified argument in the originally cloned function
-+static unsigned int clone_argnum_on_orig(struct cgraph_node *new_node, struct cgraph_node *old_node, unsigned int clone_argnum)
-+{
-+	bitmap args_to_skip;
-+	unsigned int i, new_argnum = clone_argnum;
++	rhs1 = gimple_assign_rhs1(assign);
++	head = search_interesting_stmt(head, next_node, assign, rhs1, 0);
 +
-+	if (unchanged_arglist(new_node, old_node))
-+		return clone_argnum;
++	rhs2 = gimple_assign_rhs2(assign);
++	if (rhs2)
++		head = search_interesting_stmt(head, next_node, assign, rhs2, 0);
 +
-+	gcc_assert(new_node->clone_of && new_node->clone.tree_map);
-+	args_to_skip = new_node->clone.args_to_skip;
-+	for (i = 0; i < clone_argnum; i++) {
-+		if (bitmap_bit_p(args_to_skip, i))
-+			new_argnum++;
-+	}
-+	return new_argnum;
++#if BUILDING_GCC_VERSION >= 4006
++	rhs3 = gimple_assign_rhs3(assign);
++	if (rhs3)
++		head = search_interesting_stmt(head, next_node, assign, rhs3, 0);
++#endif
++	return head;
 +}
 +
-+// Find the specified argument in the clone
-+static unsigned int orig_argnum_on_clone(struct cgraph_node *new_node, struct cgraph_node *old_node, unsigned int orig_argnum)
++static next_interesting_function_t create_so_asm_next_interesting_function_node(const gasm *stmt)
 +{
-+	bitmap args_to_skip;
-+	unsigned int i, new_argnum = orig_argnum;
++	next_interesting_function_t next_node;
++	struct fn_raw_data raw_data;
 +
-+	if (unchanged_arglist(new_node, old_node))
-+		return orig_argnum;
++	raw_data.decl = NULL_TREE;
++	raw_data.decl_str = gimple_asm_string(stmt);
++	raw_data.context = "attr";
++	raw_data.hash = 0;
++	raw_data.num = 0;
++	raw_data.marked = ASM_STMT_SO_MARK;
 +
-+	gcc_assert(new_node->clone_of && new_node->clone.tree_map);
-+	args_to_skip = new_node->clone.args_to_skip;
-+	if (bitmap_bit_p(args_to_skip, orig_argnum - 1))
-+		// XXX torolni kellene a nodeot
-+		return CANNOT_FIND_ARG;
++	next_node = get_global_next_interesting_function_entry(&raw_data);
++	if (next_node)
++		return next_node;
++	next_node = create_new_next_interesting_entry(&raw_data, NULL);
++	gcc_assert(next_node);
 +
-+	for (i = 0; i < orig_argnum; i++) {
-+		if (bitmap_bit_p(args_to_skip, i))
-+			new_argnum--;
-+	}
-+	return new_argnum;
++	add_to_global_next_interesting_function(next_node);
++	return next_node;
 +}
 +
-+// Associate the argument between a clone and a cloned function
-+static unsigned int get_correct_argnum_cnode(struct cgraph_node *node, struct cgraph_node *correct_argnum_of_node, unsigned int argnum)
++// Collect interesting stmts for duplication
++static void search_interesting_stmts(struct visited *visited)
 +{
-+	bool node_clone, correct_argnum_of_node_clone;
-+	const_tree correct_argnum_of_node_decl, node_decl;
++	basic_block bb;
++	next_interesting_function_t next_node_ret;
++	interesting_stmts_t head = NULL;
 +
-+	if (node == correct_argnum_of_node)
-+		return argnum;
-+	if (argnum == 0)
-+		return argnum;
++	next_node_ret = get_interesting_function_next_node(current_function_decl, 0);
 +
-+	correct_argnum_of_node_decl = NODE_DECL(correct_argnum_of_node);
-+	gcc_assert(correct_argnum_of_node_decl != NULL_TREE);
-+	gcc_assert(correct_argnum_of_node && !DECL_ARTIFICIAL(correct_argnum_of_node_decl));
++	FOR_EACH_BB_FN(bb, cfun) {
++		gimple_stmt_iterator gsi;
 +
-+	if (node) {
-+		node_decl = NODE_DECL(node);
-+		gcc_assert(!DECL_ARTIFICIAL(node_decl));
-+		node_clone = made_by_compiler(node_decl);
-+	} else {
-+		node_decl = NULL_TREE;
-+		node_clone = false;
-+	}
++		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
++			gimple stmt = gsi_stmt(gsi);
 +
-+	if (correct_argnum_of_node_decl == node_decl)
-+		return argnum;
++			switch (gimple_code(stmt)) {
++			case GIMPLE_ASM: {
++				tree first_node;
++				next_interesting_function_t next_node;
++				const gasm *asm_stmt = as_a_gasm(stmt);
 +
-+	correct_argnum_of_node_clone = made_by_compiler(correct_argnum_of_node_decl);
-+	// the original decl is lost if both nodes are clones
-+	if (node_clone && correct_argnum_of_node_clone) {
-+		gcc_assert(unchanged_arglist(node, correct_argnum_of_node));
-+		return argnum;
++				if (!is_size_overflow_insert_check_asm(asm_stmt))
++					continue;
++				next_node = create_so_asm_next_interesting_function_node(asm_stmt);
++				first_node = get_size_overflow_asm_input(asm_stmt);
++				head = search_interesting_stmt(head, next_node, stmt, first_node, 0);
++				break;
++			}
++			case GIMPLE_RETURN:
++				head = search_interesting_rets(head, next_node_ret, as_a_greturn(stmt));
++				break;
++			case GIMPLE_CALL:
++				head = search_interesting_calls(head, as_a_gcall(stmt));
++				break;
++			case GIMPLE_ASSIGN:
++				/* !!! TODO LTO modeban nincs duplikalas a globalis valtozora, mert a tree mergek
++				 * utan mar nem lehet megkulonboztetni attol a globalis valtozotol, aminek a scopeja csak a file
++				 * igy a context nem vardecl lesz, hanem vardecl_filenev. De execute-ban kiirja, ha hianyzik a hash tablabol
++				 * IPA-ban van duplikalas.
++				 */
++				head = search_interesting_structs_vardecls(head, as_a_gassign(stmt));
++				break;
++			default:
++				break;
++			}
++		}
 +	}
 +
-+	if (node_clone && !correct_argnum_of_node_clone)
-+		return clone_argnum_on_orig(correct_argnum_of_node, node, argnum);
-+	else if (!node_clone && correct_argnum_of_node_clone)
-+		return orig_argnum_on_clone(correct_argnum_of_node, node, argnum);
-+
-+	if (node)
-+		debug_tree(NODE_DECL(node));
-+	debug_tree(correct_argnum_of_node_decl);
-+	gcc_unreachable();
++	handle_interesting_stmt(visited, head);
++	free_interesting_stmts(head);
 +}
 +
-+unsigned int get_correct_argnum(const_tree decl, const_tree correct_argnum_of_decl, unsigned int argnum)
++static struct visited *create_visited(void)
 +{
-+	struct cgraph_node *node, *correct_argnum_of_node;
++	struct visited *new_node;
 +
-+	gcc_assert(decl != NULL_TREE);
-+	gcc_assert(correct_argnum_of_decl != NULL_TREE);
++	new_node = (struct visited *)xmalloc(sizeof(*new_node));
++	new_node->stmts = pointer_set_create();
++	new_node->my_stmts = pointer_set_create();
++	new_node->skip_expr_casts = pointer_set_create();
++	new_node->no_cast_check = pointer_set_create();
++	return new_node;
++}
 +
-+	correct_argnum_of_node = get_cnode(correct_argnum_of_decl);
-+	if (!correct_argnum_of_node || DECL_ARTIFICIAL(decl) || DECL_ARTIFICIAL(correct_argnum_of_decl))
-+		return get_correct_argnum_fndecl(decl, correct_argnum_of_decl, argnum);
++static void free_visited(struct visited *visited)
++{
++	pointer_set_destroy(visited->stmts);
++	pointer_set_destroy(visited->my_stmts);
++	pointer_set_destroy(visited->skip_expr_casts);
++	pointer_set_destroy(visited->no_cast_check);
 +
-+	node = get_cnode(decl);
-+	return get_correct_argnum_cnode(node, correct_argnum_of_node, argnum);
++	free(visited);
 +}
 +
-+// Find the original cloned function
-+tree get_orig_fndecl(const_tree clone_fndecl)
++// Remove the size_overflow asm stmt and create an assignment from the input and output of the asm
++static void replace_size_overflow_asm_with_assign(gasm *asm_stmt, tree lhs, tree rhs)
 +{
-+	struct cgraph_node *node;
++	gassign *assign;
++	gimple_stmt_iterator gsi;
 +
-+	gcc_assert(TREE_CODE(clone_fndecl) == FUNCTION_DECL);
++	// already removed
++	if (gimple_bb(asm_stmt) == NULL)
++		return;
++	gsi = gsi_for_stmt(asm_stmt);
 +
-+	if (DECL_ABSTRACT_ORIGIN(clone_fndecl))
-+		return CONST_CAST_TREE(DECL_ABSTRACT_ORIGIN(clone_fndecl));
-+	node = get_cnode(clone_fndecl);
-+	if (!node)
-+		return CONST_CAST_TREE(clone_fndecl);
++	assign = gimple_build_assign(lhs, rhs);
++	gsi_insert_before(&gsi, assign, GSI_SAME_STMT);
++	SSA_NAME_DEF_STMT(lhs) = assign;
 +
-+	while (node->clone_of)
-+		node = node->clone_of;
-+	if (!made_by_compiler(NODE_DECL(node)))
-+		return NODE_DECL(node);
-+	// Return the cloned decl because it is needed for the transform callback
-+	return CONST_CAST_TREE(clone_fndecl);
++	gsi_remove(&gsi, true);
 +}
 +
-+static tree get_interesting_fndecl_from_stmt(const gcall *stmt)
++// Replace our asm stmts with assignments (they are no longer needed and may interfere with later optimizations)
++static void remove_size_overflow_asm(gimple stmt)
 +{
-+	if (gimple_call_num_args(stmt) == 0)
-+		return NULL_TREE;
-+	return gimple_call_fndecl(stmt);
-+}
++	gimple_stmt_iterator gsi;
++	tree input, output;
 +
-+tree get_interesting_orig_fndecl_from_stmt(const gcall *stmt)
-+{
-+	tree fndecl;
++	if (!is_size_overflow_asm(stmt))
++		return;
 +
-+	fndecl = get_interesting_fndecl_from_stmt(stmt);
-+	if (fndecl == NULL_TREE)
-+		return NULL_TREE;
-+	return get_orig_fndecl(fndecl);
-+}
++	if (gimple_asm_noutputs(as_a_gasm(stmt)) == 0) {
++		gsi = gsi_for_stmt(stmt);
 +
-+void set_dominance_info(void)
-+{
-+	calculate_dominance_info(CDI_DOMINATORS);
-+	calculate_dominance_info(CDI_POST_DOMINATORS);
++		ipa_remove_stmt_references(cgraph_get_node(current_function_decl), stmt);
++		gsi_remove(&gsi, true);
++		return;
++	}
++
++	input = gimple_asm_input_op(as_a_gasm(stmt), 0);
++	output = gimple_asm_output_op(as_a_gasm(stmt), 0);
++	replace_size_overflow_asm_with_assign(as_a_gasm(stmt), TREE_VALUE(output), TREE_VALUE(input));
 +}
 +
-+void unset_dominance_info(void)
++static void remove_all_size_overflow_asm(void)
 +{
-+	free_dominance_info(CDI_DOMINATORS);
-+	free_dominance_info(CDI_POST_DOMINATORS);
++	basic_block bb;
++
++	FOR_EACH_BB_FN(bb, cfun) {
++		gimple_stmt_iterator si;
++
++		for (si = gsi_start_bb(bb); !gsi_end_p(si); gsi_next(&si))
++			remove_size_overflow_asm(gsi_stmt(si));
++	}
 +}
 +
-+void set_current_function_decl(tree fndecl)
++unsigned int size_overflow_function_transform(struct cgraph_node *node __unused)
 +{
-+	gcc_assert(fndecl != NULL_TREE);
++	struct visited *visited;
 +
-+	push_cfun(DECL_STRUCT_FUNCTION(fndecl));
-+#if BUILDING_GCC_VERSION <= 4007
-+	current_function_decl = fndecl;
++#if BUILDING_GCC_VERSION >= 4008
++	if (dump_file) {
++		fprintf(dump_file, "BEFORE TRANSFORM -------------------------\n");
++		size_overflow_dump_function(dump_file, node);
++	}
 +#endif
++	visited = create_visited();
 +	set_dominance_info();
-+}
 +
-+void unset_current_function_decl(void)
-+{
-+	unset_dominance_info();
-+#if BUILDING_GCC_VERSION <= 4007
-+	current_function_decl = NULL_TREE;
-+#endif
-+	pop_cfun();
-+}
++	search_interesting_stmts(visited);
 +
-+bool is_valid_cgraph_node(struct cgraph_node *node)
-+{
-+	if (cgraph_function_body_availability(node) == AVAIL_NOT_AVAILABLE)
-+		return false;
-+	if (node->thunk.thunk_p || node->alias)
-+		return false;
-+	return true;
-+}
++	remove_all_size_overflow_asm();
 +
-+tree get_lhs(const_gimple stmt)
-+{
-+	switch (gimple_code(stmt)) {
-+	case GIMPLE_ASSIGN:
-+	case GIMPLE_CALL:
-+		return gimple_get_lhs(stmt);
-+	case GIMPLE_PHI:
-+		return gimple_phi_result(stmt);
-+	default:
-+		debug_gimple_stmt((gimple)stmt);
-+		gcc_unreachable();
++	unset_dominance_info();
++	free_visited(visited);
++
++#if BUILDING_GCC_VERSION >= 4008
++	if (dump_file) {
++		fprintf(dump_file, "AFTER TRANSFORM -------------------------\n");
++		size_overflow_dump_function(dump_file, node);
 +	}
++#endif
++	return TODO_dump_func | TODO_verify_stmts | TODO_remove_unused_locals | TODO_update_ssa_no_phi | TODO_ggc_collect | TODO_verify_flow;
 +}
-+
-diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
+diff --git a/scripts/gcc-plugins/size_overflow_plugin/size_overflow_transform_core.c b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_transform_core.c
 new file mode 100644
-index 0000000..3f8f032
+index 0000000..062204a
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
-@@ -0,0 +1,290 @@
++++ b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_transform_core.c
+@@ -0,0 +1,1025 @@
 +/*
 + * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -209132,3014 +207823,5055 @@ index 0000000..3f8f032
 +
 +#include "size_overflow.h"
 +
-+int plugin_is_GPL_compatible;
++#define MIN_CHECK true
++#define MAX_CHECK false
 +
-+tree report_size_overflow_decl;
++unsigned int call_count = 0;
 +
-+tree size_overflow_type_HI;
-+tree size_overflow_type_SI;
-+tree size_overflow_type_DI;
-+tree size_overflow_type_TI;
++tree get_size_overflow_type(struct visited *visited, const_gimple stmt, const_tree node)
++{
++	const_tree type;
++	tree new_type;
 +
-+static struct plugin_info size_overflow_plugin_info = {
-+	.version	= "20160521",
-+	.help		= "no-size-overflow\tturn off size overflow checking\n",
-+};
++	gcc_assert(node != NULL_TREE);
 +
-+static tree handle_size_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
-+{
-+	unsigned int arg_count;
-+	enum tree_code code = TREE_CODE(*node);
++	type = TREE_TYPE(node);
 +
-+	switch (code) {
-+	case FUNCTION_DECL:
-+		arg_count = type_num_arguments(TREE_TYPE(*node));
++	if (pointer_set_contains(visited->my_stmts, stmt))
++		return TREE_TYPE(node);
++
++	switch (TYPE_MODE(type)) {
++	case QImode:
++	case HImode:
++		new_type = size_overflow_type_SI;
 +		break;
-+	case FUNCTION_TYPE:
-+	case METHOD_TYPE:
-+		arg_count = type_num_arguments(*node);
++	case SImode:
++		new_type = size_overflow_type_DI;
++		break;
++	case DImode:
++		if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode))
++			new_type = TYPE_UNSIGNED(type) ? unsigned_intDI_type_node : intDI_type_node;
++		else
++			new_type = size_overflow_type_TI;
++		break;
++	case TImode:
++		gcc_assert(!TYPE_UNSIGNED(type));
++		new_type = size_overflow_type_TI;
 +		break;
 +	default:
-+		*no_add_attrs = true;
-+		debug_tree(*node);
-+		error("%s: %qE attribute only applies to functions", __func__, name);
-+		return NULL_TREE;
++		debug_tree(node);
++		error("%s: unsupported gcc configuration (%qE).", __func__, current_function_decl);
++		gcc_unreachable();
 +	}
 +
-+	for (; args; args = TREE_CHAIN(args)) {
-+		int cur_val;
-+		tree position = TREE_VALUE(args);
++	if (TYPE_QUALS(type) != 0)
++		return build_qualified_type(new_type, TYPE_QUALS(type));
++	return new_type;
++}
 +
-+		if (TREE_CODE(position) != INTEGER_CST) {
-+			error("%s: parameter isn't an integer", __func__);
-+			debug_tree(args);
-+			*no_add_attrs = true;
-+			return NULL_TREE;
-+		}
++tree cast_to_new_size_overflow_type(struct visited *visited, gimple stmt, tree rhs, tree size_overflow_type, bool before)
++{
++	gimple_stmt_iterator gsi;
++	gimple new_stmt;
 +
-+		cur_val = tree_to_shwi(position);
-+		if (cur_val < 0 || arg_count < (unsigned int)cur_val) {
-+			error("%s: parameter %d is outside range.", __func__, cur_val);
-+			*no_add_attrs = true;
-+			return NULL_TREE;
-+		}
-+	}
-+	return NULL_TREE;
++	if (rhs == NULL_TREE)
++		return NULL_TREE;
++
++	gsi = gsi_for_stmt(stmt);
++	new_stmt = build_cast_stmt(visited, size_overflow_type, rhs, CREATE_NEW_VAR, &gsi, before, false);
++	if (gimple_assign_cast_p(new_stmt))
++		gimple_assign_set_rhs_code(new_stmt, CONVERT_EXPR);
++	pointer_set_insert(visited->my_stmts, new_stmt);
++
++	return get_lhs(new_stmt);
 +}
 +
-+static tree handle_intentional_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
++tree create_assign(struct visited *visited, gimple oldstmt, tree rhs1, bool before)
 +{
-+	unsigned int arg_count;
-+	HOST_WIDE_INT s_first_arg;
-+	enum tree_code code = TREE_CODE(*node);
++	tree lhs, dst_type;
++	gimple_stmt_iterator gsi;
 +
-+	switch (code) {
-+	case FUNCTION_DECL:
-+		arg_count = type_num_arguments(TREE_TYPE(*node));
++	if (rhs1 == NULL_TREE) {
++		debug_gimple_stmt(oldstmt);
++		error("%s: rhs1 is NULL_TREE", __func__);
++		gcc_unreachable();
++	}
++
++	switch (gimple_code(oldstmt)) {
++	case GIMPLE_ASM:
++		lhs = rhs1;
 +		break;
-+	case FUNCTION_TYPE:
-+	case METHOD_TYPE:
-+		arg_count = type_num_arguments(*node);
++	case GIMPLE_CALL:
++	case GIMPLE_ASSIGN:
++		lhs = gimple_get_lhs(oldstmt);
 +		break;
-+	case VAR_DECL:
-+	case FIELD_DECL:
-+		return NULL_TREE;
 +	default:
-+		*no_add_attrs = true;
-+		debug_tree(*node);
-+		error("%qE attribute only applies to functions, fields or vars", name);
-+		return NULL_TREE;
++		debug_gimple_stmt(oldstmt);
++		gcc_unreachable();
 +	}
 +
-+	s_first_arg = tree_to_shwi(TREE_VALUE(args));
-+	if (s_first_arg == -1)
-+		return NULL_TREE;
-+	if (s_first_arg < -1)
-+		error("%s: parameter %d is outside range.", __func__, (int)s_first_arg);
-+
-+	for (; args; args = TREE_CHAIN(args)) {
-+		unsigned int cur_val;
-+
-+		if (TREE_CODE(TREE_VALUE(args)) != INTEGER_CST) {
-+			error("%s: parameter isn't an integer", __func__);
-+			debug_tree(args);
-+			*no_add_attrs = true;
-+			return NULL_TREE;
-+		}
++	gsi = gsi_for_stmt(oldstmt);
++	pointer_set_insert(visited->stmts, oldstmt);
++	if (lookup_stmt_eh_lp(oldstmt) != 0) {
++		basic_block next_bb, cur_bb;
++		const_edge e;
 +
-+		cur_val = (unsigned int)tree_to_uhwi(TREE_VALUE(args));
-+		if (cur_val > arg_count ) {
-+			error("%s: parameter %u is outside range. (arg_count: %u)", __func__, cur_val, arg_count);
-+			*no_add_attrs = true;
-+			return NULL_TREE;
-+		}
-+	}
-+	return NULL_TREE;
-+}
++		gcc_assert(before == false);
++		gcc_assert(stmt_can_throw_internal(oldstmt));
++		gcc_assert(gimple_code(oldstmt) == GIMPLE_CALL);
++		gcc_assert(!gsi_end_p(gsi));
 +
-+static struct attribute_spec size_overflow_attr = {
-+	.name				= "size_overflow",
-+	.min_length			= 1,
-+	.max_length			= -1,
-+	.decl_required			= true,
-+	.type_required			= false,
-+	.function_type_required		= false,
-+	.handler			= handle_size_overflow_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+	.affects_type_identity		= false
-+#endif
-+};
++		cur_bb = gimple_bb(oldstmt);
++		next_bb = cur_bb->next_bb;
++		e = find_edge(cur_bb, next_bb);
++		gcc_assert(e != NULL);
++		gcc_assert(e->flags & EDGE_FALLTHRU);
 +
-+static struct attribute_spec intentional_overflow_attr = {
-+	.name				= "intentional_overflow",
-+	.min_length			= 1,
-+	.max_length			= -1,
-+	.decl_required			= true,
-+	.type_required			= false,
-+	.function_type_required		= false,
-+	.handler			= handle_intentional_overflow_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+	.affects_type_identity		= false
-+#endif
-+};
++		gsi = gsi_after_labels(next_bb);
++		gcc_assert(!gsi_end_p(gsi));
 +
-+static void register_attributes(void __unused *event_data, void __unused *data)
-+{
-+	register_attribute(&size_overflow_attr);
-+	register_attribute(&intentional_overflow_attr);
-+}
++		before = true;
++		oldstmt = gsi_stmt(gsi);
++	}
 +
-+static tree create_typedef(tree type, const char* ident)
-+{
-+	tree new_type, decl;
++	if (is_gimple_constant(rhs1) && TREE_CODE_CLASS(gimple_assign_rhs_code(oldstmt)) == tcc_comparison)
++		dst_type = get_size_overflow_type(visited, oldstmt, rhs1);
++	else
++		dst_type = get_size_overflow_type(visited, oldstmt, lhs);
 +
-+	new_type = build_variant_type_copy(type);
-+	decl = build_decl(BUILTINS_LOCATION, TYPE_DECL, get_identifier(ident), new_type);
-+	DECL_ORIGINAL_TYPE(decl) = type;
-+	TYPE_NAME(new_type) = decl;
-+	return new_type;
++	if (is_gimple_constant(rhs1))
++		return cast_a_tree(dst_type, rhs1);
++	return cast_to_new_size_overflow_type(visited, oldstmt, rhs1, dst_type, before);
 +}
 +
-+// Create the noreturn report_size_overflow() function decl.
-+static void size_overflow_start_unit(void __unused *gcc_data, void __unused *user_data)
++tree dup_assign(struct visited *visited, gassign *oldstmt, const_tree node, tree rhs1, tree rhs2, tree __unused rhs3)
 +{
-+	tree const_char_ptr_type_node;
-+	tree fntype;
-+
-+	const_char_ptr_type_node = build_pointer_type(build_type_variant(char_type_node, 1, 0));
++	gassign *stmt;
++	gimple_stmt_iterator gsi;
++	tree size_overflow_type, new_var, lhs = gimple_assign_lhs(oldstmt);
 +
-+	size_overflow_type_HI = create_typedef(intHI_type_node, "size_overflow_type_HI");
-+	size_overflow_type_SI = create_typedef(intSI_type_node, "size_overflow_type_SI");
-+	size_overflow_type_DI = create_typedef(intDI_type_node, "size_overflow_type_DI");
-+	size_overflow_type_TI = create_typedef(intTI_type_node, "size_overflow_type_TI");
++	if (pointer_set_contains(visited->my_stmts, oldstmt))
++		return lhs;
 +
-+	// void report_size_overflow(const char *loc_file, unsigned int loc_line, const char *current_func, const char *ssa_var)
-+	fntype = build_function_type_list(void_type_node,
-+					  const_char_ptr_type_node,
-+					  unsigned_type_node,
-+					  const_char_ptr_type_node,
-+					  const_char_ptr_type_node,
-+					  NULL_TREE);
-+	report_size_overflow_decl = build_fn_decl("report_size_overflow", fntype);
++	if (gimple_num_ops(oldstmt) != 4 && rhs1 == NULL_TREE) {
++		rhs1 = gimple_assign_rhs1(oldstmt);
++		rhs1 = create_assign(visited, oldstmt, rhs1, BEFORE_STMT);
++	}
++	if (gimple_num_ops(oldstmt) == 3 && rhs2 == NULL_TREE) {
++		rhs2 = gimple_assign_rhs2(oldstmt);
++		rhs2 = create_assign(visited, oldstmt, rhs2, BEFORE_STMT);
++	}
 +
-+	DECL_ASSEMBLER_NAME(report_size_overflow_decl);
-+	TREE_PUBLIC(report_size_overflow_decl) = 1;
-+	DECL_EXTERNAL(report_size_overflow_decl) = 1;
-+	DECL_ARTIFICIAL(report_size_overflow_decl) = 1;
-+//	TREE_THIS_VOLATILE(report_size_overflow_decl) = 1;
-+// !!!
-+	DECL_PRESERVE_P(report_size_overflow_decl) = 1;
-+	DECL_UNINLINABLE(report_size_overflow_decl) = 1;
-+	TREE_USED(report_size_overflow_decl) = 1;
-+	TREE_NOTHROW(report_size_overflow_decl) = 1;
-+}
++	stmt = as_a_gassign(gimple_copy(oldstmt));
++	gimple_set_location(stmt, gimple_location(oldstmt));
++	pointer_set_insert(visited->my_stmts, stmt);
 +
-+static bool disable_ubsan_si_overflow_gate(void)
-+{
-+#if BUILDING_GCC_VERSION >= 4009
-+	flag_sanitize &= ~SANITIZE_SI_OVERFLOW;
-+#endif
-+	return true;
-+}
++	if (gimple_assign_rhs_code(oldstmt) == WIDEN_MULT_EXPR)
++		gimple_assign_set_rhs_code(stmt, MULT_EXPR);
 +
-+#define PASS_NAME disable_ubsan_si_overflow
++	size_overflow_type = get_size_overflow_type(visited, oldstmt, node);
 +
-+#define NO_EXECUTE
++	new_var = create_new_var(size_overflow_type);
++	new_var = make_ssa_name(new_var, stmt);
++	gimple_assign_set_lhs(stmt, new_var);
 +
-+#include "gcc-generate-gimple-pass.h"
++	if (rhs1 != NULL_TREE)
++		gimple_assign_set_rhs1(stmt, rhs1);
 +
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+	int i;
-+	const char * const plugin_name = plugin_info->base_name;
-+	const int argc = plugin_info->argc;
-+	const struct plugin_argument * const argv = plugin_info->argv;
-+	bool enable = true;
-+	struct register_pass_info insert_size_overflow_asm_pass_info;
-+	struct register_pass_info size_overflow_pass_info;
-+#if BUILDING_GCC_VERSION >= 4009
-+	struct register_pass_info disable_ubsan_si_overflow_pass_info;
++	if (rhs2 != NULL_TREE)
++		gimple_assign_set_rhs2(stmt, rhs2);
++#if BUILDING_GCC_VERSION >= 4006
++	if (rhs3 != NULL_TREE)
++		gimple_assign_set_rhs3(stmt, rhs3);
 +#endif
++	gimple_set_vuse(stmt, gimple_vuse(oldstmt));
++	gimple_set_vdef(stmt, gimple_vdef(oldstmt));
 +
-+	static const struct ggc_root_tab gt_ggc_r_gt_size_overflow[] = {
-+		{
-+			.base = &report_size_overflow_decl,
-+			.nelt = 1,
-+			.stride = sizeof(report_size_overflow_decl),
-+			.cb = &gt_ggc_mx_tree_node,
-+			.pchw = &gt_pch_nx_tree_node
-+		},
-+		LAST_GGC_ROOT_TAB
-+	};
++	gsi = gsi_for_stmt(oldstmt);
++	gsi_insert_after(&gsi, stmt, GSI_SAME_STMT);
++	update_stmt(stmt);
++	pointer_set_insert(visited->stmts, oldstmt);
++	return gimple_assign_lhs(stmt);
++}
 +
-+	insert_size_overflow_asm_pass_info.pass				= make_insert_size_overflow_asm_pass();
-+	insert_size_overflow_asm_pass_info.reference_pass_name		= "ssa";
-+	insert_size_overflow_asm_pass_info.ref_pass_instance_number	= 1;
-+	insert_size_overflow_asm_pass_info.pos_op			= PASS_POS_INSERT_AFTER;
++static tree cast_parm_decl(struct visited *visited, tree phi_ssa_name, tree arg, tree size_overflow_type, basic_block bb)
++{
++	const_gimple assign;
++	gimple_stmt_iterator gsi;
++	basic_block first_bb;
 +
-+	size_overflow_pass_info.pass			= make_size_overflow_pass();
-+	size_overflow_pass_info.reference_pass_name	= "inline";
-+	size_overflow_pass_info.ref_pass_instance_number	= 1;
-+	size_overflow_pass_info.pos_op			= PASS_POS_INSERT_AFTER;
++	gcc_assert(SSA_NAME_IS_DEFAULT_DEF(arg));
 +
-+	if (!plugin_default_version_check(version, &gcc_version)) {
-+		error(G_("incompatible gcc/plugin versions"));
-+		return 1;
++	if (bb->index == 0) {
++		first_bb = split_block_after_labels(ENTRY_BLOCK_PTR_FOR_FN(cfun))->dest;
++		gcc_assert(dom_info_available_p(CDI_DOMINATORS));
++		set_immediate_dominator(CDI_DOMINATORS, first_bb, ENTRY_BLOCK_PTR_FOR_FN(cfun));
++		bb = first_bb;
 +	}
 +
-+	for (i = 0; i < argc; ++i) {
-+		if (!strcmp(argv[i].key, "no-size-overflow")) {
-+			enable = false;
-+			continue;
-+		}
-+		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+	}
++	gsi = gsi_after_labels(bb);
++	assign = build_cast_stmt(visited, size_overflow_type, arg, phi_ssa_name, &gsi, BEFORE_STMT, false);
++	pointer_set_insert(visited->my_stmts, assign);
++	return get_lhs(assign);
++}
 +
-+	register_callback(plugin_name, PLUGIN_INFO, NULL, &size_overflow_plugin_info);
-+	if (enable) {
-+#if BUILDING_GCC_VERSION >= 4009
-+		if (flag_sanitize & SANITIZE_SI_OVERFLOW) {
-+			error(G_("ubsan SANITIZE_SI_OVERFLOW option is unsupported"));
-+			return 1;
-+		}
-+#endif
-+		register_callback(plugin_name, PLUGIN_START_UNIT, &size_overflow_start_unit, NULL);
-+		register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_size_overflow);
-+#if BUILDING_GCC_VERSION >= 4009
-+		flag_sanitize |= SANITIZE_SI_OVERFLOW;
-+		disable_ubsan_si_overflow_pass_info.pass			= make_disable_ubsan_si_overflow_pass();
-+		disable_ubsan_si_overflow_pass_info.reference_pass_name		= "ubsan";
-+		disable_ubsan_si_overflow_pass_info.ref_pass_instance_number	= 1;
-+		disable_ubsan_si_overflow_pass_info.pos_op			= PASS_POS_REPLACE;
++static tree use_phi_ssa_name(struct visited *visited, tree ssa_name_var, tree new_arg)
++{
++	gimple_stmt_iterator gsi;
++	const_gimple assign;
++	gimple def_stmt = get_def_stmt(new_arg);
 +
-+		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &disable_ubsan_si_overflow_pass_info);
-+#endif
-+		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &insert_size_overflow_asm_pass_info);
-+		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &size_overflow_pass_info);
++	if (gimple_code(def_stmt) == GIMPLE_PHI) {
++		gsi = gsi_after_labels(gimple_bb(def_stmt));
++		assign = build_cast_stmt(visited, TREE_TYPE(new_arg), new_arg, ssa_name_var, &gsi, BEFORE_STMT, true);
++	} else {
++		gsi = gsi_for_stmt(def_stmt);
++		assign = build_cast_stmt(visited, TREE_TYPE(new_arg), new_arg, ssa_name_var, &gsi, AFTER_STMT, true);
 +	}
-+	register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
 +
-+	return 0;
++	pointer_set_insert(visited->my_stmts, assign);
++	return get_lhs(assign);
 +}
-diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin_hash.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin_hash.c
-new file mode 100644
-index 0000000..87af656
---- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin_hash.c
-@@ -0,0 +1,352 @@
-+/*
-+ * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
-+ * Licensed under the GPL v2, or (at your option) v3
-+ *
-+ * Homepage:
-+ * https://github.com/ephox-gcc-plugins/size_overflow
-+ *
-+ * Documentation:
-+ * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
-+ *
-+ * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
-+ * with double integer precision (DImode/TImode for 32/64 bit integer types).
-+ * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
-+ *
-+ * Usage:
-+ * $ make
-+ * $ make run
-+ */
 +
-+#include "size_overflow.h"
++static tree cast_visited_phi_arg(struct visited *visited, tree ssa_name_var, tree arg, tree size_overflow_type)
++{
++	basic_block bb;
++	gimple_stmt_iterator gsi;
++	const_gimple def_stmt;
++	const_gimple assign;
 +
-+#include "size_overflow_hash.h"
-+#include "disable_size_overflow_hash.h"
-+#include "size_overflow_hash_aux.h"
++	def_stmt = get_def_stmt(arg);
++	bb = gimple_bb(def_stmt);
++	gcc_assert(bb->index != 0);
++	gsi = gsi_after_labels(bb);
 +
-+static const_tree get_function_type(const_tree decl)
-+{
-+	if (FUNCTION_PTR_P(decl))
-+		return TREE_TYPE(TREE_TYPE(decl));
-+	gcc_assert(TREE_CODE(decl) == FUNCTION_DECL);
-+	return TREE_TYPE(decl);
++	assign = build_cast_stmt(visited, size_overflow_type, arg, ssa_name_var, &gsi, BEFORE_STMT, false);
++	pointer_set_insert(visited->my_stmts, assign);
++	return get_lhs(assign);
 +}
 +
-+static unsigned char get_tree_code(const_tree type)
++static tree create_new_phi_arg(struct visited *visited, tree ssa_name_var, tree new_arg, gphi *oldstmt, unsigned int i)
 +{
-+	switch (TREE_CODE(type)) {
-+	case ARRAY_TYPE:
-+		return 0;
-+	case BOOLEAN_TYPE:
-+		return 1;
-+	case ENUMERAL_TYPE:
-+		return 2;
-+	case FUNCTION_TYPE:
-+		return 3;
-+	case INTEGER_TYPE:
-+		return 4;
-+	case POINTER_TYPE:
-+		return 5;
-+	case RECORD_TYPE:
-+		return 6;
-+	case UNION_TYPE:
-+		return 7;
-+	case VOID_TYPE:
-+		return 8;
-+	case REAL_TYPE:
-+		return 9;
-+	case VECTOR_TYPE:
-+		return 10;
-+	case REFERENCE_TYPE:
-+		return 11;
-+	case OFFSET_TYPE:
-+		return 12;
-+	case COMPLEX_TYPE:
-+		return 13;
-+	default:
-+		debug_tree(type);
-+		gcc_unreachable();
-+	}
-+}
++	tree size_overflow_type;
++	tree arg;
++	const_gimple def_stmt;
 +
-+// http://www.team5150.com/~andrew/noncryptohashzoo2~/CrapWow.html
-+static unsigned int CrapWow(const char *key, unsigned int len, unsigned int seed)
-+{
-+#define cwfold( a, b, lo, hi ) { p = (unsigned int)(a) * (unsigned long long)(b); lo ^= (unsigned int)p; hi ^= (unsigned int)(p >> 32); }
-+#define cwmixa( in ) { cwfold( in, m, k, h ); }
-+#define cwmixb( in ) { cwfold( in, n, h, k ); }
++	if (new_arg != NULL_TREE && is_gimple_constant(new_arg))
++		return new_arg;
 +
-+	unsigned int m = 0x57559429;
-+	unsigned int n = 0x5052acdb;
-+	const unsigned int *key4 = (const unsigned int *)key;
-+	unsigned int h = len;
-+	unsigned int k = len + seed + n;
-+	unsigned long long p;
++	arg = gimple_phi_arg_def(oldstmt, i);
++	def_stmt = get_def_stmt(arg);
++	gcc_assert(def_stmt != NULL);
++	size_overflow_type = get_size_overflow_type(visited, oldstmt, arg);
 +
-+	while (len >= 8) {
-+		cwmixb(key4[0]) cwmixa(key4[1]) key4 += 2;
-+		len -= 8;
-+	}
-+	if (len >= 4) {
-+		cwmixb(key4[0]) key4 += 1;
-+		len -= 4;
++	switch (gimple_code(def_stmt)) {
++	case GIMPLE_PHI:
++		return cast_visited_phi_arg(visited, ssa_name_var, arg, size_overflow_type);
++	case GIMPLE_NOP: {
++		basic_block bb;
++
++		bb = gimple_phi_arg_edge(oldstmt, i)->src;
++		return cast_parm_decl(visited, ssa_name_var, arg, size_overflow_type, bb);
 +	}
-+	if (len)
-+		cwmixa(key4[0] & ((1 << (len * 8)) - 1 ));
-+	cwmixb(h ^ (k + n));
-+	return k ^ h;
++	case GIMPLE_ASM: {
++		gimple_stmt_iterator gsi;
++		const_gimple assign;
++		gimple stmt = get_def_stmt(arg);
 +
-+#undef cwfold
-+#undef cwmixa
-+#undef cwmixb
++		gsi = gsi_for_stmt(stmt);
++		assign = build_cast_stmt(visited, size_overflow_type, arg, ssa_name_var, &gsi, AFTER_STMT, false);
++		pointer_set_insert(visited->my_stmts, assign);
++		return get_lhs(assign);
++	}
++	default:
++		gcc_assert(new_arg != NULL_TREE);
++		gcc_assert(types_compatible_p(TREE_TYPE(new_arg), size_overflow_type));
++		return use_phi_ssa_name(visited, ssa_name_var, new_arg);
++	}
 +}
 +
-+static void set_hash(struct decl_hash *decl_hash_data)
++static gphi *overflow_create_phi_node(struct visited *visited, gphi *oldstmt, tree result)
 +{
-+	unsigned int fn, type, codes, seed = 0;
++	basic_block bb;
++	gphi *phi;
++	gimple_seq seq;
++	gimple_stmt_iterator gsi = gsi_for_stmt(oldstmt);
 +
-+	fn = CrapWow(decl_hash_data->fn_name, strlen(decl_hash_data->fn_name), seed) & 0xffff;
-+	codes = CrapWow((const char*)decl_hash_data->tree_codes, decl_hash_data->tree_codes_len, seed) & 0xffff;
-+	type = CrapWow(decl_hash_data->context, strlen(decl_hash_data->context), 0) & 0xffff;
-+	decl_hash_data->hash = type ^ fn ^ codes;
-+}
++	bb = gsi_bb(gsi);
 +
-+static void set_decl_type_codes(const_tree type, struct decl_hash *decl_hash_data)
-+{
-+	gcc_assert(type != NULL_TREE);
-+	gcc_assert(TREE_CODE_CLASS(TREE_CODE(type)) == tcc_type);
++	if (result == NULL_TREE) {
++		tree old_result = gimple_phi_result(oldstmt);
++		tree size_overflow_type = get_size_overflow_type(visited, oldstmt, old_result);
 +
-+	while (type && decl_hash_data->tree_codes_len < CODES_LIMIT) {
-+		decl_hash_data->tree_codes[decl_hash_data->tree_codes_len] = get_tree_code(type);
-+		decl_hash_data->tree_codes_len++;
-+		type = TREE_TYPE(type);
++		result = create_new_var(size_overflow_type);
 +	}
++
++	phi = as_a_gphi(create_phi_node(result, bb));
++	gimple_phi_set_result(phi, make_ssa_name(result, phi));
++	seq = phi_nodes(bb);
++	gsi = gsi_last(seq);
++	gsi_remove(&gsi, false);
++
++	gsi = gsi_for_stmt(oldstmt);
++	gsi_insert_after(&gsi, phi, GSI_NEW_STMT);
++	gimple_set_bb(phi, bb);
++	return phi;
 +}
 +
-+static void set_result_codes(const_tree node, struct decl_hash *decl_hash_data)
++#if BUILDING_GCC_VERSION <= 4007
++static tree create_new_phi_node(struct visited *visited, VEC(tree, heap) **args, tree ssa_name_var, gimple oldstmt)
++#else
++static tree create_new_phi_node(struct visited *visited, vec<tree, va_heap, vl_embed> *&args, tree ssa_name_var, gphi *oldstmt)
++#endif
 +{
-+	const_tree result;
-+
-+	gcc_assert(node != NULL_TREE);
++	gphi *new_phi;
++	unsigned int i;
++	tree arg, result;
++	location_t loc = gimple_location(oldstmt);
 +
-+	if (DECL_P(node)) {
-+		result = DECL_RESULT(node);
-+		if (result != NULL_TREE)
-+			return set_decl_type_codes(TREE_TYPE(result), decl_hash_data);
-+		return set_result_codes(TREE_TYPE(node), decl_hash_data);
-+	}
++#if BUILDING_GCC_VERSION <= 4007
++	gcc_assert(!VEC_empty(tree, *args));
++#else
++	gcc_assert(!args->is_empty());
++#endif
 +
-+	gcc_assert(TYPE_P(node));
++	new_phi = overflow_create_phi_node(visited, oldstmt, ssa_name_var);
++	result = gimple_phi_result(new_phi);
++	ssa_name_var = SSA_NAME_VAR(result);
 +
-+	if (TREE_CODE(node) == FUNCTION_TYPE)
-+		return set_result_codes(TREE_TYPE(node), decl_hash_data);
++#if BUILDING_GCC_VERSION <= 4007
++	FOR_EACH_VEC_ELT(tree, *args, i, arg) {
++#else
++	FOR_EACH_VEC_SAFE_ELT(args, i, arg) {
++#endif
++		arg = create_new_phi_arg(visited, ssa_name_var, arg, oldstmt, i);
++		add_phi_arg(new_phi, arg, gimple_phi_arg_edge(oldstmt, i), loc);
++	}
 +
-+	return set_decl_type_codes(node, decl_hash_data);
++#if BUILDING_GCC_VERSION <= 4007
++	VEC_free(tree, heap, *args);
++#else
++	vec_free(args);
++#endif
++	update_stmt(new_phi);
++	pointer_set_insert(visited->my_stmts, new_phi);
++	return result;
 +}
 +
-+static void set_decl_codes(struct decl_hash *decl_hash_data)
++static tree handle_phi(interesting_stmts_t expand_from, tree orig_result)
 +{
-+	const_tree arg, type;
-+	enum tree_code code;
++#if BUILDING_GCC_VERSION <= 4007
++	VEC(tree, heap) *args = NULL;
++#else
++	vec<tree, va_heap, vl_embed> *args = NULL;
++#endif
++	unsigned int i, len;
++	tree ssa_name_var = NULL_TREE;
++	gphi *oldstmt = as_a_gphi(get_def_stmt(orig_result));
 +
-+	if (TREE_CODE(decl_hash_data->decl) == VAR_DECL || TREE_CODE(decl_hash_data->decl) == FIELD_DECL) {
-+		set_decl_type_codes(TREE_TYPE(decl_hash_data->decl), decl_hash_data);
-+		return;
-+	}
++	len = gimple_phi_num_args(oldstmt);
++	pointer_set_insert(expand_from->visited->stmts, oldstmt);
++	for (i = 0; i < len; i++) {
++		tree arg, new_arg;
 +
-+	type = get_function_type(decl_hash_data->decl);
-+	code = TREE_CODE(type);
-+	gcc_assert(code == FUNCTION_TYPE || code == METHOD_TYPE);
++		arg = gimple_phi_arg_def(oldstmt, i);
++		new_arg = expand(expand_from, arg);
 +
-+	if (FUNCTION_PTR_P(decl_hash_data->decl))
-+		set_result_codes(type, decl_hash_data);
-+	else
-+		set_result_codes(decl_hash_data->decl, decl_hash_data);
++		if (ssa_name_var == NULL_TREE && new_arg != NULL_TREE)
++			ssa_name_var = SSA_NAME_VAR(new_arg);
 +
-+	for (arg = TYPE_ARG_TYPES(type); arg != NULL_TREE && decl_hash_data->tree_codes_len < CODES_LIMIT; arg = TREE_CHAIN(arg))
-+		set_decl_type_codes(TREE_VALUE(arg), decl_hash_data);
-+}
++		if (is_gimple_constant(arg)) {
++			tree size_overflow_type = get_size_overflow_type(expand_from->visited, oldstmt, arg);
 +
-+static const struct size_overflow_hash *get_proper_hash_chain(const struct size_overflow_hash *entry, const char *func_name, const char *context)
-+{
-+	for (; entry; entry = entry->next) {
-+		if (strcmp(entry->name, func_name))
-+			continue;
-+		if (!strcmp(entry->context, context))
-+			return entry;
++			new_arg = cast_a_tree(size_overflow_type, arg);
++		}
++
++#if BUILDING_GCC_VERSION <= 4007
++		VEC_safe_push(tree, heap, args, new_arg);
++#else
++		vec_safe_push(args, new_arg);
++#endif
 +	}
-+	return NULL;
++
++#if BUILDING_GCC_VERSION <= 4007
++	return create_new_phi_node(expand_from->visited, &args, ssa_name_var, oldstmt);
++#else
++	return create_new_phi_node(expand_from->visited, args, ssa_name_var, oldstmt);
++#endif
 +}
 +
-+unsigned int get_decl_hash(const_tree decl, const char *decl_name)
++static tree create_cast_assign(struct visited *visited, gassign *stmt)
 +{
-+	struct decl_hash decl_hash_data;
-+	enum tree_code code = TREE_CODE(decl);
-+
-+	gcc_assert(code == FIELD_DECL || code == FUNCTION_DECL || code == VAR_DECL);
-+
-+	// skip builtins __builtin_constant_p
-+	if (code == FUNCTION_DECL && (DECL_BUILT_IN(decl) || DECL_BUILT_IN_CLASS(decl) == BUILT_IN_NORMAL))
-+		return NO_HASH;
++	tree rhs1 = gimple_assign_rhs1(stmt);
++	tree lhs = gimple_assign_lhs(stmt);
++	const_tree rhs1_type = TREE_TYPE(rhs1);
++	const_tree lhs_type = TREE_TYPE(lhs);
 +
-+	decl_hash_data.fn_name = decl_name;
-+	decl_hash_data.decl = decl;
-+	decl_hash_data.context = get_decl_context(decl);
-+	if (!decl_hash_data.context)
-+		return NO_HASH;
-+	decl_hash_data.tree_codes_len = 0;
++	if (TYPE_UNSIGNED(rhs1_type) == TYPE_UNSIGNED(lhs_type))
++		return create_assign(visited, stmt, lhs, AFTER_STMT);
 +
-+	set_decl_codes(&decl_hash_data);
-+	gcc_assert(decl_hash_data.tree_codes_len != 0);
-+	set_hash(&decl_hash_data);
-+	return decl_hash_data.hash;
++	return create_assign(visited, stmt, rhs1, AFTER_STMT);
 +}
 +
-+const char *get_orig_decl_name(const_tree decl)
++static bool skip_lhs_cast_check(struct visited *visited, const gassign *stmt)
 +{
-+	const char *name;
-+	unsigned int len;
-+	const void *end;
-+	const_tree orig_decl;
-+
-+	if (TREE_CODE(decl) == FUNCTION_DECL)
-+		orig_decl = DECL_ORIGIN(decl);
-+	else
-+		orig_decl = decl;
-+
-+	len = DECL_NAME_LENGTH(orig_decl);
-+	name = DECL_NAME_POINTER(orig_decl);
++	const_tree rhs = gimple_assign_rhs1(stmt);
++	const_gimple def_stmt = get_def_stmt(rhs);
 +
-+	/* Sometimes gcc loses the original cgraph node leaving only clones behind.
-+	 * In such cases we will extract the name from the clone and use it in the hash table
-+	 * without checking the parameter number on the original (unavailable) decl.
-+	 */
++	// 3.8.2 kernel/futex_compat.c compat_exit_robust_list(): get_user() 64 ulong -> int (compat_long_t), int max
++	if (gimple_code(def_stmt) == GIMPLE_ASM)
++		return true;
 +
-+	if (made_by_compiler(orig_decl)) {
-+		end = memchr(name, '.', len);
-+		if (!end)
-+			return xstrndup(name, len);
-+		len = (long)end - (long)name;
-+		gcc_assert(len > 0);
++	if (is_const_plus_unsigned_signed_truncation(rhs)) {
++		pointer_set_insert(visited->no_cast_check, stmt);
++		return true;
 +	}
 +
-+	return xstrndup(name, len);
++	return false;
 +}
 +
-+const struct size_overflow_hash *get_disable_size_overflow_hash_entry(unsigned int hash, const char *decl_name, const char *context, unsigned int argnum)
++static tree create_string_param(tree string)
 +{
-+	const struct size_overflow_hash *entry, *entry_node;
++	tree i_type, a_type;
++	const int length = TREE_STRING_LENGTH(string);
 +
-+	entry = disable_size_overflow_hash[hash];
-+	entry_node = get_proper_hash_chain(entry, decl_name, context);
-+	if (entry_node && entry_node->param & (1U << argnum))
-+		return entry_node;
-+	return NULL;
++	gcc_assert(length > 0);
++
++	i_type = build_index_type(build_int_cst(NULL_TREE, length - 1));
++	a_type = build_array_type(char_type_node, i_type);
++
++	TREE_TYPE(string) = a_type;
++	TREE_CONSTANT(string) = 1;
++	TREE_READONLY(string) = 1;
++
++	return build1(ADDR_EXPR, ptr_type_node, string);
 +}
 +
-+const struct size_overflow_hash *get_size_overflow_hash_entry(unsigned int hash, const char *decl_name, const char *context, unsigned int argnum)
++static void insert_cond(basic_block cond_bb, tree arg, enum tree_code cond_code, tree type_value)
 +{
-+	const struct size_overflow_hash *entry, *entry_node;
-+
-+	entry = size_overflow_hash[hash];
-+	entry_node = get_proper_hash_chain(entry, decl_name, context);
-+	if (entry_node && entry_node->param & (1U << argnum))
-+		return entry_node;
++	gcond *cond_stmt;
++	gimple_stmt_iterator gsi = gsi_last_bb(cond_bb);
 +
-+	entry = size_overflow_hash_aux[hash];
-+	entry_node = get_proper_hash_chain(entry, decl_name, context);
-+	if (entry_node && entry_node->param & (1U << argnum))
-+		return entry_node;
-+	return NULL;
++	cond_stmt = gimple_build_cond(cond_code, arg, type_value, NULL_TREE, NULL_TREE);
++	gsi_insert_after(&gsi, cond_stmt, GSI_CONTINUE_LINKING);
++	update_stmt(cond_stmt);
 +}
 +
-+const struct size_overflow_hash *get_size_overflow_hash_entry_tree(const_tree fndecl, unsigned int argnum, bool hash_table)
++static void insert_cond_result(interesting_stmts_t expand_from, basic_block bb_true, const_gimple stmt, const_tree arg, bool min)
 +{
-+	const_tree orig_decl;
-+	unsigned int orig_argnum, hash;
-+	const char *decl_name, *context;
++	gcall *func_stmt;
++	const_gimple def_stmt;
++	const_tree loc_line;
++	tree loc_file, ssa_name, current_func;
++	expanded_location xloc;
++	char *ssa_name_buf;
++	int len;
++	struct cgraph_edge *edge;
++	struct cgraph_node *report_node;
++	int frequency;
++	gimple_stmt_iterator gsi = gsi_start_bb(bb_true);
 +
-+	if (made_by_compiler(fndecl)) {
-+		orig_decl = get_orig_fndecl(fndecl);
-+		orig_argnum = get_correct_argnum(fndecl, orig_decl, argnum);
-+	} else {
-+		orig_decl = fndecl;
-+		orig_argnum = argnum;
-+	}
++	def_stmt = get_def_stmt(arg);
++	if (gimple_has_location(def_stmt))
++		xloc = expand_location(gimple_location(def_stmt));
++	else if (gimple_has_location(stmt))
++		xloc = expand_location(gimple_location(stmt));
++	else
++		xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
 +
-+	if (orig_argnum == CANNOT_FIND_ARG)
-+		return NULL;
++	loc_line = build_int_cstu(unsigned_type_node, xloc.line);
 +
-+	decl_name = get_orig_decl_name(orig_decl);
-+	hash = get_decl_hash(orig_decl, decl_name);
-+	if (hash == NO_HASH)
-+		return NULL;
++	loc_file = build_string(strlen(xloc.file) + 1, xloc.file);
++	loc_file = create_string_param(loc_file);
 +
-+	context = get_decl_context(orig_decl);
-+	if (!context)
-+		return NULL;
++	current_func = build_string(DECL_NAME_LENGTH(current_function_decl) + 1, DECL_NAME_POINTER(current_function_decl));
++	current_func = create_string_param(current_func);
 +
-+	if (hash_table == SIZE_OVERFLOW)
-+		return get_size_overflow_hash_entry(hash, decl_name, context, orig_argnum);
-+	return get_disable_size_overflow_hash_entry(hash, decl_name, context, orig_argnum);
++	gcc_assert(DECL_NAME(SSA_NAME_VAR(arg)) != NULL);
++	call_count++;
++	len = asprintf(&ssa_name_buf, "%s_%u %s, count: %u, decl: %s; num: %u; context: %s;\n", DECL_NAME_POINTER(SSA_NAME_VAR(arg)), SSA_NAME_VERSION(arg), min ? "min" : "max", call_count, expand_from->next_node->decl_name, expand_from->next_node->num, expand_from->next_node->context);
++	gcc_assert(len > 0);
++	ssa_name = build_string(len + 1, ssa_name_buf);
++	free(ssa_name_buf);
++	ssa_name = create_string_param(ssa_name);
++
++	// void report_size_overflow(const char *file, unsigned int line, const char *func, const char *ssa_name)
++	func_stmt = as_a_gcall(gimple_build_call(report_size_overflow_decl, 4, loc_file, loc_line, current_func, ssa_name));
++	gsi_insert_after(&gsi, func_stmt, GSI_CONTINUE_LINKING);
++
++	report_node = cgraph_get_create_node(report_size_overflow_decl);
++	gcc_assert(report_node);
++	frequency = compute_call_stmt_bb_frequency(current_function_decl, bb_true);
++
++	edge = cgraph_create_edge(get_cnode(current_function_decl), report_node, func_stmt, bb_true->count, frequency, bb_true->loop_depth);
++	gcc_assert(edge != NULL);
 +}
 +
-+unsigned int find_arg_number_tree(const_tree arg, const_tree func)
++static void insert_check_size_overflow(interesting_stmts_t expand_from, gimple stmt, enum tree_code cond_code, tree arg, tree type_value, bool before, bool min)
 +{
-+	tree var;
-+	unsigned int argnum = 1;
++	basic_block cond_bb, join_bb, bb_true;
++	edge e;
++	gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
 +
-+	if (DECL_ARGUMENTS(func) == NULL_TREE)
-+		return CANNOT_FIND_ARG;
++	cond_bb = gimple_bb(stmt);
++	if (before)
++		gsi_prev(&gsi);
++	if (gsi_end_p(gsi))
++		e = split_block_after_labels(cond_bb);
++	else
++		e = split_block(cond_bb, gsi_stmt(gsi));
++	cond_bb = e->src;
++	join_bb = e->dest;
++	e->flags = EDGE_FALSE_VALUE;
++	e->probability = REG_BR_PROB_BASE;
 +
-+	if (TREE_CODE(arg) == SSA_NAME)
-+		arg = SSA_NAME_VAR(arg);
++	bb_true = create_empty_bb(cond_bb);
++	make_edge(cond_bb, bb_true, EDGE_TRUE_VALUE);
++	make_edge(cond_bb, join_bb, EDGE_FALSE_VALUE);
++	make_edge(bb_true, join_bb, EDGE_FALLTHRU);
 +
-+	for (var = DECL_ARGUMENTS(func); var; var = TREE_CHAIN(var), argnum++) {
-+		if (!operand_equal_p(arg, var, 0) && strcmp(DECL_NAME_POINTER(var), DECL_NAME_POINTER(arg)))
-+			continue;
-+		if (!skip_types(var))
-+			return argnum;
++	gcc_assert(dom_info_available_p(CDI_DOMINATORS));
++	set_immediate_dominator(CDI_DOMINATORS, bb_true, cond_bb);
++	set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
++
++	if (current_loops != NULL) {
++		gcc_assert(cond_bb->loop_father == join_bb->loop_father);
++		add_bb_to_loop(bb_true, cond_bb->loop_father);
 +	}
 +
-+	return CANNOT_FIND_ARG;
-+}
++	insert_cond(cond_bb, arg, cond_code, type_value);
++	insert_cond_result(expand_from, bb_true, stmt, arg, min);
 +
-+const_tree get_attribute(const char* attr_name, const_tree decl)
-+{
-+	const_tree attr = lookup_attribute(attr_name, DECL_ATTRIBUTES(decl));
-+	if (attr && TREE_VALUE(attr))
-+		return attr;
-+	return NULL_TREE;
++//	print_the_code_insertions(stmt);
 +}
 +
-+/* Check if the function has a size_overflow attribute or it is in the size_overflow hash table.
-+ * If the function is missing everywhere then print the missing message into stderr.
-+ */
-+void print_missing_function(next_interesting_function_t node)
++void check_size_overflow(interesting_stmts_t expand_from, gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, bool before)
 +{
-+	unsigned int argnum, hash;
-+	const struct size_overflow_hash *entry;
-+	const char *decl_name;
++	const_tree rhs_type = TREE_TYPE(rhs);
++	tree cast_rhs_type, type_max_type, type_min_type, type_max, type_min;
 +
-+	if (node->marked == ASM_STMT_SO_MARK)
++	if (pointer_set_contains(expand_from->visited->no_cast_check, stmt))
 +		return;
 +
-+	if (node->orig_next_node) {
-+		hash = node->orig_next_node->hash;
-+		decl_name = node->orig_next_node->decl_name;
-+		argnum = node->orig_next_node->num;
-+		gcc_assert(!strcmp(node->context, node->orig_next_node->context));
-+	} else {
-+		hash = node->hash;
-+		decl_name = node->decl_name;
-+		argnum = node->num;
-+	}
++	gcc_assert(rhs_type != NULL_TREE);
++	if (TREE_CODE(rhs_type) == POINTER_TYPE)
++		return;
 +
-+	entry = get_size_overflow_hash_entry(hash, decl_name, node->context, argnum);
-+	if (entry)
++	gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE);
++
++	if (is_gimple_assign(stmt) && neg_short_add_intentional_overflow(as_a_gassign(stmt)))
 +		return;
 +
-+	// inform() would be too slow
-+	fprintf(stderr, "Function %s is missing from the size_overflow hash table +%s+%s+%u+%u+\n", decl_name, decl_name, node->context, argnum, hash);
-+}
++	type_max = cast_a_tree(size_overflow_type, TYPE_MAX_VALUE(rhs_type));
++	// typemax (-1) < typemin (0)
++	if (TREE_OVERFLOW(type_max))
++		return;
 +
-diff --git a/tools/gcc/size_overflow_plugin/size_overflow_transform.c b/tools/gcc/size_overflow_plugin/size_overflow_transform.c
-new file mode 100644
-index 0000000..eebcf4c
---- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/size_overflow_transform.c
-@@ -0,0 +1,743 @@
-+/*
-+ * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
-+ * Licensed under the GPL v2, or (at your option) v3
-+ *
-+ * Homepage:
-+ * https://github.com/ephox-gcc-plugins/size_overflow
-+ *
-+ * Documentation:
-+ * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
-+ *
-+ * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
-+ * with double integer precision (DImode/TImode for 32/64 bit integer types).
-+ * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
-+ *
-+ * Usage:
-+ * $ make
-+ * $ make run
-+ */
++	type_min = cast_a_tree(size_overflow_type, TYPE_MIN_VALUE(rhs_type));
 +
-+#include "size_overflow.h"
++	cast_rhs_type = TREE_TYPE(cast_rhs);
++	type_max_type = TREE_TYPE(type_max);
++	gcc_assert(types_compatible_p(cast_rhs_type, type_max_type));
 +
-+static tree cast_to_orig_type(struct visited *visited, gimple stmt, const_tree orig_node, tree new_node)
++	insert_check_size_overflow(expand_from, stmt, GT_EXPR, cast_rhs, type_max, before, MAX_CHECK);
++
++	// special case: get_size_overflow_type(), 32, u64->s
++	if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode) && TYPE_UNSIGNED(size_overflow_type) && !TYPE_UNSIGNED(rhs_type))
++		return;
++
++	type_min_type = TREE_TYPE(type_min);
++	gcc_assert(types_compatible_p(type_max_type, type_min_type));
++	insert_check_size_overflow(expand_from, stmt, LT_EXPR, cast_rhs, type_min, before, MIN_CHECK);
++}
++
++static tree get_my_stmt_lhs(struct visited *visited, gimple stmt)
 +{
-+	gimple def_stmt;
-+	const_gimple assign;
-+	tree result, orig_type = TREE_TYPE(orig_node);
 +	gimple_stmt_iterator gsi;
++	gimple next_stmt = NULL;
 +
-+	if (gimple_code(stmt) != GIMPLE_PHI) {
-+		gsi = gsi_for_stmt(stmt);
-+		assign = build_cast_stmt(visited, orig_type, new_node, CREATE_NEW_VAR, &gsi, BEFORE_STMT, false);
-+		return get_lhs(assign);
-+	}
++	gsi = gsi_for_stmt(stmt);
 +
-+	def_stmt = get_def_stmt(new_node);
-+	if (gimple_code(def_stmt) == GIMPLE_PHI)
-+		gsi = gsi_after_labels(gimple_bb(def_stmt));
-+	else
-+		gsi = gsi_for_stmt(def_stmt);
++	do {
++		gsi_next(&gsi);
++		next_stmt = gsi_stmt(gsi);
 +
-+	result = gimple_phi_result(stmt);
-+	assign = build_cast_stmt(visited, orig_type, new_node, SSA_NAME_VAR(result), &gsi, AFTER_STMT, false);
-+	return get_lhs(assign);
-+}
++		if (gimple_code(stmt) == GIMPLE_PHI && !pointer_set_contains(visited->my_stmts, next_stmt))
++			return NULL_TREE;
 +
-+static void change_size_overflow_asm_input(gasm *stmt, tree new_input)
-+{
-+	tree list;
++		if (pointer_set_contains(visited->my_stmts, next_stmt) && !pointer_set_contains(visited->skip_expr_casts, next_stmt))
++			break;
 +
-+	gcc_assert(is_size_overflow_insert_check_asm(stmt));
++		gcc_assert(pointer_set_contains(visited->my_stmts, next_stmt));
++	} while (!gsi_end_p(gsi));
 +
-+	list = build_tree_list(NULL_TREE, build_string(3, "rm"));
-+	list = chainon(NULL_TREE, build_tree_list(list, new_input));
-+	gimple_asm_set_input_op(stmt, 0, list);
++	gcc_assert(next_stmt);
++	return get_lhs(next_stmt);
 +}
 +
-+static void change_field_write_rhs(gassign *assign, const_tree orig_rhs, tree new_rhs)
++/* When the result of the negation is cast to a signed type then move
++ * the size_overflow cast check before negation.
++ * ssa:
++ * unsigned _588
++ * _588 = _587 >> 12;
++ * _589 = -_588;
++ * _590 = (long int) _589;
++ */
++static bool handle_unsigned_neg_or_bit_not(interesting_stmts_t expand_from, const gassign *stmt)
 +{
-+	const_tree rhs1, rhs2, rhs3 = NULL_TREE;
++	gimple def_neg_stmt, neg_stmt;
++	tree lhs, new_neg_rhs;
++	const_tree rhs, neg_rhs;
++	enum tree_code rhs_code;
 +
-+	rhs1 = gimple_assign_rhs1(assign);
-+	if (rhs1 == orig_rhs) {
-+		gimple_assign_set_rhs1(assign, new_rhs);
-+		return;
-+	}
++	rhs = gimple_assign_rhs1(stmt);
++	lhs = gimple_assign_lhs(stmt);
++	if (TYPE_UNSIGNED(TREE_TYPE(lhs)) || !TYPE_UNSIGNED(TREE_TYPE(rhs)))
++		return false;
 +
-+	rhs2 = gimple_assign_rhs2(assign);
-+	if (rhs2 == orig_rhs) {
-+		gimple_assign_set_rhs2(assign, new_rhs);
-+		return;
-+	}
++	neg_stmt = get_def_stmt(rhs);
++	if (!neg_stmt || !is_gimple_assign(neg_stmt))
++		return false;
 +
-+#if BUILDING_GCC_VERSION >= 4006
-+	rhs3 = gimple_assign_rhs3(assign);
-+	if (rhs3 == orig_rhs) {
-+		gimple_assign_set_rhs3(assign, new_rhs);
-+		return;
-+	}
-+#endif
++	rhs_code = gimple_assign_rhs_code(neg_stmt);
++	if (rhs_code != BIT_NOT_EXPR && rhs_code != NEGATE_EXPR)
++		return false;
 +
-+	debug_gimple_stmt(assign);
-+	fprintf(stderr, "orig_rhs:\n");
-+	debug_tree(orig_rhs);
-+	fprintf(stderr, "rhs1:\n");
-+	debug_tree(rhs1);
-+	fprintf(stderr, "rhs2:\n");
-+	debug_tree(rhs2);
-+	fprintf(stderr, "rhs3:\n");
-+	debug_tree(rhs3);
-+	gcc_unreachable();
++	neg_rhs = gimple_assign_rhs1(neg_stmt);
++	def_neg_stmt = get_def_stmt(neg_rhs);
++	if (!def_neg_stmt)
++		return false;
++
++	new_neg_rhs = get_my_stmt_lhs(expand_from->visited, def_neg_stmt);
++	check_size_overflow(expand_from, neg_stmt, TREE_TYPE(new_neg_rhs), new_neg_rhs, lhs, BEFORE_STMT);
++	pointer_set_insert(expand_from->visited->no_cast_check, stmt);
++	return true;
 +}
 +
-+static void change_phi_arg(gphi *phi, tree new_node, unsigned int num)
++static tree create_cast_overflow_check(interesting_stmts_t expand_from, tree new_rhs1, gassign *stmt)
 +{
-+	unsigned int i;
-+	location_t loc = gimple_location(phi);
++	bool cast_lhs, cast_rhs;
++	tree lhs = gimple_assign_lhs(stmt);
++	tree rhs = gimple_assign_rhs1(stmt);
++	const_tree lhs_type = TREE_TYPE(lhs);
++	const_tree rhs_type = TREE_TYPE(rhs);
++	enum machine_mode lhs_mode = TYPE_MODE(lhs_type);
++	enum machine_mode rhs_mode = TYPE_MODE(rhs_type);
++	unsigned int lhs_size = GET_MODE_BITSIZE(lhs_mode);
++	unsigned int rhs_size = GET_MODE_BITSIZE(rhs_mode);
 +
-+	for (i = 0; i < gimple_phi_num_args(phi); i++) {
-+		if (i == num)
-+			add_phi_arg(phi, new_node, gimple_phi_arg_edge(phi, i), loc);
++	static bool check_lhs[3][4] = {
++		// ss    su     us     uu
++		{ false, true,  true,  false }, // lhs > rhs
++		{ false, false, false, false }, // lhs = rhs
++		{ true,  true,  true,  true  }, // lhs < rhs
++	};
++
++	static bool check_rhs[3][4] = {
++		// ss    su     us     uu
++		{ true,  false, true,  true  }, // lhs > rhs
++		{ true,  false, true,  true  }, // lhs = rhs
++		{ true,  false, true,  true  }, // lhs < rhs
++	};
++
++	if (handle_unsigned_neg_or_bit_not(expand_from, stmt))
++		return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++
++	// skip lhs check on HI -> QI cast
++	if (rhs_mode == HImode && lhs_mode == QImode) {
++		pointer_set_insert(expand_from->visited->no_cast_check, stmt);
++		return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
 +	}
-+}
 +
-+static void change_orig_node(struct visited *visited, gimple stmt, const_tree orig_node, tree new_node, unsigned int num)
-+{
-+	tree cast_lhs = cast_to_orig_type(visited, stmt, orig_node, new_node);
++	// skip lhs check on signed SI -> HI cast or signed SI -> QI cast
++	if (rhs_mode == SImode && !TYPE_UNSIGNED(rhs_type) && (lhs_mode == HImode || lhs_mode == QImode))
++		return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
 +
-+	switch (gimple_code(stmt)) {
-+	case GIMPLE_RETURN:
-+		gimple_return_set_retval(as_a_greturn(stmt), cast_lhs);
-+		break;
-+	case GIMPLE_CALL:
-+		gimple_call_set_arg(as_a_gcall(stmt), num - 1, cast_lhs);
-+		break;
-+	case GIMPLE_ASM:
-+		change_size_overflow_asm_input(as_a_gasm(stmt), cast_lhs);
-+		break;
-+	case GIMPLE_ASSIGN:
-+		change_field_write_rhs(as_a_gassign(stmt), orig_node, cast_lhs);
-+		break;
-+	case GIMPLE_PHI:
-+		change_phi_arg(as_a_gphi(stmt), cast_lhs, num);
-+		break;
-+	default:
-+		debug_gimple_stmt(stmt);
-+		gcc_unreachable();
++	if (lhs_size > rhs_size) {
++		cast_lhs = check_lhs[0][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
++		cast_rhs = check_rhs[0][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
++	} else if (lhs_size == rhs_size) {
++		cast_lhs = check_lhs[1][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
++		cast_rhs = check_rhs[1][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
++	} else {
++		cast_lhs = check_lhs[2][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
++		cast_rhs = check_rhs[2][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
 +	}
 +
-+	update_stmt(stmt);
-+}
++	if (!cast_lhs && !cast_rhs)
++		return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
 +
-+// e.g., 3.8.2, 64, arch/x86/ia32/ia32_signal.c copy_siginfo_from_user32(): compat_ptr() u32 max
-+static bool skip_asm_cast(const_tree arg)
-+{
-+	gimple def_stmt = get_def_stmt(arg);
++	if (cast_lhs && !skip_lhs_cast_check(expand_from->visited, stmt))
++		check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs1), new_rhs1, lhs, BEFORE_STMT);
 +
-+	if (!def_stmt || !gimple_assign_cast_p(def_stmt))
-+		return false;
++	if (cast_rhs)
++		check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs1), new_rhs1, rhs, BEFORE_STMT);
 +
-+	def_stmt = get_def_stmt(gimple_assign_rhs1(def_stmt));
-+	if (is_size_overflow_asm(def_stmt))
-+		return false;
-+	return def_stmt && gimple_code(def_stmt) == GIMPLE_ASM;
++	return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
 +}
 +
-+static interesting_stmts_t create_interesting_stmts(interesting_stmts_t head, next_interesting_function_t next_node, tree orig_node, gimple first_stmt, unsigned int num)
++static tree handle_unary_rhs(interesting_stmts_t expand_from, gassign *stmt)
 +{
-+	interesting_stmts_t new_node;
++	enum tree_code rhs_code;
++	tree rhs1, new_rhs1, lhs = gimple_assign_lhs(stmt);
 +
-+	new_node = (interesting_stmts_t )xmalloc(sizeof(*new_node));
-+	new_node->first_stmt = first_stmt;
-+	new_node->num = num;
-+	new_node->orig_node = orig_node;
-+	new_node->next = head;
-+	new_node->next_node = next_node;
-+	return new_node;
-+}
++	if (pointer_set_contains(expand_from->visited->my_stmts, stmt))
++		return lhs;
 +
-+static void free_interesting_stmts(interesting_stmts_t head)
-+{
-+	while (head) {
-+		interesting_stmts_t cur = head->next;
-+		free(head);
-+		head = cur;
-+	}
-+}
++	rhs1 = gimple_assign_rhs1(stmt);
++	if (TREE_CODE(TREE_TYPE(rhs1)) == POINTER_TYPE)
++		return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
 +
-+/* This function calls the main recursion function (expand) that duplicates the stmts. Before that it checks the intentional_overflow attribute,
-+ * it decides whether the duplication is necessary or not. After expand() it changes the orig node to the duplicated node
-+ * in the original stmt (first stmt) and it inserts the overflow check for the arg of the callee or for the return value.
-+ */
-+static interesting_stmts_t search_interesting_stmt(interesting_stmts_t head, next_interesting_function_t next_node, gimple first_stmt, tree orig_node, unsigned int num)
-+{
-+	enum tree_code orig_code;
++	new_rhs1 = expand(expand_from, rhs1);
 +
-+	gcc_assert(orig_node != NULL_TREE);
++	if (new_rhs1 == NULL_TREE)
++		return create_cast_assign(expand_from->visited, stmt);
 +
-+	if (is_gimple_constant(orig_node))
-+		return head;
++	if (pointer_set_contains(expand_from->visited->no_cast_check, stmt))
++		return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
 +
-+	orig_code = TREE_CODE(orig_node);
-+	gcc_assert(orig_code != FIELD_DECL && orig_code != FUNCTION_DECL);
++#if BUILDING_GCC_VERSION >= 5000
++	if (short_or_neg_const_ushort(stmt)) {
++		pointer_set_insert(expand_from->visited->no_cast_check, stmt);
++		return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++	}
++#endif
 +
-+	if (skip_types(orig_node))
-+		return head;
++	rhs_code = gimple_assign_rhs_code(stmt);
++	if (rhs_code == BIT_NOT_EXPR || rhs_code == NEGATE_EXPR) {
++		tree size_overflow_type = get_size_overflow_type(expand_from->visited, stmt, rhs1);
 +
-+	// find a defining marked caller argument or struct field for arg
-+	if (check_intentional_size_overflow_asm_and_attribute(orig_node) != MARK_NO)
-+		return head;
++		new_rhs1 = cast_to_new_size_overflow_type(expand_from->visited, stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
++		check_size_overflow(expand_from, stmt, size_overflow_type, new_rhs1, rhs1, BEFORE_STMT);
++		return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
++	}
 +
-+	if (skip_asm_cast(orig_node))
-+		return head;
++	if (!gimple_assign_cast_p(stmt))
++		return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
 +
-+	return create_interesting_stmts(head, next_node, orig_node, first_stmt, num);
++	return create_cast_overflow_check(expand_from, new_rhs1, stmt);
 +}
 +
-+static bool is_signed_error_code_const(const_tree node)
++static tree handle_unary_ops(interesting_stmts_t expand_from, gassign *stmt)
 +{
-+	HOST_WIDE_INT constant = tree_to_shwi(node);
++	tree rhs1, lhs = gimple_assign_lhs(stmt);
++	gimple def_stmt = get_def_stmt(lhs);
 +
-+	return constant >= -4095 && constant <= -1;
++	gcc_assert(gimple_code(def_stmt) != GIMPLE_NOP);
++	rhs1 = gimple_assign_rhs1(def_stmt);
++
++	if (is_gimple_constant(rhs1))
++		return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
++
++	switch (TREE_CODE(rhs1)) {
++	case SSA_NAME: {
++		tree ret = handle_unary_rhs(expand_from, as_a_gassign(def_stmt));
++
++		if (gimple_assign_cast_p(stmt))
++			unsigned_signed_cast_intentional_overflow(expand_from->visited, stmt);
++		return ret;
++	}
++	case ARRAY_REF:
++	case BIT_FIELD_REF:
++	case ADDR_EXPR:
++	case COMPONENT_REF:
++	case INDIRECT_REF:
++#if BUILDING_GCC_VERSION >= 4006
++	case MEM_REF:
++#endif
++	case TARGET_MEM_REF:
++	case VIEW_CONVERT_EXPR:
++		return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
++	case PARM_DECL:
++	case VAR_DECL:
++		return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
++
++	default:
++		debug_gimple_stmt(def_stmt);
++		debug_tree(rhs1);
++		gcc_unreachable();
++	}
 +}
 +
-+static bool is_unsigned_error_code_const(const_tree node)
++static void __unused print_the_code_insertions(const_gimple stmt)
 +{
-+	unsigned HOST_WIDE_INT constant = tree_to_uhwi(node);
++	location_t loc = gimple_location(stmt);
 +
-+	// ulong -4095
-+	if (constant >= 0xfffffffffffff001)
-+		return true;
-+	// uint -4095
-+	return constant >= 0xfffff001;
++	inform(loc, "Integer size_overflow check applied here.");
 +}
 +
-+static bool is_error_code_const(const_tree node)
++static bool is_from_cast(const_tree node)
 +{
-+	enum machine_mode mode;
++	gimple def_stmt = get_def_stmt(node);
 +
-+	if (!is_gimple_constant(node))
-+		return false;
-+	mode = TYPE_MODE(TREE_TYPE(node));
-+	if (mode != SImode && mode != DImode)
++	if (!def_stmt)
 +		return false;
 +
-+	if (!TYPE_UNSIGNED(TREE_TYPE(node)) && is_signed_error_code_const(node))
++	if (gimple_assign_cast_p(def_stmt))
 +		return true;
-+	return TYPE_UNSIGNED(TREE_TYPE(node)) && is_unsigned_error_code_const(node);
++
++	return false;
 +}
 +
-+static bool has_error_code(gphi *phi)
++// Skip duplication when there is a minus expr and the type of rhs1 or rhs2 is a pointer_type.
++static bool is_ptr_diff(gassign *stmt)
 +{
-+	unsigned int i, len = gimple_phi_num_args(phi);
-+
-+	for (i = 0; i < len; i++) {
-+		const_tree arg = gimple_phi_arg_def(phi, i);
++	const_tree rhs1, rhs2, ptr1_rhs, ptr2_rhs;
 +
-+		if (is_error_code_const(arg))
-+			return true;
-+	}
++	if (gimple_assign_rhs_code(stmt) != MINUS_EXPR)
++		return false;
 +
-+	return false;
-+}
++	rhs1 = gimple_assign_rhs1(stmt);
++	if (!is_from_cast(rhs1))
++		return false;
 +
-+static interesting_stmts_t search_interesting_rets(interesting_stmts_t head, next_interesting_function_t next_node_ret, greturn *ret)
-+{
-+	tree first_node;
++	rhs2 = gimple_assign_rhs2(stmt);
++	if (!is_from_cast(rhs2))
++		return false;
 +
-+	if (!next_node_ret || next_node_ret->marked == ASM_STMT_SO_MARK)
-+		return head;
++	ptr1_rhs = gimple_assign_rhs1(get_def_stmt(rhs1));
++	ptr2_rhs = gimple_assign_rhs1(get_def_stmt(rhs2));
 +
-+	first_node = gimple_return_retval(ret);
-+	if (first_node == NULL_TREE)
-+		return head;
++	if (TREE_CODE(TREE_TYPE(ptr1_rhs)) != POINTER_TYPE && TREE_CODE(TREE_TYPE(ptr2_rhs)) != POINTER_TYPE)
++		return false;
 +
-+	return search_interesting_stmt(head, next_node_ret, ret, first_node, 0);
++	return true;
 +}
 +
-+static void handle_binary_assign(interesting_stmts_t expand_from, gassign *assign, tree rhs)
++static tree handle_comparison_code_class(interesting_stmts_t expand_from, gassign *stmt, tree new_rhs1, tree new_rhs2)
 +{
-+	tree new_node;
-+	gimple def_orig_node;
++	tree rhs1, rhs2, lhs;
 +
-+	new_node = expand(expand_from, rhs);
-+	if (new_node == NULL_TREE)
-+		return;
++	rhs1 = gimple_assign_rhs1(stmt);
++	if (!is_gimple_constant(rhs1) && new_rhs1 != NULL_TREE)
++		check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs1), new_rhs1, rhs1, BEFORE_STMT);
 +
-+	def_orig_node = get_def_stmt(rhs);
-+	if (pointer_set_contains(expand_from->visited->no_cast_check, def_orig_node))
-+		return;
-+	change_orig_node(expand_from->visited, assign, rhs, new_node, 0);
-+	check_size_overflow(expand_from, assign, TREE_TYPE(new_node), new_node, rhs, BEFORE_STMT);
++	lhs = gimple_assign_lhs(stmt);
++	if (new_rhs2 == NULL_TREE)
++		return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
++
++	rhs2 = gimple_assign_rhs2(stmt);
++	if (!is_gimple_constant(rhs2))
++		check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs2), new_rhs2, rhs2, BEFORE_STMT);
++	return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
 +}
 +
-+static bool search_error_codes(gimple_set *visited_error_codes, interesting_stmts_t expand_from, tree lhs, bool error_code)
++static tree handle_binary_ops(interesting_stmts_t expand_from, tree lhs)
 +{
-+	gimple def_stmt;
++	enum intentional_overflow_type res;
++	tree rhs1, rhs2, new_lhs;
++	gassign *def_stmt = as_a_gassign(get_def_stmt(lhs));
++	tree new_rhs1 = NULL_TREE;
++	tree new_rhs2 = NULL_TREE;
 +
-+	def_stmt = get_def_stmt(lhs);
-+	if (!def_stmt || gimple_code(def_stmt) == GIMPLE_NOP)
-+		return error_code;
++	if (is_ptr_diff(def_stmt))
++		return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
 +
-+	if (pointer_set_insert(visited_error_codes, def_stmt))
-+		return error_code;
++	rhs1 = gimple_assign_rhs1(def_stmt);
++	rhs2 = gimple_assign_rhs2(def_stmt);
 +
-+	if (is_gimple_constant(lhs))
-+		return error_code;
-+	if (skip_types(lhs))
-+		return is_error_code_const(lhs);
++	/* no DImode/TImode division in the 32/64 bit kernel */
++	switch (gimple_assign_rhs_code(def_stmt)) {
++	case RDIV_EXPR:
++	case TRUNC_DIV_EXPR:
++	case CEIL_DIV_EXPR:
++	case FLOOR_DIV_EXPR:
++	case ROUND_DIV_EXPR:
++	case TRUNC_MOD_EXPR:
++	case CEIL_MOD_EXPR:
++	case FLOOR_MOD_EXPR:
++	case ROUND_MOD_EXPR:
++	case EXACT_DIV_EXPR:
++	case POINTER_PLUS_EXPR:
++	case BIT_AND_EXPR:
++		return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
++	default:
++		break;
++	}
 +
-+	switch (gimple_code(def_stmt)) {
-+	case GIMPLE_CALL:
-+	case GIMPLE_ASM:
-+		return error_code;
-+	case GIMPLE_ASSIGN: {
-+		tree rhs1, rhs2;
-+		gassign *assign = as_a_gassign(def_stmt);
++	new_lhs = handle_integer_truncation(expand_from, lhs);
++	if (new_lhs != NULL_TREE)
++		return new_lhs;
 +
-+		switch (gimple_num_ops(assign)) {
-+		case 2:
-+			return search_error_codes(visited_error_codes, expand_from, gimple_assign_rhs1(def_stmt), error_code);
-+		case 3:
-+			if (!error_code)
-+				return error_code;
++	if (TREE_CODE(rhs1) == SSA_NAME)
++		new_rhs1 = expand(expand_from, rhs1);
++	if (TREE_CODE(rhs2) == SSA_NAME)
++		new_rhs2 = expand(expand_from, rhs2);
 +
-+			/* Run stmt duplication from the binary assignment ops (rhs1 and rhs2)
-+			 * so that size_overflow checking skips the lhs of the last binary assignment
-+			 * before the error code PHI.
-+			 */
-+			rhs1 = gimple_assign_rhs1(assign);
-+			handle_binary_assign(expand_from, assign, rhs1);
-+			rhs2 = gimple_assign_rhs2(assign);
-+			handle_binary_assign(expand_from, assign, rhs2);
-+			return error_code;
-+		}
-+		gcc_unreachable();
++	res = add_mul_intentional_overflow(def_stmt);
++	if (res != NO_INTENTIONAL_OVERFLOW) {
++		new_lhs = dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
++		insert_cast_expr(expand_from->visited, as_a_gassign(get_def_stmt(new_lhs)), res);
++		return new_lhs;
 +	}
-+	case GIMPLE_PHI: {
-+		unsigned int i;
 +
-+		error_code = has_error_code(as_a_gphi(def_stmt));
-+		for (i = 0; i < gimple_phi_num_args(def_stmt); i++) {
-+			error_code = search_error_codes(visited_error_codes, expand_from, gimple_phi_arg_def(def_stmt, i), error_code);
-+		}
-+		return error_code;
-+	}
-+	default:
-+		debug_gimple_stmt(def_stmt);
-+		error("%s: unknown gimple code", __func__);
-+		gcc_unreachable();
++	if (skip_expr_on_double_type(def_stmt)) {
++		new_lhs = dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
++		insert_cast_expr(expand_from->visited, as_a_gassign(get_def_stmt(new_lhs)), NO_INTENTIONAL_OVERFLOW);
++		return new_lhs;
 +	}
-+}
 +
-+static bool handle_error_codes(interesting_stmts_t expand_from)
-+{
-+	bool error_code;
-+	gimple_set *visited_error_codes;
++	if (is_a_neg_overflow(def_stmt, rhs2))
++		return handle_intentional_overflow(expand_from, true, def_stmt, new_rhs1, NULL_TREE);
++	if (is_a_neg_overflow(def_stmt, rhs1))
++		return handle_intentional_overflow(expand_from, true, def_stmt, new_rhs2, new_rhs2);
 +
-+	// expand the data flow from a return stmt
-+	if (expand_from->next_node->num != 0 || strcmp(expand_from->next_node->context, "fndecl"))
-+		return false;
 +
-+	visited_error_codes = pointer_set_create();
-+	error_code = search_error_codes(visited_error_codes, expand_from, expand_from->orig_node, false);
-+	pointer_set_destroy(visited_error_codes);
++	if (is_a_constant_overflow(def_stmt, rhs2))
++		return handle_intentional_overflow(expand_from, !is_a_cast_and_const_overflow(rhs1), def_stmt, new_rhs1, NULL_TREE);
++	if (is_a_constant_overflow(def_stmt, rhs1))
++		return handle_intentional_overflow(expand_from, !is_a_cast_and_const_overflow(rhs2), def_stmt, new_rhs2, new_rhs2);
 +
-+	return error_code;
++	// the const is between 0 and (signed) MAX
++	if (is_gimple_constant(rhs1))
++		new_rhs1 = create_assign(expand_from->visited, def_stmt, rhs1, BEFORE_STMT);
++	if (is_gimple_constant(rhs2))
++		new_rhs2 = create_assign(expand_from->visited, def_stmt, rhs2, BEFORE_STMT);
++
++	if (TREE_CODE_CLASS(gimple_assign_rhs_code(def_stmt)) == tcc_comparison)
++		return handle_comparison_code_class(expand_from, def_stmt, new_rhs1, new_rhs2);
++
++	if (uconst_neg_intentional_overflow(def_stmt)) {
++		inform(gimple_location(def_stmt), "%s: gcc intentional overflow", __func__);
++		gcc_unreachable();
++	}
++
++	return dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
 +}
 +
-+static void handle_interesting_stmt(struct visited *visited, interesting_stmts_t head)
++#if BUILDING_GCC_VERSION >= 4006
++static tree get_new_rhs(interesting_stmts_t expand_from, tree size_overflow_type, tree rhs)
 +{
-+	interesting_stmts_t cur;
++	if (is_gimple_constant(rhs))
++		return cast_a_tree(size_overflow_type, rhs);
++	if (TREE_CODE(rhs) != SSA_NAME)
++		return NULL_TREE;
++	return expand(expand_from, rhs);
++}
 +
-+	for (cur = head; cur; cur = cur->next) {
-+		tree new_node;
-+		gimple orig_def_stmt;
++static tree handle_ternary_ops(interesting_stmts_t expand_from, tree lhs)
++{
++	tree rhs1, rhs2, rhs3, new_rhs1, new_rhs2, new_rhs3, size_overflow_type;
++	gassign *def_stmt = as_a_gassign(get_def_stmt(lhs));
 +
-+		cur->visited = visited;
-+		if (handle_error_codes(cur))
-+			continue;
++	size_overflow_type = get_size_overflow_type(expand_from->visited, def_stmt, lhs);
 +
-+		new_node = expand(cur, cur->orig_node);
-+		if (new_node == NULL_TREE)
-+			continue;
++	rhs1 = gimple_assign_rhs1(def_stmt);
++	rhs2 = gimple_assign_rhs2(def_stmt);
++	rhs3 = gimple_assign_rhs3(def_stmt);
++	new_rhs1 = get_new_rhs(expand_from, size_overflow_type, rhs1);
++	new_rhs2 = get_new_rhs(expand_from, size_overflow_type, rhs2);
++	new_rhs3 = get_new_rhs(expand_from, size_overflow_type, rhs3);
 +
-+		orig_def_stmt = get_def_stmt(cur->orig_node);
-+		if (pointer_set_contains(visited->no_cast_check, orig_def_stmt))
-+			continue;
-+		change_orig_node(visited, cur->first_stmt, cur->orig_node, new_node, cur->num);
-+		check_size_overflow(cur, cur->first_stmt, TREE_TYPE(new_node), new_node, cur->orig_node, BEFORE_STMT);
-+	}
++	return dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, new_rhs3);
 +}
++#endif
 +
-+static next_interesting_function_t get_interesting_function_next_node(tree decl, unsigned int num)
++static tree expand_visited(struct visited *visited, gimple def_stmt)
 +{
-+	next_interesting_function_t next_node;
-+	const struct size_overflow_hash *so_hash;
-+	struct fn_raw_data raw_data;
++	gimple_stmt_iterator gsi;
++	enum gimple_code code = gimple_code(def_stmt);
 +
-+	raw_data.decl = decl;
-+	raw_data.decl_str = DECL_NAME_POINTER(decl);
-+	raw_data.num = num;
-+	raw_data.marked = YES_SO_MARK;
++	if (code == GIMPLE_ASM)
++		return NULL_TREE;
 +
-+	next_node = get_global_next_interesting_function_entry_with_hash(&raw_data);
-+	if (next_node && next_node->marked != NO_SO_MARK)
-+		return next_node;
++	gsi = gsi_for_stmt(def_stmt);
++	gsi_next(&gsi);
 +
-+	so_hash = get_size_overflow_hash_entry_tree(raw_data.decl, raw_data.num, SIZE_OVERFLOW);
-+	if (so_hash)
-+		return get_and_create_next_node_from_global_next_nodes(&raw_data, NULL);
-+	return NULL;
++	if (gimple_code(def_stmt) == GIMPLE_PHI && gsi_end_p(gsi))
++		return NULL_TREE;
++	return get_my_stmt_lhs(visited, def_stmt);
 +}
 +
-+tree handle_fnptr_assign(const_gimple stmt)
++tree expand(interesting_stmts_t expand_from, tree lhs)
 +{
-+	tree field, rhs, op0;
-+	const_tree op0_type;
-+	enum tree_code rhs_code;
++	gimple def_stmt;
 +
-+	// TODO skip binary assignments for now (fs/sync.c _591 = __bpf_call_base + _590;)
-+	if (gimple_num_ops(stmt) != 2)
-+		return NULL_TREE;
++	def_stmt = get_def_stmt(lhs);
 +
-+	gcc_assert(gimple_num_ops(stmt) == 2);
-+	// TODO skip asm_stmt for now
-+	if (gimple_code(stmt) == GIMPLE_ASM)
-+		return NULL_TREE;
-+	rhs = gimple_assign_rhs1(stmt);
-+	if (is_gimple_constant(rhs))
++	if (!def_stmt || gimple_code(def_stmt) == GIMPLE_NOP)
 +		return NULL_TREE;
 +
-+	rhs_code = TREE_CODE(rhs);
-+	if (rhs_code == VAR_DECL)
-+		return rhs;
++	if (pointer_set_contains(expand_from->visited->my_stmts, def_stmt))
++		return lhs;
 +
-+	switch (rhs_code) {
-+	case ADDR_EXPR:
-+		op0 = TREE_OPERAND(rhs, 0);
-+		gcc_assert(TREE_CODE(op0) == FUNCTION_DECL);
-+		return op0;
-+	case COMPONENT_REF:
-+		break;
-+	// TODO skip array_ref for now
-+	case ARRAY_REF:
-+		return NULL_TREE;
-+	// TODO skip ssa_name because it can lead to parm_decl
-+	case SSA_NAME:
++	if (pointer_set_contains(expand_from->visited->stmts, def_stmt))
++		return expand_visited(expand_from->visited, def_stmt);
++
++	if (is_gimple_constant(lhs))
 +		return NULL_TREE;
-+	// TODO skip mem_ref and indirect_ref for now
-+#if BUILDING_GCC_VERSION >= 4006
-+	case MEM_REF:
-+#endif
-+	case INDIRECT_REF:
++	if (skip_types(lhs))
 +		return NULL_TREE;
-+	default:
-+		debug_tree(rhs);
-+		debug_gimple_stmt((gimple)stmt);
-+		gcc_unreachable();
-+	}
 +
-+	op0 = TREE_OPERAND(rhs, 0);
-+	switch (TREE_CODE(op0)) {
-+	// TODO skip array_ref and parm_decl for now
-+	case ARRAY_REF:
-+	case PARM_DECL:
-+		return NULL_TREE;
-+	case COMPONENT_REF:
++	switch (gimple_code(def_stmt)) {
++	case GIMPLE_PHI:
++		return handle_phi(expand_from, lhs);
++	case GIMPLE_CALL:
++	case GIMPLE_ASM:
++		if (is_size_overflow_asm(def_stmt))
++			return expand(expand_from, get_size_overflow_asm_input(as_a_gasm(def_stmt)));
++		return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
++	case GIMPLE_ASSIGN:
++		switch (gimple_num_ops(def_stmt)) {
++		case 2:
++			return handle_unary_ops(expand_from, as_a_gassign(def_stmt));
++		case 3:
++			return handle_binary_ops(expand_from, lhs);
 +#if BUILDING_GCC_VERSION >= 4006
-+	case MEM_REF:
++		case 4:
++			return handle_ternary_ops(expand_from, lhs);
 +#endif
-+	case INDIRECT_REF:
-+	case VAR_DECL:
-+		break;
++		}
 +	default:
-+		debug_tree(op0);
++		debug_gimple_stmt(def_stmt);
++		error("%s: unknown gimple code", __func__);
 +		gcc_unreachable();
 +	}
-+
-+	op0_type = TREE_TYPE(op0);
-+	// TODO skip unions for now
-+	if (TREE_CODE(op0_type) == UNION_TYPE)
-+		return NULL_TREE;
-+	gcc_assert(TREE_CODE(op0_type) == RECORD_TYPE);
-+
-+	field = TREE_OPERAND(rhs, 1);
-+	gcc_assert(TREE_CODE(field) == FIELD_DECL);
-+	return field;
 +}
+diff --git a/scripts/gcc-plugins/stackleak_plugin.c b/scripts/gcc-plugins/stackleak_plugin.c
+new file mode 100644
+index 0000000..8b69bd4
+--- /dev/null
++++ b/scripts/gcc-plugins/stackleak_plugin.c
+@@ -0,0 +1,350 @@
++/*
++ * Copyright 2011-2016 by the PaX Team <pageexec@××××××××.hu>
++ * Licensed under the GPL v2
++ *
++ * Note: the choice of the license means that the compilation process is
++ *       NOT 'eligible' as defined by gcc's library exception to the GPL v3,
++ *       but for the kernel it doesn't matter since it doesn't link against
++ *       any of the gcc libraries
++ *
++ * gcc plugin to help implement various PaX features
++ *
++ * - track lowest stack pointer
++ *
++ * TODO:
++ * - initialize all local variables
++ *
++ * BUGS:
++ * - none known
++ */
 +
-+static tree get_fn_or_fnptr_decl(const gcall *call_stmt)
-+{
-+	const_tree fnptr;
-+	const_gimple def_stmt;
-+	tree decl = gimple_call_fndecl(call_stmt);
++#include "gcc-common.h"
 +
-+	if (decl != NULL_TREE)
-+		return decl;
++int plugin_is_GPL_compatible;
 +
-+	fnptr = gimple_call_fn(call_stmt);
-+	if (fnptr == NULL_TREE)
-+		return NULL_TREE;
++static int track_frame_size = -1;
++static const char track_function[] = "pax_track_stack";
++static const char check_function[] = "pax_check_alloca";
++static GTY(()) tree track_function_decl;
++static GTY(()) tree check_function_decl;
++static bool init_locals;
 +
-+	// !!! assertot kell irni 0-ra, mert csak az lehet ott
-+	if (is_gimple_constant(fnptr))
-+		return NULL_TREE;
-+	def_stmt = get_fnptr_def_stmt(fnptr);
-+	return handle_fnptr_assign(def_stmt);
-+}
++static struct plugin_info stackleak_plugin_info = {
++	.version	= "201602181345",
++	.help		= "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
++//			  "initialize-locals\t\tforcibly initialize all stack frames\n"
++};
 +
-+// Start stmt duplication on marked function parameters
-+static interesting_stmts_t search_interesting_calls(interesting_stmts_t head, gcall *call_stmt)
++static void stackleak_check_alloca(gimple_stmt_iterator *gsi)
 +{
-+	tree decl;
-+	unsigned int i, len;
-+
-+	len = gimple_call_num_args(call_stmt);
-+	if (len == 0)
-+		return head;
-+
-+	decl = get_fn_or_fnptr_decl(call_stmt);
-+	if (decl == NULL_TREE)
-+		return head;
-+
-+	for (i = 0; i < len; i++) {
-+		tree arg;
-+		next_interesting_function_t next_node;
++	gimple stmt;
++	gcall *check_alloca;
++	tree alloca_size;
++	cgraph_node_ptr node;
++	int frequency;
++	basic_block bb;
 +
-+		arg = gimple_call_arg(call_stmt, i);
-+		if (is_gimple_constant(arg))
-+			continue;
-+		if (skip_types(arg))
-+			continue;
-+		next_node = get_interesting_function_next_node(decl, i + 1);
-+		if (next_node)
-+			head = search_interesting_stmt(head, next_node, call_stmt, arg, i + 1);
-+	}
++	// insert call to void pax_check_alloca(unsigned long size)
++	alloca_size = gimple_call_arg(gsi_stmt(*gsi), 0);
++	stmt = gimple_build_call(check_function_decl, 1, alloca_size);
++	check_alloca = as_a_gcall(stmt);
++	gsi_insert_before(gsi, check_alloca, GSI_SAME_STMT);
 +
-+	return head;
++	// update the cgraph
++	bb = gimple_bb(check_alloca);
++	node = cgraph_get_create_node(check_function_decl);
++	gcc_assert(node);
++	frequency = compute_call_stmt_bb_frequency(current_function_decl, bb);
++	cgraph_create_edge(cgraph_get_node(current_function_decl), node, check_alloca, bb->count, frequency, bb->loop_depth);
 +}
 +
-+// Find assignements to structure fields and vardecls
-+static interesting_stmts_t search_interesting_structs_vardecls(interesting_stmts_t head, gassign *assign)
++static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi, bool after)
 +{
-+	enum intentional_mark mark;
-+	next_interesting_function_t next_node;
-+	tree rhs1, rhs2, lhs, decl;
-+#if BUILDING_GCC_VERSION >= 4006
-+	tree rhs3;
-+#endif
-+
-+	lhs = gimple_assign_lhs(assign);
-+
-+	if (VAR_P(lhs))
-+		decl = lhs;
-+	else
-+		decl = get_ref_field(lhs);
-+	if (decl == NULL_TREE)
-+		return head;
-+	if (DECL_NAME(decl) == NULL_TREE)
-+		return head;
-+
-+	if (is_bitfield_unnamed_cast(decl, assign))
-+		return head;
-+
-+	next_node = get_interesting_function_next_node(decl, 0);
-+	if (!next_node)
-+		return head;
-+
-+	mark = get_intentional_attr_type(decl);
-+	if (mark != MARK_NO)
-+		return head;
-+
-+	rhs1 = gimple_assign_rhs1(assign);
-+	head = search_interesting_stmt(head, next_node, assign, rhs1, 0);
++	gimple stmt;
++	gcall *track_stack;
++	cgraph_node_ptr node;
++	int frequency;
++	basic_block bb;
 +
-+	rhs2 = gimple_assign_rhs2(assign);
-+	if (rhs2)
-+		head = search_interesting_stmt(head, next_node, assign, rhs2, 0);
++	// insert call to void pax_track_stack(void)
++	stmt = gimple_build_call(track_function_decl, 0);
++	track_stack = as_a_gcall(stmt);
++	if (after)
++		gsi_insert_after(gsi, track_stack, GSI_CONTINUE_LINKING);
++	else
++		gsi_insert_before(gsi, track_stack, GSI_SAME_STMT);
 +
-+#if BUILDING_GCC_VERSION >= 4006
-+	rhs3 = gimple_assign_rhs3(assign);
-+	if (rhs3)
-+		head = search_interesting_stmt(head, next_node, assign, rhs3, 0);
-+#endif
-+	return head;
++	// update the cgraph
++	bb = gimple_bb(track_stack);
++	node = cgraph_get_create_node(track_function_decl);
++	gcc_assert(node);
++	frequency = compute_call_stmt_bb_frequency(current_function_decl, bb);
++	cgraph_create_edge(cgraph_get_node(current_function_decl), node, track_stack, bb->count, frequency, bb->loop_depth);
 +}
 +
-+static next_interesting_function_t create_so_asm_next_interesting_function_node(const gasm *stmt)
++static bool is_alloca(gimple stmt)
 +{
-+	next_interesting_function_t next_node;
-+	struct fn_raw_data raw_data;
-+
-+	raw_data.decl = NULL_TREE;
-+	raw_data.decl_str = gimple_asm_string(stmt);
-+	raw_data.context = "attr";
-+	raw_data.hash = 0;
-+	raw_data.num = 0;
-+	raw_data.marked = ASM_STMT_SO_MARK;
++	if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
++		return true;
 +
-+	next_node = get_global_next_interesting_function_entry(&raw_data);
-+	if (next_node)
-+		return next_node;
-+	next_node = create_new_next_interesting_entry(&raw_data, NULL);
-+	gcc_assert(next_node);
++#if BUILDING_GCC_VERSION >= 4007
++	if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
++		return true;
++#endif
 +
-+	add_to_global_next_interesting_function(next_node);
-+	return next_node;
++	return false;
 +}
 +
-+// Collect interesting stmts for duplication
-+static void search_interesting_stmts(struct visited *visited)
++static unsigned int stackleak_tree_instrument_execute(void)
 +{
-+	basic_block bb;
-+	next_interesting_function_t next_node_ret;
-+	interesting_stmts_t head = NULL;
++	basic_block bb, entry_bb;
++	bool prologue_instrumented = false, is_leaf = true;
 +
-+	next_node_ret = get_interesting_function_next_node(current_function_decl, 0);
++	entry_bb = ENTRY_BLOCK_PTR_FOR_FN(cfun)->next_bb;
 +
++	// 1. loop through BBs and GIMPLE statements
 +	FOR_EACH_BB_FN(bb, cfun) {
 +		gimple_stmt_iterator gsi;
 +
 +		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+			gimple stmt = gsi_stmt(gsi);
++			gimple stmt;
 +
-+			switch (gimple_code(stmt)) {
-+			case GIMPLE_ASM: {
-+				tree first_node;
-+				next_interesting_function_t next_node;
-+				const gasm *asm_stmt = as_a_gasm(stmt);
++			stmt = gsi_stmt(gsi);
 +
-+				if (!is_size_overflow_insert_check_asm(asm_stmt))
-+					continue;
-+				next_node = create_so_asm_next_interesting_function_node(asm_stmt);
-+				first_node = get_size_overflow_asm_input(asm_stmt);
-+				head = search_interesting_stmt(head, next_node, stmt, first_node, 0);
-+				break;
-+			}
-+			case GIMPLE_RETURN:
-+				head = search_interesting_rets(head, next_node_ret, as_a_greturn(stmt));
-+				break;
-+			case GIMPLE_CALL:
-+				head = search_interesting_calls(head, as_a_gcall(stmt));
-+				break;
-+			case GIMPLE_ASSIGN:
-+				/* !!! TODO LTO modeban nincs duplikalas a globalis valtozora, mert a tree mergek
-+				 * utan mar nem lehet megkulonboztetni attol a globalis valtozotol, aminek a scopeja csak a file
-+				 * igy a context nem vardecl lesz, hanem vardecl_filenev. De execute-ban kiirja, ha hianyzik a hash tablabol
-+				 * IPA-ban van duplikalas.
-+				 */
-+				head = search_interesting_structs_vardecls(head, as_a_gassign(stmt));
-+				break;
-+			default:
-+				break;
-+			}
++			if (is_gimple_call(stmt))
++				is_leaf = false;
++
++			// gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
++			if (!is_alloca(stmt))
++				continue;
++
++			// 2. insert stack overflow check before each __builtin_alloca call
++			stackleak_check_alloca(&gsi);
++
++			// 3. insert track call after each __builtin_alloca call
++			stackleak_add_instrumentation(&gsi, true);
++			if (bb == entry_bb)
++				prologue_instrumented = true;
 +		}
 +	}
 +
-+	handle_interesting_stmt(visited, head);
-+	free_interesting_stmts(head);
-+}
++	// special cases for some bad linux code: taking the address of static inline functions will materialize them
++	// but we mustn't instrument some of them as the resulting stack alignment required by the function call ABI
++	// will break other assumptions regarding the expected (but not otherwise enforced) register clobbering  ABI.
++	// case in point: native_save_fl on amd64 when optimized for size clobbers rdx if it were instrumented here.
++	if (is_leaf && !TREE_PUBLIC(current_function_decl) && DECL_DECLARED_INLINE_P(current_function_decl))
++		return 0;
++	if (is_leaf && !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)), "_paravirt_", 10))
++		return 0;
 +
-+static struct visited *create_visited(void)
-+{
-+	struct visited *new_node;
++	// 4. insert track call at the beginning
++	if (!prologue_instrumented) {
++		gimple_stmt_iterator gsi;
 +
-+	new_node = (struct visited *)xmalloc(sizeof(*new_node));
-+	new_node->stmts = pointer_set_create();
-+	new_node->my_stmts = pointer_set_create();
-+	new_node->skip_expr_casts = pointer_set_create();
-+	new_node->no_cast_check = pointer_set_create();
-+	return new_node;
++		gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
++		bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
++		if (!single_pred_p(bb)) {
++//			gcc_assert(bb_loop_depth(bb) || (bb->flags & BB_IRREDUCIBLE_LOOP));
++			split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
++			gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
++			bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
++		}
++		gsi = gsi_after_labels(bb);
++		stackleak_add_instrumentation(&gsi, false);
++	}
++
++	return 0;
 +}
 +
-+static void free_visited(struct visited *visited)
++static unsigned int stackleak_final_execute(void)
 +{
-+	pointer_set_destroy(visited->stmts);
-+	pointer_set_destroy(visited->my_stmts);
-+	pointer_set_destroy(visited->skip_expr_casts);
-+	pointer_set_destroy(visited->no_cast_check);
++	rtx_insn *insn, *next;
 +
-+	free(visited);
-+}
++	if (cfun->calls_alloca)
++		return 0;
 +
-+// Remove the size_overflow asm stmt and create an assignment from the input and output of the asm
-+static void replace_size_overflow_asm_with_assign(gasm *asm_stmt, tree lhs, tree rhs)
-+{
-+	gassign *assign;
-+	gimple_stmt_iterator gsi;
++	// keep calls only if function frame is big enough
++	if (get_frame_size() >= track_frame_size)
++		return 0;
 +
-+	// already removed
-+	if (gimple_bb(asm_stmt) == NULL)
-+		return;
-+	gsi = gsi_for_stmt(asm_stmt);
++	// 1. find pax_track_stack calls
++	for (insn = get_insns(); insn; insn = next) {
++		// rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
++		rtx body;
 +
-+	assign = gimple_build_assign(lhs, rhs);
-+	gsi_insert_before(&gsi, assign, GSI_SAME_STMT);
-+	SSA_NAME_DEF_STMT(lhs) = assign;
++		next = NEXT_INSN(insn);
++		if (!CALL_P(insn))
++			continue;
++		body = PATTERN(insn);
++		if (GET_CODE(body) != CALL)
++			continue;
++		body = XEXP(body, 0);
++		if (GET_CODE(body) != MEM)
++			continue;
++		body = XEXP(body, 0);
++		if (GET_CODE(body) != SYMBOL_REF)
++			continue;
++//		if (strcmp(XSTR(body, 0), track_function))
++		if (SYMBOL_REF_DECL(body) != track_function_decl)
++			continue;
++//		warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
++		// 2. delete call
++		delete_insn_and_edges(insn);
++#if BUILDING_GCC_VERSION >= 4007
++		if (GET_CODE(next) == NOTE && NOTE_KIND(next) == NOTE_INSN_CALL_ARG_LOCATION) {
++			insn = next;
++			next = NEXT_INSN(insn);
++			delete_insn_and_edges(insn);
++		}
++#endif
++	}
 +
-+	gsi_remove(&gsi, true);
++//	print_simple_rtl(stderr, get_insns());
++//	print_rtl(stderr, get_insns());
++//	warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
++
++	return 0;
 +}
 +
-+// Replace our asm stmts with assignments (they are no longer needed and may interfere with later optimizations)
-+static void remove_size_overflow_asm(gimple stmt)
++static bool stackleak_track_stack_gate(void)
 +{
-+	gimple_stmt_iterator gsi;
-+	tree input, output;
++	tree section;
 +
-+	if (!is_size_overflow_asm(stmt))
-+		return;
++	if (ix86_cmodel != CM_KERNEL)
++		return false;
 +
-+	if (gimple_asm_noutputs(as_a_gasm(stmt)) == 0) {
-+		gsi = gsi_for_stmt(stmt);
++	section = lookup_attribute("section", DECL_ATTRIBUTES(current_function_decl));
++	if (section && TREE_VALUE(section)) {
++		section = TREE_VALUE(TREE_VALUE(section));
 +
-+		ipa_remove_stmt_references(cgraph_get_node(current_function_decl), stmt);
-+		gsi_remove(&gsi, true);
-+		return;
++		if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10))
++			return false;
++		if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13))
++			return false;
++		if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13))
++			return false;
++		if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13))
++			return false;
 +	}
 +
-+	input = gimple_asm_input_op(as_a_gasm(stmt), 0);
-+	output = gimple_asm_output_op(as_a_gasm(stmt), 0);
-+	replace_size_overflow_asm_with_assign(as_a_gasm(stmt), TREE_VALUE(output), TREE_VALUE(input));
++	return track_frame_size >= 0;
 +}
 +
-+static void remove_all_size_overflow_asm(void)
++static void stackleak_start_unit(void *gcc_data, void *user_data)
 +{
-+	basic_block bb;
++	tree fntype;
 +
-+	FOR_EACH_BB_FN(bb, cfun) {
-+		gimple_stmt_iterator si;
++	// void pax_track_stack(void)
++	fntype = build_function_type_list(void_type_node, NULL_TREE);
++	track_function_decl = build_fn_decl(track_function, fntype);
++	DECL_ASSEMBLER_NAME(track_function_decl); // for LTO
++	TREE_PUBLIC(track_function_decl) = 1;
++	TREE_USED(track_function_decl) = 1;
++	DECL_EXTERNAL(track_function_decl) = 1;
++	DECL_ARTIFICIAL(track_function_decl) = 1;
++	DECL_PRESERVE_P(track_function_decl) = 1;
 +
-+		for (si = gsi_start_bb(bb); !gsi_end_p(si); gsi_next(&si))
-+			remove_size_overflow_asm(gsi_stmt(si));
-+	}
++	// void pax_check_alloca(unsigned long)
++	fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
++	check_function_decl = build_fn_decl(check_function, fntype);
++	DECL_ASSEMBLER_NAME(check_function_decl); // for LTO
++	TREE_PUBLIC(check_function_decl) = 1;
++	TREE_USED(check_function_decl) = 1;
++	DECL_EXTERNAL(check_function_decl) = 1;
++	DECL_ARTIFICIAL(check_function_decl) = 1;
++	DECL_PRESERVE_P(check_function_decl) = 1;
 +}
 +
-+unsigned int size_overflow_function_transform(struct cgraph_node *node __unused)
++static bool stackleak_tree_instrument_gate(void)
 +{
-+	struct visited *visited;
++	return stackleak_track_stack_gate();
++}
 +
-+#if BUILDING_GCC_VERSION >= 4008
-+	if (dump_file) {
-+		fprintf(dump_file, "BEFORE TRANSFORM -------------------------\n");
-+		size_overflow_dump_function(dump_file, node);
-+	}
-+#endif
-+	visited = create_visited();
-+	set_dominance_info();
++#define PASS_NAME stackleak_tree_instrument
++#define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
++#define TODO_FLAGS_START TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts
++#define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa | TODO_rebuild_cgraph_edges
++#include "gcc-generate-gimple-pass.h"
 +
-+	search_interesting_stmts(visited);
++static bool stackleak_final_gate(void)
++{
++	return stackleak_track_stack_gate();
++}
 +
-+	remove_all_size_overflow_asm();
++#define PASS_NAME stackleak_final
++#define TODO_FLAGS_FINISH TODO_dump_func
++#include "gcc-generate-rtl-pass.h"
 +
-+	unset_dominance_info();
-+	free_visited(visited);
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++	const char * const plugin_name = plugin_info->base_name;
++	const int argc = plugin_info->argc;
++	const struct plugin_argument * const argv = plugin_info->argv;
++	int i;
++	struct register_pass_info stackleak_tree_instrument_pass_info;
++	struct register_pass_info stackleak_final_pass_info;
++	static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = {
++		{
++			.base = &track_function_decl,
++			.nelt = 1,
++			.stride = sizeof(track_function_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		{
++			.base = &check_function_decl,
++			.nelt = 1,
++			.stride = sizeof(check_function_decl),
++			.cb = &gt_ggc_mx_tree_node,
++			.pchw = &gt_pch_nx_tree_node
++		},
++		LAST_GGC_ROOT_TAB
++	};
 +
-+#if BUILDING_GCC_VERSION >= 4008
-+	if (dump_file) {
-+		fprintf(dump_file, "AFTER TRANSFORM -------------------------\n");
-+		size_overflow_dump_function(dump_file, node);
++	stackleak_tree_instrument_pass_info.pass			= make_stackleak_tree_instrument_pass();
++//	stackleak_tree_instrument_pass_info.reference_pass_name		= "tree_profile";
++	stackleak_tree_instrument_pass_info.reference_pass_name		= "optimized";
++	stackleak_tree_instrument_pass_info.ref_pass_instance_number	= 1;
++	stackleak_tree_instrument_pass_info.pos_op 			= PASS_POS_INSERT_BEFORE;
++
++	stackleak_final_pass_info.pass				= make_stackleak_final_pass();
++	stackleak_final_pass_info.reference_pass_name		= "final";
++	stackleak_final_pass_info.ref_pass_instance_number	= 1;
++	stackleak_final_pass_info.pos_op 			= PASS_POS_INSERT_BEFORE;
++
++	if (!plugin_default_version_check(version, &gcc_version)) {
++		error(G_("incompatible gcc/plugin versions"));
++		return 1;
 +	}
-+#endif
-+	return TODO_dump_func | TODO_verify_stmts | TODO_remove_unused_locals | TODO_update_ssa_no_phi | TODO_ggc_collect | TODO_verify_flow;
++
++	register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
++
++	for (i = 0; i < argc; ++i) {
++		if (!strcmp(argv[i].key, "track-lowest-sp")) {
++			if (!argv[i].value) {
++				error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++				continue;
++			}
++			track_frame_size = atoi(argv[i].value);
++			if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
++				error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
++			continue;
++		}
++		if (!strcmp(argv[i].key, "initialize-locals")) {
++			if (argv[i].value) {
++				error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
++				continue;
++			}
++			init_locals = true;
++			continue;
++		}
++		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++	}
++
++	register_callback(plugin_name, PLUGIN_START_UNIT, &stackleak_start_unit, NULL);
++	register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_stackleak);
++	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
++	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
++
++	return 0;
 +}
-diff --git a/tools/gcc/size_overflow_plugin/size_overflow_transform_core.c b/tools/gcc/size_overflow_plugin/size_overflow_transform_core.c
+diff --git a/scripts/gcc-plugins/structleak_plugin.c b/scripts/gcc-plugins/structleak_plugin.c
 new file mode 100644
-index 0000000..062204a
+index 0000000..d7596e6
 --- /dev/null
-+++ b/tools/gcc/size_overflow_plugin/size_overflow_transform_core.c
-@@ -0,0 +1,1025 @@
++++ b/scripts/gcc-plugins/structleak_plugin.c
+@@ -0,0 +1,239 @@
 +/*
-+ * Copyright 2011-2016 by Emese Revfy <re.emese@×××××.com>
-+ * Licensed under the GPL v2, or (at your option) v3
++ * Copyright 2013-2016 by PaX Team <pageexec@××××××××.hu>
++ * Licensed under the GPL v2
 + *
-+ * Homepage:
-+ * https://github.com/ephox-gcc-plugins/size_overflow
++ * Note: the choice of the license means that the compilation process is
++ *       NOT 'eligible' as defined by gcc's library exception to the GPL v3,
++ *       but for the kernel it doesn't matter since it doesn't link against
++ *       any of the gcc libraries
 + *
-+ * Documentation:
-+ * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
++ * gcc plugin to forcibly initialize certain local variables that could
++ * otherwise leak kernel stack to userland if they aren't properly initialized
++ * by later code
 + *
-+ * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
-+ * with double integer precision (DImode/TImode for 32/64 bit integer types).
-+ * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
++ * Homepage: http://pax.grsecurity.net/
 + *
 + * Usage:
-+ * $ make
-+ * $ make run
++ * $ # for 4.5/4.6/C based 4.7
++ * $ gcc -I`gcc -print-file-name=plugin`/include -I`gcc -print-file-name=plugin`/include/c-family -fPIC -shared -O2 -o structleak_plugin.so structleak_plugin.c
++ * $ # for C++ based 4.7/4.8+
++ * $ g++ -I`g++ -print-file-name=plugin`/include -I`g++ -print-file-name=plugin`/include/c-family -fPIC -shared -O2 -o structleak_plugin.so structleak_plugin.c
++ * $ gcc -fplugin=./structleak_plugin.so test.c -O2
++ *
++ * TODO: eliminate redundant initializers
++ *       increase type coverage
 + */
 +
-+#include "size_overflow.h"
++#include "gcc-common.h"
 +
-+#define MIN_CHECK true
-+#define MAX_CHECK false
++// unused C type flag in all versions 4.5-6
++#define TYPE_USERSPACE(TYPE) TYPE_LANG_FLAG_5(TYPE)
 +
-+unsigned int call_count = 0;
++int plugin_is_GPL_compatible;
 +
-+tree get_size_overflow_type(struct visited *visited, const_gimple stmt, const_tree node)
-+{
-+	const_tree type;
-+	tree new_type;
++static struct plugin_info structleak_plugin_info = {
++	.version	= "201602181345",
++	.help		= "disable\tdo not activate plugin\n",
++};
 +
-+	gcc_assert(node != NULL_TREE);
++static tree handle_user_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
++{
++	*no_add_attrs = true;
 +
-+	type = TREE_TYPE(node);
++	// check for types? for now accept everything linux has to offer
++	if (TREE_CODE(*node) != FIELD_DECL)
++		return NULL_TREE;
 +
-+	if (pointer_set_contains(visited->my_stmts, stmt))
-+		return TREE_TYPE(node);
++	*no_add_attrs = false;
++	return NULL_TREE;
++}
 +
-+	switch (TYPE_MODE(type)) {
-+	case QImode:
-+	case HImode:
-+		new_type = size_overflow_type_SI;
-+		break;
-+	case SImode:
-+		new_type = size_overflow_type_DI;
-+		break;
-+	case DImode:
-+		if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode))
-+			new_type = TYPE_UNSIGNED(type) ? unsigned_intDI_type_node : intDI_type_node;
-+		else
-+			new_type = size_overflow_type_TI;
-+		break;
-+	case TImode:
-+		gcc_assert(!TYPE_UNSIGNED(type));
-+		new_type = size_overflow_type_TI;
-+		break;
-+	default:
-+		debug_tree(node);
-+		error("%s: unsupported gcc configuration (%qE).", __func__, current_function_decl);
-+		gcc_unreachable();
-+	}
++static struct attribute_spec user_attr = {
++	.name			= "user",
++	.min_length		= 0,
++	.max_length		= 0,
++	.decl_required		= false,
++	.type_required		= false,
++	.function_type_required	= false,
++	.handler		= handle_user_attribute,
++#if BUILDING_GCC_VERSION >= 4007
++	.affects_type_identity	= true
++#endif
++};
 +
-+	if (TYPE_QUALS(type) != 0)
-+		return build_qualified_type(new_type, TYPE_QUALS(type));
-+	return new_type;
++static void register_attributes(void *event_data, void *data)
++{
++	register_attribute(&user_attr);
++//	register_attribute(&force_attr);
 +}
 +
-+tree cast_to_new_size_overflow_type(struct visited *visited, gimple stmt, tree rhs, tree size_overflow_type, bool before)
++static tree get_field_type(tree field)
 +{
-+	gimple_stmt_iterator gsi;
-+	gimple new_stmt;
-+
-+	if (rhs == NULL_TREE)
-+		return NULL_TREE;
-+
-+	gsi = gsi_for_stmt(stmt);
-+	new_stmt = build_cast_stmt(visited, size_overflow_type, rhs, CREATE_NEW_VAR, &gsi, before, false);
-+	if (gimple_assign_cast_p(new_stmt))
-+		gimple_assign_set_rhs_code(new_stmt, CONVERT_EXPR);
-+	pointer_set_insert(visited->my_stmts, new_stmt);
-+
-+	return get_lhs(new_stmt);
++	return strip_array_types(TREE_TYPE(field));
 +}
 +
-+tree create_assign(struct visited *visited, gimple oldstmt, tree rhs1, bool before)
++static bool is_userspace_type(tree type)
 +{
-+	tree lhs, dst_type;
-+	gimple_stmt_iterator gsi;
-+
-+	if (rhs1 == NULL_TREE) {
-+		debug_gimple_stmt(oldstmt);
-+		error("%s: rhs1 is NULL_TREE", __func__);
-+		gcc_unreachable();
-+	}
-+
-+	switch (gimple_code(oldstmt)) {
-+	case GIMPLE_ASM:
-+		lhs = rhs1;
-+		break;
-+	case GIMPLE_CALL:
-+	case GIMPLE_ASSIGN:
-+		lhs = gimple_get_lhs(oldstmt);
-+		break;
-+	default:
-+		debug_gimple_stmt(oldstmt);
-+		gcc_unreachable();
-+	}
-+
-+	gsi = gsi_for_stmt(oldstmt);
-+	pointer_set_insert(visited->stmts, oldstmt);
-+	if (lookup_stmt_eh_lp(oldstmt) != 0) {
-+		basic_block next_bb, cur_bb;
-+		const_edge e;
-+
-+		gcc_assert(before == false);
-+		gcc_assert(stmt_can_throw_internal(oldstmt));
-+		gcc_assert(gimple_code(oldstmt) == GIMPLE_CALL);
-+		gcc_assert(!gsi_end_p(gsi));
++	tree field;
 +
-+		cur_bb = gimple_bb(oldstmt);
-+		next_bb = cur_bb->next_bb;
-+		e = find_edge(cur_bb, next_bb);
-+		gcc_assert(e != NULL);
-+		gcc_assert(e->flags & EDGE_FALLTHRU);
++	for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
++		tree fieldtype = get_field_type(field);
++		enum tree_code code = TREE_CODE(fieldtype);
 +
-+		gsi = gsi_after_labels(next_bb);
-+		gcc_assert(!gsi_end_p(gsi));
++		if (code == RECORD_TYPE || code == UNION_TYPE)
++			if (is_userspace_type(fieldtype))
++				return true;
 +
-+		before = true;
-+		oldstmt = gsi_stmt(gsi);
++		if (lookup_attribute("user", DECL_ATTRIBUTES(field)))
++			return true;
 +	}
-+
-+	if (is_gimple_constant(rhs1) && TREE_CODE_CLASS(gimple_assign_rhs_code(oldstmt)) == tcc_comparison)
-+		dst_type = get_size_overflow_type(visited, oldstmt, rhs1);
-+	else
-+		dst_type = get_size_overflow_type(visited, oldstmt, lhs);
-+
-+	if (is_gimple_constant(rhs1))
-+		return cast_a_tree(dst_type, rhs1);
-+	return cast_to_new_size_overflow_type(visited, oldstmt, rhs1, dst_type, before);
++	return false;
 +}
 +
-+tree dup_assign(struct visited *visited, gassign *oldstmt, const_tree node, tree rhs1, tree rhs2, tree __unused rhs3)
++static void finish_type(void *event_data, void *data)
 +{
-+	gassign *stmt;
-+	gimple_stmt_iterator gsi;
-+	tree size_overflow_type, new_var, lhs = gimple_assign_lhs(oldstmt);
-+
-+	if (pointer_set_contains(visited->my_stmts, oldstmt))
-+		return lhs;
-+
-+	if (gimple_num_ops(oldstmt) != 4 && rhs1 == NULL_TREE) {
-+		rhs1 = gimple_assign_rhs1(oldstmt);
-+		rhs1 = create_assign(visited, oldstmt, rhs1, BEFORE_STMT);
-+	}
-+	if (gimple_num_ops(oldstmt) == 3 && rhs2 == NULL_TREE) {
-+		rhs2 = gimple_assign_rhs2(oldstmt);
-+		rhs2 = create_assign(visited, oldstmt, rhs2, BEFORE_STMT);
-+	}
-+
-+	stmt = as_a_gassign(gimple_copy(oldstmt));
-+	gimple_set_location(stmt, gimple_location(oldstmt));
-+	pointer_set_insert(visited->my_stmts, stmt);
-+
-+	if (gimple_assign_rhs_code(oldstmt) == WIDEN_MULT_EXPR)
-+		gimple_assign_set_rhs_code(stmt, MULT_EXPR);
-+
-+	size_overflow_type = get_size_overflow_type(visited, oldstmt, node);
-+
-+	new_var = create_new_var(size_overflow_type);
-+	new_var = make_ssa_name(new_var, stmt);
-+	gimple_assign_set_lhs(stmt, new_var);
++	tree type = (tree)event_data;
 +
-+	if (rhs1 != NULL_TREE)
-+		gimple_assign_set_rhs1(stmt, rhs1);
++	if (type == NULL_TREE || type == error_mark_node)
++		return;
 +
-+	if (rhs2 != NULL_TREE)
-+		gimple_assign_set_rhs2(stmt, rhs2);
-+#if BUILDING_GCC_VERSION >= 4006
-+	if (rhs3 != NULL_TREE)
-+		gimple_assign_set_rhs3(stmt, rhs3);
++#if BUILDING_GCC_VERSION >= 5000
++	if (TREE_CODE(type) == ENUMERAL_TYPE)
++		return;
 +#endif
-+	gimple_set_vuse(stmt, gimple_vuse(oldstmt));
-+	gimple_set_vdef(stmt, gimple_vdef(oldstmt));
 +
-+	gsi = gsi_for_stmt(oldstmt);
-+	gsi_insert_after(&gsi, stmt, GSI_SAME_STMT);
-+	update_stmt(stmt);
-+	pointer_set_insert(visited->stmts, oldstmt);
-+	return gimple_assign_lhs(stmt);
++	if (TYPE_USERSPACE(type))
++		return;
++
++	if (is_userspace_type(type))
++		TYPE_USERSPACE(type) = 1;
 +}
 +
-+static tree cast_parm_decl(struct visited *visited, tree phi_ssa_name, tree arg, tree size_overflow_type, basic_block bb)
++static void initialize(tree var)
 +{
-+	const_gimple assign;
++	basic_block bb;
 +	gimple_stmt_iterator gsi;
-+	basic_block first_bb;
++	tree initializer;
++	gimple init_stmt;
 +
-+	gcc_assert(SSA_NAME_IS_DEFAULT_DEF(arg));
++	// this is the original entry bb before the forced split
++	bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
 +
-+	if (bb->index == 0) {
-+		first_bb = split_block_after_labels(ENTRY_BLOCK_PTR_FOR_FN(cfun))->dest;
-+		gcc_assert(dom_info_available_p(CDI_DOMINATORS));
-+		set_immediate_dominator(CDI_DOMINATORS, first_bb, ENTRY_BLOCK_PTR_FOR_FN(cfun));
-+		bb = first_bb;
-+	}
++	// first check if the variable is already initialized, warn otherwise
++	for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
++		gimple stmt = gsi_stmt(gsi);
++		tree rhs1;
 +
-+	gsi = gsi_after_labels(bb);
-+	assign = build_cast_stmt(visited, size_overflow_type, arg, phi_ssa_name, &gsi, BEFORE_STMT, false);
-+	pointer_set_insert(visited->my_stmts, assign);
-+	return get_lhs(assign);
-+}
++		// we're looking for an assignment of a single rhs...
++		if (!gimple_assign_single_p(stmt))
++			continue;
++		rhs1 = gimple_assign_rhs1(stmt);
++#if BUILDING_GCC_VERSION >= 4007
++		// ... of a non-clobbering expression...
++		if (TREE_CLOBBER_P(rhs1))
++			continue;
++#endif
++		// ... to our variable...
++		if (gimple_get_lhs(stmt) != var)
++			continue;
++		// if it's an initializer then we're good
++		if (TREE_CODE(rhs1) == CONSTRUCTOR)
++			return;
++	}
 +
-+static tree use_phi_ssa_name(struct visited *visited, tree ssa_name_var, tree new_arg)
-+{
-+	gimple_stmt_iterator gsi;
-+	const_gimple assign;
-+	gimple def_stmt = get_def_stmt(new_arg);
++	// these aren't the 0days you're looking for
++//	inform(DECL_SOURCE_LOCATION(var), "userspace variable will be forcibly initialized");
 +
-+	if (gimple_code(def_stmt) == GIMPLE_PHI) {
-+		gsi = gsi_after_labels(gimple_bb(def_stmt));
-+		assign = build_cast_stmt(visited, TREE_TYPE(new_arg), new_arg, ssa_name_var, &gsi, BEFORE_STMT, true);
-+	} else {
-+		gsi = gsi_for_stmt(def_stmt);
-+		assign = build_cast_stmt(visited, TREE_TYPE(new_arg), new_arg, ssa_name_var, &gsi, AFTER_STMT, true);
-+	}
++	// build the initializer expression
++	initializer = build_constructor(TREE_TYPE(var), NULL);
 +
-+	pointer_set_insert(visited->my_stmts, assign);
-+	return get_lhs(assign);
++	// build the initializer stmt
++	init_stmt = gimple_build_assign(var, initializer);
++	gsi = gsi_after_labels(single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
++	gsi_insert_before(&gsi, init_stmt, GSI_NEW_STMT);
++	update_stmt(init_stmt);
 +}
 +
-+static tree cast_visited_phi_arg(struct visited *visited, tree ssa_name_var, tree arg, tree size_overflow_type)
++static unsigned int structleak_execute(void)
 +{
 +	basic_block bb;
-+	gimple_stmt_iterator gsi;
-+	const_gimple def_stmt;
-+	const_gimple assign;
-+
-+	def_stmt = get_def_stmt(arg);
-+	bb = gimple_bb(def_stmt);
-+	gcc_assert(bb->index != 0);
-+	gsi = gsi_after_labels(bb);
-+
-+	assign = build_cast_stmt(visited, size_overflow_type, arg, ssa_name_var, &gsi, BEFORE_STMT, false);
-+	pointer_set_insert(visited->my_stmts, assign);
-+	return get_lhs(assign);
-+}
++	unsigned int ret = 0;
++	tree var;
++	unsigned int i;
 +
-+static tree create_new_phi_arg(struct visited *visited, tree ssa_name_var, tree new_arg, gphi *oldstmt, unsigned int i)
-+{
-+	tree size_overflow_type;
-+	tree arg;
-+	const_gimple def_stmt;
++	// split the first bb where we can put the forced initializers
++	gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
++	bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
++	if (!single_pred_p(bb)) {
++//		gcc_assert(bb_loop_depth(bb) || (bb->flags & BB_IRREDUCIBLE_LOOP));
++		split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
++		gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
++	}
 +
-+	if (new_arg != NULL_TREE && is_gimple_constant(new_arg))
-+		return new_arg;
++	// enumarate all local variables and forcibly initialize our targets
++	FOR_EACH_LOCAL_DECL(cfun, i, var) {
++		tree type = TREE_TYPE(var);
 +
-+	arg = gimple_phi_arg_def(oldstmt, i);
-+	def_stmt = get_def_stmt(arg);
-+	gcc_assert(def_stmt != NULL);
-+	size_overflow_type = get_size_overflow_type(visited, oldstmt, arg);
++		gcc_assert(DECL_P(var));
++		if (!auto_var_in_fn_p(var, current_function_decl))
++			continue;
 +
-+	switch (gimple_code(def_stmt)) {
-+	case GIMPLE_PHI:
-+		return cast_visited_phi_arg(visited, ssa_name_var, arg, size_overflow_type);
-+	case GIMPLE_NOP: {
-+		basic_block bb;
++		// only care about structure types
++		if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
++			continue;
 +
-+		bb = gimple_phi_arg_edge(oldstmt, i)->src;
-+		return cast_parm_decl(visited, ssa_name_var, arg, size_overflow_type, bb);
++		// if the type is of interest, examine the variable
++		if (TYPE_USERSPACE(type))
++			initialize(var);
 +	}
-+	case GIMPLE_ASM: {
-+		gimple_stmt_iterator gsi;
-+		const_gimple assign;
-+		gimple stmt = get_def_stmt(arg);
 +
-+		gsi = gsi_for_stmt(stmt);
-+		assign = build_cast_stmt(visited, size_overflow_type, arg, ssa_name_var, &gsi, AFTER_STMT, false);
-+		pointer_set_insert(visited->my_stmts, assign);
-+		return get_lhs(assign);
-+	}
-+	default:
-+		gcc_assert(new_arg != NULL_TREE);
-+		gcc_assert(types_compatible_p(TREE_TYPE(new_arg), size_overflow_type));
-+		return use_phi_ssa_name(visited, ssa_name_var, new_arg);
-+	}
++	return ret;
 +}
 +
-+static gphi *overflow_create_phi_node(struct visited *visited, gphi *oldstmt, tree result)
++#define PASS_NAME structleak
++#define NO_GATE
++#define PROPERTIES_REQUIRED PROP_cfg
++#define TODO_FLAGS_FINISH TODO_verify_il | TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa | TODO_ggc_collect | TODO_verify_flow
++#include "gcc-generate-gimple-pass.h"
++
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
 +{
-+	basic_block bb;
-+	gphi *phi;
-+	gimple_seq seq;
-+	gimple_stmt_iterator gsi = gsi_for_stmt(oldstmt);
++	int i;
++	const char * const plugin_name = plugin_info->base_name;
++	const int argc = plugin_info->argc;
++	const struct plugin_argument * const argv = plugin_info->argv;
++	bool enable = true;
++	struct register_pass_info structleak_pass_info;
 +
-+	bb = gsi_bb(gsi);
++	structleak_pass_info.pass			= make_structleak_pass();
++	structleak_pass_info.reference_pass_name	= "ssa";
++	structleak_pass_info.ref_pass_instance_number	= 1;
++	structleak_pass_info.pos_op			= PASS_POS_INSERT_AFTER;
 +
-+	if (result == NULL_TREE) {
-+		tree old_result = gimple_phi_result(oldstmt);
-+		tree size_overflow_type = get_size_overflow_type(visited, oldstmt, old_result);
++	if (!plugin_default_version_check(version, &gcc_version)) {
++		error(G_("incompatible gcc/plugin versions"));
++		return 1;
++	}
 +
-+		result = create_new_var(size_overflow_type);
++	if (strncmp(lang_hooks.name, "GNU C", 5) && !strncmp(lang_hooks.name, "GNU C+", 6)) {
++		inform(UNKNOWN_LOCATION, G_("%s supports C only, not %s"), plugin_name, lang_hooks.name);
++		enable = false;
 +	}
 +
-+	phi = as_a_gphi(create_phi_node(result, bb));
-+	gimple_phi_set_result(phi, make_ssa_name(result, phi));
-+	seq = phi_nodes(bb);
-+	gsi = gsi_last(seq);
-+	gsi_remove(&gsi, false);
++	for (i = 0; i < argc; ++i) {
++		if (!strcmp(argv[i].key, "disable")) {
++			enable = false;
++			continue;
++		}
++		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++	}
 +
-+	gsi = gsi_for_stmt(oldstmt);
-+	gsi_insert_after(&gsi, phi, GSI_NEW_STMT);
-+	gimple_set_bb(phi, bb);
-+	return phi;
++	register_callback(plugin_name, PLUGIN_INFO, NULL, &structleak_plugin_info);
++	if (enable) {
++		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &structleak_pass_info);
++		register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
++	}
++	register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
++
++	return 0;
 +}
+diff --git a/scripts/headers_install.sh b/scripts/headers_install.sh
+index fdebd66..a349e33 100755
+--- a/scripts/headers_install.sh
++++ b/scripts/headers_install.sh
+@@ -32,6 +32,7 @@ do
+ 	FILE="$(basename "$i")"
+ 	sed -r \
+ 		-e 's/([ \t(])(__user|__force|__iomem)[ \t]/\1/g' \
++		-e 's/__intentional_overflow\([- \t,0-9]*\)//g' \
+ 		-e 's/__attribute_const__([ \t]|$)/\1/g' \
+ 		-e 's@^#include <linux/compiler.h>@@' \
+ 		-e 's/(^|[^a-zA-Z0-9])__packed([^a-zA-Z0-9_]|$)/\1__attribute__((packed))\2/g' \
+diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
+index 8fa81e8..a9ac144 100644
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -89,7 +89,7 @@ static inline int is_arm_mapping_symbol(const char *str)
+ }
+ 
+ static int check_symbol_range(const char *sym, unsigned long long addr,
+-			      struct addr_range *ranges, int entries)
++			      struct addr_range *ranges, size_t entries)
+ {
+ 	size_t i;
+ 	struct addr_range *ar;
+@@ -178,7 +178,7 @@ static int read_symbol(FILE *in, struct sym_entry *s)
+ }
+ 
+ static int symbol_in_range(struct sym_entry *s, struct addr_range *ranges,
+-			   int entries)
++			   size_t entries)
+ {
+ 	size_t i;
+ 	struct addr_range *ar;
+diff --git a/scripts/kconfig/lkc.h b/scripts/kconfig/lkc.h
+index 91ca126..5f7cad6 100644
+--- a/scripts/kconfig/lkc.h
++++ b/scripts/kconfig/lkc.h
+@@ -108,7 +108,8 @@ void menu_add_expr(enum prop_type type, struct expr *expr, struct expr *dep);
+ void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep);
+ void menu_add_option(int token, char *arg);
+ void menu_finalize(struct menu *parent);
+-void menu_set_type(int type);
++enum symbol_type;
++void menu_set_type(enum symbol_type type);
+ 
+ /* util.c */
+ struct file *file_lookup(const char *name);
+@@ -123,7 +124,7 @@ struct gstr {
+ 	* when max_width is not zero long lines in string s (if any) get
+ 	* wrapped not to exceed the max_width value
+ 	*/
+-	int max_width;
++	size_t max_width;
+ };
+ struct gstr str_new(void);
+ void str_free(struct gstr *gs);
+diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
+index aed678e..1a703de 100644
+--- a/scripts/kconfig/menu.c
++++ b/scripts/kconfig/menu.c
+@@ -109,7 +109,7 @@ void menu_add_dep(struct expr *dep)
+ 	current_entry->dep = expr_alloc_and(current_entry->dep, menu_check_dep(dep));
+ }
+ 
+-void menu_set_type(int type)
++void menu_set_type(enum symbol_type type)
+ {
+ 	struct symbol *sym = current_entry->sym;
+ 
+diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
+index 25cf0c2..eb178ce 100644
+--- a/scripts/kconfig/symbol.c
++++ b/scripts/kconfig/symbol.c
+@@ -956,7 +956,7 @@ const char *sym_escape_string_value(const char *in)
+ 
+ struct sym_match {
+ 	struct symbol	*sym;
+-	off_t		so, eo;
++	regoff_t	so, eo;
+ };
+ 
+ /* Compare matched symbols as thus:
+@@ -978,8 +978,8 @@ static int sym_rel_comp(const void *sym1, const void *sym2)
+ 	 * exactly; if this is the case, we can't decide which comes first,
+ 	 * and we fallback to sorting alphabetically.
+ 	 */
+-	exact1 = (s1->eo - s1->so) == strlen(s1->sym->name);
+-	exact2 = (s2->eo - s2->so) == strlen(s2->sym->name);
++	exact1 = (s1->eo - s1->so) == (long)strlen(s1->sym->name);
++	exact2 = (s2->eo - s2->so) == (long)strlen(s2->sym->name);
+ 	if (exact1 && !exact2)
+ 		return -1;
+ 	if (!exact1 && exact2)
+diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
+index ba6c34e..ea10bce 100755
+--- a/scripts/link-vmlinux.sh
++++ b/scripts/link-vmlinux.sh
+@@ -179,7 +179,7 @@ else
+ fi;
+ 
+ # final build of init/
+-${MAKE} -f "${srctree}/scripts/Makefile.build" obj=init
++${MAKE} -f "${srctree}/scripts/Makefile.build" obj=init GCC_PLUGINS_CFLAGS="${GCC_PLUGINS_CFLAGS}" GCC_PLUGINS_AFLAGS="${GCC_PLUGINS_AFLAGS}"
+ 
+ kallsymso=""
+ kallsyms_vmlinux=""
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index a915507..27c1b41 100644
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -156,7 +156,7 @@ static void device_id_check(const char *modname, const char *device_id,
+ 			    unsigned long size, unsigned long id_size,
+ 			    void *symval)
+ {
+-	int i;
++	unsigned int i;
+ 
+ 	if (size % id_size || size < id_size) {
+ 		fatal("%s: sizeof(struct %s_device_id)=%lu is not a modulo "
+@@ -185,7 +185,7 @@ static void device_id_check(const char *modname, const char *device_id,
+ /* USB is special because the bcdDevice can be matched against a numeric range */
+ /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipNinN" */
+ static void do_usb_entry(void *symval,
+-			 unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
++			 unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
+ 			 unsigned char range_lo, unsigned char range_hi,
+ 			 unsigned char max, struct module *mod)
+ {
+@@ -295,7 +295,7 @@ static void do_usb_entry_multi(void *symval, struct module *mod)
+ {
+ 	unsigned int devlo, devhi;
+ 	unsigned char chi, clo, max;
+-	int ndigits;
++	unsigned int ndigits;
+ 
+ 	DEF_FIELD(symval, usb_device_id, match_flags);
+ 	DEF_FIELD(symval, usb_device_id, idVendor);
+@@ -619,7 +619,7 @@ static void do_pnp_device_entry(void *symval, unsigned long size,
+ 	for (i = 0; i < count; i++) {
+ 		DEF_FIELD_ADDR(symval + i*id_size, pnp_device_id, id);
+ 		char acpi_id[sizeof(*id)];
+-		int j;
++		unsigned int j;
+ 
+ 		buf_printf(&mod->dev_table_buf,
+ 			   "MODULE_ALIAS(\"pnp:d%s*\");\n", *id);
+@@ -648,7 +648,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
+ 
+ 		for (j = 0; j < PNP_MAX_DEVICES; j++) {
+ 			const char *id = (char *)(*devs)[j].id;
+-			int i2, j2;
++			unsigned int i2, j2;
+ 			int dup = 0;
+ 
+ 			if (!id[0])
+@@ -674,7 +674,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
+ 			/* add an individual alias for every device entry */
+ 			if (!dup) {
+ 				char acpi_id[PNP_ID_LEN];
+-				int k;
++				unsigned int k;
+ 
+ 				buf_printf(&mod->dev_table_buf,
+ 					   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
+@@ -999,7 +999,7 @@ static void dmi_ascii_filter(char *d, const char *s)
+ static int do_dmi_entry(const char *filename, void *symval,
+ 			char *alias)
+ {
+-	int i, j;
++	unsigned int i, j;
+ 	DEF_FIELD_ADDR(symval, dmi_system_id, matches);
+ 	sprintf(alias, "dmi*");
+ 
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 48958d3..d5ccb52 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -37,6 +37,7 @@ static int vmlinux_section_warnings = 1;
+ static int warn_unresolved = 0;
+ /* How a symbol is exported */
+ static int sec_mismatch_count = 0;
++static int writable_fptr_count = 0;
+ static int sec_mismatch_verbose = 1;
+ static int sec_mismatch_fatal = 0;
+ /* ignore missing files */
+@@ -947,6 +948,7 @@ enum mismatch {
+ 	ANY_EXIT_TO_ANY_INIT,
+ 	EXPORT_TO_INIT_EXIT,
+ 	EXTABLE_TO_NON_TEXT,
++	DATA_TO_TEXT
+ };
+ 
+ /**
+@@ -1073,6 +1075,12 @@ static const struct sectioncheck sectioncheck[] = {
+ 	.good_tosec = {ALL_TEXT_SECTIONS , NULL},
+ 	.mismatch = EXTABLE_TO_NON_TEXT,
+ 	.handler = extable_mismatch_handler,
++},
++/* Do not reference code from writable data */
++{
++	.fromsec = { DATA_SECTIONS, NULL },
++	.bad_tosec = { ALL_TEXT_SECTIONS, NULL },
++	.mismatch = DATA_TO_TEXT
+ }
+ };
+ 
+@@ -1222,10 +1230,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
+ 			continue;
+ 		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
+ 			continue;
+-		if (sym->st_value == addr)
+-			return sym;
+ 		/* Find a symbol nearby - addr are maybe negative */
+ 		d = sym->st_value - addr;
++		if (d == 0)
++			return sym;
+ 		if (d < 0)
+ 			d = addr - sym->st_value;
+ 		if (d < distance) {
+@@ -1384,7 +1392,11 @@ static void report_sec_mismatch(const char *modname,
+ 	char *prl_from;
+ 	char *prl_to;
+ 
+-	sec_mismatch_count++;
++	if (mismatch->mismatch == DATA_TO_TEXT)
++		writable_fptr_count++;
++	else
++		sec_mismatch_count++;
 +
-+#if BUILDING_GCC_VERSION <= 4007
-+static tree create_new_phi_node(struct visited *visited, VEC(tree, heap) **args, tree ssa_name_var, gimple oldstmt)
-+#else
-+static tree create_new_phi_node(struct visited *visited, vec<tree, va_heap, vl_embed> *&args, tree ssa_name_var, gphi *oldstmt)
+ 	if (!sec_mismatch_verbose)
+ 		return;
+ 
+@@ -1508,6 +1520,14 @@ static void report_sec_mismatch(const char *modname,
+ 		fatal("There's a special handler for this mismatch type, "
+ 		      "we should never get here.");
+ 		break;
++	case DATA_TO_TEXT:
++#if 0
++		fprintf(stderr,
++		"The %s %s:%s references\n"
++		"the %s %s:%s%s\n",
++		from, fromsec, fromsym, to, tosec, tosym, to_p);
 +#endif
-+{
-+	gphi *new_phi;
++		break;
+ 	}
+ 	fprintf(stderr, "\n");
+ }
+@@ -1897,7 +1917,7 @@ static void section_rel(const char *modname, struct elf_info *elf,
+ static void check_sec_ref(struct module *mod, const char *modname,
+ 			  struct elf_info *elf)
+ {
+-	int i;
 +	unsigned int i;
-+	tree arg, result;
-+	location_t loc = gimple_location(oldstmt);
-+
-+#if BUILDING_GCC_VERSION <= 4007
-+	gcc_assert(!VEC_empty(tree, *args));
-+#else
-+	gcc_assert(!args->is_empty());
-+#endif
-+
-+	new_phi = overflow_create_phi_node(visited, oldstmt, ssa_name_var);
-+	result = gimple_phi_result(new_phi);
-+	ssa_name_var = SSA_NAME_VAR(result);
-+
-+#if BUILDING_GCC_VERSION <= 4007
-+	FOR_EACH_VEC_ELT(tree, *args, i, arg) {
-+#else
-+	FOR_EACH_VEC_SAFE_ELT(args, i, arg) {
-+#endif
-+		arg = create_new_phi_arg(visited, ssa_name_var, arg, oldstmt, i);
-+		add_phi_arg(new_phi, arg, gimple_phi_arg_edge(oldstmt, i), loc);
-+	}
-+
-+#if BUILDING_GCC_VERSION <= 4007
-+	VEC_free(tree, heap, *args);
-+#else
-+	vec_free(args);
-+#endif
-+	update_stmt(new_phi);
-+	pointer_set_insert(visited->my_stmts, new_phi);
-+	return result;
-+}
-+
-+static tree handle_phi(interesting_stmts_t expand_from, tree orig_result)
-+{
-+#if BUILDING_GCC_VERSION <= 4007
-+	VEC(tree, heap) *args = NULL;
-+#else
-+	vec<tree, va_heap, vl_embed> *args = NULL;
-+#endif
-+	unsigned int i, len;
-+	tree ssa_name_var = NULL_TREE;
-+	gphi *oldstmt = as_a_gphi(get_def_stmt(orig_result));
-+
-+	len = gimple_phi_num_args(oldstmt);
-+	pointer_set_insert(expand_from->visited->stmts, oldstmt);
-+	for (i = 0; i < len; i++) {
-+		tree arg, new_arg;
-+
-+		arg = gimple_phi_arg_def(oldstmt, i);
-+		new_arg = expand(expand_from, arg);
-+
-+		if (ssa_name_var == NULL_TREE && new_arg != NULL_TREE)
-+			ssa_name_var = SSA_NAME_VAR(new_arg);
-+
-+		if (is_gimple_constant(arg)) {
-+			tree size_overflow_type = get_size_overflow_type(expand_from->visited, oldstmt, arg);
-+
-+			new_arg = cast_a_tree(size_overflow_type, arg);
+ 	Elf_Shdr *sechdrs = elf->sechdrs;
+ 
+ 	/* Walk through all sections */
+@@ -2028,7 +2048,7 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf,
+ 	va_end(ap);
+ }
+ 
+-void buf_write(struct buffer *buf, const char *s, int len)
++void buf_write(struct buffer *buf, const char *s, unsigned int len)
+ {
+ 	if (buf->size - buf->pos < len) {
+ 		buf->size += len + SZ;
+@@ -2258,7 +2278,7 @@ static void write_if_changed(struct buffer *b, const char *fname)
+ 	if (fstat(fileno(file), &st) < 0)
+ 		goto close_write;
+ 
+-	if (st.st_size != b->pos)
++	if (st.st_size != (off_t)b->pos)
+ 		goto close_write;
+ 
+ 	tmp = NOFAIL(malloc(b->pos));
+@@ -2496,6 +2516,14 @@ int main(int argc, char **argv)
+ 			      "Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them.\n");
+ 		}
+ 	}
++	if (writable_fptr_count) {
++		if (!sec_mismatch_verbose) {
++			warn("modpost: Found %d writable function pointer(s).\n"
++			     "To see full details build your kernel with:\n"
++			     "'make CONFIG_DEBUG_SECTION_MISMATCH=y'\n",
++			     writable_fptr_count);
 +		}
-+
-+#if BUILDING_GCC_VERSION <= 4007
-+		VEC_safe_push(tree, heap, args, new_arg);
-+#else
-+		vec_safe_push(args, new_arg);
-+#endif
 +	}
-+
-+#if BUILDING_GCC_VERSION <= 4007
-+	return create_new_phi_node(expand_from->visited, &args, ssa_name_var, oldstmt);
-+#else
-+	return create_new_phi_node(expand_from->visited, args, ssa_name_var, oldstmt);
-+#endif
-+}
-+
-+static tree create_cast_assign(struct visited *visited, gassign *stmt)
-+{
-+	tree rhs1 = gimple_assign_rhs1(stmt);
-+	tree lhs = gimple_assign_lhs(stmt);
-+	const_tree rhs1_type = TREE_TYPE(rhs1);
-+	const_tree lhs_type = TREE_TYPE(lhs);
-+
-+	if (TYPE_UNSIGNED(rhs1_type) == TYPE_UNSIGNED(lhs_type))
-+		return create_assign(visited, stmt, lhs, AFTER_STMT);
-+
-+	return create_assign(visited, stmt, rhs1, AFTER_STMT);
-+}
-+
-+static bool skip_lhs_cast_check(struct visited *visited, const gassign *stmt)
-+{
-+	const_tree rhs = gimple_assign_rhs1(stmt);
-+	const_gimple def_stmt = get_def_stmt(rhs);
-+
-+	// 3.8.2 kernel/futex_compat.c compat_exit_robust_list(): get_user() 64 ulong -> int (compat_long_t), int max
-+	if (gimple_code(def_stmt) == GIMPLE_ASM)
-+		return true;
-+
-+	if (is_const_plus_unsigned_signed_truncation(rhs)) {
-+		pointer_set_insert(visited->no_cast_check, stmt);
-+		return true;
+ 
+ 	return err;
+ }
+diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h
+index 6a5e151..f2fbaf5 100644
+--- a/scripts/mod/modpost.h
++++ b/scripts/mod/modpost.h
+@@ -98,15 +98,15 @@ void *do_nofail(void *ptr, const char *expr);
+ 
+ struct buffer {
+ 	char *p;
+-	int pos;
+-	int size;
++	unsigned int pos;
++	unsigned int size;
+ };
+ 
+ void __attribute__((format(printf, 2, 3)))
+ buf_printf(struct buffer *buf, const char *fmt, ...);
+ 
+ void
+-buf_write(struct buffer *buf, const char *s, int len);
++buf_write(struct buffer *buf, const char *s, unsigned int len);
+ 
+ struct module {
+ 	struct module *next;
+diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
+index 944418d..15291e4 100644
+--- a/scripts/mod/sumversion.c
++++ b/scripts/mod/sumversion.c
+@@ -470,7 +470,7 @@ static void write_version(const char *filename, const char *sum,
+ 		goto out;
+ 	}
+ 
+-	if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
++	if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
+ 		warn("writing sum in %s failed: %s\n",
+ 			filename, strerror(errno));
+ 		goto out;
+diff --git a/scripts/module-common.lds b/scripts/module-common.lds
+index 73a2c7d..df11b31 100644
+--- a/scripts/module-common.lds
++++ b/scripts/module-common.lds
+@@ -6,6 +6,10 @@
+ SECTIONS {
+ 	/DISCARD/ : { *(.discard) }
+ 
++	.rodata			0: {
++		*(.rodata) *(.rodata.*)
++		*(.data..read_only)
 +	}
+ 	__ksymtab		0 : { *(SORT(___ksymtab+*)) }
+ 	__ksymtab_gpl		0 : { *(SORT(___ksymtab_gpl+*)) }
+ 	__ksymtab_unused	0 : { *(SORT(___ksymtab_unused+*)) }
+diff --git a/scripts/package/Makefile b/scripts/package/Makefile
+index c2c7389..81b8117 100644
+--- a/scripts/package/Makefile
++++ b/scripts/package/Makefile
+@@ -40,7 +40,7 @@ if test "$(objtree)" != "$(srctree)"; then \
+ fi ; \
+ $(srctree)/scripts/setlocalversion --save-scmversion; \
+ ln -sf $(srctree) $(2); \
+-tar -cz $(RCS_TAR_IGNORE) -f $(2).tar.gz \
++tar --owner=root --group=root -cz $(RCS_TAR_IGNORE) -f $(2).tar.gz \
+ 	$(addprefix $(2)/,$(TAR_CONTENT) $(3)); \
+ rm -f $(2) $(objtree)/.scmversion
+ 
+diff --git a/scripts/package/builddeb b/scripts/package/builddeb
+index 6c3b038..4bac93f 100755
+--- a/scripts/package/builddeb
++++ b/scripts/package/builddeb
+@@ -326,6 +326,7 @@ fi
+ (cd $srctree; find arch/$SRCARCH -name module.lds -o -name Kbuild.platforms -o -name Platform) >> "$objtree/debian/hdrsrcfiles"
+ (cd $srctree; find $(find arch/$SRCARCH -name include -o -name scripts -type d) -type f) >> "$objtree/debian/hdrsrcfiles"
+ (cd $objtree; find arch/$SRCARCH/include Module.symvers include scripts -type f) >> "$objtree/debian/hdrobjfiles"
++(cd $objtree; find scripts/gcc-plugins -name \*.so -o -name gcc-common.h) >> "$objtree/debian/hdrobjfiles"
+ destdir=$kernel_headers_dir/usr/src/linux-headers-$version
+ mkdir -p "$destdir"
+ (cd $srctree; tar -c -f - -T -) < "$objtree/debian/hdrsrcfiles" | (cd $destdir; tar -xf -)
+diff --git a/scripts/package/mkspec b/scripts/package/mkspec
+index fe44d68..3874acb 100755
+--- a/scripts/package/mkspec
++++ b/scripts/package/mkspec
+@@ -120,29 +120,40 @@ echo 'rm -f $RPM_BUILD_ROOT'"/lib/modules/$KERNELRELEASE/{build,source}"
+ echo "mkdir -p "'$RPM_BUILD_ROOT'"/usr/src/kernels/$KERNELRELEASE"
+ echo "EXCLUDES=\"$RCS_TAR_IGNORE --exclude .tmp_versions --exclude=*vmlinux* --exclude=*.o --exclude=*.ko --exclude=*.cmd --exclude=Documentation --exclude=firmware --exclude .config.old --exclude .missing-syscalls.d\""
+ echo "tar "'$EXCLUDES'" -cf- . | (cd "'$RPM_BUILD_ROOT'"/usr/src/kernels/$KERNELRELEASE;tar xvf -)"
+-echo 'cd $RPM_BUILD_ROOT'"/lib/modules/$KERNELRELEASE"
+-echo "ln -sf /usr/src/kernels/$KERNELRELEASE build"
+-echo "ln -sf /usr/src/kernels/$KERNELRELEASE source"
+ fi
+ 
+ echo ""
+ echo "%clean"
+ echo 'rm -rf $RPM_BUILD_ROOT'
+ echo ""
++echo "%pre"
++echo 'chmod -f 0500 /boot'
++echo 'if [ -d /lib/modules ]; then'
++echo 'chmod -f 0500 /lib/modules'
++echo 'fi'
++echo 'if [ -d /lib32/modules ]; then'
++echo 'chmod -f 0500 /lib32/modules'
++echo 'fi'
++echo 'if [ -d /lib64/modules ]; then'
++echo 'chmod -f 0500 /lib64/modules'
++echo 'fi'
++echo ""
++echo "%post devel"
++echo "ln -sf /usr/src/kernels/$KERNELRELEASE /lib/modules/$KERNELRELEASE/build"
++echo "ln -sf /usr/src/kernels/$KERNELRELEASE /lib/modules/$KERNELRELEASE/source"
++echo ""
+ echo "%post"
+-echo "if [ -x /sbin/installkernel -a -r /boot/vmlinuz-$KERNELRELEASE -a -r /boot/System.map-$KERNELRELEASE ]; then"
+-echo "cp /boot/vmlinuz-$KERNELRELEASE /boot/.vmlinuz-$KERNELRELEASE-rpm"
+-echo "cp /boot/System.map-$KERNELRELEASE /boot/.System.map-$KERNELRELEASE-rpm"
+-echo "rm -f /boot/vmlinuz-$KERNELRELEASE /boot/System.map-$KERNELRELEASE"
+-echo "/sbin/installkernel $KERNELRELEASE /boot/.vmlinuz-$KERNELRELEASE-rpm /boot/.System.map-$KERNELRELEASE-rpm"
+-echo "rm -f /boot/.vmlinuz-$KERNELRELEASE-rpm /boot/.System.map-$KERNELRELEASE-rpm"
++echo "if [ -x /sbin/dracut ]; then"
++echo '/sbin/new-kernel-pkg --dracut --mkinitrd --depmod --install --make-default '"$KERNELRELEASE"' || exit $?'
++echo "else"
++echo '/sbin/new-kernel-pkg --mkinitrd --depmod --install --make-default '"$KERNELRELEASE"' || exit $?'
+ echo "fi"
+ echo ""
+ echo "%files"
+-echo '%defattr (-, root, root)'
+-echo "/lib/modules/$KERNELRELEASE"
++echo '%defattr (400, root, root, 500)'
+ echo "%exclude /lib/modules/$KERNELRELEASE/build"
+ echo "%exclude /lib/modules/$KERNELRELEASE/source"
++echo "/lib/modules/$KERNELRELEASE"
+ echo "/lib/firmware/$KERNELRELEASE"
+ echo "/boot/*"
+ echo ""
+@@ -152,9 +163,11 @@ echo "/usr/include"
+ echo ""
+ if ! $PREBUILT; then
+ echo "%files devel"
+-echo '%defattr (-, root, root)'
++echo '%defattr (400, root, root, 500)'
++echo "%dir /lib/modules/$KERNELRELEASE"
+ echo "/usr/src/kernels/$KERNELRELEASE"
+-echo "/lib/modules/$KERNELRELEASE/build"
+-echo "/lib/modules/$KERNELRELEASE/source"
++echo "%attr (500, root, root) /usr/src/kernels/$KERNELRELEASE/scripts/recordmcount"
++echo "%attr (500, root, root) /usr/src/kernels/$KERNELRELEASE/scripts/basic/fixdep"
++echo "%attr (500, root, root) /usr/src/kernels/$KERNELRELEASE/scripts/mod/modpost"
+ echo ""
+ fi
+diff --git a/scripts/pnmtologo.c b/scripts/pnmtologo.c
+index 4718d78..9220d58 100644
+--- a/scripts/pnmtologo.c
++++ b/scripts/pnmtologo.c
+@@ -244,14 +244,14 @@ static void write_header(void)
+     fprintf(out, " *  Linux logo %s\n", logoname);
+     fputs(" */\n\n", out);
+     fputs("#include <linux/linux_logo.h>\n\n", out);
+-    fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
++    fprintf(out, "static unsigned char %s_data[] = {\n",
+ 	    logoname);
+ }
+ 
+ static void write_footer(void)
+ {
+     fputs("\n};\n\n", out);
+-    fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
++    fprintf(out, "const struct linux_logo %s = {\n", logoname);
+     fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
+     fprintf(out, "\t.width\t\t= %d,\n", logo_width);
+     fprintf(out, "\t.height\t\t= %d,\n", logo_height);
+@@ -381,7 +381,7 @@ static void write_logo_clut224(void)
+     fputs("\n};\n\n", out);
+ 
+     /* write logo clut */
+-    fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
++    fprintf(out, "static unsigned char %s_clut[] = {\n",
+ 	    logoname);
+     write_hex_cnt = 0;
+     for (i = 0; i < logo_clutsize; i++) {
+diff --git a/scripts/sortextable.h b/scripts/sortextable.h
+index ba87004..3f4852c 100644
+--- a/scripts/sortextable.h
++++ b/scripts/sortextable.h
+@@ -108,9 +108,9 @@ do_func(Elf_Ehdr *ehdr, char const *const fname, table_sort_t custom_sort)
+ 	const char *secstrtab;
+ 	const char *strtab;
+ 	char *extab_image;
+-	int extab_index = 0;
+-	int i;
+-	int idx;
++	unsigned int extab_index = 0;
++	unsigned int i;
++	unsigned int idx;
+ 	unsigned int num_sections;
+ 	unsigned int secindex_strings;
+ 
+diff --git a/scripts/tags.sh b/scripts/tags.sh
+index 23ba1c6..cad2484 100755
+--- a/scripts/tags.sh
++++ b/scripts/tags.sh
+@@ -26,7 +26,7 @@ else
+ fi
+ 
+ # ignore userspace tools
+-ignore="$ignore ( -path ${tree}tools ) -prune -o"
++ignore="$ignore ( -path \"${tree}tools/[^g]*\" ) -prune -o"
+ 
+ # Find all available archs
+ find_all_archs()
+diff --git a/security/Kconfig b/security/Kconfig
+index e452378..8059bd2 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -4,6 +4,993 @@
+ 
+ menu "Security options"
+ 
++menu "Grsecurity"
 +
-+	return false;
-+}
-+
-+static tree create_string_param(tree string)
-+{
-+	tree i_type, a_type;
-+	const int length = TREE_STRING_LENGTH(string);
++	config ARCH_TRACK_EXEC_LIMIT
++	bool
 +
-+	gcc_assert(length > 0);
++	config PAX_KERNEXEC_PLUGIN
++	bool
++	depends on GCC_PLUGINS
 +
-+	i_type = build_index_type(build_int_cst(NULL_TREE, length - 1));
-+	a_type = build_array_type(char_type_node, i_type);
++	config PAX_PER_CPU_PGD
++	bool
 +
-+	TREE_TYPE(string) = a_type;
-+	TREE_CONSTANT(string) = 1;
-+	TREE_READONLY(string) = 1;
++	config TASK_SIZE_MAX_SHIFT
++	int
++	depends on X86_64
++	default 47 if !PAX_PER_CPU_PGD
++	default 42 if PAX_PER_CPU_PGD
 +
-+	return build1(ADDR_EXPR, ptr_type_node, string);
-+}
++	config PAX_ENABLE_PAE
++	bool
++	default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
++	
++	config PAX_USERCOPY_SLABS
++	bool
 +
-+static void insert_cond(basic_block cond_bb, tree arg, enum tree_code cond_code, tree type_value)
-+{
-+	gcond *cond_stmt;
-+	gimple_stmt_iterator gsi = gsi_last_bb(cond_bb);
++config GRKERNSEC
++	bool "Grsecurity"
++	select CRYPTO
++	select CRYPTO_SHA256
++	select PROC_FS
++	select STOP_MACHINE
++	select TTY
++	select DEBUG_KERNEL
++	select DEBUG_LIST
++	select MULTIUSER
++	help
++	  If you say Y here, you will be able to configure many features
++	  that will enhance the security of your system.  It is highly
++	  recommended that you say Y here and read through the help
++	  for each option so that you fully understand the features and
++	  can evaluate their usefulness for your machine.
 +
-+	cond_stmt = gimple_build_cond(cond_code, arg, type_value, NULL_TREE, NULL_TREE);
-+	gsi_insert_after(&gsi, cond_stmt, GSI_CONTINUE_LINKING);
-+	update_stmt(cond_stmt);
-+}
++choice
++	prompt "Configuration Method"
++	depends on GRKERNSEC
++	default GRKERNSEC_CONFIG_CUSTOM
++	help
 +
-+static void insert_cond_result(interesting_stmts_t expand_from, basic_block bb_true, const_gimple stmt, const_tree arg, bool min)
-+{
-+	gcall *func_stmt;
-+	const_gimple def_stmt;
-+	const_tree loc_line;
-+	tree loc_file, ssa_name, current_func;
-+	expanded_location xloc;
-+	char *ssa_name_buf;
-+	int len;
-+	struct cgraph_edge *edge;
-+	struct cgraph_node *report_node;
-+	int frequency;
-+	gimple_stmt_iterator gsi = gsi_start_bb(bb_true);
++config GRKERNSEC_CONFIG_AUTO
++	bool "Automatic"
++	help
++	  If you choose this configuration method, you'll be able to answer a small
++	  number of simple questions about how you plan to use this kernel.
++	  The settings of grsecurity and PaX will be automatically configured for
++	  the highest commonly-used settings within the provided constraints.
 +
-+	def_stmt = get_def_stmt(arg);
-+	if (gimple_has_location(def_stmt))
-+		xloc = expand_location(gimple_location(def_stmt));
-+	else if (gimple_has_location(stmt))
-+		xloc = expand_location(gimple_location(stmt));
-+	else
-+		xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
++	  If you require additional configuration, custom changes can still be made
++	  from the "custom configuration" menu.
 +
-+	loc_line = build_int_cstu(unsigned_type_node, xloc.line);
++config GRKERNSEC_CONFIG_CUSTOM
++	bool "Custom"
++	help
++	  If you choose this configuration method, you'll be able to configure all
++	  grsecurity and PaX settings manually.  Via this method, no options are
++	  automatically enabled.
 +
-+	loc_file = build_string(strlen(xloc.file) + 1, xloc.file);
-+	loc_file = create_string_param(loc_file);
++	  Take note that if menuconfig is exited with this configuration method
++	  chosen, you will not be able to use the automatic configuration methods
++	  without starting again with a kernel configuration with no grsecurity
++	  or PaX options specified inside.
 +
-+	current_func = build_string(DECL_NAME_LENGTH(current_function_decl) + 1, DECL_NAME_POINTER(current_function_decl));
-+	current_func = create_string_param(current_func);
++endchoice
 +
-+	gcc_assert(DECL_NAME(SSA_NAME_VAR(arg)) != NULL);
-+	call_count++;
-+	len = asprintf(&ssa_name_buf, "%s_%u %s, count: %u, decl: %s; num: %u; context: %s;\n", DECL_NAME_POINTER(SSA_NAME_VAR(arg)), SSA_NAME_VERSION(arg), min ? "min" : "max", call_count, expand_from->next_node->decl_name, expand_from->next_node->num, expand_from->next_node->context);
-+	gcc_assert(len > 0);
-+	ssa_name = build_string(len + 1, ssa_name_buf);
-+	free(ssa_name_buf);
-+	ssa_name = create_string_param(ssa_name);
++choice
++	prompt "Usage Type"
++	depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
++	default GRKERNSEC_CONFIG_SERVER
++	help
 +
-+	// void report_size_overflow(const char *file, unsigned int line, const char *func, const char *ssa_name)
-+	func_stmt = as_a_gcall(gimple_build_call(report_size_overflow_decl, 4, loc_file, loc_line, current_func, ssa_name));
-+	gsi_insert_after(&gsi, func_stmt, GSI_CONTINUE_LINKING);
++config GRKERNSEC_CONFIG_SERVER
++	bool "Server"
++	help
++	  Choose this option if you plan to use this kernel on a server.
 +
-+	report_node = cgraph_get_create_node(report_size_overflow_decl);
-+	gcc_assert(report_node);
-+	frequency = compute_call_stmt_bb_frequency(current_function_decl, bb_true);
++config GRKERNSEC_CONFIG_DESKTOP
++	bool "Desktop"
++	help
++	  Choose this option if you plan to use this kernel on a desktop.
 +
-+	edge = cgraph_create_edge(get_cnode(current_function_decl), report_node, func_stmt, bb_true->count, frequency, bb_true->loop_depth);
-+	gcc_assert(edge != NULL);
-+}
++endchoice
 +
-+static void insert_check_size_overflow(interesting_stmts_t expand_from, gimple stmt, enum tree_code cond_code, tree arg, tree type_value, bool before, bool min)
-+{
-+	basic_block cond_bb, join_bb, bb_true;
-+	edge e;
-+	gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
++choice
++	prompt "Virtualization Type"
++	depends on (GRKERNSEC && X86 && GRKERNSEC_CONFIG_AUTO)
++	default GRKERNSEC_CONFIG_VIRT_NONE
++	help
 +
-+	cond_bb = gimple_bb(stmt);
-+	if (before)
-+		gsi_prev(&gsi);
-+	if (gsi_end_p(gsi))
-+		e = split_block_after_labels(cond_bb);
-+	else
-+		e = split_block(cond_bb, gsi_stmt(gsi));
-+	cond_bb = e->src;
-+	join_bb = e->dest;
-+	e->flags = EDGE_FALSE_VALUE;
-+	e->probability = REG_BR_PROB_BASE;
++config GRKERNSEC_CONFIG_VIRT_NONE
++	bool "None"
++	help
++	  Choose this option if this kernel will be run on bare metal.
 +
-+	bb_true = create_empty_bb(cond_bb);
-+	make_edge(cond_bb, bb_true, EDGE_TRUE_VALUE);
-+	make_edge(cond_bb, join_bb, EDGE_FALSE_VALUE);
-+	make_edge(bb_true, join_bb, EDGE_FALLTHRU);
++config GRKERNSEC_CONFIG_VIRT_GUEST
++	bool "Guest"
++	help
++	  Choose this option if this kernel will be run as a VM guest.
 +
-+	gcc_assert(dom_info_available_p(CDI_DOMINATORS));
-+	set_immediate_dominator(CDI_DOMINATORS, bb_true, cond_bb);
-+	set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
++config GRKERNSEC_CONFIG_VIRT_HOST
++	bool "Host"
++	help
++	  Choose this option if this kernel will be run as a VM host.
 +
-+	if (current_loops != NULL) {
-+		gcc_assert(cond_bb->loop_father == join_bb->loop_father);
-+		add_bb_to_loop(bb_true, cond_bb->loop_father);
-+	}
++endchoice
 +
-+	insert_cond(cond_bb, arg, cond_code, type_value);
-+	insert_cond_result(expand_from, bb_true, stmt, arg, min);
++choice
++	prompt "Virtualization Hardware"
++	depends on (GRKERNSEC && X86 && GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_GUEST || GRKERNSEC_CONFIG_VIRT_HOST))
++	help
 +
-+//	print_the_code_insertions(stmt);
-+}
++config GRKERNSEC_CONFIG_VIRT_EPT
++	bool "EPT/RVI Processor Support"
++	depends on X86
++	help
++	  Choose this option if your CPU supports the EPT or RVI features of 2nd-gen
++	  hardware virtualization.  This allows for additional kernel hardening protections
++	  to operate without additional performance impact.
 +
-+void check_size_overflow(interesting_stmts_t expand_from, gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, bool before)
-+{
-+	const_tree rhs_type = TREE_TYPE(rhs);
-+	tree cast_rhs_type, type_max_type, type_min_type, type_max, type_min;
++	  To see if your Intel processor supports EPT, see:
++	  http://ark.intel.com/Products/VirtualizationTechnology
++	  (Most Core i3/5/7 support EPT)
 +
-+	if (pointer_set_contains(expand_from->visited->no_cast_check, stmt))
-+		return;
++	  To see if your AMD processor supports RVI, see:
++	  http://support.amd.com/us/kbarticles/Pages/GPU120AMDRVICPUsHyperVWin8.aspx
 +
-+	gcc_assert(rhs_type != NULL_TREE);
-+	if (TREE_CODE(rhs_type) == POINTER_TYPE)
-+		return;
++config GRKERNSEC_CONFIG_VIRT_SOFT
++	bool "First-gen/No Hardware Virtualization"
++	help
++	  Choose this option if you use an Atom/Pentium/Core 2 processor that either doesn't
++	  support hardware virtualization or doesn't support the EPT/RVI extensions.
 +
-+	gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE);
++endchoice
 +
-+	if (is_gimple_assign(stmt) && neg_short_add_intentional_overflow(as_a_gassign(stmt)))
-+		return;
++choice
++	prompt "Virtualization Software"
++	depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_GUEST || GRKERNSEC_CONFIG_VIRT_HOST))
++	help
 +
-+	type_max = cast_a_tree(size_overflow_type, TYPE_MAX_VALUE(rhs_type));
-+	// typemax (-1) < typemin (0)
-+	if (TREE_OVERFLOW(type_max))
-+		return;
++config GRKERNSEC_CONFIG_VIRT_XEN
++	bool "Xen"
++	help
++	  Choose this option if this kernel is running as a Xen guest or host.
 +
-+	type_min = cast_a_tree(size_overflow_type, TYPE_MIN_VALUE(rhs_type));
++config GRKERNSEC_CONFIG_VIRT_VMWARE
++	bool "VMWare"
++	help
++	  Choose this option if this kernel is running as a VMWare guest or host.
 +
-+	cast_rhs_type = TREE_TYPE(cast_rhs);
-+	type_max_type = TREE_TYPE(type_max);
-+	gcc_assert(types_compatible_p(cast_rhs_type, type_max_type));
++config GRKERNSEC_CONFIG_VIRT_KVM
++	bool "KVM"
++	help
++	  Choose this option if this kernel is running as a KVM guest or host.
 +
-+	insert_check_size_overflow(expand_from, stmt, GT_EXPR, cast_rhs, type_max, before, MAX_CHECK);
++config GRKERNSEC_CONFIG_VIRT_VIRTUALBOX
++	bool "VirtualBox"
++	help
++	  Choose this option if this kernel is running as a VirtualBox guest or host.
 +
-+	// special case: get_size_overflow_type(), 32, u64->s
-+	if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode) && TYPE_UNSIGNED(size_overflow_type) && !TYPE_UNSIGNED(rhs_type))
-+		return;
++config GRKERNSEC_CONFIG_VIRT_HYPERV
++	bool "Hyper-V"
++	help
++	  Choose this option if this kernel is running as a Hyper-V guest.
 +
-+	type_min_type = TREE_TYPE(type_min);
-+	gcc_assert(types_compatible_p(type_max_type, type_min_type));
-+	insert_check_size_overflow(expand_from, stmt, LT_EXPR, cast_rhs, type_min, before, MIN_CHECK);
-+}
++endchoice
 +
-+static tree get_my_stmt_lhs(struct visited *visited, gimple stmt)
-+{
-+	gimple_stmt_iterator gsi;
-+	gimple next_stmt = NULL;
++choice
++	prompt "Required Priorities"
++	depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
++	default GRKERNSEC_CONFIG_PRIORITY_PERF
++	help
 +
-+	gsi = gsi_for_stmt(stmt);
++config GRKERNSEC_CONFIG_PRIORITY_PERF
++	bool "Performance"
++	help
++	  Choose this option if performance is of highest priority for this deployment
++	  of grsecurity.  Features like UDEREF on a 64bit kernel, kernel stack clearing,
++	  clearing of structures intended for userland, and freed memory sanitizing will
++	  be disabled.
 +
-+	do {
-+		gsi_next(&gsi);
-+		next_stmt = gsi_stmt(gsi);
++config GRKERNSEC_CONFIG_PRIORITY_SECURITY
++	bool "Security"
++	help
++	  Choose this option if security is of highest priority for this deployment of
++	  grsecurity.  UDEREF, kernel stack clearing, clearing of structures intended
++	  for userland, and freed memory sanitizing will be enabled for this kernel.
++	  In a worst-case scenario, these features can introduce a 20% performance hit
++	  (UDEREF on x64 contributing half of this hit).
 +
-+		if (gimple_code(stmt) == GIMPLE_PHI && !pointer_set_contains(visited->my_stmts, next_stmt))
-+			return NULL_TREE;
++endchoice
 +
-+		if (pointer_set_contains(visited->my_stmts, next_stmt) && !pointer_set_contains(visited->skip_expr_casts, next_stmt))
-+			break;
++menu "Default Special Groups"
++depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
 +
-+		gcc_assert(pointer_set_contains(visited->my_stmts, next_stmt));
-+	} while (!gsi_end_p(gsi));
++config GRKERNSEC_PROC_GID
++	int "GID exempted from /proc restrictions"
++	default 1001
++	help
++	  Setting this GID determines which group will be exempted from
++	  grsecurity's /proc restrictions, allowing users of the specified
++	  group  to view network statistics and the existence of other users'
++	  processes on the system.  This GID may also be chosen at boot time
++	  via "grsec_proc_gid=" on the kernel commandline.
 +
-+	gcc_assert(next_stmt);
-+	return get_lhs(next_stmt);
-+}
++config GRKERNSEC_TPE_UNTRUSTED_GID
++        int "GID for TPE-untrusted users"
++        depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
++        default 1005
++        help
++	  Setting this GID determines which group untrusted users should
++	  be added to.  These users will be placed under grsecurity's Trusted Path
++	  Execution mechanism, preventing them from executing their own binaries.
++	  The users will only be able to execute binaries in directories owned and
++	  writable only by the root user.  If the sysctl option is enabled, a sysctl
++	  option with name "tpe_gid" is created.
 +
-+/* When the result of the negation is cast to a signed type then move
-+ * the size_overflow cast check before negation.
-+ * ssa:
-+ * unsigned _588
-+ * _588 = _587 >> 12;
-+ * _589 = -_588;
-+ * _590 = (long int) _589;
-+ */
-+static bool handle_unsigned_neg_or_bit_not(interesting_stmts_t expand_from, const gassign *stmt)
-+{
-+	gimple def_neg_stmt, neg_stmt;
-+	tree lhs, new_neg_rhs;
-+	const_tree rhs, neg_rhs;
-+	enum tree_code rhs_code;
++config GRKERNSEC_TPE_TRUSTED_GID
++        int "GID for TPE-trusted users"
++        depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
++        default 1005
++        help
++          Setting this GID determines what group TPE restrictions will be
++          *disabled* for.  If the sysctl option is enabled, a sysctl option
++          with name "tpe_gid" is created.
 +
-+	rhs = gimple_assign_rhs1(stmt);
-+	lhs = gimple_assign_lhs(stmt);
-+	if (TYPE_UNSIGNED(TREE_TYPE(lhs)) || !TYPE_UNSIGNED(TREE_TYPE(rhs)))
-+		return false;
++config GRKERNSEC_SYMLINKOWN_GID
++        int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
++        depends on GRKERNSEC_CONFIG_SERVER
++        default 1006
++        help
++          Setting this GID determines what group kernel-enforced
++          SymlinksIfOwnerMatch will be enabled for.  If the sysctl option
++          is enabled, a sysctl option with name "symlinkown_gid" is created.
 +
-+	neg_stmt = get_def_stmt(rhs);
-+	if (!neg_stmt || !is_gimple_assign(neg_stmt))
-+		return false;
 +
-+	rhs_code = gimple_assign_rhs_code(neg_stmt);
-+	if (rhs_code != BIT_NOT_EXPR && rhs_code != NEGATE_EXPR)
-+		return false;
++endmenu
 +
-+	neg_rhs = gimple_assign_rhs1(neg_stmt);
-+	def_neg_stmt = get_def_stmt(neg_rhs);
-+	if (!def_neg_stmt)
-+		return false;
++menu "Customize Configuration"
++depends on GRKERNSEC
 +
-+	new_neg_rhs = get_my_stmt_lhs(expand_from->visited, def_neg_stmt);
-+	check_size_overflow(expand_from, neg_stmt, TREE_TYPE(new_neg_rhs), new_neg_rhs, lhs, BEFORE_STMT);
-+	pointer_set_insert(expand_from->visited->no_cast_check, stmt);
-+	return true;
-+}
++menu "PaX"
 +
-+static tree create_cast_overflow_check(interesting_stmts_t expand_from, tree new_rhs1, gassign *stmt)
-+{
-+	bool cast_lhs, cast_rhs;
-+	tree lhs = gimple_assign_lhs(stmt);
-+	tree rhs = gimple_assign_rhs1(stmt);
-+	const_tree lhs_type = TREE_TYPE(lhs);
-+	const_tree rhs_type = TREE_TYPE(rhs);
-+	enum machine_mode lhs_mode = TYPE_MODE(lhs_type);
-+	enum machine_mode rhs_mode = TYPE_MODE(rhs_type);
-+	unsigned int lhs_size = GET_MODE_BITSIZE(lhs_mode);
-+	unsigned int rhs_size = GET_MODE_BITSIZE(rhs_mode);
++config PAX
++	bool "Enable various PaX features"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
++	help
++	  This allows you to enable various PaX features.  PaX adds
++	  intrusion prevention mechanisms to the kernel that reduce
++	  the risks posed by exploitable memory corruption bugs.
 +
-+	static bool check_lhs[3][4] = {
-+		// ss    su     us     uu
-+		{ false, true,  true,  false }, // lhs > rhs
-+		{ false, false, false, false }, // lhs = rhs
-+		{ true,  true,  true,  true  }, // lhs < rhs
-+	};
++menu "PaX Control"
++	depends on PAX
 +
-+	static bool check_rhs[3][4] = {
-+		// ss    su     us     uu
-+		{ true,  false, true,  true  }, // lhs > rhs
-+		{ true,  false, true,  true  }, // lhs = rhs
-+		{ true,  false, true,  true  }, // lhs < rhs
-+	};
++config PAX_SOFTMODE
++	bool 'Support soft mode'
++	help
++	  Enabling this option will allow you to run PaX in soft mode, that
++	  is, PaX features will not be enforced by default, only on executables
++	  marked explicitly.  You must also enable PT_PAX_FLAGS or XATTR_PAX_FLAGS
++	  support as they are the only way to mark executables for soft mode use.
 +
-+	if (handle_unsigned_neg_or_bit_not(expand_from, stmt))
-+		return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++	  Soft mode can be activated by using the "pax_softmode=1" kernel command
++	  line option on boot.  Furthermore you can control various PaX features
++	  at runtime via the entries in /proc/sys/kernel/pax.
 +
-+	// skip lhs check on HI -> QI cast
-+	if (rhs_mode == HImode && lhs_mode == QImode) {
-+		pointer_set_insert(expand_from->visited->no_cast_check, stmt);
-+		return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
-+	}
++config PAX_EI_PAX
++	bool 'Use legacy ELF header marking'
++	default y if GRKERNSEC_CONFIG_AUTO
++	help
++	  Enabling this option will allow you to control PaX features on
++	  a per executable basis via the 'chpax' utility available at
++	  http://pax.grsecurity.net/.  The control flags will be read from
++	  an otherwise reserved part of the ELF header.  This marking has
++	  numerous drawbacks (no support for soft-mode, toolchain does not
++	  know about the non-standard use of the ELF header) therefore it
++	  has been deprecated in favour of PT_PAX_FLAGS and XATTR_PAX_FLAGS
++	  support.
 +
-+	// skip lhs check on signed SI -> HI cast or signed SI -> QI cast
-+	if (rhs_mode == SImode && !TYPE_UNSIGNED(rhs_type) && (lhs_mode == HImode || lhs_mode == QImode))
-+		return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
++	  Note that if you enable PT_PAX_FLAGS or XATTR_PAX_FLAGS marking
++	  support as well, they will override the legacy EI_PAX marks.
 +
-+	if (lhs_size > rhs_size) {
-+		cast_lhs = check_lhs[0][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
-+		cast_rhs = check_rhs[0][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
-+	} else if (lhs_size == rhs_size) {
-+		cast_lhs = check_lhs[1][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
-+		cast_rhs = check_rhs[1][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
-+	} else {
-+		cast_lhs = check_lhs[2][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
-+		cast_rhs = check_rhs[2][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
-+	}
++	  If you enable none of the marking options then all applications
++	  will run with PaX enabled on them by default.
 +
-+	if (!cast_lhs && !cast_rhs)
-+		return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++config PAX_PT_PAX_FLAGS
++	bool 'Use ELF program header marking'
++	default y if GRKERNSEC_CONFIG_AUTO
++	help
++	  Enabling this option will allow you to control PaX features on
++	  a per executable basis via the 'paxctl' utility available at
++	  http://pax.grsecurity.net/.  The control flags will be read from
++	  a PaX specific ELF program header (PT_PAX_FLAGS).  This marking
++	  has the benefits of supporting both soft mode and being fully
++	  integrated into the toolchain (the binutils patch is available
++	  from http://pax.grsecurity.net).
 +
-+	if (cast_lhs && !skip_lhs_cast_check(expand_from->visited, stmt))
-+		check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs1), new_rhs1, lhs, BEFORE_STMT);
++	  Note that if you enable the legacy EI_PAX marking support as well,
++	  the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
 +
-+	if (cast_rhs)
-+		check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs1), new_rhs1, rhs, BEFORE_STMT);
++	  If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
++	  must make sure that the marks are the same if a binary has both marks.
 +
-+	return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
-+}
++	  If you enable none of the marking options then all applications
++	  will run with PaX enabled on them by default.
 +
-+static tree handle_unary_rhs(interesting_stmts_t expand_from, gassign *stmt)
-+{
-+	enum tree_code rhs_code;
-+	tree rhs1, new_rhs1, lhs = gimple_assign_lhs(stmt);
++config PAX_XATTR_PAX_FLAGS
++	bool 'Use filesystem extended attributes marking'
++	default y if GRKERNSEC_CONFIG_AUTO
++	select CIFS_XATTR if CIFS
++	select EXT2_FS_XATTR if EXT2_FS
++	select EXT3_FS_XATTR if EXT3_FS
++	select F2FS_FS_XATTR if F2FS_FS
++	select JFFS2_FS_XATTR if JFFS2_FS
++	select REISERFS_FS_XATTR if REISERFS_FS
++	select SQUASHFS_XATTR if SQUASHFS
++	select TMPFS_XATTR if TMPFS
++	help
++	  Enabling this option will allow you to control PaX features on
++	  a per executable basis via the 'setfattr' utility.  The control
++	  flags will be read from the user.pax.flags extended attribute of
++	  the file.  This marking has the benefit of supporting binary-only
++	  applications that self-check themselves (e.g., skype) and would
++	  not tolerate chpax/paxctl changes.  The main drawback is that
++	  extended attributes are not supported by some filesystems (e.g.,
++	  isofs, udf, vfat) so copying files through such filesystems will
++	  lose the extended attributes and these PaX markings.
 +
-+	if (pointer_set_contains(expand_from->visited->my_stmts, stmt))
-+		return lhs;
++	  Note that if you enable the legacy EI_PAX marking support as well,
++	  the EI_PAX marks will be overridden by the XATTR_PAX_FLAGS marks.
 +
-+	rhs1 = gimple_assign_rhs1(stmt);
-+	if (TREE_CODE(TREE_TYPE(rhs1)) == POINTER_TYPE)
-+		return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
++	  If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
++	  must make sure that the marks are the same if a binary has both marks.
 +
-+	new_rhs1 = expand(expand_from, rhs1);
++	  If you enable none of the marking options then all applications
++	  will run with PaX enabled on them by default.
 +
-+	if (new_rhs1 == NULL_TREE)
-+		return create_cast_assign(expand_from->visited, stmt);
++choice
++	prompt 'MAC system integration'
++	default PAX_HAVE_ACL_FLAGS
++	help
++	  Mandatory Access Control systems have the option of controlling
++	  PaX flags on a per executable basis, choose the method supported
++	  by your particular system.
 +
-+	if (pointer_set_contains(expand_from->visited->no_cast_check, stmt))
-+		return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++	  - "none": if your MAC system does not interact with PaX,
++	  - "direct": if your MAC system defines pax_set_initial_flags() itself,
++	  - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
 +
-+#if BUILDING_GCC_VERSION >= 5000
-+	if (short_or_neg_const_ushort(stmt)) {
-+		pointer_set_insert(expand_from->visited->no_cast_check, stmt);
-+		return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
-+	}
-+#endif
++	  NOTE: this option is for developers/integrators only.
 +
-+	rhs_code = gimple_assign_rhs_code(stmt);
-+	if (rhs_code == BIT_NOT_EXPR || rhs_code == NEGATE_EXPR) {
-+		tree size_overflow_type = get_size_overflow_type(expand_from->visited, stmt, rhs1);
++	config PAX_NO_ACL_FLAGS
++		bool 'none'
 +
-+		new_rhs1 = cast_to_new_size_overflow_type(expand_from->visited, stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
-+		check_size_overflow(expand_from, stmt, size_overflow_type, new_rhs1, rhs1, BEFORE_STMT);
-+		return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
-+	}
++	config PAX_HAVE_ACL_FLAGS
++		bool 'direct'
 +
-+	if (!gimple_assign_cast_p(stmt))
-+		return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++	config PAX_HOOK_ACL_FLAGS
++		bool 'hook'
++endchoice
 +
-+	return create_cast_overflow_check(expand_from, new_rhs1, stmt);
-+}
++endmenu
 +
-+static tree handle_unary_ops(interesting_stmts_t expand_from, gassign *stmt)
-+{
-+	tree rhs1, lhs = gimple_assign_lhs(stmt);
-+	gimple def_stmt = get_def_stmt(lhs);
++menu "Non-executable pages"
++	depends on PAX
 +
-+	gcc_assert(gimple_code(def_stmt) != GIMPLE_NOP);
-+	rhs1 = gimple_assign_rhs1(def_stmt);
++config PAX_NOEXEC
++	bool "Enforce non-executable pages"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on ALPHA || (ARM && (CPU_V6 || CPU_V6K || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86
++	help
++	  By design some architectures do not allow for protecting memory
++	  pages against execution or even if they do, Linux does not make
++	  use of this feature.  In practice this means that if a page is
++	  readable (such as the stack or heap) it is also executable.
 +
-+	if (is_gimple_constant(rhs1))
-+		return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
++	  There is a well known exploit technique that makes use of this
++	  fact and a common programming mistake where an attacker can
++	  introduce code of his choice somewhere in the attacked program's
++	  memory (typically the stack or the heap) and then execute it.
 +
-+	switch (TREE_CODE(rhs1)) {
-+	case SSA_NAME: {
-+		tree ret = handle_unary_rhs(expand_from, as_a_gassign(def_stmt));
++	  If the attacked program was running with different (typically
++	  higher) privileges than that of the attacker, then he can elevate
++	  his own privilege level (e.g. get a root shell, write to files for
++	  which he does not have write access to, etc).
 +
-+		if (gimple_assign_cast_p(stmt))
-+			unsigned_signed_cast_intentional_overflow(expand_from->visited, stmt);
-+		return ret;
-+	}
-+	case ARRAY_REF:
-+	case BIT_FIELD_REF:
-+	case ADDR_EXPR:
-+	case COMPONENT_REF:
-+	case INDIRECT_REF:
-+#if BUILDING_GCC_VERSION >= 4006
-+	case MEM_REF:
-+#endif
-+	case TARGET_MEM_REF:
-+	case VIEW_CONVERT_EXPR:
-+		return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
-+	case PARM_DECL:
-+	case VAR_DECL:
-+		return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
++	  Enabling this option will let you choose from various features
++	  that prevent the injection and execution of 'foreign' code in
++	  a program.
 +
-+	default:
-+		debug_gimple_stmt(def_stmt);
-+		debug_tree(rhs1);
-+		gcc_unreachable();
-+	}
-+}
++	  This will also break programs that rely on the old behaviour and
++	  expect that dynamically allocated memory via the malloc() family
++	  of functions is executable (which it is not).  Notable examples
++	  are the XFree86 4.x server, the java runtime and wine.
 +
-+static void __unused print_the_code_insertions(const_gimple stmt)
-+{
-+	location_t loc = gimple_location(stmt);
++config PAX_PAGEEXEC
++	bool "Paging based non-executable pages"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
++	select ARCH_TRACK_EXEC_LIMIT if X86_32
++	help
++	  This implementation is based on the paging feature of the CPU.
++	  On i386 without hardware non-executable bit support there is a
++	  variable but usually low performance impact, however on Intel's
++	  P4 core based CPUs it is very high so you should not enable this
++	  for kernels meant to be used on such CPUs.
 +
-+	inform(loc, "Integer size_overflow check applied here.");
-+}
++	  On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
++	  with hardware non-executable bit support there is no performance
++	  impact, on ppc the impact is negligible.
 +
-+static bool is_from_cast(const_tree node)
-+{
-+	gimple def_stmt = get_def_stmt(node);
++	  Note that several architectures require various emulations due to
++	  badly designed userland ABIs, this will cause a performance impact
++	  but will disappear as soon as userland is fixed. For example, ppc
++	  userland MUST have been built with secure-plt by a recent toolchain.
 +
-+	if (!def_stmt)
-+		return false;
++config PAX_SEGMEXEC
++	bool "Segmentation based non-executable pages"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on PAX_NOEXEC && X86_32
++	help
++	  This implementation is based on the segmentation feature of the
++	  CPU and has a very small performance impact, however applications
++	  will be limited to a 1.5 GB address space instead of the normal
++	  3 GB.
 +
-+	if (gimple_assign_cast_p(def_stmt))
-+		return true;
++config PAX_EMUTRAMP
++	bool "Emulate trampolines"
++	default y if PARISC || GRKERNSEC_CONFIG_AUTO
++	depends on (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
++	help
++	  There are some programs and libraries that for one reason or
++	  another attempt to execute special small code snippets from
++	  non-executable memory pages.  Most notable examples are the
++	  signal handler return code generated by the kernel itself and
++	  the GCC trampolines.
 +
-+	return false;
-+}
++	  If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
++	  such programs will no longer work under your kernel.
 +
-+// Skip duplication when there is a minus expr and the type of rhs1 or rhs2 is a pointer_type.
-+static bool is_ptr_diff(gassign *stmt)
-+{
-+	const_tree rhs1, rhs2, ptr1_rhs, ptr2_rhs;
++	  As a remedy you can say Y here and use the 'chpax' or 'paxctl'
++	  utilities to enable trampoline emulation for the affected programs
++	  yet still have the protection provided by the non-executable pages.
 +
-+	if (gimple_assign_rhs_code(stmt) != MINUS_EXPR)
-+		return false;
++	  On parisc you MUST enable this option and EMUSIGRT as well, otherwise
++	  your system will not even boot.
 +
-+	rhs1 = gimple_assign_rhs1(stmt);
-+	if (!is_from_cast(rhs1))
-+		return false;
++	  Alternatively you can say N here and use the 'chpax' or 'paxctl'
++	  utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
++	  for the affected files.
 +
-+	rhs2 = gimple_assign_rhs2(stmt);
-+	if (!is_from_cast(rhs2))
-+		return false;
++	  NOTE: enabling this feature *may* open up a loophole in the
++	  protection provided by non-executable pages that an attacker
++	  could abuse.  Therefore the best solution is to not have any
++	  files on your system that would require this option.  This can
++	  be achieved by not using libc5 (which relies on the kernel
++	  signal handler return code) and not using or rewriting programs
++	  that make use of the nested function implementation of GCC.
++	  Skilled users can just fix GCC itself so that it implements
++	  nested function calls in a way that does not interfere with PaX.
 +
-+	ptr1_rhs = gimple_assign_rhs1(get_def_stmt(rhs1));
-+	ptr2_rhs = gimple_assign_rhs1(get_def_stmt(rhs2));
++config PAX_EMUSIGRT
++	bool "Automatically emulate sigreturn trampolines"
++	depends on PAX_EMUTRAMP && PARISC
++	default y
++	help
++	  Enabling this option will have the kernel automatically detect
++	  and emulate signal return trampolines executing on the stack
++	  that would otherwise lead to task termination.
 +
-+	if (TREE_CODE(TREE_TYPE(ptr1_rhs)) != POINTER_TYPE && TREE_CODE(TREE_TYPE(ptr2_rhs)) != POINTER_TYPE)
-+		return false;
++	  This solution is intended as a temporary one for users with
++	  legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
++	  Modula-3 runtime, etc) or executables linked to such, basically
++	  everything that does not specify its own SA_RESTORER function in
++	  normal executable memory like glibc 2.1+ does.
 +
-+	return true;
-+}
++	  On parisc you MUST enable this option, otherwise your system will
++	  not even boot.
 +
-+static tree handle_comparison_code_class(interesting_stmts_t expand_from, gassign *stmt, tree new_rhs1, tree new_rhs2)
-+{
-+	tree rhs1, rhs2, lhs;
++	  NOTE: this feature cannot be disabled on a per executable basis
++	  and since it *does* open up a loophole in the protection provided
++	  by non-executable pages, the best solution is to not have any
++	  files on your system that would require this option.
 +
-+	rhs1 = gimple_assign_rhs1(stmt);
-+	if (!is_gimple_constant(rhs1) && new_rhs1 != NULL_TREE)
-+		check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs1), new_rhs1, rhs1, BEFORE_STMT);
++config PAX_MPROTECT
++	bool "Restrict mprotect()"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
++	help
++	  Enabling this option will prevent programs from
++	   - changing the executable status of memory pages that were
++	     not originally created as executable,
++	   - making read-only executable pages writable again,
++	   - creating executable pages from anonymous memory,
++	   - making read-only-after-relocations (RELRO) data pages writable again.
 +
-+	lhs = gimple_assign_lhs(stmt);
-+	if (new_rhs2 == NULL_TREE)
-+		return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
++	  You should say Y here to complete the protection provided by
++	  the enforcement of non-executable pages.
 +
-+	rhs2 = gimple_assign_rhs2(stmt);
-+	if (!is_gimple_constant(rhs2))
-+		check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs2), new_rhs2, rhs2, BEFORE_STMT);
-+	return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
-+}
++	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
++	  this feature on a per file basis.
 +
-+static tree handle_binary_ops(interesting_stmts_t expand_from, tree lhs)
-+{
-+	enum intentional_overflow_type res;
-+	tree rhs1, rhs2, new_lhs;
-+	gassign *def_stmt = as_a_gassign(get_def_stmt(lhs));
-+	tree new_rhs1 = NULL_TREE;
-+	tree new_rhs2 = NULL_TREE;
++config PAX_MPROTECT_COMPAT
++	bool "Use legacy/compat protection demoting (read help)"
++	depends on PAX_MPROTECT
++	default n
++	help
++	  The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
++	  by sending the proper error code to the application.  For some older
++	  userland, this can cause problems with applications that assume such
++	  allocations will not be prevented by PaX or SELinux and other access
++	  control systems and have no fallback mechanisms.  For modern distros,
++	  this option should generally be set to 'N'.
++	  
++config PAX_ELFRELOCS
++	bool "Allow ELF text relocations (read help)"
++	depends on PAX_MPROTECT
++	default n
++	help
++	  Non-executable pages and mprotect() restrictions are effective
++	  in preventing the introduction of new executable code into an
++	  attacked task's address space.  There remain only two venues
++	  for this kind of attack: if the attacker can execute already
++	  existing code in the attacked task then he can either have it
++	  create and mmap() a file containing his code or have it mmap()
++	  an already existing ELF library that does not have position
++	  independent code in it and use mprotect() on it to make it
++	  writable and copy his code there.  While protecting against
++	  the former approach is beyond PaX, the latter can be prevented
++	  by having only PIC ELF libraries on one's system (which do not
++	  need to relocate their code).  If you are sure this is your case,
++	  as is the case with all modern Linux distributions, then leave
++	  this option disabled.  You should say 'n' here.
 +
-+	if (is_ptr_diff(def_stmt))
-+		return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
++config PAX_ETEXECRELOCS
++	bool "Allow ELF ET_EXEC text relocations"
++	depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
++	select PAX_ELFRELOCS
++	default y
++	help
++	  On some architectures there are incorrectly created applications
++	  that require text relocations and would not work without enabling
++	  this option.  If you are an alpha, ia64 or parisc user, you should
++	  enable this option and disable it once you have made sure that
++	  none of your applications need it.
 +
-+	rhs1 = gimple_assign_rhs1(def_stmt);
-+	rhs2 = gimple_assign_rhs2(def_stmt);
++config PAX_EMUPLT
++	bool "Automatically emulate ELF PLT"
++	depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
++	default y
++	help
++	  Enabling this option will have the kernel automatically detect
++	  and emulate the Procedure Linkage Table entries in ELF files.
++	  On some architectures such entries are in writable memory, and
++	  become non-executable leading to task termination.  Therefore
++	  it is mandatory that you enable this option on alpha, parisc,
++	  sparc and sparc64, otherwise your system would not even boot.
 +
-+	/* no DImode/TImode division in the 32/64 bit kernel */
-+	switch (gimple_assign_rhs_code(def_stmt)) {
-+	case RDIV_EXPR:
-+	case TRUNC_DIV_EXPR:
-+	case CEIL_DIV_EXPR:
-+	case FLOOR_DIV_EXPR:
-+	case ROUND_DIV_EXPR:
-+	case TRUNC_MOD_EXPR:
-+	case CEIL_MOD_EXPR:
-+	case FLOOR_MOD_EXPR:
-+	case ROUND_MOD_EXPR:
-+	case EXACT_DIV_EXPR:
-+	case POINTER_PLUS_EXPR:
-+	case BIT_AND_EXPR:
-+		return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
-+	default:
-+		break;
-+	}
++	  NOTE: this feature *does* open up a loophole in the protection
++	  provided by the non-executable pages, therefore the proper
++	  solution is to modify the toolchain to produce a PLT that does
++	  not need to be writable.
 +
-+	new_lhs = handle_integer_truncation(expand_from, lhs);
-+	if (new_lhs != NULL_TREE)
-+		return new_lhs;
++config PAX_DLRESOLVE
++	bool 'Emulate old glibc resolver stub'
++	depends on PAX_EMUPLT && SPARC
++	default n
++	help
++	  This option is needed if userland has an old glibc (before 2.4)
++	  that puts a 'save' instruction into the runtime generated resolver
++	  stub that needs special emulation.
 +
-+	if (TREE_CODE(rhs1) == SSA_NAME)
-+		new_rhs1 = expand(expand_from, rhs1);
-+	if (TREE_CODE(rhs2) == SSA_NAME)
-+		new_rhs2 = expand(expand_from, rhs2);
++config PAX_KERNEXEC
++	bool "Enforce non-executable kernel pages"
++	default y if GRKERNSEC_CONFIG_AUTO && (!X86 || GRKERNSEC_CONFIG_VIRT_NONE || (GRKERNSEC_CONFIG_VIRT_EPT && GRKERNSEC_CONFIG_VIRT_GUEST) || (GRKERNSEC_CONFIG_VIRT_EPT && GRKERNSEC_CONFIG_VIRT_KVM))
++	depends on (X86 || (ARM && (CPU_V6 || CPU_V6K || CPU_V7) && !(ARM_LPAE && MODULES))) && !XEN
++	select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
++	select PAX_KERNEXEC_PLUGIN if X86_64
++	select ARM_KERNMEM_PERMS if ARM
++	help
++	  This is the kernel land equivalent of PAGEEXEC and MPROTECT,
++	  that is, enabling this option will make it harder to inject
++	  and execute 'foreign' code in kernel memory itself.
 +
-+	res = add_mul_intentional_overflow(def_stmt);
-+	if (res != NO_INTENTIONAL_OVERFLOW) {
-+		new_lhs = dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
-+		insert_cast_expr(expand_from->visited, as_a_gassign(get_def_stmt(new_lhs)), res);
-+		return new_lhs;
-+	}
++	  Note that on amd64, CONFIG_EFI enabled with "efi=old_map" on
++	  the kernel command-line will result in an RWX physical map.
 +
-+	if (skip_expr_on_double_type(def_stmt)) {
-+		new_lhs = dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
-+		insert_cast_expr(expand_from->visited, as_a_gassign(get_def_stmt(new_lhs)), NO_INTENTIONAL_OVERFLOW);
-+		return new_lhs;
-+	}
++	  Likewise, the EFI runtime services are necessarily mapped as
++	  RWX.  If CONFIG_EFI is enabled on an EFI-capable system, it
++	  is recommended that you boot with "noefi" on the kernel
++	  command-line if possible to eliminate the mapping.
 +
-+	if (is_a_neg_overflow(def_stmt, rhs2))
-+		return handle_intentional_overflow(expand_from, true, def_stmt, new_rhs1, NULL_TREE);
-+	if (is_a_neg_overflow(def_stmt, rhs1))
-+		return handle_intentional_overflow(expand_from, true, def_stmt, new_rhs2, new_rhs2);
++choice
++	prompt "Return Address Instrumentation Method"
++	default PAX_KERNEXEC_PLUGIN_METHOD_BTS
++	depends on PAX_KERNEXEC_PLUGIN
++	help
++	  Select the method used to instrument function pointer dereferences.
++	  Note that binary modules cannot be instrumented by this approach.
 +
++	  Note that the implementation requires a gcc with plugin support,
++	  i.e., gcc 4.5 or newer.  You may need to install the supporting
++	  headers explicitly in addition to the normal gcc package.
 +
-+	if (is_a_constant_overflow(def_stmt, rhs2))
-+		return handle_intentional_overflow(expand_from, !is_a_cast_and_const_overflow(rhs1), def_stmt, new_rhs1, NULL_TREE);
-+	if (is_a_constant_overflow(def_stmt, rhs1))
-+		return handle_intentional_overflow(expand_from, !is_a_cast_and_const_overflow(rhs2), def_stmt, new_rhs2, new_rhs2);
++	config PAX_KERNEXEC_PLUGIN_METHOD_BTS
++		bool "bts"
++		help
++		  This method is compatible with binary only modules but has
++		  a higher runtime overhead.
 +
-+	// the const is between 0 and (signed) MAX
-+	if (is_gimple_constant(rhs1))
-+		new_rhs1 = create_assign(expand_from->visited, def_stmt, rhs1, BEFORE_STMT);
-+	if (is_gimple_constant(rhs2))
-+		new_rhs2 = create_assign(expand_from->visited, def_stmt, rhs2, BEFORE_STMT);
++	config PAX_KERNEXEC_PLUGIN_METHOD_OR
++		bool "or"
++		depends on !PARAVIRT
++		help
++		  This method is incompatible with binary only modules but has
++		  a lower runtime overhead.
++endchoice
 +
-+	if (TREE_CODE_CLASS(gimple_assign_rhs_code(def_stmt)) == tcc_comparison)
-+		return handle_comparison_code_class(expand_from, def_stmt, new_rhs1, new_rhs2);
++config PAX_KERNEXEC_PLUGIN_METHOD
++	string
++	default "bts" if PAX_KERNEXEC_PLUGIN_METHOD_BTS
++	default "or" if PAX_KERNEXEC_PLUGIN_METHOD_OR
++	default ""
 +
-+	if (uconst_neg_intentional_overflow(def_stmt)) {
-+		inform(gimple_location(def_stmt), "%s: gcc intentional overflow", __func__);
-+		gcc_unreachable();
-+	}
++config PAX_KERNEXEC_MODULE_TEXT
++	int "Minimum amount of memory reserved for module code"
++	default "8" if (!GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_SERVER)
++	default "12" if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP)
++	depends on PAX_KERNEXEC && X86_32
++	help
++	  Due to implementation details the kernel must reserve a fixed
++	  amount of memory for runtime allocated code (such as modules)
++	  at compile time that cannot be changed at runtime.  Here you
++	  can specify the minimum amount in MB that will be reserved.
++	  Due to the same implementation details this size will always
++	  be rounded up to the next 2/4 MB boundary (depends on PAE) so
++	  the actually available memory for runtime allocated code will
++	  usually be more than this minimum.
 +
-+	return dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
-+}
++	  The default 4 MB should be enough for most users but if you have
++	  an excessive number of modules (e.g., most distribution configs
++	  compile many drivers as modules) or use huge modules such as
++	  nvidia's kernel driver, you will need to adjust this amount.
++	  A good rule of thumb is to look at your currently loaded kernel
++	  modules and add up their sizes.
 +
-+#if BUILDING_GCC_VERSION >= 4006
-+static tree get_new_rhs(interesting_stmts_t expand_from, tree size_overflow_type, tree rhs)
-+{
-+	if (is_gimple_constant(rhs))
-+		return cast_a_tree(size_overflow_type, rhs);
-+	if (TREE_CODE(rhs) != SSA_NAME)
-+		return NULL_TREE;
-+	return expand(expand_from, rhs);
-+}
++endmenu
 +
-+static tree handle_ternary_ops(interesting_stmts_t expand_from, tree lhs)
-+{
-+	tree rhs1, rhs2, rhs3, new_rhs1, new_rhs2, new_rhs3, size_overflow_type;
-+	gassign *def_stmt = as_a_gassign(get_def_stmt(lhs));
++menu "Address Space Layout Randomization"
++	depends on PAX
 +
-+	size_overflow_type = get_size_overflow_type(expand_from->visited, def_stmt, lhs);
++config PAX_ASLR
++	bool "Address Space Layout Randomization"
++	default y if GRKERNSEC_CONFIG_AUTO
++	help
++	  Many if not most exploit techniques rely on the knowledge of
++	  certain addresses in the attacked program.  The following options
++	  will allow the kernel to apply a certain amount of randomization
++	  to specific parts of the program thereby forcing an attacker to
++	  guess them in most cases.  Any failed guess will most likely crash
++	  the attacked program which allows the kernel to detect such attempts
++	  and react on them.  PaX itself provides no reaction mechanisms,
++	  instead it is strongly encouraged that you make use of grsecurity's
++	  (http://www.grsecurity.net/) built-in crash detection features or
++	  develop one yourself.
 +
-+	rhs1 = gimple_assign_rhs1(def_stmt);
-+	rhs2 = gimple_assign_rhs2(def_stmt);
-+	rhs3 = gimple_assign_rhs3(def_stmt);
-+	new_rhs1 = get_new_rhs(expand_from, size_overflow_type, rhs1);
-+	new_rhs2 = get_new_rhs(expand_from, size_overflow_type, rhs2);
-+	new_rhs3 = get_new_rhs(expand_from, size_overflow_type, rhs3);
++	  By saying Y here you can choose to randomize the following areas:
++	   - top of the task's kernel stack
++	   - top of the task's userland stack
++	   - base address for mmap() requests that do not specify one
++	     (this includes all libraries)
++	   - base address of the main executable
 +
-+	return dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, new_rhs3);
-+}
-+#endif
++	  It is strongly recommended to say Y here as address space layout
++	  randomization has negligible impact on performance yet it provides
++	  a very effective protection.
 +
-+static tree expand_visited(struct visited *visited, gimple def_stmt)
-+{
-+	gimple_stmt_iterator gsi;
-+	enum gimple_code code = gimple_code(def_stmt);
++	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
++	  this feature on a per file basis.
 +
-+	if (code == GIMPLE_ASM)
-+		return NULL_TREE;
++config PAX_RANDKSTACK
++	bool "Randomize kernel stack base"
++	default y if GRKERNSEC_CONFIG_AUTO && !(GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_VIRTUALBOX)
++	depends on X86_TSC && X86
++	help
++	  By saying Y here the kernel will randomize every task's kernel
++	  stack on every system call.  This will not only force an attacker
++	  to guess it but also prevent him from making use of possible
++	  leaked information about it.
 +
-+	gsi = gsi_for_stmt(def_stmt);
-+	gsi_next(&gsi);
++	  Since the kernel stack is a rather scarce resource, randomization
++	  may cause unexpected stack overflows, therefore you should very
++	  carefully test your system.  Note that once enabled in the kernel
++	  configuration, this feature cannot be disabled on a per file basis.
 +
-+	if (gimple_code(def_stmt) == GIMPLE_PHI && gsi_end_p(gsi))
-+		return NULL_TREE;
-+	return get_my_stmt_lhs(visited, def_stmt);
-+}
++config PAX_RANDUSTACK
++	bool
 +
-+tree expand(interesting_stmts_t expand_from, tree lhs)
-+{
-+	gimple def_stmt;
++config PAX_RANDMMAP
++	bool "Randomize user stack and mmap() bases"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on PAX_ASLR
++	select PAX_RANDUSTACK
++	help
++	  By saying Y here the kernel will randomize every task's userland
++	  stack and use a randomized base address for mmap() requests that
++	  do not specify one themselves.
 +
-+	def_stmt = get_def_stmt(lhs);
++	  The stack randomization is done in two steps where the second
++	  one may apply a big amount of shift to the top of the stack and
++	  cause problems for programs that want to use lots of memory (more
++	  than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
 +
-+	if (!def_stmt || gimple_code(def_stmt) == GIMPLE_NOP)
-+		return NULL_TREE;
++	  As a result of mmap randomization all dynamically loaded libraries
++	  will appear at random addresses and therefore be harder to exploit
++	  by a technique where an attacker attempts to execute library code
++	  for his purposes (e.g. spawn a shell from an exploited program that
++	  is running at an elevated privilege level).
 +
-+	if (pointer_set_contains(expand_from->visited->my_stmts, def_stmt))
-+		return lhs;
++	  Furthermore, if a program is relinked as a dynamic ELF file, its
++	  base address will be randomized as well, completing the full
++	  randomization of the address space layout.  Attacking such programs
++	  becomes a guess game.  You can find an example of doing this at
++	  http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
++	  http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
 +
-+	if (pointer_set_contains(expand_from->visited->stmts, def_stmt))
-+		return expand_visited(expand_from->visited, def_stmt);
++	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
++	  feature on a per file basis.
 +
-+	if (is_gimple_constant(lhs))
-+		return NULL_TREE;
-+	if (skip_types(lhs))
-+		return NULL_TREE;
++endmenu
 +
-+	switch (gimple_code(def_stmt)) {
-+	case GIMPLE_PHI:
-+		return handle_phi(expand_from, lhs);
-+	case GIMPLE_CALL:
-+	case GIMPLE_ASM:
-+		if (is_size_overflow_asm(def_stmt))
-+			return expand(expand_from, get_size_overflow_asm_input(as_a_gasm(def_stmt)));
-+		return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
-+	case GIMPLE_ASSIGN:
-+		switch (gimple_num_ops(def_stmt)) {
-+		case 2:
-+			return handle_unary_ops(expand_from, as_a_gassign(def_stmt));
-+		case 3:
-+			return handle_binary_ops(expand_from, lhs);
-+#if BUILDING_GCC_VERSION >= 4006
-+		case 4:
-+			return handle_ternary_ops(expand_from, lhs);
-+#endif
-+		}
-+	default:
-+		debug_gimple_stmt(def_stmt);
-+		error("%s: unknown gimple code", __func__);
-+		gcc_unreachable();
-+	}
-+}
-diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
-new file mode 100644
-index 0000000..8b69bd4
---- /dev/null
-+++ b/tools/gcc/stackleak_plugin.c
-@@ -0,0 +1,350 @@
-+/*
-+ * Copyright 2011-2016 by the PaX Team <pageexec@××××××××.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ *       NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ *       but for the kernel it doesn't matter since it doesn't link against
-+ *       any of the gcc libraries
-+ *
-+ * gcc plugin to help implement various PaX features
-+ *
-+ * - track lowest stack pointer
-+ *
-+ * TODO:
-+ * - initialize all local variables
-+ *
-+ * BUGS:
-+ * - none known
-+ */
++menu "Miscellaneous hardening features"
 +
-+#include "gcc-common.h"
++config PAX_MEMORY_SANITIZE
++	bool "Sanitize all freed memory"
++	default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
++	help
++	  By saying Y here the kernel will erase memory pages and slab objects
++	  as soon as they are freed.  This in turn reduces the lifetime of data
++	  stored in them, making it less likely that sensitive information such
++	  as passwords, cryptographic secrets, etc stay in memory for too long.
 +
-+int plugin_is_GPL_compatible;
++	  This is especially useful for programs whose runtime is short, long
++	  lived processes and the kernel itself benefit from this as long as
++	  they ensure timely freeing of memory that may hold sensitive
++	  information.
 +
-+static int track_frame_size = -1;
-+static const char track_function[] = "pax_track_stack";
-+static const char check_function[] = "pax_check_alloca";
-+static GTY(()) tree track_function_decl;
-+static GTY(()) tree check_function_decl;
-+static bool init_locals;
++	  A nice side effect of the sanitization of slab objects is the
++	  reduction of possible info leaks caused by padding bytes within the
++	  leaky structures.  Use-after-free bugs for structures containing
++	  pointers can also be detected as dereferencing the sanitized pointer
++	  will generate an access violation.
 +
-+static struct plugin_info stackleak_plugin_info = {
-+	.version	= "201602181345",
-+	.help		= "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
-+//			  "initialize-locals\t\tforcibly initialize all stack frames\n"
-+};
++	  The tradeoff is performance impact, on a single CPU system kernel
++	  compilation sees a 3% slowdown, other systems and workloads may vary
++	  and you are advised to test this feature on your expected workload
++	  before deploying it.
 +
-+static void stackleak_check_alloca(gimple_stmt_iterator *gsi)
-+{
-+	gimple stmt;
-+	gcall *check_alloca;
-+	tree alloca_size;
-+	cgraph_node_ptr node;
-+	int frequency;
-+	basic_block bb;
++	  The slab sanitization feature excludes a few slab caches per default
++	  for performance reasons.  To extend the feature to cover those as
++	  well, pass "pax_sanitize_slab=full" as kernel command line parameter.
 +
-+	// insert call to void pax_check_alloca(unsigned long size)
-+	alloca_size = gimple_call_arg(gsi_stmt(*gsi), 0);
-+	stmt = gimple_build_call(check_function_decl, 1, alloca_size);
-+	check_alloca = as_a_gcall(stmt);
-+	gsi_insert_before(gsi, check_alloca, GSI_SAME_STMT);
++	  To reduce the performance penalty by sanitizing pages only, albeit
++	  limiting the effectiveness of this feature at the same time, slab
++	  sanitization can be disabled with the kernel command line parameter
++	  "pax_sanitize_slab=off".
 +
-+	// update the cgraph
-+	bb = gimple_bb(check_alloca);
-+	node = cgraph_get_create_node(check_function_decl);
-+	gcc_assert(node);
-+	frequency = compute_call_stmt_bb_frequency(current_function_decl, bb);
-+	cgraph_create_edge(cgraph_get_node(current_function_decl), node, check_alloca, bb->count, frequency, bb->loop_depth);
-+}
++	  Note that this feature does not protect data stored in live pages,
++	  e.g., process memory swapped to disk may stay there for a long time.
 +
-+static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi, bool after)
-+{
-+	gimple stmt;
-+	gcall *track_stack;
-+	cgraph_node_ptr node;
-+	int frequency;
-+	basic_block bb;
++config PAX_MEMORY_STACKLEAK
++	bool "Sanitize kernel stack"
++	default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
++	depends on X86 && GCC_PLUGINS
++	help
++	  By saying Y here the kernel will erase the kernel stack before it
++	  returns from a system call.  This in turn reduces the information
++	  that a kernel stack leak bug can reveal.
 +
-+	// insert call to void pax_track_stack(void)
-+	stmt = gimple_build_call(track_function_decl, 0);
-+	track_stack = as_a_gcall(stmt);
-+	if (after)
-+		gsi_insert_after(gsi, track_stack, GSI_CONTINUE_LINKING);
-+	else
-+		gsi_insert_before(gsi, track_stack, GSI_SAME_STMT);
++	  Note that such a bug can still leak information that was put on
++	  the stack by the current system call (the one eventually triggering
++	  the bug) but traces of earlier system calls on the kernel stack
++	  cannot leak anymore.
 +
-+	// update the cgraph
-+	bb = gimple_bb(track_stack);
-+	node = cgraph_get_create_node(track_function_decl);
-+	gcc_assert(node);
-+	frequency = compute_call_stmt_bb_frequency(current_function_decl, bb);
-+	cgraph_create_edge(cgraph_get_node(current_function_decl), node, track_stack, bb->count, frequency, bb->loop_depth);
-+}
++	  The tradeoff is performance impact: on a single CPU system kernel
++	  compilation sees a 1% slowdown, other systems and workloads may vary
++	  and you are advised to test this feature on your expected workload
++	  before deploying it.
 +
-+static bool is_alloca(gimple stmt)
-+{
-+	if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
-+		return true;
++	  Note that the full feature requires a gcc with plugin support,
++	  i.e., gcc 4.5 or newer.  You may need to install the supporting
++	  headers explicitly in addition to the normal gcc package.  Using
++	  older gcc versions means that functions with large enough stack
++	  frames may leave uninitialized memory behind that may be exposed
++	  to a later syscall leaking the stack.
 +
-+#if BUILDING_GCC_VERSION >= 4007
-+	if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
-+		return true;
-+#endif
++config PAX_MEMORY_STRUCTLEAK
++	bool "Forcibly initialize local variables copied to userland"
++	default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
++	depends on GCC_PLUGINS
++	help
++	  By saying Y here the kernel will zero initialize some local
++	  variables that are going to be copied to userland.  This in
++	  turn prevents unintended information leakage from the kernel
++	  stack should later code forget to explicitly set all parts of
++	  the copied variable.
 +
-+	return false;
-+}
++	  The tradeoff is less performance impact than PAX_MEMORY_STACKLEAK
++	  at a much smaller coverage.
 +
-+static unsigned int stackleak_tree_instrument_execute(void)
-+{
-+	basic_block bb, entry_bb;
-+	bool prologue_instrumented = false, is_leaf = true;
++	  Note that the implementation requires a gcc with plugin support,
++	  i.e., gcc 4.5 or newer.  You may need to install the supporting
++	  headers explicitly in addition to the normal gcc package.
 +
-+	entry_bb = ENTRY_BLOCK_PTR_FOR_FN(cfun)->next_bb;
++config PAX_MEMORY_UDEREF
++	bool "Prevent invalid userland pointer dereference"
++	default y if GRKERNSEC_CONFIG_AUTO && !(X86_64 && GRKERNSEC_CONFIG_PRIORITY_PERF) && !(X86_64 && GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_VIRTUALBOX) && (!X86 || GRKERNSEC_CONFIG_VIRT_NONE || GRKERNSEC_CONFIG_VIRT_EPT)
++	depends on (X86 || (ARM && (CPU_V6 || CPU_V6K || CPU_V7) && !ARM_LPAE)) && !UML_X86 && !XEN
++	select PAX_PER_CPU_PGD if X86_64
++	help
++	  By saying Y here the kernel will be prevented from dereferencing
++	  userland pointers in contexts where the kernel expects only kernel
++	  pointers.  This is both a useful runtime debugging feature and a
++	  security measure that prevents exploiting a class of kernel bugs.
 +
-+	// 1. loop through BBs and GIMPLE statements
-+	FOR_EACH_BB_FN(bb, cfun) {
-+		gimple_stmt_iterator gsi;
++	  The tradeoff is that some virtualization solutions may experience
++	  a huge slowdown and therefore you should not enable this feature
++	  for kernels meant to run in such environments.  Whether a given VM
++	  solution is affected or not is best determined by simply trying it
++	  out, the performance impact will be obvious right on boot as this
++	  mechanism engages from very early on.  A good rule of thumb is that
++	  VMs running on CPUs without hardware virtualization support (i.e.,
++	  the majority of IA-32 CPUs) will likely experience the slowdown.
 +
-+		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+			gimple stmt;
++	  On X86_64 the kernel will make use of PCID support when available
++	  (Intel's Westmere, Sandy Bridge, etc) for better security (default)
++	  or performance impact.  Pass pax_weakuderef on the kernel command
++	  line to choose the latter.
 +
-+			stmt = gsi_stmt(gsi);
++config PAX_REFCOUNT
++	bool "Prevent various kernel object reference counter overflows"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on GRKERNSEC && ((ARM && (CPU_V6 || CPU_V6K || CPU_V7)) || MIPS || PPC || SPARC64 || X86)
++	help
++	  By saying Y here the kernel will detect and prevent overflowing
++	  various (but not all) kinds of object reference counters.  Such
++	  overflows can normally occur due to bugs only and are often, if
++	  not always, exploitable.
 +
-+			if (is_gimple_call(stmt))
-+				is_leaf = false;
++	  The tradeoff is that data structures protected by an overflowed
++	  refcount will never be freed and therefore will leak memory.  Note
++	  that this leak also happens even without this protection but in
++	  that case the overflow can eventually trigger the freeing of the
++	  data structure while it is still being used elsewhere, resulting
++	  in the exploitable situation that this feature prevents.
 +
-+			// gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
-+			if (!is_alloca(stmt))
-+				continue;
++	  Since this has a negligible performance impact, you should enable
++	  this feature.
 +
-+			// 2. insert stack overflow check before each __builtin_alloca call
-+			stackleak_check_alloca(&gsi);
++config PAX_CONSTIFY_PLUGIN
++	bool "Automatically constify eligible structures"
++	default y
++	depends on !UML && PAX_KERNEXEC
++	help
++	  By saying Y here the compiler will automatically constify a class
++	  of types that contain only function pointers.  This reduces the
++	  kernel's attack surface and also produces a better memory layout.
 +
-+			// 3. insert track call after each __builtin_alloca call
-+			stackleak_add_instrumentation(&gsi, true);
-+			if (bb == entry_bb)
-+				prologue_instrumented = true;
-+		}
-+	}
++	  Note that the implementation requires a gcc with plugin support,
++	  i.e., gcc 4.5 or newer.  You may need to install the supporting
++	  headers explicitly in addition to the normal gcc package.
++ 
++	  Note that if some code really has to modify constified variables
++	  then the source code will have to be patched to allow it.  Examples
++	  can be found in PaX itself (the no_const attribute) and for some
++	  out-of-tree modules at http://www.grsecurity.net/~paxguy1/ .
 +
-+	// special cases for some bad linux code: taking the address of static inline functions will materialize them
-+	// but we mustn't instrument some of them as the resulting stack alignment required by the function call ABI
-+	// will break other assumptions regarding the expected (but not otherwise enforced) register clobbering  ABI.
-+	// case in point: native_save_fl on amd64 when optimized for size clobbers rdx if it were instrumented here.
-+	if (is_leaf && !TREE_PUBLIC(current_function_decl) && DECL_DECLARED_INLINE_P(current_function_decl))
-+		return 0;
-+	if (is_leaf && !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)), "_paravirt_", 10))
-+		return 0;
++config PAX_USERCOPY
++	bool "Harden heap object copies between kernel and userland"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on ARM || IA64 || PPC || SPARC || X86
++	depends on GRKERNSEC && (SLAB || SLUB || SLOB)
++	select PAX_USERCOPY_SLABS
++	help
++	  By saying Y here the kernel will enforce the size of heap objects
++	  when they are copied in either direction between the kernel and
++	  userland, even if only a part of the heap object is copied.
 +
-+	// 4. insert track call at the beginning
-+	if (!prologue_instrumented) {
-+		gimple_stmt_iterator gsi;
++	  Specifically, this checking prevents information leaking from the
++	  kernel heap during kernel to userland copies (if the kernel heap
++	  object is otherwise fully initialized) and prevents kernel heap
++	  overflows during userland to kernel copies.
 +
-+		gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
-+		bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
-+		if (!single_pred_p(bb)) {
-+//			gcc_assert(bb_loop_depth(bb) || (bb->flags & BB_IRREDUCIBLE_LOOP));
-+			split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
-+			gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
-+			bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
-+		}
-+		gsi = gsi_after_labels(bb);
-+		stackleak_add_instrumentation(&gsi, false);
-+	}
++	  Note that the current implementation provides the strictest bounds
++	  checks for the SLUB allocator.
 +
-+	return 0;
-+}
++	  Enabling this option also enables per-slab cache protection against
++	  data in a given cache being copied into/out of via userland
++	  accessors.  Though the whitelist of regions will be reduced over
++	  time, it notably protects important data structures like task structs.
 +
-+static unsigned int stackleak_final_execute(void)
-+{
-+	rtx_insn *insn, *next;
++	  If frame pointers are enabled on x86, this option will also restrict
++	  copies into and out of the kernel stack to local variables within a
++	  single frame.
 +
-+	if (cfun->calls_alloca)
-+		return 0;
++	  Since this has a negligible performance impact, you should enable
++	  this feature.
 +
-+	// keep calls only if function frame is big enough
-+	if (get_frame_size() >= track_frame_size)
-+		return 0;
++config PAX_USERCOPY_DEBUG
++	bool
++	depends on X86 && PAX_USERCOPY
++	default n
 +
-+	// 1. find pax_track_stack calls
-+	for (insn = get_insns(); insn; insn = next) {
-+		// rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
-+		rtx body;
++config PAX_SIZE_OVERFLOW
++	bool "Prevent various integer overflows in function size parameters"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on GCC_PLUGINS
++	help
++	  By saying Y here the kernel recomputes expressions of function
++	  arguments marked by a size_overflow attribute with double integer
++	  precision (DImode/TImode for 32/64 bit integer types).
 +
-+		next = NEXT_INSN(insn);
-+		if (!CALL_P(insn))
-+			continue;
-+		body = PATTERN(insn);
-+		if (GET_CODE(body) != CALL)
-+			continue;
-+		body = XEXP(body, 0);
-+		if (GET_CODE(body) != MEM)
-+			continue;
-+		body = XEXP(body, 0);
-+		if (GET_CODE(body) != SYMBOL_REF)
-+			continue;
-+//		if (strcmp(XSTR(body, 0), track_function))
-+		if (SYMBOL_REF_DECL(body) != track_function_decl)
-+			continue;
-+//		warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
-+		// 2. delete call
-+		delete_insn_and_edges(insn);
-+#if BUILDING_GCC_VERSION >= 4007
-+		if (GET_CODE(next) == NOTE && NOTE_KIND(next) == NOTE_INSN_CALL_ARG_LOCATION) {
-+			insn = next;
-+			next = NEXT_INSN(insn);
-+			delete_insn_and_edges(insn);
-+		}
-+#endif
-+	}
++	  The recomputed argument is checked against TYPE_MAX and an event
++	  is logged on overflow and the triggering process is killed.
 +
-+//	print_simple_rtl(stderr, get_insns());
-+//	print_rtl(stderr, get_insns());
-+//	warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
++	  Homepage: https://github.com/ephox-gcc-plugins
 +
-+	return 0;
-+}
++	  Note that the implementation requires a gcc with plugin support,
++	  i.e., gcc 4.5 or newer.  You may need to install the supporting
++	  headers explicitly in addition to the normal gcc package.
 +
-+static bool stackleak_track_stack_gate(void)
-+{
-+	tree section;
++config PAX_LATENT_ENTROPY
++	bool "Generate some entropy during boot and runtime"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on GCC_PLUGINS
++	help
++	  By saying Y here the kernel will instrument some kernel code to
++	  extract some entropy from both original and artificially created
++	  program state.  This will help especially embedded systems where
++	  there is little 'natural' source of entropy normally.  The cost
++	  is some slowdown of the boot process and fork and irq processing.
 +
-+	if (ix86_cmodel != CM_KERNEL)
-+		return false;
++	  When pax_extra_latent_entropy is passed on the kernel command line,
++	  entropy will be extracted from up to the first 4GB of RAM while the
++	  runtime memory allocator is being initialized.  This costs even more
++	  slowdown of the boot process.
 +
-+	section = lookup_attribute("section", DECL_ATTRIBUTES(current_function_decl));
-+	if (section && TREE_VALUE(section)) {
-+		section = TREE_VALUE(TREE_VALUE(section));
++	  Note that the implementation requires a gcc with plugin support,
++	  i.e., gcc 4.5 or newer.  You may need to install the supporting
++	  headers explicitly in addition to the normal gcc package.
 +
-+		if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10))
-+			return false;
-+		if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13))
-+			return false;
-+		if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13))
-+			return false;
-+		if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13))
-+			return false;
-+	}
++	  Note that entropy extracted this way is not cryptographically
++	  secure!
 +
-+	return track_frame_size >= 0;
-+}
++config PAX_RAP
++	bool "Prevent code reuse attacks"
++	depends on X86_64
++	default y if GRKERNSEC_CONFIG_AUTO
++	help
++	  By saying Y here the kernel will check indirect control transfers
++	  in order to detect and prevent attacks that try to hijack control
++	  flow by overwriting code pointers.
 +
-+static void stackleak_start_unit(void *gcc_data, void *user_data)
-+{
-+	tree fntype;
++	  Note that binary modules cannot be instrumented by this approach.
 +
-+	// void pax_track_stack(void)
-+	fntype = build_function_type_list(void_type_node, NULL_TREE);
-+	track_function_decl = build_fn_decl(track_function, fntype);
-+	DECL_ASSEMBLER_NAME(track_function_decl); // for LTO
-+	TREE_PUBLIC(track_function_decl) = 1;
-+	TREE_USED(track_function_decl) = 1;
-+	DECL_EXTERNAL(track_function_decl) = 1;
-+	DECL_ARTIFICIAL(track_function_decl) = 1;
-+	DECL_PRESERVE_P(track_function_decl) = 1;
++	  Note that the implementation requires a gcc with plugin support,
++	  i.e., gcc 4.5 or newer.  You may need to install the supporting
++	  headers explicitly in addition to the normal gcc package.
 +
-+	// void pax_check_alloca(unsigned long)
-+	fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
-+	check_function_decl = build_fn_decl(check_function, fntype);
-+	DECL_ASSEMBLER_NAME(check_function_decl); // for LTO
-+	TREE_PUBLIC(check_function_decl) = 1;
-+	TREE_USED(check_function_decl) = 1;
-+	DECL_EXTERNAL(check_function_decl) = 1;
-+	DECL_ARTIFICIAL(check_function_decl) = 1;
-+	DECL_PRESERVE_P(check_function_decl) = 1;
-+}
++endmenu
 +
-+static bool stackleak_tree_instrument_gate(void)
-+{
-+	return stackleak_track_stack_gate();
-+}
++endmenu
 +
-+#define PASS_NAME stackleak_tree_instrument
-+#define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
-+#define TODO_FLAGS_START TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts
-+#define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa | TODO_rebuild_cgraph_edges
-+#include "gcc-generate-gimple-pass.h"
++source grsecurity/Kconfig
 +
-+static bool stackleak_final_gate(void)
-+{
-+	return stackleak_track_stack_gate();
-+}
++endmenu
 +
-+#define PASS_NAME stackleak_final
-+#define TODO_FLAGS_FINISH TODO_dump_func
-+#include "gcc-generate-rtl-pass.h"
++endmenu
 +
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
+ source security/keys/Kconfig
+ 
+ config SECURITY_DMESG_RESTRICT
+@@ -104,7 +1091,7 @@ config INTEL_TXT
+ config LSM_MMAP_MIN_ADDR
+ 	int "Low address space for LSM to protect from user allocation"
+ 	depends on SECURITY && SECURITY_SELINUX
+-	default 32768 if ARM || (ARM64 && COMPAT)
++	default 32768 if ALPHA || ARM || (ARM64 && COMPAT) || PARISC || SPARC32
+ 	default 65536
+ 	help
+ 	  This is the portion of low virtual memory which should be protected
+diff --git a/security/apparmor/file.c b/security/apparmor/file.c
+index 913f377..6e392d5 100644
+--- a/security/apparmor/file.c
++++ b/security/apparmor/file.c
+@@ -348,8 +348,8 @@ static inline bool xindex_is_subset(u32 link, u32 target)
+ int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
+ 		 struct path *new_dir, struct dentry *new_dentry)
+ {
+-	struct path link = { new_dir->mnt, new_dentry };
+-	struct path target = { new_dir->mnt, old_dentry };
++	struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry };
++	struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry };
+ 	struct path_cond cond = {
+ 		d_backing_inode(old_dentry)->i_uid,
+ 		d_backing_inode(old_dentry)->i_mode
+diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
+index c28b0f2..3b9fee0 100644
+--- a/security/apparmor/include/policy.h
++++ b/security/apparmor/include/policy.h
+@@ -134,7 +134,7 @@ struct aa_namespace {
+ 	struct aa_ns_acct acct;
+ 	struct aa_profile *unconfined;
+ 	struct list_head sub_ns;
+-	atomic_t uniq_null;
++	atomic_unchecked_t uniq_null;
+ 	long uniq_id;
+ 
+ 	struct dentry *dents[AAFS_NS_SIZEOF];
+diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
+index dec607c..37fe357 100644
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -176,7 +176,7 @@ static int common_perm_dir_dentry(int op, struct path *dir,
+ 				  struct dentry *dentry, u32 mask,
+ 				  struct path_cond *cond)
+ {
+-	struct path path = { dir->mnt, dentry };
++	struct path path = { .mnt = dir->mnt, .dentry = dentry };
+ 
+ 	return common_perm(op, &path, mask, cond);
+ }
+@@ -193,7 +193,7 @@ static int common_perm_dir_dentry(int op, struct path *dir,
+ static int common_perm_mnt_dentry(int op, struct vfsmount *mnt,
+ 				  struct dentry *dentry, u32 mask)
+ {
+-	struct path path = { mnt, dentry };
++	struct path path = { .mnt = mnt, .dentry = dentry };
+ 	struct path_cond cond = { d_backing_inode(dentry)->i_uid,
+ 				  d_backing_inode(dentry)->i_mode
+ 	};
+@@ -315,8 +315,8 @@ static int apparmor_path_rename(struct path *old_dir, struct dentry *old_dentry,
+ 
+ 	profile = aa_current_profile();
+ 	if (!unconfined(profile)) {
+-		struct path old_path = { old_dir->mnt, old_dentry };
+-		struct path new_path = { new_dir->mnt, new_dentry };
++		struct path old_path = { .mnt = old_dir->mnt, .dentry = old_dentry };
++		struct path new_path = { .mnt = new_dir->mnt, .dentry = new_dentry };
+ 		struct path_cond cond = { d_backing_inode(old_dentry)->i_uid,
+ 					  d_backing_inode(old_dentry)->i_mode
+ 		};
+@@ -677,11 +677,11 @@ static const struct kernel_param_ops param_ops_aalockpolicy = {
+ 	.get = param_get_aalockpolicy
+ };
+ 
+-static int param_set_audit(const char *val, struct kernel_param *kp);
+-static int param_get_audit(char *buffer, struct kernel_param *kp);
++static int param_set_audit(const char *val, const struct kernel_param *kp);
++static int param_get_audit(char *buffer, const struct kernel_param *kp);
+ 
+-static int param_set_mode(const char *val, struct kernel_param *kp);
+-static int param_get_mode(char *buffer, struct kernel_param *kp);
++static int param_set_mode(const char *val, const struct kernel_param *kp);
++static int param_get_mode(char *buffer, const struct kernel_param *kp);
+ 
+ /* Flag values, also controllable via /sys/module/apparmor/parameters
+  * We define special types as we want to do additional mediation.
+@@ -791,7 +791,7 @@ static int param_get_aauint(char *buffer, const struct kernel_param *kp)
+ 	return param_get_uint(buffer, kp);
+ }
+ 
+-static int param_get_audit(char *buffer, struct kernel_param *kp)
++static int param_get_audit(char *buffer, const struct kernel_param *kp)
+ {
+ 	if (!capable(CAP_MAC_ADMIN))
+ 		return -EPERM;
+@@ -802,7 +802,7 @@ static int param_get_audit(char *buffer, struct kernel_param *kp)
+ 	return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]);
+ }
+ 
+-static int param_set_audit(const char *val, struct kernel_param *kp)
++static int param_set_audit(const char *val, const struct kernel_param *kp)
+ {
+ 	int i;
+ 	if (!capable(CAP_MAC_ADMIN))
+@@ -824,7 +824,7 @@ static int param_set_audit(const char *val, struct kernel_param *kp)
+ 	return -EINVAL;
+ }
+ 
+-static int param_get_mode(char *buffer, struct kernel_param *kp)
++static int param_get_mode(char *buffer, const struct kernel_param *kp)
+ {
+ 	if (!capable(CAP_MAC_ADMIN))
+ 		return -EPERM;
+@@ -835,7 +835,7 @@ static int param_get_mode(char *buffer, struct kernel_param *kp)
+ 	return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]);
+ }
+ 
+-static int param_set_mode(const char *val, struct kernel_param *kp)
++static int param_set_mode(const char *val, const struct kernel_param *kp)
+ {
+ 	int i;
+ 	if (!capable(CAP_MAC_ADMIN))
+diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
+index 705c287..81257f1 100644
+--- a/security/apparmor/policy.c
++++ b/security/apparmor/policy.c
+@@ -298,7 +298,7 @@ static struct aa_namespace *alloc_namespace(const char *prefix,
+ 	/* ns and ns->unconfined share ns->unconfined refcount */
+ 	ns->unconfined->ns = ns;
+ 
+-	atomic_set(&ns->uniq_null, 0);
++	atomic_set_unchecked(&ns->uniq_null, 0);
+ 
+ 	return ns;
+ 
+@@ -689,7 +689,7 @@ struct aa_profile *aa_new_null_profile(struct aa_profile *parent, int hat)
+ {
+ 	struct aa_profile *profile = NULL;
+ 	char *name;
+-	int uniq = atomic_inc_return(&parent->ns->uniq_null);
++	int uniq = atomic_inc_return_unchecked(&parent->ns->uniq_null);
+ 
+ 	/* freed below */
+ 	name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, GFP_KERNEL);
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 48071ed..b805e0f 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -438,6 +438,32 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
+ 	return 0;
+ }
+ 
++/* returns:
++	1 for suid privilege
++	2 for sgid privilege
++	3 for fscap privilege
++*/
++int is_privileged_binary(const struct dentry *dentry)
 +{
-+	const char * const plugin_name = plugin_info->base_name;
-+	const int argc = plugin_info->argc;
-+	const struct plugin_argument * const argv = plugin_info->argv;
-+	int i;
-+	struct register_pass_info stackleak_tree_instrument_pass_info;
-+	struct register_pass_info stackleak_final_pass_info;
-+	static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = {
-+		{
-+			.base = &track_function_decl,
-+			.nelt = 1,
-+			.stride = sizeof(track_function_decl),
-+			.cb = &gt_ggc_mx_tree_node,
-+			.pchw = &gt_pch_nx_tree_node
-+		},
-+		{
-+			.base = &check_function_decl,
-+			.nelt = 1,
-+			.stride = sizeof(check_function_decl),
-+			.cb = &gt_ggc_mx_tree_node,
-+			.pchw = &gt_pch_nx_tree_node
-+		},
-+		LAST_GGC_ROOT_TAB
-+	};
-+
-+	stackleak_tree_instrument_pass_info.pass			= make_stackleak_tree_instrument_pass();
-+//	stackleak_tree_instrument_pass_info.reference_pass_name		= "tree_profile";
-+	stackleak_tree_instrument_pass_info.reference_pass_name		= "optimized";
-+	stackleak_tree_instrument_pass_info.ref_pass_instance_number	= 1;
-+	stackleak_tree_instrument_pass_info.pos_op 			= PASS_POS_INSERT_BEFORE;
++	struct cpu_vfs_cap_data capdata;
++	struct inode *inode = dentry->d_inode;
 +
-+	stackleak_final_pass_info.pass				= make_stackleak_final_pass();
-+	stackleak_final_pass_info.reference_pass_name		= "final";
-+	stackleak_final_pass_info.ref_pass_instance_number	= 1;
-+	stackleak_final_pass_info.pos_op 			= PASS_POS_INSERT_BEFORE;
++	if (!inode || S_ISDIR(inode->i_mode))
++		return 0;
 +
-+	if (!plugin_default_version_check(version, &gcc_version)) {
-+		error(G_("incompatible gcc/plugin versions"));
++	if (inode->i_mode & S_ISUID)
 +		return 1;
-+	}
-+
-+	register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
++	if ((inode->i_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
++		return 2;
 +
-+	for (i = 0; i < argc; ++i) {
-+		if (!strcmp(argv[i].key, "track-lowest-sp")) {
-+			if (!argv[i].value) {
-+				error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+				continue;
-+			}
-+			track_frame_size = atoi(argv[i].value);
-+			if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
-+				error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
-+			continue;
-+		}
-+		if (!strcmp(argv[i].key, "initialize-locals")) {
-+			if (argv[i].value) {
-+				error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
-+				continue;
-+			}
-+			init_locals = true;
-+			continue;
-+		}
-+		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++	if (!get_vfs_caps_from_disk(dentry, &capdata)) {
++		if (!cap_isclear(capdata.inheritable) || !cap_isclear(capdata.permitted))
++			return 3;
 +	}
 +
-+	register_callback(plugin_name, PLUGIN_START_UNIT, &stackleak_start_unit, NULL);
-+	register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_stackleak);
-+	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
-+	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
-+
 +	return 0;
 +}
-diff --git a/tools/gcc/structleak_plugin.c b/tools/gcc/structleak_plugin.c
-new file mode 100644
-index 0000000..d7596e6
---- /dev/null
-+++ b/tools/gcc/structleak_plugin.c
-@@ -0,0 +1,239 @@
-+/*
-+ * Copyright 2013-2016 by PaX Team <pageexec@××××××××.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ *       NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ *       but for the kernel it doesn't matter since it doesn't link against
-+ *       any of the gcc libraries
-+ *
-+ * gcc plugin to forcibly initialize certain local variables that could
-+ * otherwise leak kernel stack to userland if they aren't properly initialized
-+ * by later code
-+ *
-+ * Homepage: http://pax.grsecurity.net/
-+ *
-+ * Usage:
-+ * $ # for 4.5/4.6/C based 4.7
-+ * $ gcc -I`gcc -print-file-name=plugin`/include -I`gcc -print-file-name=plugin`/include/c-family -fPIC -shared -O2 -o structleak_plugin.so structleak_plugin.c
-+ * $ # for C++ based 4.7/4.8+
-+ * $ g++ -I`g++ -print-file-name=plugin`/include -I`g++ -print-file-name=plugin`/include/c-family -fPIC -shared -O2 -o structleak_plugin.so structleak_plugin.c
-+ * $ gcc -fplugin=./structleak_plugin.so test.c -O2
-+ *
-+ * TODO: eliminate redundant initializers
-+ *       increase type coverage
-+ */
 +
-+#include "gcc-common.h"
+ /*
+  * Attempt to get the on-exec apply capability sets for an executable file from
+  * its xattrs and, if present, apply them to the proposed credentials being
+@@ -628,6 +654,9 @@ int cap_bprm_secureexec(struct linux_binprm *bprm)
+ 	const struct cred *cred = current_cred();
+ 	kuid_t root_uid = make_kuid(cred->user_ns, 0);
+ 
++	if (gr_acl_enable_at_secure())
++		return 1;
 +
-+// unused C type flag in all versions 4.5-6
-+#define TYPE_USERSPACE(TYPE) TYPE_LANG_FLAG_5(TYPE)
+ 	if (!uid_eq(cred->uid, root_uid)) {
+ 		if (bprm->cap_effective)
+ 			return 1;
+diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
+index 585af61..b7d35ff 100644
+--- a/security/integrity/ima/ima.h
++++ b/security/integrity/ima/ima.h
+@@ -125,8 +125,8 @@ int ima_init_template(void);
+ extern spinlock_t ima_queue_lock;
+ 
+ struct ima_h_table {
+-	atomic_long_t len;	/* number of stored measurements in the list */
+-	atomic_long_t violations;
++	atomic_long_unchecked_t len;	/* number of stored measurements in the list */
++	atomic_long_unchecked_t violations;
+ 	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
+ };
+ extern struct ima_h_table ima_htable;
+diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
+index 1d950fb..a8f4eab 100644
+--- a/security/integrity/ima/ima_api.c
++++ b/security/integrity/ima/ima_api.c
+@@ -137,7 +137,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
+ 	int result;
+ 
+ 	/* can overflow, only indicator */
+-	atomic_long_inc(&ima_htable.violations);
++	atomic_long_inc_unchecked(&ima_htable.violations);
+ 
+ 	result = ima_alloc_init_template(&event_data, &entry);
+ 	if (result < 0) {
+diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
+index f355231..c71f640 100644
+--- a/security/integrity/ima/ima_fs.c
++++ b/security/integrity/ima/ima_fs.c
+@@ -30,12 +30,12 @@ static DEFINE_MUTEX(ima_write_mutex);
+ static int valid_policy = 1;
+ #define TMPBUFLEN 12
+ static ssize_t ima_show_htable_value(char __user *buf, size_t count,
+-				     loff_t *ppos, atomic_long_t *val)
++				     loff_t *ppos, atomic_long_unchecked_t *val)
+ {
+ 	char tmpbuf[TMPBUFLEN];
+ 	ssize_t len;
+ 
+-	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
++	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
+ 	return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
+ }
+ 
+diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
+index 552705d..9920f4fb 100644
+--- a/security/integrity/ima/ima_queue.c
++++ b/security/integrity/ima/ima_queue.c
+@@ -83,7 +83,7 @@ static int ima_add_digest_entry(struct ima_template_entry *entry)
+ 	INIT_LIST_HEAD(&qe->later);
+ 	list_add_tail_rcu(&qe->later, &ima_measurements);
+ 
+-	atomic_long_inc(&ima_htable.len);
++	atomic_long_inc_unchecked(&ima_htable.len);
+ 	key = ima_hash_key(entry->digest);
+ 	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
+ 	return 0;
+diff --git a/security/keys/internal.h b/security/keys/internal.h
+index 5105c2c..a5010e6 100644
+--- a/security/keys/internal.h
++++ b/security/keys/internal.h
+@@ -90,12 +90,16 @@ extern void key_type_put(struct key_type *ktype);
+ 
+ extern int __key_link_begin(struct key *keyring,
+ 			    const struct keyring_index_key *index_key,
+-			    struct assoc_array_edit **_edit);
++			    struct assoc_array_edit **_edit)
++			    __acquires(&keyring->sem)
++			    __acquires(&keyring_serialise_link_sem);
+ extern int __key_link_check_live_key(struct key *keyring, struct key *key);
+ extern void __key_link(struct key *key, struct assoc_array_edit **_edit);
+ extern void __key_link_end(struct key *keyring,
+ 			   const struct keyring_index_key *index_key,
+-			   struct assoc_array_edit *edit);
++			   struct assoc_array_edit *edit)
++			   __releases(&keyring->sem)
++			   __releases(&keyring_serialise_link_sem);
+ 
+ extern key_ref_t find_key_to_update(key_ref_t keyring_ref,
+ 				    const struct keyring_index_key *index_key);
+@@ -191,7 +195,7 @@ struct request_key_auth {
+ 	void			*callout_info;
+ 	size_t			callout_len;
+ 	pid_t			pid;
+-};
++} __randomize_layout;
+ 
+ extern struct key_type key_type_request_key_auth;
+ extern struct key *request_key_auth_new(struct key *target,
+diff --git a/security/keys/key.c b/security/keys/key.c
+index 09ef276..ab2894f 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -283,7 +283,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
+ 
+ 	atomic_set(&key->usage, 1);
+ 	init_rwsem(&key->sem);
+-	lockdep_set_class(&key->sem, &type->lock_class);
++	lockdep_set_class(&key->sem, (struct lock_class_key *)&type->lock_class);
+ 	key->index_key.type = type;
+ 	key->user = user;
+ 	key->quotalen = quotalen;
+@@ -1077,7 +1077,9 @@ int register_key_type(struct key_type *ktype)
+ 	struct key_type *p;
+ 	int ret;
+ 
+-	memset(&ktype->lock_class, 0, sizeof(ktype->lock_class));
++	pax_open_kernel();
++	memset((void *)&ktype->lock_class, 0, sizeof(ktype->lock_class));
++	pax_close_kernel();
+ 
+ 	ret = -EEXIST;
+ 	down_write(&key_types_sem);
+@@ -1089,7 +1091,7 @@ int register_key_type(struct key_type *ktype)
+ 	}
+ 
+ 	/* store the type */
+-	list_add(&ktype->link, &key_types_list);
++	pax_list_add((struct list_head *)&ktype->link, &key_types_list);
+ 
+ 	pr_notice("Key type %s registered\n", ktype->name);
+ 	ret = 0;
+@@ -1111,7 +1113,7 @@ EXPORT_SYMBOL(register_key_type);
+ void unregister_key_type(struct key_type *ktype)
+ {
+ 	down_write(&key_types_sem);
+-	list_del_init(&ktype->link);
++	pax_list_del_init((struct list_head *)&ktype->link);
+ 	downgrade_write(&key_types_sem);
+ 	key_gc_keytype(ktype);
+ 	pr_notice("Key type %s unregistered\n", ktype->name);
+@@ -1129,10 +1131,10 @@ void __init key_init(void)
+ 			0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
+ 
+ 	/* add the special key types */
+-	list_add_tail(&key_type_keyring.link, &key_types_list);
+-	list_add_tail(&key_type_dead.link, &key_types_list);
+-	list_add_tail(&key_type_user.link, &key_types_list);
+-	list_add_tail(&key_type_logon.link, &key_types_list);
++	pax_list_add_tail((struct list_head *)&key_type_keyring.link, &key_types_list);
++	pax_list_add_tail((struct list_head *)&key_type_dead.link, &key_types_list);
++	pax_list_add_tail((struct list_head *)&key_type_user.link, &key_types_list);
++	pax_list_add_tail((struct list_head *)&key_type_logon.link, &key_types_list);
+ 
+ 	/* record the root user tracking */
+ 	rb_link_node(&root_key_user.node,
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index f931ccf..ed9cd36 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -1071,8 +1071,6 @@ static int keyring_detect_cycle(struct key *A, struct key *B)
+ int __key_link_begin(struct key *keyring,
+ 		     const struct keyring_index_key *index_key,
+ 		     struct assoc_array_edit **_edit)
+-	__acquires(&keyring->sem)
+-	__acquires(&keyring_serialise_link_sem)
+ {
+ 	struct assoc_array_edit *edit;
+ 	int ret;
+@@ -1172,8 +1170,6 @@ void __key_link(struct key *key, struct assoc_array_edit **_edit)
+ void __key_link_end(struct key *keyring,
+ 		    const struct keyring_index_key *index_key,
+ 		    struct assoc_array_edit *edit)
+-	__releases(&keyring->sem)
+-	__releases(&keyring_serialise_link_sem)
+ {
+ 	BUG_ON(index_key->type == NULL);
+ 	kenter("%d,%s,", keyring->serial, index_key->type->name);
+diff --git a/security/min_addr.c b/security/min_addr.c
+index f728728..6457a0c 100644
+--- a/security/min_addr.c
++++ b/security/min_addr.c
+@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
+  */
+ static void update_mmap_min_addr(void)
+ {
++#ifndef SPARC
+ #ifdef CONFIG_LSM_MMAP_MIN_ADDR
+ 	if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
+ 		mmap_min_addr = dac_mmap_min_addr;
+@@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
+ #else
+ 	mmap_min_addr = dac_mmap_min_addr;
+ #endif
++#endif
+ }
+ 
+ /*
+diff --git a/security/selinux/avc.c b/security/selinux/avc.c
+index e60c79d..41fb721 100644
+--- a/security/selinux/avc.c
++++ b/security/selinux/avc.c
+@@ -71,7 +71,7 @@ struct avc_xperms_node {
+ struct avc_cache {
+ 	struct hlist_head	slots[AVC_CACHE_SLOTS]; /* head for avc_node->list */
+ 	spinlock_t		slots_lock[AVC_CACHE_SLOTS]; /* lock for writes */
+-	atomic_t		lru_hint;	/* LRU hint for reclaim scan */
++	atomic_unchecked_t	lru_hint;	/* LRU hint for reclaim scan */
+ 	atomic_t		active_nodes;
+ 	u32			latest_notif;	/* latest revocation notification */
+ };
+@@ -183,7 +183,7 @@ void __init avc_init(void)
+ 		spin_lock_init(&avc_cache.slots_lock[i]);
+ 	}
+ 	atomic_set(&avc_cache.active_nodes, 0);
+-	atomic_set(&avc_cache.lru_hint, 0);
++	atomic_set_unchecked(&avc_cache.lru_hint, 0);
+ 
+ 	avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node),
+ 					0, SLAB_PANIC, NULL);
+@@ -521,7 +521,7 @@ static inline int avc_reclaim_node(void)
+ 	spinlock_t *lock;
+ 
+ 	for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) {
+-		hvalue = atomic_inc_return(&avc_cache.lru_hint) & (AVC_CACHE_SLOTS - 1);
++		hvalue = atomic_inc_return_unchecked(&avc_cache.lru_hint) & (AVC_CACHE_SLOTS - 1);
+ 		head = &avc_cache.slots[hvalue];
+ 		lock = &avc_cache.slots_lock[hvalue];
+ 
+diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
+index 1450f85..a91e0bc 100644
+--- a/security/selinux/include/xfrm.h
++++ b/security/selinux/include/xfrm.h
+@@ -48,7 +48,7 @@ static inline void selinux_xfrm_notify_policyload(void)
+ 
+ 	rtnl_lock();
+ 	for_each_net(net) {
+-		atomic_inc(&net->xfrm.flow_cache_genid);
++		atomic_inc_unchecked(&net->xfrm.flow_cache_genid);
+ 		rt_genid_bump_all(net);
+ 	}
+ 	rtnl_unlock();
+diff --git a/security/tomoyo/file.c b/security/tomoyo/file.c
+index 2367b10..a0c3c51 100644
+--- a/security/tomoyo/file.c
++++ b/security/tomoyo/file.c
+@@ -692,7 +692,7 @@ int tomoyo_path_number_perm(const u8 type, struct path *path,
+ {
+ 	struct tomoyo_request_info r;
+ 	struct tomoyo_obj_info obj = {
+-		.path1 = *path,
++		.path1 = { .mnt = path->mnt, .dentry = path->dentry },
+ 	};
+ 	int error = -ENOMEM;
+ 	struct tomoyo_path_info buf;
+@@ -740,7 +740,7 @@ int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
+ 	struct tomoyo_path_info buf;
+ 	struct tomoyo_request_info r;
+ 	struct tomoyo_obj_info obj = {
+-		.path1 = *path,
++		.path1 = { .mnt = path->mnt, .dentry = path->dentry },
+ 	};
+ 	int idx;
+ 
+@@ -786,7 +786,7 @@ int tomoyo_path_perm(const u8 operation, const struct path *path, const char *ta
+ {
+ 	struct tomoyo_request_info r;
+ 	struct tomoyo_obj_info obj = {
+-		.path1 = *path,
++		.path1 = { .mnt = path->mnt, .dentry = path->dentry },
+ 	};
+ 	int error;
+ 	struct tomoyo_path_info buf;
+@@ -843,7 +843,7 @@ int tomoyo_mkdev_perm(const u8 operation, struct path *path,
+ {
+ 	struct tomoyo_request_info r;
+ 	struct tomoyo_obj_info obj = {
+-		.path1 = *path,
++		.path1 = { .mnt = path->mnt, .dentry = path->dentry },
+ 	};
+ 	int error = -ENOMEM;
+ 	struct tomoyo_path_info buf;
+@@ -890,8 +890,8 @@ int tomoyo_path2_perm(const u8 operation, struct path *path1,
+ 	struct tomoyo_path_info buf2;
+ 	struct tomoyo_request_info r;
+ 	struct tomoyo_obj_info obj = {
+-		.path1 = *path1,
+-		.path2 = *path2,
++		.path1 = { .mnt = path1->mnt, .dentry = path1->dentry },
++		.path2 = { .mnt = path2->mnt, .dentry = path2->dentry }
+ 	};
+ 	int idx;
+ 
+diff --git a/security/tomoyo/mount.c b/security/tomoyo/mount.c
+index 390c646..f2f8db3 100644
+--- a/security/tomoyo/mount.c
++++ b/security/tomoyo/mount.c
+@@ -118,6 +118,10 @@ static int tomoyo_mount_acl(struct tomoyo_request_info *r,
+ 		   type == tomoyo_mounts[TOMOYO_MOUNT_MOVE]) {
+ 		need_dev = -1; /* dev_name is a directory */
+ 	} else {
++		if (!capable(CAP_SYS_ADMIN)) {
++			error = -EPERM;
++			goto out;
++		}
+ 		fstype = get_fs_type(type);
+ 		if (!fstype) {
+ 			error = -ENODEV;
+diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
+index cbf3df4..22b11df 100644
+--- a/security/tomoyo/tomoyo.c
++++ b/security/tomoyo/tomoyo.c
+@@ -165,7 +165,7 @@ static int tomoyo_path_truncate(struct path *path)
+  */
+ static int tomoyo_path_unlink(struct path *parent, struct dentry *dentry)
+ {
+-	struct path path = { parent->mnt, dentry };
++	struct path path = { .mnt = parent->mnt, .dentry = dentry };
+ 	return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL);
+ }
+ 
+@@ -181,7 +181,7 @@ static int tomoyo_path_unlink(struct path *parent, struct dentry *dentry)
+ static int tomoyo_path_mkdir(struct path *parent, struct dentry *dentry,
+ 			     umode_t mode)
+ {
+-	struct path path = { parent->mnt, dentry };
++	struct path path = { .mnt = parent->mnt, .dentry = dentry };
+ 	return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path,
+ 				       mode & S_IALLUGO);
+ }
+@@ -196,7 +196,7 @@ static int tomoyo_path_mkdir(struct path *parent, struct dentry *dentry,
+  */
+ static int tomoyo_path_rmdir(struct path *parent, struct dentry *dentry)
+ {
+-	struct path path = { parent->mnt, dentry };
++	struct path path = { .mnt = parent->mnt, .dentry = dentry };
+ 	return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL);
+ }
+ 
+@@ -212,7 +212,7 @@ static int tomoyo_path_rmdir(struct path *parent, struct dentry *dentry)
+ static int tomoyo_path_symlink(struct path *parent, struct dentry *dentry,
+ 			       const char *old_name)
+ {
+-	struct path path = { parent->mnt, dentry };
++	struct path path = { .mnt = parent->mnt, .dentry = dentry };
+ 	return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name);
+ }
+ 
+@@ -229,7 +229,7 @@ static int tomoyo_path_symlink(struct path *parent, struct dentry *dentry,
+ static int tomoyo_path_mknod(struct path *parent, struct dentry *dentry,
+ 			     umode_t mode, unsigned int dev)
+ {
+-	struct path path = { parent->mnt, dentry };
++	struct path path = { .mnt = parent->mnt, .dentry = dentry };
+ 	int type = TOMOYO_TYPE_CREATE;
+ 	const unsigned int perm = mode & S_IALLUGO;
+ 
+@@ -268,8 +268,8 @@ static int tomoyo_path_mknod(struct path *parent, struct dentry *dentry,
+ static int tomoyo_path_link(struct dentry *old_dentry, struct path *new_dir,
+ 			    struct dentry *new_dentry)
+ {
+-	struct path path1 = { new_dir->mnt, old_dentry };
+-	struct path path2 = { new_dir->mnt, new_dentry };
++	struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry };
++	struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry };
+ 	return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2);
+ }
+ 
+@@ -288,8 +288,8 @@ static int tomoyo_path_rename(struct path *old_parent,
+ 			      struct path *new_parent,
+ 			      struct dentry *new_dentry)
+ {
+-	struct path path1 = { old_parent->mnt, old_dentry };
+-	struct path path2 = { new_parent->mnt, new_dentry };
++	struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry };
++	struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry };
+ 	return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2);
+ }
+ 
+@@ -417,7 +417,7 @@ static int tomoyo_sb_mount(const char *dev_name, struct path *path,
+  */
+ static int tomoyo_sb_umount(struct vfsmount *mnt, int flags)
+ {
+-	struct path path = { mnt, mnt->mnt_root };
++	struct path path = { .mnt = mnt, .dentry = mnt->mnt_root };
+ 	return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL);
+ }
+ 
+diff --git a/security/yama/Kconfig b/security/yama/Kconfig
+index 90c605e..bf3a29a 100644
+--- a/security/yama/Kconfig
++++ b/security/yama/Kconfig
+@@ -1,6 +1,6 @@
+ config SECURITY_YAMA
+ 	bool "Yama support"
+-	depends on SECURITY
++	depends on SECURITY && !GRKERNSEC
+ 	default n
+ 	help
+ 	  This selects Yama, which extends DAC support with additional
+diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
+index cb6ed10..fb00554 100644
+--- a/security/yama/yama_lsm.c
++++ b/security/yama/yama_lsm.c
+@@ -357,7 +357,7 @@ static struct security_hook_list yama_hooks[] = {
+ static int yama_dointvec_minmax(struct ctl_table *table, int write,
+ 				void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+-	struct ctl_table table_copy;
++	ctl_table_no_const table_copy;
+ 
+ 	if (write && !capable(CAP_SYS_PTRACE))
+ 		return -EPERM;
+diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
+index a04edff..6811b91 100644
+--- a/sound/aoa/codecs/onyx.c
++++ b/sound/aoa/codecs/onyx.c
+@@ -54,7 +54,7 @@ struct onyx {
+ 				spdif_locked:1,
+ 				analog_locked:1,
+ 				original_mute:2;
+-	int			open_count;
++	local_t			open_count;
+ 	struct codec_info	*codec_info;
+ 
+ 	/* mutex serializes concurrent access to the device
+@@ -747,7 +747,7 @@ static int onyx_open(struct codec_info_item *cii,
+ 	struct onyx *onyx = cii->codec_data;
+ 
+ 	mutex_lock(&onyx->mutex);
+-	onyx->open_count++;
++	local_inc(&onyx->open_count);
+ 	mutex_unlock(&onyx->mutex);
+ 
+ 	return 0;
+@@ -759,8 +759,7 @@ static int onyx_close(struct codec_info_item *cii,
+ 	struct onyx *onyx = cii->codec_data;
+ 
+ 	mutex_lock(&onyx->mutex);
+-	onyx->open_count--;
+-	if (!onyx->open_count)
++	if (local_dec_and_test(&onyx->open_count))
+ 		onyx->spdif_locked = onyx->analog_locked = 0;
+ 	mutex_unlock(&onyx->mutex);
+ 
+diff --git a/sound/aoa/codecs/onyx.h b/sound/aoa/codecs/onyx.h
+index ffd2025..df062c9 100644
+--- a/sound/aoa/codecs/onyx.h
++++ b/sound/aoa/codecs/onyx.h
+@@ -11,6 +11,7 @@
+ #include <linux/i2c.h>
+ #include <asm/pmac_low_i2c.h>
+ #include <asm/prom.h>
++#include <asm/local.h>
+ 
+ /* PCM3052 register definitions */
+ 
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index ebc9fdf..61f491e 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -1193,10 +1193,10 @@ snd_pcm_sframes_t snd_pcm_oss_write3(struct snd_pcm_substream *substream, const
+ 		if (in_kernel) {
+ 			mm_segment_t fs;
+ 			fs = snd_enter_user();
+-			ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
++			ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
+ 			snd_leave_user(fs);
+ 		} else {
+-			ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
++			ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
+ 		}
+ 		if (ret != -EPIPE && ret != -ESTRPIPE)
+ 			break;
+@@ -1236,10 +1236,10 @@ snd_pcm_sframes_t snd_pcm_oss_read3(struct snd_pcm_substream *substream, char *p
+ 		if (in_kernel) {
+ 			mm_segment_t fs;
+ 			fs = snd_enter_user();
+-			ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
++			ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
+ 			snd_leave_user(fs);
+ 		} else {
+-			ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
++			ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
+ 		}
+ 		if (ret == -EPIPE) {
+ 			if (runtime->status->state == SNDRV_PCM_STATE_DRAINING) {
+@@ -1335,7 +1335,7 @@ static ssize_t snd_pcm_oss_write2(struct snd_pcm_substream *substream, const cha
+ 		struct snd_pcm_plugin_channel *channels;
+ 		size_t oss_frame_bytes = (runtime->oss.plugin_first->src_width * runtime->oss.plugin_first->src_format.channels) / 8;
+ 		if (!in_kernel) {
+-			if (copy_from_user(runtime->oss.buffer, (const char __force __user *)buf, bytes))
++			if (copy_from_user(runtime->oss.buffer, (const char __force_user *)buf, bytes))
+ 				return -EFAULT;
+ 			buf = runtime->oss.buffer;
+ 		}
+@@ -1405,7 +1405,7 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
+ 			}
+ 		} else {
+ 			tmp = snd_pcm_oss_write2(substream,
+-						 (const char __force *)buf,
++						 (const char __force_kernel *)buf,
+ 						 runtime->oss.period_bytes, 0);
+ 			if (tmp <= 0)
+ 				goto err;
+@@ -1431,7 +1431,7 @@ static ssize_t snd_pcm_oss_read2(struct snd_pcm_substream *substream, char *buf,
+ 	struct snd_pcm_runtime *runtime = substream->runtime;
+ 	snd_pcm_sframes_t frames, frames1;
+ #ifdef CONFIG_SND_PCM_OSS_PLUGINS
+-	char __user *final_dst = (char __force __user *)buf;
++	char __user *final_dst = (char __force_user *)buf;
+ 	if (runtime->oss.plugin_first) {
+ 		struct snd_pcm_plugin_channel *channels;
+ 		size_t oss_frame_bytes = (runtime->oss.plugin_last->dst_width * runtime->oss.plugin_last->dst_format.channels) / 8;
+@@ -1493,7 +1493,7 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
+ 			xfer += tmp;
+ 			runtime->oss.buffer_used -= tmp;
+ 		} else {
+-			tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
++			tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf,
+ 						runtime->oss.period_bytes, 0);
+ 			if (tmp <= 0)
+ 				goto err;
+@@ -1662,7 +1662,7 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
+ 								   size1);
+ 					size1 /= runtime->channels; /* frames */
+ 					fs = snd_enter_user();
+-					snd_pcm_lib_write(substream, (void __force __user *)runtime->oss.buffer, size1);
++					snd_pcm_lib_write(substream, (void __force_user *)runtime->oss.buffer, size1);
+ 					snd_leave_user(fs);
+ 				}
+ 			} else if (runtime->access == SNDRV_PCM_ACCESS_RW_NONINTERLEAVED) {
+diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
+index 1f64ab0..26a7233 100644
+--- a/sound/core/pcm_compat.c
++++ b/sound/core/pcm_compat.c
+@@ -31,7 +31,7 @@ static int snd_pcm_ioctl_delay_compat(struct snd_pcm_substream *substream,
+ 	int err;
+ 
+ 	fs = snd_enter_user();
+-	err = snd_pcm_delay(substream, &delay);
++	err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay);
+ 	snd_leave_user(fs);
+ 	if (err < 0)
+ 		return err;
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 3a9b66c..2b38b21 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -1867,8 +1867,9 @@ EXPORT_SYMBOL(snd_pcm_lib_ioctl);
+  * Even if more than one periods have elapsed since the last call, you
+  * have to call this only once.
+  */
+-void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
++void snd_pcm_period_elapsed(void *_substream)
+ {
++	struct snd_pcm_substream *substream = _substream;
+ 	struct snd_pcm_runtime *runtime;
+ 	unsigned long flags;
+ 
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 9106d8e..e7e2e3c 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -3014,11 +3014,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
+ 	switch (substream->stream) {
+ 	case SNDRV_PCM_STREAM_PLAYBACK:
+ 		result = snd_pcm_playback_ioctl1(NULL, substream, cmd,
+-						 (void __user *)arg);
++						 (void __force_user *)arg);
+ 		break;
+ 	case SNDRV_PCM_STREAM_CAPTURE:
+ 		result = snd_pcm_capture_ioctl1(NULL, substream, cmd,
+-						(void __user *)arg);
++						(void __force_user *)arg);
+ 		break;
+ 	default:
+ 		result = -EINVAL;
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index 795437b..3650746 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -871,9 +871,10 @@ static int snd_rawmidi_control_ioctl(struct snd_card *card,
+  *
+  * Return: The size of read data, or a negative error code on failure.
+  */
+-int snd_rawmidi_receive(struct snd_rawmidi_substream *substream,
+-			const unsigned char *buffer, int count)
++int snd_rawmidi_receive(void *_substream, const void *_buffer, int count)
+ {
++	struct snd_rawmidi_substream *substream = _substream;
++	const unsigned char *buffer = _buffer;
+ 	unsigned long flags;
+ 	int result = 0, count1;
+ 	struct snd_rawmidi_runtime *runtime = substream->runtime;
+diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
+index b16dbef04..8eb05a4 100644
+--- a/sound/core/seq/oss/seq_oss_synth.c
++++ b/sound/core/seq/oss/seq_oss_synth.c
+@@ -653,8 +653,8 @@ snd_seq_oss_synth_info_read(struct snd_info_buffer *buf)
+ 			    rec->synth_type, rec->synth_subtype,
+ 			    rec->nr_voices);
+ 		snd_iprintf(buf, "  capabilities : ioctl %s / load_patch %s\n",
+-			    enabled_str((long)rec->oper.ioctl),
+-			    enabled_str((long)rec->oper.load_patch));
++			    enabled_str(!!rec->oper.ioctl),
++			    enabled_str(!!rec->oper.load_patch));
+ 		snd_use_lock_free(&rec->use_lock);
+ 	}
+ }
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 58e79e0..19751d1 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -416,7 +416,7 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count,
+ 	if (!client->accept_input || (fifo = client->data.user.fifo) == NULL)
+ 		return -ENXIO;
+ 
+-	if (atomic_read(&fifo->overflow) > 0) {
++	if (atomic_read_unchecked(&fifo->overflow) > 0) {
+ 		/* buffer overflow is detected */
+ 		snd_seq_fifo_clear(fifo);
+ 		/* return error code */
+@@ -446,7 +446,7 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count,
+ 			count -= sizeof(struct snd_seq_event);
+ 			buf += sizeof(struct snd_seq_event);
+ 			err = snd_seq_expand_var_event(&cell->event, count,
+-						       (char __force *)buf, 0,
++						       (char __force_kernel *)buf, 0,
+ 						       sizeof(struct snd_seq_event));
+ 			if (err < 0)
+ 				break;
+@@ -1062,13 +1062,13 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
+ 			}
+ 			/* set user space pointer */
+ 			event.data.ext.len = extlen | SNDRV_SEQ_EXT_USRPTR;
+-			event.data.ext.ptr = (char __force *)buf
++			event.data.ext.ptr = (char __force_kernel *)buf
+ 						+ sizeof(struct snd_seq_event);
+ 			len += extlen; /* increment data length */
+ 		} else {
+ #ifdef CONFIG_COMPAT
+ 			if (client->convert32 && snd_seq_ev_is_varusr(&event)) {
+-				void *ptr = (void __force *)compat_ptr(event.data.raw32.d[1]);
++				void *ptr = (void __force_kernel *)compat_ptr(event.data.raw32.d[1]);
+ 				event.data.ext.ptr = ptr;
+ 			}
+ #endif
+@@ -2423,7 +2423,7 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg)
+ 	if (client == NULL)
+ 		return -ENXIO;
+ 	fs = snd_enter_user();
+-	result = snd_seq_do_ioctl(client, cmd, (void __force __user *)arg);
++	result = snd_seq_do_ioctl(client, cmd, (void __force_user *)arg);
+ 	snd_leave_user(fs);
+ 	return result;
+ }
+diff --git a/sound/core/seq/seq_compat.c b/sound/core/seq/seq_compat.c
+index 6517590..9905cee 100644
+--- a/sound/core/seq/seq_compat.c
++++ b/sound/core/seq/seq_compat.c
+@@ -60,7 +60,7 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned
+ 	data->kernel = NULL;
+ 
+ 	fs = snd_enter_user();
+-	err = snd_seq_do_ioctl(client, cmd, data);
++	err = snd_seq_do_ioctl(client, cmd, (void __force_user *)data);
+ 	snd_leave_user(fs);
+ 	if (err < 0)
+ 		goto error;
+diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
+index 1d5acbe..5f55223 100644
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -50,7 +50,7 @@ struct snd_seq_fifo *snd_seq_fifo_new(int poolsize)
+ 	spin_lock_init(&f->lock);
+ 	snd_use_lock_init(&f->use_lock);
+ 	init_waitqueue_head(&f->input_sleep);
+-	atomic_set(&f->overflow, 0);
++	atomic_set_unchecked(&f->overflow, 0);
+ 
+ 	f->head = NULL;
+ 	f->tail = NULL;
+@@ -96,7 +96,7 @@ void snd_seq_fifo_clear(struct snd_seq_fifo *f)
+ 	unsigned long flags;
+ 
+ 	/* clear overflow flag */
+-	atomic_set(&f->overflow, 0);
++	atomic_set_unchecked(&f->overflow, 0);
+ 
+ 	snd_use_lock_sync(&f->use_lock);
+ 	spin_lock_irqsave(&f->lock, flags);
+@@ -123,7 +123,7 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f,
+ 	err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL); /* always non-blocking */
+ 	if (err < 0) {
+ 		if ((err == -ENOMEM) || (err == -EAGAIN))
+-			atomic_inc(&f->overflow);
++			atomic_inc_unchecked(&f->overflow);
+ 		snd_use_lock_free(&f->use_lock);
+ 		return err;
+ 	}
+diff --git a/sound/core/seq/seq_fifo.h b/sound/core/seq/seq_fifo.h
+index 062c446..a4b6f4c 100644
+--- a/sound/core/seq/seq_fifo.h
++++ b/sound/core/seq/seq_fifo.h
+@@ -35,7 +35,7 @@ struct snd_seq_fifo {
+ 	spinlock_t lock;
+ 	snd_use_lock_t use_lock;
+ 	wait_queue_head_t input_sleep;
+-	atomic_t overflow;
++	atomic_unchecked_t overflow;
+ 
+ };
+ 
+diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
+index c850345..ec0a853 100644
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -87,7 +87,7 @@ int snd_seq_dump_var_event(const struct snd_seq_event *event,
+ 
+ 	if (event->data.ext.len & SNDRV_SEQ_EXT_USRPTR) {
+ 		char buf[32];
+-		char __user *curptr = (char __force __user *)event->data.ext.ptr;
++		char __user *curptr = (char __force_user *)event->data.ext.ptr;
+ 		while (len > 0) {
+ 			int size = sizeof(buf);
+ 			if (len < size)
+@@ -126,15 +126,19 @@ EXPORT_SYMBOL(snd_seq_dump_var_event);
+  * expand the variable length event to linear buffer space.
+  */
+ 
+-static int seq_copy_in_kernel(char **bufptr, const void *src, int size)
++static int seq_copy_in_kernel(void *_bufptr, const void *src, int size)
+ {
++	char **bufptr = (char **)_bufptr;
++
+ 	memcpy(*bufptr, src, size);
+ 	*bufptr += size;
+ 	return 0;
+ }
+ 
+-static int seq_copy_in_user(char __user **bufptr, const void *src, int size)
++static int seq_copy_in_user(void *_bufptr, const void *src, int size)
+ {
++	char __user **bufptr = (char __user **)_bufptr;
++
+ 	if (copy_to_user(*bufptr, src, size))
+ 		return -EFAULT;
+ 	*bufptr += size;
+@@ -158,13 +162,13 @@ int snd_seq_expand_var_event(const struct snd_seq_event *event, int count, char
+ 	if (event->data.ext.len & SNDRV_SEQ_EXT_USRPTR) {
+ 		if (! in_kernel)
+ 			return -EINVAL;
+-		if (copy_from_user(buf, (void __force __user *)event->data.ext.ptr, len))
++		if (copy_from_user(buf, (void __force_user *)event->data.ext.ptr, len))
+ 			return -EFAULT;
+ 		return newlen;
+ 	}
+ 	err = snd_seq_dump_var_event(event,
+-				     in_kernel ? (snd_seq_dump_func_t)seq_copy_in_kernel :
+-				     (snd_seq_dump_func_t)seq_copy_in_user,
++				     in_kernel ? seq_copy_in_kernel :
++				     seq_copy_in_user,
+ 				     &buf);
+ 	return err < 0 ? err : newlen;
+ }
+@@ -344,7 +348,7 @@ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
+ 				tmp->event = src->event;
+ 				src = src->next;
+ 			} else if (is_usrptr) {
+-				if (copy_from_user(&tmp->event, (char __force __user *)buf, size)) {
++				if (copy_from_user(&tmp->event, (char __force_user *)buf, size)) {
+ 					err = -EFAULT;
+ 					goto __error;
+ 				}
+diff --git a/sound/core/seq/seq_midi.c b/sound/core/seq/seq_midi.c
+index 5dd0ee2..0208e35 100644
+--- a/sound/core/seq/seq_midi.c
++++ b/sound/core/seq/seq_midi.c
+@@ -111,8 +111,9 @@ static void snd_midi_input_event(struct snd_rawmidi_substream *substream)
+ 	}
+ }
+ 
+-static int dump_midi(struct snd_rawmidi_substream *substream, const char *buf, int count)
++static int dump_midi(void *_substream, const void *buf, int count)
+ {
++	struct snd_rawmidi_substream *substream = _substream;
+ 	struct snd_rawmidi_runtime *runtime;
+ 	int tmp;
+ 
+@@ -148,7 +149,7 @@ static int event_process_midi(struct snd_seq_event *ev, int direct,
+ 			pr_debug("ALSA: seq_midi: invalid sysex event flags = 0x%x\n", ev->flags);
+ 			return 0;
+ 		}
+-		snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)dump_midi, substream);
++		snd_seq_dump_var_event(ev, dump_midi, substream);
+ 		snd_midi_event_reset_decode(msynth->parser);
+ 	} else {
+ 		if (msynth->parser == NULL)
+diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
+index c82ed3e..e11d039 100644
+--- a/sound/core/seq/seq_virmidi.c
++++ b/sound/core/seq/seq_virmidi.c
+@@ -90,7 +90,7 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
+ 		if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
+ 			if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
+ 				continue;
+-			snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream);
++			snd_seq_dump_var_event(ev, snd_rawmidi_receive, vmidi->substream);
+ 		} else {
+ 			len = snd_midi_event_decode(vmidi->parser, msg, sizeof(msg), ev);
+ 			if (len > 0)
+diff --git a/sound/core/sound.c b/sound/core/sound.c
+index 175f9e4..3518d31 100644
+--- a/sound/core/sound.c
++++ b/sound/core/sound.c
+@@ -86,7 +86,7 @@ static void snd_request_other(int minor)
+ 	case SNDRV_MINOR_TIMER:		str = "snd-timer";	break;
+ 	default:			return;
+ 	}
+-	request_module(str);
++	request_module("%s", str);
+ }
+ 
+ #endif	/* modular kernel */
+diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
+index 2a008a9..a1efb3f 100644
+--- a/sound/drivers/mts64.c
++++ b/sound/drivers/mts64.c
+@@ -29,6 +29,7 @@
+ #include <sound/initval.h>
+ #include <sound/rawmidi.h>
+ #include <sound/control.h>
++#include <asm/local.h>
+ 
+ #define CARD_NAME "Miditerminal 4140"
+ #define DRIVER_NAME "MTS64"
+@@ -67,7 +68,7 @@ struct mts64 {
+ 	struct pardevice *pardev;
+ 	int pardev_claimed;
+ 
+-	int open_count;
++	local_t open_count;
+ 	int current_midi_output_port;
+ 	int current_midi_input_port;
+ 	u8 mode[MTS64_NUM_INPUT_PORTS];
+@@ -687,7 +688,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
+ {
+ 	struct mts64 *mts = substream->rmidi->private_data;
+ 
+-	if (mts->open_count == 0) {
++	if (local_read(&mts->open_count) == 0) {
+ 		/* We don't need a spinlock here, because this is just called 
+ 		   if the device has not been opened before. 
+ 		   So there aren't any IRQs from the device */
+@@ -695,7 +696,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
+ 
+ 		msleep(50);
+ 	}
+-	++(mts->open_count);
++	local_inc(&mts->open_count);
+ 
+ 	return 0;
+ }
+@@ -705,8 +706,7 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
+ 	struct mts64 *mts = substream->rmidi->private_data;
+ 	unsigned long flags;
+ 
+-	--(mts->open_count);
+-	if (mts->open_count == 0) {
++	if (local_dec_return(&mts->open_count) == 0) {
+ 		/* We need the spinlock_irqsave here because we can still
+ 		   have IRQs at this point */
+ 		spin_lock_irqsave(&mts->lock, flags);
+@@ -715,8 +715,8 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
+ 
+ 		msleep(500);
+ 
+-	} else if (mts->open_count < 0)
+-		mts->open_count = 0;
++	} else if (local_read(&mts->open_count) < 0)
++		local_set(&mts->open_count, 0);
+ 
+ 	return 0;
+ }
+diff --git a/sound/drivers/opl4/opl4_lib.c b/sound/drivers/opl4/opl4_lib.c
+index 89c7aa0..6d75e49 100644
+--- a/sound/drivers/opl4/opl4_lib.c
++++ b/sound/drivers/opl4/opl4_lib.c
+@@ -29,7 +29,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@×××××××.de>");
+ MODULE_DESCRIPTION("OPL4 driver");
+ MODULE_LICENSE("GPL");
+ 
+-static void inline snd_opl4_wait(struct snd_opl4 *opl4)
++static inline void snd_opl4_wait(struct snd_opl4 *opl4)
+ {
+ 	int timeout = 10;
+ 	while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
+diff --git a/sound/drivers/portman2x4.c b/sound/drivers/portman2x4.c
+index 464385a..46ab3f6 100644
+--- a/sound/drivers/portman2x4.c
++++ b/sound/drivers/portman2x4.c
+@@ -48,6 +48,7 @@
+ #include <sound/initval.h>
+ #include <sound/rawmidi.h>
+ #include <sound/control.h>
++#include <asm/local.h>
+ 
+ #define CARD_NAME "Portman 2x4"
+ #define DRIVER_NAME "portman"
+@@ -85,7 +86,7 @@ struct portman {
+ 	struct pardevice *pardev;
+ 	int pardev_claimed;
+ 
+-	int open_count;
++	local_t open_count;
+ 	int mode[PORTMAN_NUM_INPUT_PORTS];
+ 	struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
+ };
+diff --git a/sound/firewire/amdtp-am824.c b/sound/firewire/amdtp-am824.c
+index bebddc6..f5976be 100644
+--- a/sound/firewire/amdtp-am824.c
++++ b/sound/firewire/amdtp-am824.c
+@@ -314,7 +314,7 @@ void amdtp_am824_midi_trigger(struct amdtp_stream *s, unsigned int port,
+ 	struct amdtp_am824 *p = s->protocol;
+ 
+ 	if (port < p->midi_ports)
+-		ACCESS_ONCE(p->midi[port]) = midi;
++		ACCESS_ONCE_RW(p->midi[port]) = midi;
+ }
+ EXPORT_SYMBOL_GPL(amdtp_am824_midi_trigger);
+ 
+diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c
+index ed29026..933d2ae 100644
+--- a/sound/firewire/amdtp-stream.c
++++ b/sound/firewire/amdtp-stream.c
+@@ -344,7 +344,7 @@ static void update_pcm_pointers(struct amdtp_stream *s,
+ 	ptr = s->pcm_buffer_pointer + frames;
+ 	if (ptr >= pcm->runtime->buffer_size)
+ 		ptr -= pcm->runtime->buffer_size;
+-	ACCESS_ONCE(s->pcm_buffer_pointer) = ptr;
++	ACCESS_ONCE_RW(s->pcm_buffer_pointer) = ptr;
+ 
+ 	s->pcm_period_pointer += frames;
+ 	if (s->pcm_period_pointer >= pcm->runtime->period_size) {
+@@ -811,7 +811,7 @@ EXPORT_SYMBOL(amdtp_stream_pcm_pointer);
+ void amdtp_stream_update(struct amdtp_stream *s)
+ {
+ 	/* Precomputing. */
+-	ACCESS_ONCE(s->source_node_id_field) =
++	ACCESS_ONCE_RW(s->source_node_id_field) =
+ 		(fw_parent_device(s->unit)->card->node_id << CIP_SID_SHIFT) &
+ 								CIP_SID_MASK;
+ }
+diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h
+index 8775704..8fea566 100644
+--- a/sound/firewire/amdtp-stream.h
++++ b/sound/firewire/amdtp-stream.h
+@@ -215,7 +215,7 @@ static inline bool amdtp_stream_pcm_running(struct amdtp_stream *s)
+ static inline void amdtp_stream_pcm_trigger(struct amdtp_stream *s,
+ 					    struct snd_pcm_substream *pcm)
+ {
+-	ACCESS_ONCE(s->pcm) = pcm;
++	ACCESS_ONCE_RW(s->pcm) = pcm;
+ }
+ 
+ static inline bool cip_sfc_is_base_44100(enum cip_sfc sfc)
+diff --git a/sound/firewire/digi00x/amdtp-dot.c b/sound/firewire/digi00x/amdtp-dot.c
+index 0ac92ab..a2081aa 100644
+--- a/sound/firewire/digi00x/amdtp-dot.c
++++ b/sound/firewire/digi00x/amdtp-dot.c
+@@ -365,7 +365,7 @@ void amdtp_dot_midi_trigger(struct amdtp_stream *s, unsigned int port,
+ 	struct amdtp_dot *p = s->protocol;
+ 
+ 	if (port < p->midi_ports)
+-		ACCESS_ONCE(p->midi[port]) = midi;
++		ACCESS_ONCE_RW(p->midi[port]) = midi;
+ }
+ 
+ static unsigned int process_tx_data_blocks(struct amdtp_stream *s,
+diff --git a/sound/firewire/isight.c b/sound/firewire/isight.c
+index 48d6dca..a0266c23 100644
+--- a/sound/firewire/isight.c
++++ b/sound/firewire/isight.c
+@@ -96,7 +96,7 @@ static void isight_update_pointers(struct isight *isight, unsigned int count)
+ 	ptr += count;
+ 	if (ptr >= runtime->buffer_size)
+ 		ptr -= runtime->buffer_size;
+-	ACCESS_ONCE(isight->buffer_pointer) = ptr;
++	ACCESS_ONCE_RW(isight->buffer_pointer) = ptr;
+ 
+ 	isight->period_counter += count;
+ 	if (isight->period_counter >= runtime->period_size) {
+@@ -293,7 +293,7 @@ static int isight_hw_params(struct snd_pcm_substream *substream,
+ 	if (err < 0)
+ 		return err;
+ 
+-	ACCESS_ONCE(isight->pcm_active) = true;
++	ACCESS_ONCE_RW(isight->pcm_active) = true;
+ 
+ 	return 0;
+ }
+@@ -331,7 +331,7 @@ static int isight_hw_free(struct snd_pcm_substream *substream)
+ {
+ 	struct isight *isight = substream->private_data;
+ 
+-	ACCESS_ONCE(isight->pcm_active) = false;
++	ACCESS_ONCE_RW(isight->pcm_active) = false;
+ 
+ 	mutex_lock(&isight->mutex);
+ 	isight_stop_streaming(isight);
+@@ -424,10 +424,10 @@ static int isight_trigger(struct snd_pcm_substream *substream, int cmd)
+ 
+ 	switch (cmd) {
+ 	case SNDRV_PCM_TRIGGER_START:
+-		ACCESS_ONCE(isight->pcm_running) = true;
++		ACCESS_ONCE_RW(isight->pcm_running) = true;
+ 		break;
+ 	case SNDRV_PCM_TRIGGER_STOP:
+-		ACCESS_ONCE(isight->pcm_running) = false;
++		ACCESS_ONCE_RW(isight->pcm_running) = false;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+diff --git a/sound/firewire/oxfw/oxfw-scs1x.c b/sound/firewire/oxfw/oxfw-scs1x.c
+index bb53eb3..670cd89 100644
+--- a/sound/firewire/oxfw/oxfw-scs1x.c
++++ b/sound/firewire/oxfw/oxfw-scs1x.c
+@@ -278,9 +278,9 @@ static void midi_capture_trigger(struct snd_rawmidi_substream *stream, int up)
+ 
+ 	if (up) {
+ 		scs->input_escape_count = 0;
+-		ACCESS_ONCE(scs->input) = stream;
++		ACCESS_ONCE_RW(scs->input) = stream;
+ 	} else {
+-		ACCESS_ONCE(scs->input) = NULL;
++		ACCESS_ONCE_RW(scs->input) = NULL;
+ 	}
+ }
+ 
+@@ -310,10 +310,10 @@ static void midi_playback_trigger(struct snd_rawmidi_substream *stream, int up)
+ 		scs->output_escaped = false;
+ 		scs->output_idle = false;
+ 
+-		ACCESS_ONCE(scs->output) = stream;
++		ACCESS_ONCE_RW(scs->output) = stream;
+ 		tasklet_schedule(&scs->tasklet);
+ 	} else {
+-		ACCESS_ONCE(scs->output) = NULL;
++		ACCESS_ONCE_RW(scs->output) = NULL;
+ 	}
+ }
+ static void midi_playback_drain(struct snd_rawmidi_substream *stream)
+diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c
+index dc91072..d85a10a 100644
+--- a/sound/oss/sb_audio.c
++++ b/sound/oss/sb_audio.c
+@@ -900,7 +900,7 @@ sb16_copy_from_user(int dev,
+ 		buf16 = (signed short *)(localbuf + localoffs);
+ 		while (c)
+ 		{
+-			locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
++			locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
+ 			if (copy_from_user(lbuf8,
+ 					   userbuf+useroffs + p,
+ 					   locallen))
+diff --git a/sound/oss/swarm_cs4297a.c b/sound/oss/swarm_cs4297a.c
+index 213a416..aeab5c9 100644
+--- a/sound/oss/swarm_cs4297a.c
++++ b/sound/oss/swarm_cs4297a.c
+@@ -2623,7 +2623,6 @@ static int __init cs4297a_init(void)
+ {
+ 	struct cs4297a_state *s;
+ 	u32 pwr, id;
+-	mm_segment_t fs;
+ 	int rval;
+ 	u64 cfg;
+ 	int mdio_val;
+@@ -2709,22 +2708,23 @@ static int __init cs4297a_init(void)
+         if (!rval) {
+ 		char *sb1250_duart_present;
+ 
++#if 0
++                mm_segment_t fs;
+                 fs = get_fs();
+                 set_fs(KERNEL_DS);
+-#if 0
+                 val = SOUND_MASK_LINE;
+                 mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
+                 for (i = 0; i < ARRAY_SIZE(initvol); i++) {
+                         val = initvol[i].vol;
+                         mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
+                 }
++                set_fs(fs);
+ //                cs4297a_write_ac97(s, 0x18, 0x0808);
+ #else
+                 //                cs4297a_write_ac97(s, 0x5e, 0x180);
+                 cs4297a_write_ac97(s, 0x02, 0x0808);
+                 cs4297a_write_ac97(s, 0x18, 0x0808);
+ #endif
+-                set_fs(fs);
+ 
+                 list_add(&s->list, &cs4297a_devs);
+ 
+diff --git a/sound/pci/als300.c b/sound/pci/als300.c
+index add3176..c9394d9 100644
+--- a/sound/pci/als300.c
++++ b/sound/pci/als300.c
+@@ -647,7 +647,7 @@ static int snd_als300_create(struct snd_card *card,
+ 			     struct snd_als300 **rchip)
+ {
+ 	struct snd_als300 *chip;
+-	void *irq_handler;
++	irq_handler_t irq_handler;
+ 	int err;
+ 
+ 	static struct snd_device_ops ops = {
+diff --git a/sound/pci/aw2/aw2-alsa.c b/sound/pci/aw2/aw2-alsa.c
+index 1677143..85aca1d 100644
+--- a/sound/pci/aw2/aw2-alsa.c
++++ b/sound/pci/aw2/aw2-alsa.c
+@@ -458,7 +458,6 @@ static int snd_aw2_pcm_prepare_playback(struct snd_pcm_substream *substream)
+ 
+ 	/* Define Interrupt callback */
+ 	snd_aw2_saa7146_define_it_playback_callback(pcm_device->stream_number,
+-						    (snd_aw2_saa7146_it_cb)
+ 						    snd_pcm_period_elapsed,
+ 						    (void *)substream);
+ 
+@@ -487,7 +486,6 @@ static int snd_aw2_pcm_prepare_capture(struct snd_pcm_substream *substream)
+ 
+ 	/* Define Interrupt callback */
+ 	snd_aw2_saa7146_define_it_capture_callback(pcm_device->stream_number,
+-						   (snd_aw2_saa7146_it_cb)
+ 						   snd_pcm_period_elapsed,
+ 						   (void *)substream);
+ 
+diff --git a/sound/pci/aw2/aw2-saa7146.c b/sound/pci/aw2/aw2-saa7146.c
+index 1d78904..d9c1056 100644
+--- a/sound/pci/aw2/aw2-saa7146.c
++++ b/sound/pci/aw2/aw2-saa7146.c
+@@ -262,7 +262,7 @@ void snd_aw2_saa7146_define_it_playback_callback(unsigned int stream_number,
+ {
+ 	if (stream_number < NB_STREAM_PLAYBACK) {
+ 		arr_substream_it_playback_cb[stream_number].p_it_callback =
+-		    (snd_aw2_saa7146_it_cb) p_it_callback;
++		    p_it_callback;
+ 		arr_substream_it_playback_cb[stream_number].p_callback_param =
+ 		    (void *)p_callback_param;
+ 	}
+@@ -275,7 +275,7 @@ void snd_aw2_saa7146_define_it_capture_callback(unsigned int stream_number,
+ {
+ 	if (stream_number < NB_STREAM_CAPTURE) {
+ 		arr_substream_it_capture_cb[stream_number].p_it_callback =
+-		    (snd_aw2_saa7146_it_cb) p_it_callback;
++		    p_it_callback;
+ 		arr_substream_it_capture_cb[stream_number].p_callback_param =
+ 		    (void *)p_callback_param;
+ 	}
+diff --git a/sound/pci/ctxfi/ctamixer.c b/sound/pci/ctxfi/ctamixer.c
+index 5fcbb06..f4b85df 100644
+--- a/sound/pci/ctxfi/ctamixer.c
++++ b/sound/pci/ctxfi/ctamixer.c
+@@ -297,8 +297,9 @@ static int put_amixer_rsc(struct amixer_mgr *mgr, struct amixer *amixer)
+ 	return 0;
+ }
+ 
+-int amixer_mgr_create(struct hw *hw, struct amixer_mgr **ramixer_mgr)
++int amixer_mgr_create(struct hw *hw, void **_ramixer_mgr)
+ {
++	struct amixer_mgr **ramixer_mgr = (struct amixer_mgr **)_ramixer_mgr;
+ 	int err;
+ 	struct amixer_mgr *amixer_mgr;
+ 
+@@ -326,8 +327,10 @@ error:
+ 	return err;
+ }
+ 
+-int amixer_mgr_destroy(struct amixer_mgr *amixer_mgr)
++int amixer_mgr_destroy(void *_amixer_mgr)
+ {
++	struct amixer_mgr *amixer_mgr = _amixer_mgr;
 +
-+int plugin_is_GPL_compatible;
+ 	rsc_mgr_uninit(&amixer_mgr->mgr);
+ 	kfree(amixer_mgr);
+ 	return 0;
+@@ -452,8 +455,9 @@ static int put_sum_rsc(struct sum_mgr *mgr, struct sum *sum)
+ 	return 0;
+ }
+ 
+-int sum_mgr_create(struct hw *hw, struct sum_mgr **rsum_mgr)
++int sum_mgr_create(struct hw *hw, void **_rsum_mgr)
+ {
++	struct sum_mgr **rsum_mgr = (struct sum_mgr **)_rsum_mgr;
+ 	int err;
+ 	struct sum_mgr *sum_mgr;
+ 
+@@ -481,8 +485,10 @@ error:
+ 	return err;
+ }
+ 
+-int sum_mgr_destroy(struct sum_mgr *sum_mgr)
++int sum_mgr_destroy(void *_sum_mgr)
+ {
++	struct sum_mgr *sum_mgr = _sum_mgr;
 +
-+static struct plugin_info structleak_plugin_info = {
-+	.version	= "201602181345",
-+	.help		= "disable\tdo not activate plugin\n",
-+};
+ 	rsc_mgr_uninit(&sum_mgr->mgr);
+ 	kfree(sum_mgr);
+ 	return 0;
+diff --git a/sound/pci/ctxfi/ctamixer.h b/sound/pci/ctxfi/ctamixer.h
+index 2de18aa..2fbd01b 100644
+--- a/sound/pci/ctxfi/ctamixer.h
++++ b/sound/pci/ctxfi/ctamixer.h
+@@ -47,8 +47,8 @@ struct sum_mgr {
+ };
+ 
+ /* Constructor and destructor of daio resource manager */
+-int sum_mgr_create(struct hw *hw, struct sum_mgr **rsum_mgr);
+-int sum_mgr_destroy(struct sum_mgr *sum_mgr);
++int sum_mgr_create(struct hw *hw, void **rsum_mgr);
++int sum_mgr_destroy(void *sum_mgr);
+ 
+ /* Define the descriptor of a amixer resource */
+ struct amixer_rsc_ops;
+@@ -93,7 +93,7 @@ struct amixer_mgr {
+ };
+ 
+ /* Constructor and destructor of amixer resource manager */
+-int amixer_mgr_create(struct hw *hw, struct amixer_mgr **ramixer_mgr);
+-int amixer_mgr_destroy(struct amixer_mgr *amixer_mgr);
++int amixer_mgr_create(struct hw *hw, void **ramixer_mgr);
++int amixer_mgr_destroy(void *amixer_mgr);
+ 
+ #endif /* CTAMIXER_H */
+diff --git a/sound/pci/ctxfi/ctatc.c b/sound/pci/ctxfi/ctatc.c
+index 977a598..a787004 100644
+--- a/sound/pci/ctxfi/ctatc.c
++++ b/sound/pci/ctxfi/ctatc.c
+@@ -113,16 +113,16 @@ static struct {
+ 	int (*create)(struct hw *hw, void **rmgr);
+ 	int (*destroy)(void *mgr);
+ } rsc_mgr_funcs[NUM_RSCTYP] = {
+-	[SRC] 		= { .create 	= (create_t)src_mgr_create,
+-			    .destroy 	= (destroy_t)src_mgr_destroy	},
+-	[SRCIMP] 	= { .create 	= (create_t)srcimp_mgr_create,
+-			    .destroy 	= (destroy_t)srcimp_mgr_destroy	},
+-	[AMIXER]	= { .create	= (create_t)amixer_mgr_create,
+-			    .destroy	= (destroy_t)amixer_mgr_destroy	},
+-	[SUM]		= { .create	= (create_t)sum_mgr_create,
+-			    .destroy	= (destroy_t)sum_mgr_destroy	},
+-	[DAIO]		= { .create	= (create_t)daio_mgr_create,
+-			    .destroy	= (destroy_t)daio_mgr_destroy	}
++	[SRC] 		= { .create 	= src_mgr_create,
++			    .destroy 	= src_mgr_destroy	},
++	[SRCIMP] 	= { .create 	= srcimp_mgr_create,
++			    .destroy 	= srcimp_mgr_destroy	},
++	[AMIXER]	= { .create	= amixer_mgr_create,
++			    .destroy	= amixer_mgr_destroy	},
++	[SUM]		= { .create	= sum_mgr_create,
++			    .destroy	= sum_mgr_destroy	},
++	[DAIO]		= { .create	= daio_mgr_create,
++			    .destroy	= daio_mgr_destroy	}
+ };
+ 
+ static int
+diff --git a/sound/pci/ctxfi/ctdaio.c b/sound/pci/ctxfi/ctdaio.c
+index 7f089cb..6bea28e 100644
+--- a/sound/pci/ctxfi/ctdaio.c
++++ b/sound/pci/ctxfi/ctdaio.c
+@@ -687,8 +687,9 @@ static int daio_mgr_commit_write(struct daio_mgr *mgr)
+ 	return 0;
+ }
+ 
+-int daio_mgr_create(struct hw *hw, struct daio_mgr **rdaio_mgr)
++int daio_mgr_create(struct hw *hw, void **_rdaio_mgr)
+ {
++	struct daio_mgr **rdaio_mgr = (struct daio_mgr **)_rdaio_mgr;
+ 	int err, i;
+ 	struct daio_mgr *daio_mgr;
+ 	struct imapper *entry;
+@@ -741,8 +742,9 @@ error1:
+ 	return err;
+ }
+ 
+-int daio_mgr_destroy(struct daio_mgr *daio_mgr)
++int daio_mgr_destroy(void *_daio_mgr)
+ {
++	struct daio_mgr *daio_mgr = _daio_mgr;
+ 	unsigned long flags;
+ 
+ 	/* free daio input mapper list */
+diff --git a/sound/pci/ctxfi/ctdaio.h b/sound/pci/ctxfi/ctdaio.h
+index a30be73..91b8dbd 100644
+--- a/sound/pci/ctxfi/ctdaio.h
++++ b/sound/pci/ctxfi/ctdaio.h
+@@ -119,7 +119,7 @@ struct daio_mgr {
+ };
+ 
+ /* Constructor and destructor of daio resource manager */
+-int daio_mgr_create(struct hw *hw, struct daio_mgr **rdaio_mgr);
+-int daio_mgr_destroy(struct daio_mgr *daio_mgr);
++int daio_mgr_create(struct hw *hw, void **rdaio_mgr);
++int daio_mgr_destroy(void *daio_mgr);
+ 
+ #endif /* CTDAIO_H */
+diff --git a/sound/pci/ctxfi/ctsrc.c b/sound/pci/ctxfi/ctsrc.c
+index a5a72df..f86edb8 100644
+--- a/sound/pci/ctxfi/ctsrc.c
++++ b/sound/pci/ctxfi/ctsrc.c
+@@ -544,8 +544,9 @@ static int src_mgr_commit_write(struct src_mgr *mgr)
+ 	return 0;
+ }
+ 
+-int src_mgr_create(struct hw *hw, struct src_mgr **rsrc_mgr)
++int src_mgr_create(struct hw *hw, void **_rsrc_mgr)
+ {
++	struct src_mgr **rsrc_mgr = (struct src_mgr **)_rsrc_mgr;
+ 	int err, i;
+ 	struct src_mgr *src_mgr;
+ 
+@@ -584,8 +585,10 @@ error1:
+ 	return err;
+ }
+ 
+-int src_mgr_destroy(struct src_mgr *src_mgr)
++int src_mgr_destroy(void *_src_mgr)
+ {
++	struct src_mgr *src_mgr = _src_mgr;
 +
-+static tree handle_user_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
+ 	rsc_mgr_uninit(&src_mgr->mgr);
+ 	kfree(src_mgr);
+ 
+@@ -828,8 +831,9 @@ static int srcimp_imap_delete(struct srcimp_mgr *mgr, struct imapper *entry)
+ 	return err;
+ }
+ 
+-int srcimp_mgr_create(struct hw *hw, struct srcimp_mgr **rsrcimp_mgr)
++int srcimp_mgr_create(struct hw *hw, void **_rsrcimp_mgr)
+ {
++	struct srcimp_mgr **rsrcimp_mgr = (struct srcimp_mgr **)_rsrcimp_mgr;
+ 	int err;
+ 	struct srcimp_mgr *srcimp_mgr;
+ 	struct imapper *entry;
+@@ -873,8 +877,9 @@ error1:
+ 	return err;
+ }
+ 
+-int srcimp_mgr_destroy(struct srcimp_mgr *srcimp_mgr)
++int srcimp_mgr_destroy(void *_srcimp_mgr)
+ {
++	struct srcimp_mgr *srcimp_mgr = _srcimp_mgr;
+ 	unsigned long flags;
+ 
+ 	/* free src input mapper list */
+diff --git a/sound/pci/ctxfi/ctsrc.h b/sound/pci/ctxfi/ctsrc.h
+index 92944a0..fc78ed4 100644
+--- a/sound/pci/ctxfi/ctsrc.h
++++ b/sound/pci/ctxfi/ctsrc.h
+@@ -143,10 +143,10 @@ struct srcimp_mgr {
+ };
+ 
+ /* Constructor and destructor of SRC resource manager */
+-int src_mgr_create(struct hw *hw, struct src_mgr **rsrc_mgr);
+-int src_mgr_destroy(struct src_mgr *src_mgr);
++int src_mgr_create(struct hw *hw, void **rsrc_mgr);
++int src_mgr_destroy(void *src_mgr);
+ /* Constructor and destructor of SRCIMP resource manager */
+-int srcimp_mgr_create(struct hw *hw, struct srcimp_mgr **rsrc_mgr);
+-int srcimp_mgr_destroy(struct srcimp_mgr *srcimp_mgr);
++int srcimp_mgr_create(struct hw *hw, void **rsrc_mgr);
++int srcimp_mgr_destroy(void *srcimp_mgr);
+ 
+ #endif /* CTSRC_H */
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 8374188..f073778 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -1743,7 +1743,7 @@ static int get_kctl_0dB_offset(struct hda_codec *codec,
+ 		/* FIXME: set_fs() hack for obtaining user-space TLV data */
+ 		mm_segment_t fs = get_fs();
+ 		set_fs(get_ds());
+-		if (!kctl->tlv.c(kctl, 0, sizeof(_tlv), _tlv))
++		if (!kctl->tlv.c(kctl, 0, sizeof(_tlv), (unsigned int __force_user *)_tlv))
+ 			tlv = _tlv;
+ 		set_fs(fs);
+ 	} else if (kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_TLV_READ)
+diff --git a/sound/pci/ymfpci/ymfpci.h b/sound/pci/ymfpci/ymfpci.h
+index 149d4cb..7784769 100644
+--- a/sound/pci/ymfpci/ymfpci.h
++++ b/sound/pci/ymfpci/ymfpci.h
+@@ -358,7 +358,7 @@ struct snd_ymfpci {
+ 	spinlock_t reg_lock;
+ 	spinlock_t voice_lock;
+ 	wait_queue_head_t interrupt_sleep;
+-	atomic_t interrupt_sleep_count;
++	atomic_unchecked_t interrupt_sleep_count;
+ 	struct snd_info_entry *proc_entry;
+ 	const struct firmware *dsp_microcode;
+ 	const struct firmware *controller_microcode;
+diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
+index 4c26076..a13f370 100644
+--- a/sound/pci/ymfpci/ymfpci_main.c
++++ b/sound/pci/ymfpci/ymfpci_main.c
+@@ -204,8 +204,8 @@ static void snd_ymfpci_hw_stop(struct snd_ymfpci *chip)
+ 		if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
+ 			break;
+ 	}
+-	if (atomic_read(&chip->interrupt_sleep_count)) {
+-		atomic_set(&chip->interrupt_sleep_count, 0);
++	if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
++		atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
+ 		wake_up(&chip->interrupt_sleep);
+ 	}
+       __end:
+@@ -789,7 +789,7 @@ static void snd_ymfpci_irq_wait(struct snd_ymfpci *chip)
+ 		 	continue;
+ 		init_waitqueue_entry(&wait, current);
+ 		add_wait_queue(&chip->interrupt_sleep, &wait);
+-		atomic_inc(&chip->interrupt_sleep_count);
++		atomic_inc_unchecked(&chip->interrupt_sleep_count);
+ 		schedule_timeout_uninterruptible(msecs_to_jiffies(50));
+ 		remove_wait_queue(&chip->interrupt_sleep, &wait);
+ 	}
+@@ -827,8 +827,8 @@ static irqreturn_t snd_ymfpci_interrupt(int irq, void *dev_id)
+ 		snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
+ 		spin_unlock(&chip->reg_lock);
+ 
+-		if (atomic_read(&chip->interrupt_sleep_count)) {
+-			atomic_set(&chip->interrupt_sleep_count, 0);
++		if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
++			atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
+ 			wake_up(&chip->interrupt_sleep);
+ 		}
+ 	}
+@@ -2384,7 +2384,7 @@ int snd_ymfpci_create(struct snd_card *card,
+ 	spin_lock_init(&chip->reg_lock);
+ 	spin_lock_init(&chip->voice_lock);
+ 	init_waitqueue_head(&chip->interrupt_sleep);
+-	atomic_set(&chip->interrupt_sleep_count, 0);
++	atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
+ 	chip->card = card;
+ 	chip->pci = pci;
+ 	chip->irq = -1;
+diff --git a/sound/soc/codecs/cx20442.c b/sound/soc/codecs/cx20442.c
+index d6f4abb..5d59f0c 100644
+--- a/sound/soc/codecs/cx20442.c
++++ b/sound/soc/codecs/cx20442.c
+@@ -263,6 +263,12 @@ static int v253_hangup(struct tty_struct *tty)
+ 	return 0;
+ }
+ 
++static int v253_hw_write(void *client, const char *buf, int count)
 +{
-+	*no_add_attrs = true;
-+
-+	// check for types? for now accept everything linux has to offer
-+	if (TREE_CODE(*node) != FIELD_DECL)
-+		return NULL_TREE;
-+
-+	*no_add_attrs = false;
-+	return NULL_TREE;
++	struct tty_struct *tty = client;
++	return tty->ops->write(client, buf, count);
 +}
 +
-+static struct attribute_spec user_attr = {
-+	.name			= "user",
-+	.min_length		= 0,
-+	.max_length		= 0,
-+	.decl_required		= false,
-+	.type_required		= false,
-+	.function_type_required	= false,
-+	.handler		= handle_user_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+	.affects_type_identity	= true
-+#endif
-+};
-+
-+static void register_attributes(void *event_data, void *data)
+ /* Line discipline .receive_buf() */
+ static void v253_receive(struct tty_struct *tty,
+ 				const unsigned char *cp, char *fp, int count)
+@@ -280,7 +286,7 @@ static void v253_receive(struct tty_struct *tty,
+ 
+ 		/* Set up codec driver access to modem controls */
+ 		cx20442->control_data = tty;
+-		codec->hw_write = (hw_write_t)tty->ops->write;
++		codec->hw_write = v253_hw_write;
+ 		codec->component.card->pop_time = 1;
+ 	}
+ }
+diff --git a/sound/soc/codecs/sti-sas.c b/sound/soc/codecs/sti-sas.c
+index 160d61a..cd7a4ac 100644
+--- a/sound/soc/codecs/sti-sas.c
++++ b/sound/soc/codecs/sti-sas.c
+@@ -591,11 +591,13 @@ static int sti_sas_driver_probe(struct platform_device *pdev)
+ 	sti_sas_dai[STI_SAS_DAI_ANALOG_OUT].ops = drvdata->dev_data->dac_ops;
+ 
+ 	/* Set dapms*/
+-	sti_sas_driver.dapm_widgets = drvdata->dev_data->dapm_widgets;
+-	sti_sas_driver.num_dapm_widgets = drvdata->dev_data->num_dapm_widgets;
++	pax_open_kernel();
++	const_cast(sti_sas_driver.dapm_widgets) = drvdata->dev_data->dapm_widgets;
++	const_cast(sti_sas_driver.num_dapm_widgets) = drvdata->dev_data->num_dapm_widgets;
+ 
+-	sti_sas_driver.dapm_routes = drvdata->dev_data->dapm_routes;
+-	sti_sas_driver.num_dapm_routes = drvdata->dev_data->num_dapm_routes;
++	const_cast(sti_sas_driver.dapm_routes) = drvdata->dev_data->dapm_routes;
++	const_cast(sti_sas_driver.num_dapm_routes) = drvdata->dev_data->num_dapm_routes;
++	pax_close_kernel();
+ 
+ 	/* Store context */
+ 	dev_set_drvdata(&pdev->dev, drvdata);
+diff --git a/sound/soc/codecs/tlv320dac33.c b/sound/soc/codecs/tlv320dac33.c
+index f7a6ce7..82310c8 100644
+--- a/sound/soc/codecs/tlv320dac33.c
++++ b/sound/soc/codecs/tlv320dac33.c
+@@ -1375,13 +1375,18 @@ static int dac33_set_dai_fmt(struct snd_soc_dai *codec_dai,
+ 	return 0;
+ }
+ 
++static int dac33_hw_write(void *client, const char *buf, int count)
 +{
-+	register_attribute(&user_attr);
-+//	register_attribute(&force_attr);
++	return i2c_master_send(client, buf, count);
 +}
 +
-+static tree get_field_type(tree field)
+ static int dac33_soc_probe(struct snd_soc_codec *codec)
+ {
+ 	struct tlv320dac33_priv *dac33 = snd_soc_codec_get_drvdata(codec);
+ 	int ret = 0;
+ 
+ 	codec->control_data = dac33->control_data;
+-	codec->hw_write = (hw_write_t) i2c_master_send;
++	codec->hw_write = dac33_hw_write;
+ 	dac33->codec = codec;
+ 
+ 	/* Read the tlv320dac33 ID registers */
+diff --git a/sound/soc/codecs/uda1380.c b/sound/soc/codecs/uda1380.c
+index 35f0469..7c25cd5 100644
+--- a/sound/soc/codecs/uda1380.c
++++ b/sound/soc/codecs/uda1380.c
+@@ -687,6 +687,11 @@ static struct snd_soc_dai_driver uda1380_dai[] = {
+ },
+ };
+ 
++static int uda1380_hw_write(void *client, const char *buf, int count)
 +{
-+	return strip_array_types(TREE_TYPE(field));
++	return i2c_master_send(client, buf, count);
 +}
 +
-+static bool is_userspace_type(tree type)
-+{
-+	tree field;
-+
-+	for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
-+		tree fieldtype = get_field_type(field);
-+		enum tree_code code = TREE_CODE(fieldtype);
-+
-+		if (code == RECORD_TYPE || code == UNION_TYPE)
-+			if (is_userspace_type(fieldtype))
-+				return true;
-+
-+		if (lookup_attribute("user", DECL_ATTRIBUTES(field)))
-+			return true;
-+	}
-+	return false;
-+}
+ static int uda1380_probe(struct snd_soc_codec *codec)
+ {
+ 	struct uda1380_platform_data *pdata =codec->dev->platform_data;
+@@ -695,7 +700,7 @@ static int uda1380_probe(struct snd_soc_codec *codec)
+ 
+ 	uda1380->codec = codec;
+ 
+-	codec->hw_write = (hw_write_t)i2c_master_send;
++	codec->hw_write = uda1380_hw_write;
+ 	codec->control_data = uda1380->control_data;
+ 
+ 	if (!pdata)
+diff --git a/sound/soc/intel/skylake/skl-sst-dsp.h b/sound/soc/intel/skylake/skl-sst-dsp.h
+index cbb4075..edda3dd 100644
+--- a/sound/soc/intel/skylake/skl-sst-dsp.h
++++ b/sound/soc/intel/skylake/skl-sst-dsp.h
+@@ -117,14 +117,14 @@ struct skl_dsp_fw_ops {
+ 	int (*load_mod)(struct sst_dsp *ctx, u16 mod_id, char *mod_name);
+ 	int (*unload_mod)(struct sst_dsp *ctx, u16 mod_id);
+ 
+-};
++} __no_const;
+ 
+ struct skl_dsp_loader_ops {
+ 	int (*alloc_dma_buf)(struct device *dev,
+ 		struct snd_dma_buffer *dmab, size_t size);
+ 	int (*free_dma_buf)(struct device *dev,
+ 		struct snd_dma_buffer *dmab);
+-};
++} __no_const;
+ 
+ struct skl_load_module_info {
+ 	u16 mod_id;
+diff --git a/sound/soc/soc-ac97.c b/sound/soc/soc-ac97.c
+index 7e0acd8..b4b2acb 100644
+--- a/sound/soc/soc-ac97.c
++++ b/sound/soc/soc-ac97.c
+@@ -416,8 +416,10 @@ int snd_soc_set_ac97_ops_of_reset(struct snd_ac97_bus_ops *ops,
+ 	if (ret)
+ 		return ret;
+ 
+-	ops->warm_reset = snd_soc_ac97_warm_reset;
+-	ops->reset = snd_soc_ac97_reset;
++	pax_open_kernel();
++	const_cast(ops->warm_reset) = snd_soc_ac97_warm_reset;
++	const_cast(ops->reset) = snd_soc_ac97_reset;
++	pax_close_kernel();
+ 
+ 	snd_ac97_rst_cfg = cfg;
+ 	return 0;
+diff --git a/sound/soc/xtensa/xtfpga-i2s.c b/sound/soc/xtensa/xtfpga-i2s.c
+index 8382ffa..86af7d0 100644
+--- a/sound/soc/xtensa/xtfpga-i2s.c
++++ b/sound/soc/xtensa/xtfpga-i2s.c
+@@ -437,7 +437,7 @@ static int xtfpga_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
+ 	case SNDRV_PCM_TRIGGER_START:
+ 	case SNDRV_PCM_TRIGGER_RESUME:
+ 	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+-		ACCESS_ONCE(i2s->tx_ptr) = 0;
++		ACCESS_ONCE_RW(i2s->tx_ptr) = 0;
+ 		rcu_assign_pointer(i2s->tx_substream, substream);
+ 		xtfpga_pcm_refill_fifo(i2s);
+ 		break;
+diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
+index a020920..55579f6 100644
+--- a/sound/synth/emux/emux_seq.c
++++ b/sound/synth/emux/emux_seq.c
+@@ -33,13 +33,13 @@ static int snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *inf
+  * MIDI emulation operators
+  */
+ static struct snd_midi_op emux_ops = {
+-	snd_emux_note_on,
+-	snd_emux_note_off,
+-	snd_emux_key_press,
+-	snd_emux_terminate_note,
+-	snd_emux_control,
+-	snd_emux_nrpn,
+-	snd_emux_sysex,
++	.note_on = snd_emux_note_on,
++	.note_off = snd_emux_note_off,
++	.key_press = snd_emux_key_press,
++	.note_terminate = snd_emux_terminate_note,
++	.control = snd_emux_control,
++	.nrpn = snd_emux_nrpn,
++	.sysex = snd_emux_sysex,
+ };
+ 
+ 
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index 81b7da8..bb2676f 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -307,7 +307,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
+ {
+ 	struct usb_device *usbdev = line6->usbdev;
+ 	int ret;
+-	unsigned char len;
++	unsigned char *plen;
+ 	unsigned count;
+ 
+ 	if (address > 0xffff || datalen > 0xff)
+@@ -324,6 +324,10 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
+ 		return ret;
+ 	}
+ 
++	plen = kmalloc(1, GFP_KERNEL);
++	if (plen == NULL)
++		return -ENOMEM;
 +
-+static void finish_type(void *event_data, void *data)
-+{
-+	tree type = (tree)event_data;
+ 	/* Wait for data length. We'll get 0xff until length arrives. */
+ 	for (count = 0; count < LINE6_READ_WRITE_MAX_RETRIES; count++) {
+ 		mdelay(LINE6_READ_WRITE_STATUS_DELAY);
+@@ -331,30 +335,35 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
+ 		ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67,
+ 				      USB_TYPE_VENDOR | USB_RECIP_DEVICE |
+ 				      USB_DIR_IN,
+-				      0x0012, 0x0000, &len, 1,
++				      0x0012, 0x0000, plen, 1,
+ 				      LINE6_TIMEOUT * HZ);
+ 		if (ret < 0) {
+ 			dev_err(line6->ifcdev,
+ 				"receive length failed (error %d)\n", ret);
++			kfree(plen);
+ 			return ret;
+ 		}
+ 
+-		if (len != 0xff)
++		if (*plen != 0xff)
+ 			break;
+ 	}
+ 
+-	if (len == 0xff) {
++	if (*plen == 0xff) {
+ 		dev_err(line6->ifcdev, "read failed after %d retries\n",
+ 			count);
++		kfree(plen);
+ 		return -EIO;
+-	} else if (len != datalen) {
++	} else if (*plen != datalen) {
+ 		/* should be equal or something went wrong */
+ 		dev_err(line6->ifcdev,
+ 			"length mismatch (expected %d, got %d)\n",
+-			(int)datalen, (int)len);
++			(int)datalen, (int)*plen);
++		kfree(plen);
+ 		return -EIO;
+ 	}
+ 
++	kfree(plen);
 +
-+	if (type == NULL_TREE || type == error_mark_node)
-+		return;
+ 	/* receive the result: */
+ 	ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67,
+ 			      USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+@@ -378,7 +387,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
+ {
+ 	struct usb_device *usbdev = line6->usbdev;
+ 	int ret;
+-	unsigned char status;
++	unsigned char *status;
+ 	int count;
+ 
+ 	if (address > 0xffff || datalen > 0xffff)
+@@ -395,6 +404,10 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
+ 		return ret;
+ 	}
+ 
++	status = kmalloc(1, GFP_KERNEL);
++	if (status == NULL)
++		return -ENOMEM;
 +
-+#if BUILDING_GCC_VERSION >= 5000
-+	if (TREE_CODE(type) == ENUMERAL_TYPE)
-+		return;
-+#endif
+ 	for (count = 0; count < LINE6_READ_WRITE_MAX_RETRIES; count++) {
+ 		mdelay(LINE6_READ_WRITE_STATUS_DELAY);
+ 
+@@ -403,27 +416,32 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
+ 				      USB_TYPE_VENDOR | USB_RECIP_DEVICE |
+ 				      USB_DIR_IN,
+ 				      0x0012, 0x0000,
+-				      &status, 1, LINE6_TIMEOUT * HZ);
++				      status, 1, LINE6_TIMEOUT * HZ);
+ 
+ 		if (ret < 0) {
+ 			dev_err(line6->ifcdev,
+ 				"receiving status failed (error %d)\n", ret);
++			kfree(status);
+ 			return ret;
+ 		}
+ 
+-		if (status != 0xff)
++		if (*status != 0xff)
+ 			break;
+ 	}
+ 
+-	if (status == 0xff) {
++	if (*status == 0xff) {
+ 		dev_err(line6->ifcdev, "write failed after %d retries\n",
+ 			count);
++		kfree(status);
+ 		return -EIO;
+-	} else if (status != 0) {
++	} else if (*status != 0) {
+ 		dev_err(line6->ifcdev, "write failed (error %d)\n", ret);
++		kfree(status);
+ 		return -EIO;
+ 	}
+ 
++	kfree(status);
 +
-+	if (TYPE_USERSPACE(type))
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(line6_write_data);
+diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c
+index 6d4c50c..aa658c8 100644
+--- a/sound/usb/line6/toneport.c
++++ b/sound/usb/line6/toneport.c
+@@ -367,13 +367,19 @@ static bool toneport_has_source_select(struct usb_line6_toneport *toneport)
+ */
+ static void toneport_setup(struct usb_line6_toneport *toneport)
+ {
+-	int ticks;
++	int *ticks;
+ 	struct usb_line6 *line6 = &toneport->line6;
+ 	struct usb_device *usbdev = line6->usbdev;
+ 
++	ticks = kmalloc(sizeof(int), GFP_KERNEL);
++	if (ticks == NULL)
 +		return;
 +
-+	if (is_userspace_type(type))
-+		TYPE_USERSPACE(type) = 1;
-+}
-+
-+static void initialize(tree var)
-+{
-+	basic_block bb;
-+	gimple_stmt_iterator gsi;
-+	tree initializer;
-+	gimple init_stmt;
-+
-+	// this is the original entry bb before the forced split
-+	bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
-+
-+	// first check if the variable is already initialized, warn otherwise
-+	for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+		gimple stmt = gsi_stmt(gsi);
-+		tree rhs1;
-+
-+		// we're looking for an assignment of a single rhs...
-+		if (!gimple_assign_single_p(stmt))
-+			continue;
-+		rhs1 = gimple_assign_rhs1(stmt);
-+#if BUILDING_GCC_VERSION >= 4007
-+		// ... of a non-clobbering expression...
-+		if (TREE_CLOBBER_P(rhs1))
-+			continue;
-+#endif
-+		// ... to our variable...
-+		if (gimple_get_lhs(stmt) != var)
-+			continue;
-+		// if it's an initializer then we're good
-+		if (TREE_CODE(rhs1) == CONSTRUCTOR)
-+			return;
-+	}
-+
-+	// these aren't the 0days you're looking for
-+//	inform(DECL_SOURCE_LOCATION(var), "userspace variable will be forcibly initialized");
-+
-+	// build the initializer expression
-+	initializer = build_constructor(TREE_TYPE(var), NULL);
-+
-+	// build the initializer stmt
-+	init_stmt = gimple_build_assign(var, initializer);
-+	gsi = gsi_after_labels(single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
-+	gsi_insert_before(&gsi, init_stmt, GSI_NEW_STMT);
-+	update_stmt(init_stmt);
-+}
-+
-+static unsigned int structleak_execute(void)
-+{
-+	basic_block bb;
-+	unsigned int ret = 0;
-+	tree var;
-+	unsigned int i;
-+
-+	// split the first bb where we can put the forced initializers
-+	gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
-+	bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
-+	if (!single_pred_p(bb)) {
-+//		gcc_assert(bb_loop_depth(bb) || (bb->flags & BB_IRREDUCIBLE_LOOP));
-+		split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
-+		gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
-+	}
-+
-+	// enumarate all local variables and forcibly initialize our targets
-+	FOR_EACH_LOCAL_DECL(cfun, i, var) {
-+		tree type = TREE_TYPE(var);
-+
-+		gcc_assert(DECL_P(var));
-+		if (!auto_var_in_fn_p(var, current_function_decl))
-+			continue;
-+
-+		// only care about structure types
-+		if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
-+			continue;
-+
-+		// if the type is of interest, examine the variable
-+		if (TYPE_USERSPACE(type))
-+			initialize(var);
-+	}
-+
-+	return ret;
-+}
-+
-+#define PASS_NAME structleak
-+#define NO_GATE
-+#define PROPERTIES_REQUIRED PROP_cfg
-+#define TODO_FLAGS_FINISH TODO_verify_il | TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa | TODO_ggc_collect | TODO_verify_flow
-+#include "gcc-generate-gimple-pass.h"
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+	int i;
-+	const char * const plugin_name = plugin_info->base_name;
-+	const int argc = plugin_info->argc;
-+	const struct plugin_argument * const argv = plugin_info->argv;
-+	bool enable = true;
-+	struct register_pass_info structleak_pass_info;
-+
-+	structleak_pass_info.pass			= make_structleak_pass();
-+	structleak_pass_info.reference_pass_name	= "ssa";
-+	structleak_pass_info.ref_pass_instance_number	= 1;
-+	structleak_pass_info.pos_op			= PASS_POS_INSERT_AFTER;
-+
-+	if (!plugin_default_version_check(version, &gcc_version)) {
-+		error(G_("incompatible gcc/plugin versions"));
-+		return 1;
-+	}
-+
-+	if (strncmp(lang_hooks.name, "GNU C", 5) && !strncmp(lang_hooks.name, "GNU C+", 6)) {
-+		inform(UNKNOWN_LOCATION, G_("%s supports C only, not %s"), plugin_name, lang_hooks.name);
-+		enable = false;
-+	}
-+
-+	for (i = 0; i < argc; ++i) {
-+		if (!strcmp(argv[i].key, "disable")) {
-+			enable = false;
-+			continue;
-+		}
-+		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+	}
-+
-+	register_callback(plugin_name, PLUGIN_INFO, NULL, &structleak_plugin_info);
-+	if (enable) {
-+		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &structleak_pass_info);
-+		register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
-+	}
-+	register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
+ 	/* sync time on device with host: */
+-	ticks = (int)get_seconds();
+-	line6_write_data(line6, 0x80c6, &ticks, 4);
++	*ticks = (int)get_seconds();
++	line6_write_data(line6, 0x80c6, ticks, sizeof(int));
 +
-+	return 0;
-+}
++	kfree(ticks);
+ 
+ 	/* enable device: */
+ 	toneport_send_cmd(usbdev, 0x0301, 0x0000);
 diff --git a/tools/include/linux/compiler.h b/tools/include/linux/compiler.h
 index fa7208a..d568e71 100644
 --- a/tools/include/linux/compiler.h