main/linux-grsec: merge in stable changes

up to 3.4.28
(cherry picked from commit e9cdf8cd88dc59d04558de3006ffd63cf4c175eb)

Conflicts:
	main/linux-grsec/APKBUILD

2 files changed, 893 insertions, 5 deletions

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 21c7b161d6..604ca3bd00 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -4,7 +4,7 @@ _flavor=grsec
 pkgname=linux-${_flavor}
 pkgver=3.6.11
 _kernver=3.6
-pkgrel=5
+pkgrel=6
 pkgdesc="Linux kernel with grsecurity"
 url=http://grsecurity.net
 depends="mkinitfs linux-firmware"
@@ -14,7 +14,7 @@ _config=${config:-kernelconfig.${CARCH}}
 install=
 source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
         http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
-        patch-3.6.11-al1.patch
+        patch-3.6.11-al2.patch
         grsecurity-2.9.1-3.6.11-al1-unofficial-0.patch
         
         0004-arp-flush-arp-cache-on-device-change.patch
@@ -144,7 +144,7 @@ dev() {
 
 md5sums="1a1760420eac802c541a20ab51a093d1  linux-3.6.tar.xz
 bd4bba74093405887d521309a74c19e9  patch-3.6.11.xz
-90efc91d59e9cfde50de2031a798e62b  patch-3.6.11-al1.patch
+4d225839f004e4133c5fa48b7ca0ddf5  patch-3.6.11-al2.patch
 3838e6334ed957fd73e793e1816fe66c  grsecurity-2.9.1-3.6.11-al1-unofficial-0.patch
 776adeeb5272093574f8836c5037dd7d  0004-arp-flush-arp-cache-on-device-change.patch
 daf2cbb558588c49c138fe9ca2482b64  r8169-num-rx-desc.patch
diff --git a/main/linux-grsec/patch-3.6.11-al1.patch b/main/linux-grsec/patch-3.6.11-al2.patch
index 053b2c9d75..3139bf3a63 100644
--- a/main/linux-grsec/patch-3.6.11-al1.patch
+++ b/main/linux-grsec/patch-3.6.11-al2.patch
@@ -422,6 +422,28 @@ index 5cee802..53339c1 100644
         init_gbpages();
  
         /* max_pfn_mapped is updated here */
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index ad3730b..aac684d 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1009,6 +1009,9 @@ static int acpi_processor_setup_cpuidle_cx(struct acpi_processor *pr)
+                return -EINVAL;
+        }
+ 
++       if (!dev)
++               return -EINVAL;
++
+        dev->cpu = pr->id;
+ 
+        if (max_cstate == 0)
+@@ -1196,6 +1199,7 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
+                }
+ 
+                /* Populate Updated C-state information */
++               acpi_processor_get_power_info(pr);
+                acpi_processor_setup_cpuidle_states(pr);
+ 
+                /* Enable all cpuidle devices */
 diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
 index d1ecca2..f1fcaca 100644
 --- a/drivers/acpi/scan.c
@@ -842,6 +864,41 @@ index 847ed55..813aa38 100644
         sleep_states[ACPI_STATE_S0] = 1;
         printk(KERN_INFO PREFIX "(supports S0");
  
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 7862d17..4979127 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -53,6 +53,7 @@
+ 
+ enum {
+        AHCI_PCI_BAR_STA2X11    = 0,
++       AHCI_PCI_BAR_ENMOTUS    = 2,
+        AHCI_PCI_BAR_STANDARD   = 5,
+ };
+ 
+@@ -410,6 +411,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+        { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci },   /* ASM1061 */
+        { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1062 */
+ 
++       /* Enmotus */
++       { PCI_DEVICE(0x1c44, 0x8000), board_ahci },
++
+        /* Generic, PCI class code for AHCI */
+        { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+          PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci },
+@@ -1098,9 +1102,11 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+                dev_info(&pdev->dev,
+                         "PDC42819 can only drive SATA devices with this driver\n");
+ 
+-       /* The Connext uses non-standard BAR */
++       /* Both Connext and Enmotus devices use non-standard BARs */
+        if (pdev->vendor == PCI_VENDOR_ID_STMICRO && pdev->device == 0xCC06)
+                ahci_pci_bar = AHCI_PCI_BAR_STA2X11;
++       else if (pdev->vendor == 0x1c44 && pdev->device == 0x8000)
++               ahci_pci_bar = AHCI_PCI_BAR_ENMOTUS;
+ 
+        /* acquire resources */
+        rc = pcim_enable_device(pdev);
 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
 index 8e1039c..8789aef 100644
 --- a/drivers/ata/libata-core.c
@@ -1221,6 +1278,19 @@ index 654e248..e023c65 100644
  
         /* Atheros AR9285 Malbec with sflash firmware */
         { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
+diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
+index f7f1dc6..ed0e8b7 100644
+--- a/drivers/dma/ioat/dma_v3.c
++++ b/drivers/dma/ioat/dma_v3.c
+@@ -951,7 +951,7 @@ static int __devinit ioat_xor_val_self_test(struct ioatdma_device *device)
+                        goto free_resources;
+                }
+        }
+-       dma_sync_single_for_device(dev, dest_dma, PAGE_SIZE, DMA_TO_DEVICE);
++       dma_sync_single_for_device(dev, dest_dma, PAGE_SIZE, DMA_FROM_DEVICE);
+ 
+        /* skip validate if the capability is not present */
+        if (!dma_has_cap(DMA_XOR_VAL, dma_chan->device->cap_mask))
 diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
 index 08c6749..638e1f7 100644
 --- a/drivers/firewire/net.c
@@ -1259,11 +1329,206 @@ index 08c6749..638e1f7 100644
                 put_unaligned_be32(node_id << 16 | IANA_SPECIFIER_ID >> 8, p);
                 put_unaligned_be32((IANA_SPECIFIER_ID & 0xff) << 24
                                                 | RFC2734_SW_VERSION, &p[4]);
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index b298158..fd3ae62 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -16,6 +16,7 @@
+  */
+ static char dmi_empty_string[] = "        ";
+ 
++static u16 __initdata dmi_ver;
+ /*
+  * Catch too early calls to dmi_check_system():
+  */
+@@ -118,12 +119,12 @@ static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
+        return 0;
+ }
+ 
+-static int __init dmi_checksum(const u8 *buf)
++static int __init dmi_checksum(const u8 *buf, u8 len)
+ {
+        u8 sum = 0;
+        int a;
+ 
+-       for (a = 0; a < 15; a++)
++       for (a = 0; a < len; a++)
+                sum += buf[a];
+ 
+        return sum == 0;
+@@ -161,8 +162,10 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, int inde
+                return;
+ 
+        for (i = 0; i < 16 && (is_ff || is_00); i++) {
+-               if(d[i] != 0x00) is_ff = 0;
+-               if(d[i] != 0xFF) is_00 = 0;
++               if (d[i] != 0x00)
++                       is_00 = 0;
++               if (d[i] != 0xFF)
++                       is_ff = 0;
+        }
+ 
+        if (is_ff || is_00)
+@@ -172,7 +175,15 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, int inde
+        if (!s)
+                return;
+ 
+-       sprintf(s, "%pUB", d);
++       /*
++        * As of version 2.6 of the SMBIOS specification, the first 3 fields of
++        * the UUID are supposed to be little-endian encoded.  The specification
++        * says that this is the defacto standard.
++        */
++       if (dmi_ver >= 0x0206)
++               sprintf(s, "%pUL", d);
++       else
++               sprintf(s, "%pUB", d);
+ 
+         dmi_ident[slot] = s;
+ }
+@@ -404,29 +415,57 @@ static int __init dmi_present(const char __iomem *p)
+        u8 buf[15];
+ 
+        memcpy_fromio(buf, p, 15);
+-       if ((memcmp(buf, "_DMI_", 5) == 0) && dmi_checksum(buf)) {
++       if (dmi_checksum(buf, 15)) {
+                dmi_num = (buf[13] << 8) | buf[12];
+                dmi_len = (buf[7] << 8) | buf[6];
+                dmi_base = (buf[11] << 24) | (buf[10] << 16) |
+                        (buf[9] << 8) | buf[8];
+ 
+-               /*
+-                * DMI version 0.0 means that the real version is taken from
+-                * the SMBIOS version, which we don't know at this point.
+-                */
+-               if (buf[14] != 0)
+-                       printk(KERN_INFO "DMI %d.%d present.\n",
+-                              buf[14] >> 4, buf[14] & 0xF);
+-               else
+-                       printk(KERN_INFO "DMI present.\n");
+                if (dmi_walk_early(dmi_decode) == 0) {
++                       if (dmi_ver)
++                               pr_info("SMBIOS %d.%d present.\n",
++                                      dmi_ver >> 8, dmi_ver & 0xFF);
++                       else {
++                               dmi_ver = (buf[14] & 0xF0) << 4 |
++                                          (buf[14] & 0x0F);
++                               pr_info("Legacy DMI %d.%d present.\n",
++                                      dmi_ver >> 8, dmi_ver & 0xFF);
++                       }
+                        dmi_dump_ids();
+                        return 0;
+                }
+        }
++       dmi_ver = 0;
+        return 1;
+ }
+ 
++static int __init smbios_present(const char __iomem *p)
++{
++       u8 buf[32];
++       int offset = 0;
++
++       memcpy_fromio(buf, p, 32);
++       if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
++               dmi_ver = (buf[6] << 8) + buf[7];
++
++               /* Some BIOS report weird SMBIOS version, fix that up */
++               switch (dmi_ver) {
++               case 0x021F:
++               case 0x0221:
++                       pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
++                              dmi_ver & 0xFF, 3);
++                       dmi_ver = 0x0203;
++                       break;
++               case 0x0233:
++                       pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
++                       dmi_ver = 0x0206;
++                       break;
++               }
++               offset = 16;
++       }
++       return dmi_present(buf + offset);
++}
++
+ void __init dmi_scan_machine(void)
+ {
+        char __iomem *p, *q;
+@@ -444,7 +483,7 @@ void __init dmi_scan_machine(void)
+                if (p == NULL)
+                        goto error;
+ 
+-               rc = dmi_present(p + 0x10); /* offset of _DMI_ string */
++               rc = smbios_present(p);
+                dmi_iounmap(p, 32);
+                if (!rc) {
+                        dmi_available = 1;
+@@ -462,7 +501,12 @@ void __init dmi_scan_machine(void)
+                        goto error;
+ 
+                for (q = p; q < p + 0x10000; q += 16) {
+-                       rc = dmi_present(q);
++                       if (memcmp(q, "_SM_", 4) == 0 && q - p <= 0xFFE0)
++                               rc = smbios_present(q);
++                       else if (memcmp(q, "_DMI_", 5) == 0)
++                               rc = dmi_present(q);
++                       else
++                               continue;
+                        if (!rc) {
+                                dmi_available = 1;
+                                dmi_iounmap(p, 0x10000);
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index cdf46b5..d8bb392 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -749,6 +749,8 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
+        total = 0;
+        for (i = 0; i < count; i++) {
+                struct drm_i915_gem_relocation_entry __user *user_relocs;
++               u64 invalid_offset = (u64)-1;
++               int j;
+ 
+                user_relocs = (void __user *)(uintptr_t)exec[i].relocs_ptr;
+ 
+@@ -759,6 +761,25 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
+                        goto err;
+                }
+ 
++               /* As we do not update the known relocation offsets after
++                * relocating (due to the complexities in lock handling),
++                * we need to mark them as invalid now so that we force the
++                * relocation processing next time. Just in case the target
++                * object is evicted and then rebound into its old
++                * presumed_offset before the next execbuffer - if that
++                * happened we would make the mistake of assuming that the
++                * relocations were valid.
++                */
++               for (j = 0; j < exec[i].relocation_count; j++) {
++                       if (copy_to_user(&user_relocs[j].presumed_offset,
++                                        &invalid_offset,
++                                        sizeof(invalid_offset))) {
++                               ret = -EFAULT;
++                               mutex_lock(&dev->struct_mutex);
++                               goto err;
++                       }
++               }
++
+                reloc_offset[i] = total;
+                total += exec[i].relocation_count;
+        }
 diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index f02cfad..a1f91aa 100644
+index f02cfad..380e7da 100644
 --- a/drivers/gpu/drm/i915/i915_reg.h
 +++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -3274,6 +3274,8 @@
+@@ -506,6 +506,7 @@
+  * the enables for writing to the corresponding low bit.
+  */
+ #define _3D_CHICKEN    0x02084
++#define  _3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB     (1 << 10)
+ #define _3D_CHICKEN2   0x0208c
+ /* Disables pipelining of read flushes past the SF-WIZ interface.
+  * Required on all Ironlake steppings according to the B-Spec, but the
+@@ -3274,6 +3275,8 @@
  #define _PFA_CTL_1               0x68080
  #define _PFB_CTL_1               0x68880
  #define  PF_ENABLE              (1<<31)
@@ -1374,6 +1639,21 @@ index 0c52448..2e6448c 100644
                 .ident = "Gigabyte GA-D525TUD",
                 .matches = {
                         DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co., Ltd."),
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index c23c9ea..572b2ca 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3324,6 +3324,10 @@ static void gen6_init_clock_gating(struct drm_device *dev)
+                   I915_READ(ILK_DISPLAY_CHICKEN2) |
+                   ILK_ELPIN_409_SELECT);
+ 
++       /* WaDisableHiZPlanesWhenMSAAEnabled */
++       I915_WRITE(_3D_CHICKEN,
++                  _MASKED_BIT_ENABLE(_3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB));
++
+        I915_WRITE(WM3_LP_ILK, 0);
+        I915_WRITE(WM2_LP_ILK, 0);
+        I915_WRITE(WM1_LP_ILK, 0);
 diff --git a/drivers/gpu/drm/nouveau/nv04_dfp.c b/drivers/gpu/drm/nouveau/nv04_dfp.c
 index 89640f2..2b59f41 100644
 --- a/drivers/gpu/drm/nouveau/nv04_dfp.c
@@ -3305,6 +3585,242 @@ index aa970fc..8fa144f 100644
  }
  
  static void _rtl_usb_io_handler_init(struct device *dev,
+diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
+index 26ffd3e..2c113de 100644
+--- a/drivers/pci/hotplug/pciehp.h
++++ b/drivers/pci/hotplug/pciehp.h
+@@ -44,7 +44,6 @@ extern bool pciehp_poll_mode;
+ extern int pciehp_poll_time;
+ extern bool pciehp_debug;
+ extern bool pciehp_force;
+-extern struct workqueue_struct *pciehp_wq;
+ 
+ #define dbg(format, arg...)                                            \
+ do {                                                                   \
+@@ -78,6 +77,7 @@ struct slot {
+        struct hotplug_slot *hotplug_slot;
+        struct delayed_work work;       /* work for button event */
+        struct mutex lock;
++       struct workqueue_struct *wq;
+ };
+ 
+ struct event_info {
+diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
+index 365c6b9..9e39df9 100644
+--- a/drivers/pci/hotplug/pciehp_core.c
++++ b/drivers/pci/hotplug/pciehp_core.c
+@@ -42,7 +42,6 @@ bool pciehp_debug;
+ bool pciehp_poll_mode;
+ int pciehp_poll_time;
+ bool pciehp_force;
+-struct workqueue_struct *pciehp_wq;
+ 
+ #define DRIVER_VERSION "0.4"
+ #define DRIVER_AUTHOR  "Dan Zink <dan.zink@compaq.com>, Greg Kroah-Hartman <greg@kroah.com>, Dely Sy <dely.l.sy@intel.com>"
+@@ -340,18 +339,13 @@ static int __init pcied_init(void)
+ {
+        int retval = 0;
+ 
+-       pciehp_wq = alloc_workqueue("pciehp", 0, 0);
+-       if (!pciehp_wq)
+-               return -ENOMEM;
+-
+        pciehp_firmware_init();
+        retval = pcie_port_service_register(&hpdriver_portdrv);
+        dbg("pcie_port_service_register = %d\n", retval);
+        info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
+-       if (retval) {
+-               destroy_workqueue(pciehp_wq);
++       if (retval)
+                dbg("Failure to register service\n");
+-       }
++
+        return retval;
+ }
+ 
+@@ -359,7 +353,6 @@ static void __exit pcied_cleanup(void)
+ {
+        dbg("unload_pciehpd()\n");
+        pcie_port_service_unregister(&hpdriver_portdrv);
+-       destroy_workqueue(pciehp_wq);
+        info(DRIVER_DESC " version: " DRIVER_VERSION " unloaded\n");
+ }
+ 
+diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
+index 27f4429..38f0186 100644
+--- a/drivers/pci/hotplug/pciehp_ctrl.c
++++ b/drivers/pci/hotplug/pciehp_ctrl.c
+@@ -49,7 +49,7 @@ static int queue_interrupt_event(struct slot *p_slot, u32 event_type)
+        info->p_slot = p_slot;
+        INIT_WORK(&info->work, interrupt_event_handler);
+ 
+-       queue_work(pciehp_wq, &info->work);
++       queue_work(p_slot->wq, &info->work);
+ 
+        return 0;
+ }
+@@ -344,7 +344,7 @@ void pciehp_queue_pushbutton_work(struct work_struct *work)
+                kfree(info);
+                goto out;
+        }
+-       queue_work(pciehp_wq, &info->work);
++       queue_work(p_slot->wq, &info->work);
+  out:
+        mutex_unlock(&p_slot->lock);
+ }
+@@ -377,7 +377,7 @@ static void handle_button_press_event(struct slot *p_slot)
+                if (ATTN_LED(ctrl))
+                        pciehp_set_attention_status(p_slot, 0);
+ 
+-               queue_delayed_work(pciehp_wq, &p_slot->work, 5*HZ);
++               queue_delayed_work(p_slot->wq, &p_slot->work, 5*HZ);
+                break;
+        case BLINKINGOFF_STATE:
+        case BLINKINGON_STATE:
+@@ -439,7 +439,7 @@ static void handle_surprise_event(struct slot *p_slot)
+        else
+                p_slot->state = POWERON_STATE;
+ 
+-       queue_work(pciehp_wq, &info->work);
++       queue_work(p_slot->wq, &info->work);
+ }
+ 
+ static void interrupt_event_handler(struct work_struct *work)
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index 302451e..61632c5 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -773,23 +773,32 @@ static void pcie_shutdown_notification(struct controller *ctrl)
+ static int pcie_init_slot(struct controller *ctrl)
+ {
+        struct slot *slot;
++       char name[32];
+ 
+        slot = kzalloc(sizeof(*slot), GFP_KERNEL);
+        if (!slot)
+                return -ENOMEM;
+ 
++       snprintf(name, sizeof(name), "pciehp-%u", PSN(ctrl));
++       slot->wq = alloc_workqueue(name, 0, 0);
++       if (!slot->wq)
++               goto abort;
++
+        slot->ctrl = ctrl;
+        mutex_init(&slot->lock);
+        INIT_DELAYED_WORK(&slot->work, pciehp_queue_pushbutton_work);
+        ctrl->slot = slot;
+        return 0;
++abort:
++       kfree(slot);
++       return -ENOMEM;
+ }
+ 
+ static void pcie_cleanup_slot(struct controller *ctrl)
+ {
+        struct slot *slot = ctrl->slot;
+        cancel_delayed_work(&slot->work);
+-       flush_workqueue(pciehp_wq);
++       destroy_workqueue(slot->wq);
+        kfree(slot);
+ }
+ 
+diff --git a/drivers/pci/hotplug/shpchp.h b/drivers/pci/hotplug/shpchp.h
+index ca64932..1b69d95 100644
+--- a/drivers/pci/hotplug/shpchp.h
++++ b/drivers/pci/hotplug/shpchp.h
+@@ -47,7 +47,6 @@ extern bool shpchp_poll_mode;
+ extern int shpchp_poll_time;
+ extern bool shpchp_debug;
+ extern struct workqueue_struct *shpchp_wq;
+-extern struct workqueue_struct *shpchp_ordered_wq;
+ 
+ #define dbg(format, arg...)                                            \
+ do {                                                                   \
+diff --git a/drivers/pci/hotplug/shpchp_core.c b/drivers/pci/hotplug/shpchp_core.c
+index b6de307..8c6d645 100644
+--- a/drivers/pci/hotplug/shpchp_core.c
++++ b/drivers/pci/hotplug/shpchp_core.c
+@@ -40,7 +40,6 @@ bool shpchp_debug;
+ bool shpchp_poll_mode;
+ int shpchp_poll_time;
+ struct workqueue_struct *shpchp_wq;
+-struct workqueue_struct *shpchp_ordered_wq;
+ 
+ #define DRIVER_VERSION "0.4"
+ #define DRIVER_AUTHOR  "Dan Zink <dan.zink@compaq.com>, Greg Kroah-Hartman <greg@kroah.com>, Dely Sy <dely.l.sy@intel.com>"
+@@ -181,7 +180,6 @@ void cleanup_slots(struct controller *ctrl)
+                list_del(&slot->slot_list);
+                cancel_delayed_work(&slot->work);
+                flush_workqueue(shpchp_wq);
+-               flush_workqueue(shpchp_ordered_wq);
+                pci_hp_deregister(slot->hotplug_slot);
+        }
+ }
+@@ -370,17 +368,10 @@ static int __init shpcd_init(void)
+        if (!shpchp_wq)
+                return -ENOMEM;
+ 
+-       shpchp_ordered_wq = alloc_ordered_workqueue("shpchp_ordered", 0);
+-       if (!shpchp_ordered_wq) {
+-               destroy_workqueue(shpchp_wq);
+-               return -ENOMEM;
+-       }
+-
+        retval = pci_register_driver(&shpc_driver);
+        dbg("%s: pci_register_driver = %d\n", __func__, retval);
+        info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
+        if (retval) {
+-               destroy_workqueue(shpchp_ordered_wq);
+                destroy_workqueue(shpchp_wq);
+        }
+        return retval;
+@@ -390,7 +381,6 @@ static void __exit shpcd_cleanup(void)
+ {
+        dbg("unload_shpchpd()\n");
+        pci_unregister_driver(&shpc_driver);
+-       destroy_workqueue(shpchp_ordered_wq);
+        destroy_workqueue(shpchp_wq);
+        info(DRIVER_DESC " version: " DRIVER_VERSION " unloaded\n");
+ }
+diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
+index f9b5a52..fd2cae9 100644
+--- a/drivers/pci/hotplug/shpchp_ctrl.c
++++ b/drivers/pci/hotplug/shpchp_ctrl.c
+@@ -453,7 +453,7 @@ void shpchp_queue_pushbutton_work(struct work_struct *work)
+                kfree(info);
+                goto out;
+        }
+-       queue_work(shpchp_ordered_wq, &info->work);
++       queue_work(shpchp_wq, &info->work);
+  out:
+        mutex_unlock(&p_slot->lock);
+ }
+diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
+index 1b7d05d..b0c92a5 100644
+--- a/drivers/pci/pcie/aer/aerdrv_core.c
++++ b/drivers/pci/pcie/aer/aerdrv_core.c
+@@ -649,6 +649,7 @@ static void aer_recover_work_func(struct work_struct *work)
+                        continue;
+                }
+                do_recovery(pdev, entry.severity);
++               pci_dev_put(pdev);
+        }
+ }
+ #endif
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index b500840..474f22f 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -798,6 +798,9 @@ void pcie_clear_aspm(struct pci_bus *bus)
+ {
+        struct pci_dev *child;
+ 
++       if (aspm_force)
++               return;
++
+        /*
+         * Clear any ASPM setup that the firmware has carried out on this bus
+         */
 diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
 index 5155317..161e7f0 100644
 --- a/drivers/pci/quirks.c
@@ -3578,6 +4094,49 @@ index ce5224c..931a7d9 100644
         if (!type)
                 goto exit_store_host_reset;
  
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 4df73e5..8afedd6 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2926,10 +2926,6 @@ static int __init init_sd(void)
+        if (err)
+                goto err_out;
+ 
+-       err = scsi_register_driver(&sd_template.gendrv);
+-       if (err)
+-               goto err_out_class;
+-
+        sd_cdb_cache = kmem_cache_create("sd_ext_cdb", SD_EXT_CDB_SIZE,
+                                         0, 0, NULL);
+        if (!sd_cdb_cache) {
+@@ -2943,8 +2939,15 @@ static int __init init_sd(void)
+                goto err_out_cache;
+        }
+ 
++       err = scsi_register_driver(&sd_template.gendrv);
++       if (err)
++               goto err_out_driver;
++
+        return 0;
+ 
++err_out_driver:
++       mempool_destroy(sd_cdb_pool);
++
+ err_out_cache:
+        kmem_cache_destroy(sd_cdb_cache);
+ 
+@@ -2967,10 +2970,10 @@ static void __exit exit_sd(void)
+ 
+        SCSI_LOG_HLQUEUE(3, printk("exit_sd: exiting sd driver\n"));
+ 
++       scsi_unregister_driver(&sd_template.gendrv);
+        mempool_destroy(sd_cdb_pool);
+        kmem_cache_destroy(sd_cdb_cache);
+ 
+-       scsi_unregister_driver(&sd_template.gendrv);
+        class_unregister(&sd_disk_class);
+ 
+        for (i = 0; i < SD_MAJORS; i++)
 diff --git a/drivers/staging/comedi/Kconfig b/drivers/staging/comedi/Kconfig
 index 6cee785..2701546 100644
 --- a/drivers/staging/comedi/Kconfig
@@ -4828,6 +5387,18 @@ index 0ab7da2..583150b 100644
         if (cp->string == NULL &&
                         !(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
                 cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index eb0fd10..b6c4084 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1619,6 +1619,7 @@ static int __devinit dwc3_gadget_init_endpoints(struct dwc3 *dwc)
+ 
+                if (epnum == 0 || epnum == 1) {
+                        dep->endpoint.maxpacket = 512;
++                       dep->endpoint.maxburst = 1;
+                        dep->endpoint.ops = &dwc3_gadget_ep0_ops;
+                        if (!epnum)
+                                dwc->gadget.ep0 = &dep->endpoint;
 diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
 index afdbb1c..4ad1f1c 100644
 --- a/drivers/usb/gadget/dummy_hcd.c
@@ -5082,6 +5653,60 @@ index 39f9e4a..eb5563a 100644
  }
  
  bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
+diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
+index e4db350..3fe069f 100644
+--- a/drivers/usb/host/uhci-hcd.c
++++ b/drivers/usb/host/uhci-hcd.c
+@@ -447,6 +447,10 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd)
+                return IRQ_NONE;
+        uhci_writew(uhci, status, USBSTS);              /* Clear it */
+ 
++       spin_lock(&uhci->lock);
++       if (unlikely(!uhci->is_initialized))    /* not yet configured */
++               goto done;
++
+        if (status & ~(USBSTS_USBINT | USBSTS_ERROR | USBSTS_RD)) {
+                if (status & USBSTS_HSE)
+                        dev_err(uhci_dev(uhci), "host system error, "
+@@ -455,7 +459,6 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd)
+                        dev_err(uhci_dev(uhci), "host controller process "
+                                        "error, something bad happened!\n");
+                if (status & USBSTS_HCH) {
+-                       spin_lock(&uhci->lock);
+                        if (uhci->rh_state >= UHCI_RH_RUNNING) {
+                                dev_err(uhci_dev(uhci),
+                                        "host controller halted, "
+@@ -473,15 +476,15 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd)
+                                 * pending unlinks */
+                                mod_timer(&hcd->rh_timer, jiffies);
+                        }
+-                       spin_unlock(&uhci->lock);
+                }
+        }
+ 
+-       if (status & USBSTS_RD)
++       if (status & USBSTS_RD) {
++               spin_unlock(&uhci->lock);
+                usb_hcd_poll_rh_status(hcd);
+-       else {
+-               spin_lock(&uhci->lock);
++       } else {
+                uhci_scan_schedule(uhci);
++ done:
+                spin_unlock(&uhci->lock);
+        }
+ 
+@@ -662,9 +665,9 @@ static int uhci_start(struct usb_hcd *hcd)
+         */
+        mb();
+ 
++       spin_lock_irq(&uhci->lock);
+        configure_hc(uhci);
+        uhci->is_initialized = 1;
+-       spin_lock_irq(&uhci->lock);
+        start_rh(uhci);
+        spin_unlock_irq(&uhci->lock);
+        return 0;
 diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
 index d5eb357..abb9772 100644
 --- a/drivers/usb/host/xhci-hub.c
@@ -6681,6 +7306,28 @@ index 8d3c427..50a6cbe 100644
  #define PCI_DEVICE_ID_RICOH_R5CE823    0xe823
  #define PCI_DEVICE_ID_RICOH_R5C832     0x0832
  #define PCI_DEVICE_ID_RICOH_R5C843     0x0843
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 23bddac..d2bbc12 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -2684,7 +2684,16 @@ static inline void thread_group_cputime_init(struct signal_struct *sig)
+ extern void recalc_sigpending_and_wake(struct task_struct *t);
+ extern void recalc_sigpending(void);
+ 
+-extern void signal_wake_up(struct task_struct *t, int resume_stopped);
++extern void signal_wake_up_state(struct task_struct *t, unsigned int state);
++
++static inline void signal_wake_up(struct task_struct *t, bool resume)
++{
++       signal_wake_up_state(t, resume ? TASK_WAKEKILL : 0);
++}
++static inline void ptrace_signal_wake_up(struct task_struct *t, bool resume)
++{
++       signal_wake_up_state(t, resume ? __TASK_TRACED : 0);
++}
+ 
+ /*
+  * Wrappers for p->thread_info->cpu access. No-op on UP.
 diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
 index ba1d361..1832927 100644
 --- a/include/net/inet_connection_sock.h
@@ -6779,6 +7426,231 @@ index 4c69326..e48caf8 100644
         }
  
         if (!alloc_cpumask_var(&mask, GFP_KERNEL)) {
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index a232bb5..b96de86b4 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -117,11 +117,45 @@ void __ptrace_unlink(struct task_struct *child)
+         * TASK_KILLABLE sleeps.
+         */
+        if (child->jobctl & JOBCTL_STOP_PENDING || task_is_traced(child))
+-               signal_wake_up(child, task_is_traced(child));
++               ptrace_signal_wake_up(child, true);
+ 
+        spin_unlock(&child->sighand->siglock);
+ }
+ 
++/* Ensure that nothing can wake it up, even SIGKILL */
++static bool ptrace_freeze_traced(struct task_struct *task)
++{
++       bool ret = false;
++
++       /* Lockless, nobody but us can set this flag */
++       if (task->jobctl & JOBCTL_LISTENING)
++               return ret;
++
++       spin_lock_irq(&task->sighand->siglock);
++       if (task_is_traced(task) && !__fatal_signal_pending(task)) {
++               task->state = __TASK_TRACED;
++               ret = true;
++       }
++       spin_unlock_irq(&task->sighand->siglock);
++
++       return ret;
++}
++
++static void ptrace_unfreeze_traced(struct task_struct *task)
++{
++       if (task->state != __TASK_TRACED)
++               return;
++
++       WARN_ON(!task->ptrace || task->parent != current);
++
++       spin_lock_irq(&task->sighand->siglock);
++       if (__fatal_signal_pending(task))
++               wake_up_state(task, __TASK_TRACED);
++       else
++               task->state = TASK_TRACED;
++       spin_unlock_irq(&task->sighand->siglock);
++}
++
+ /**
+  * ptrace_check_attach - check whether ptracee is ready for ptrace operation
+  * @child: ptracee to check for
+@@ -151,24 +185,29 @@ int ptrace_check_attach(struct task_struct *child, bool ignore_state)
+         * be changed by us so it's not changing right after this.
+         */
+        read_lock(&tasklist_lock);
+-       if ((child->ptrace & PT_PTRACED) && child->parent == current) {
++       if (child->ptrace && child->parent == current) {
++               WARN_ON(child->state == __TASK_TRACED);
+                /*
+                 * child->sighand can't be NULL, release_task()
+                 * does ptrace_unlink() before __exit_signal().
+                 */
+-               spin_lock_irq(&child->sighand->siglock);
+-               WARN_ON_ONCE(task_is_stopped(child));
+-               if (ignore_state || (task_is_traced(child) &&
+-                                    !(child->jobctl & JOBCTL_LISTENING)))
++               if (ignore_state || ptrace_freeze_traced(child))
+                        ret = 0;
+-               spin_unlock_irq(&child->sighand->siglock);
+        }
+        read_unlock(&tasklist_lock);
+ 
+-       if (!ret && !ignore_state)
+-               ret = wait_task_inactive(child, TASK_TRACED) ? 0 : -ESRCH;
++       if (!ret && !ignore_state) {
++               if (!wait_task_inactive(child, __TASK_TRACED)) {
++                       /*
++                        * This can only happen if may_ptrace_stop() fails and
++                        * ptrace_stop() changes ->state back to TASK_RUNNING,
++                        * so we should not worry about leaking __TASK_TRACED.
++                        */
++                       WARN_ON(child->state == __TASK_TRACED);
++                       ret = -ESRCH;
++               }
++       }
+ 
+-       /* All systems go.. */
+        return ret;
+ }
+ 
+@@ -310,7 +349,7 @@ static int ptrace_attach(struct task_struct *task, long request,
+         */
+        if (task_is_stopped(task) &&
+            task_set_jobctl_pending(task, JOBCTL_TRAP_STOP | JOBCTL_TRAPPING))
+-               signal_wake_up(task, 1);
++               signal_wake_up_state(task, __TASK_STOPPED);
+ 
+        spin_unlock(&task->sighand->siglock);
+ 
+@@ -727,7 +766,7 @@ int ptrace_request(struct task_struct *child, long request,
+                 * tracee into STOP.
+                 */
+                if (likely(task_set_jobctl_pending(child, JOBCTL_TRAP_STOP)))
+-                       signal_wake_up(child, child->jobctl & JOBCTL_LISTENING);
++                       ptrace_signal_wake_up(child, child->jobctl & JOBCTL_LISTENING);
+ 
+                unlock_task_sighand(child, &flags);
+                ret = 0;
+@@ -753,7 +792,7 @@ int ptrace_request(struct task_struct *child, long request,
+                         * start of this trap and now.  Trigger re-trap.
+                         */
+                        if (child->jobctl & JOBCTL_TRAP_NOTIFY)
+-                               signal_wake_up(child, true);
++                               ptrace_signal_wake_up(child, true);
+                        ret = 0;
+                }
+                unlock_task_sighand(child, &flags);
+@@ -890,6 +929,8 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
+                goto out_put_task_struct;
+ 
+        ret = arch_ptrace(child, request, addr, data);
++       if (ret || request != PTRACE_DETACH)
++               ptrace_unfreeze_traced(child);
+ 
+  out_put_task_struct:
+        put_task_struct(child);
+@@ -1029,8 +1070,11 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
+ 
+        ret = ptrace_check_attach(child, request == PTRACE_KILL ||
+                                  request == PTRACE_INTERRUPT);
+-       if (!ret)
++       if (!ret) {
+                ret = compat_arch_ptrace(child, request, addr, data);
++               if (ret || request != PTRACE_DETACH)
++                       ptrace_unfreeze_traced(child);
++       }
+ 
+  out_put_task_struct:
+        put_task_struct(child);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 1a48cdb..5eb6c96 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1686,7 +1686,8 @@ out:
+  */
+ int wake_up_process(struct task_struct *p)
+ {
+-       return try_to_wake_up(p, TASK_ALL, 0);
++       WARN_ON(task_is_stopped_or_traced(p));
++       return try_to_wake_up(p, TASK_NORMAL, 0);
+ }
+ EXPORT_SYMBOL(wake_up_process);
+ 
+diff --git a/kernel/signal.c b/kernel/signal.c
+index be4f856..67b64be 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -678,23 +678,17 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
+  * No need to set need_resched since signal event passing
+  * goes through ->blocked
+  */
+-void signal_wake_up(struct task_struct *t, int resume)
++void signal_wake_up_state(struct task_struct *t, unsigned int state)
+ {
+-       unsigned int mask;
+-
+        set_tsk_thread_flag(t, TIF_SIGPENDING);
+-
+        /*
+-        * For SIGKILL, we want to wake it up in the stopped/traced/killable
++        * TASK_WAKEKILL also means wake it up in the stopped/traced/killable
+         * case. We don't check t->state here because there is a race with it
+         * executing another processor and just now entering stopped state.
+         * By using wake_up_state, we ensure the process will wake up and
+         * handle its death signal.
+         */
+-       mask = TASK_INTERRUPTIBLE;
+-       if (resume)
+-               mask |= TASK_WAKEKILL;
+-       if (!wake_up_state(t, mask))
++       if (!wake_up_state(t, state | TASK_INTERRUPTIBLE))
+                kick_process(t);
+ }
+ 
+@@ -842,7 +836,7 @@ static void ptrace_trap_notify(struct task_struct *t)
+        assert_spin_locked(&t->sighand->siglock);
+ 
+        task_set_jobctl_pending(t, JOBCTL_TRAP_NOTIFY);
+-       signal_wake_up(t, t->jobctl & JOBCTL_LISTENING);
++       ptrace_signal_wake_up(t, t->jobctl & JOBCTL_LISTENING);
+ }
+ 
+ /*
+@@ -1797,6 +1791,10 @@ static inline int may_ptrace_stop(void)
+         * If SIGKILL was already sent before the caller unlocked
+         * ->siglock we must see ->core_state != NULL. Otherwise it
+         * is safe to enter schedule().
++        *
++        * This is almost outdated, a task with the pending SIGKILL can't
++        * block in TASK_TRACED. But PTRACE_EVENT_EXIT can be reported
++        * after SIGKILL was already dequeued.
+         */
+        if (unlikely(current->mm->core_state) &&
+            unlikely(current->mm == current->parent->mm))
+@@ -1922,6 +1920,7 @@ static void ptrace_stop(int exit_code, int why, int clear_code, siginfo_t *info)
+                if (gstop_done)
+                        do_notify_parent_cldstop(current, false, why);
+ 
++               /* tasklist protects us from ptrace_freeze_traced() */
+                __set_current_state(TASK_RUNNING);
+                if (clear_code)
+                        current->exit_code = 0;
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 781ecc2..7f8a8df 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3863,7 +3863,7 @@ static int ftrace_module_notify(struct notifier_block *self,
+ 
+ struct notifier_block ftrace_module_nb = {
+        .notifier_call = ftrace_module_notify,
+-       .priority = 0,
++       .priority = INT_MAX,    /* Run before anything that can use kprobes */
+ };
+ 
+ extern unsigned long __start_mcount_loc[];
 diff --git a/lib/atomic64.c b/lib/atomic64.c
 index 9785378..08a4f06 100644
 --- a/lib/atomic64.c
@@ -8088,6 +8960,22 @@ index 5d7f61d..2480c01 100644
  
         xprt = req->rq_xprt;
         if (task->tk_ops->rpc_count_stats != NULL)
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index 49a464f..62fa2c5 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -205,9 +205,9 @@ int evm_update_evmxattr(struct dentry *dentry, const char *xattr_name,
+                rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_EVM,
+                                           &xattr_data,
+                                           sizeof(xattr_data), 0);
+-       }
+-       else if (rc == -ENODATA)
++       } else if (rc == -ENODATA && inode->i_op->removexattr) {
+                rc = inode->i_op->removexattr(dentry, XATTR_NAME_EVM);
++       }
+        return rc;
+ }
+ 
 diff --git a/sound/arm/pxa2xx-ac97-lib.c b/sound/arm/pxa2xx-ac97-lib.c
 index 48d7c0a..bd3ba88 100644
 --- a/sound/arm/pxa2xx-ac97-lib.c