[gentoo-commits] linux-patches r2582 - in genpatches-2.6/trunk: 3.10 3.11 3.12 3.4

[Tom Wijsman (tomwij)]

Author: tomwij
Date: 2013-11-21 00:37:00 +0000 (Thu, 21 Nov 2013)
New Revision: 2582

Added:
   genpatches-2.6/trunk/3.10/1019_linux-3.10.20.patch
   genpatches-2.6/trunk/3.11/1008_linux-3.11.9.patch
   genpatches-2.6/trunk/3.12/1000_linux-3.12.1.patch
   genpatches-2.6/trunk/3.4/1069_linux-3.4.70.patch
Modified:
   genpatches-2.6/trunk/3.10/0000_README
   genpatches-2.6/trunk/3.11/0000_README
   genpatches-2.6/trunk/3.12/0000_README
   genpatches-2.6/trunk/3.4/0000_README
Log:
Linux patches 3.4.70, 3.10.20, 3.11.9 and 3.12.1.

Modified: genpatches-2.6/trunk/3.10/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10/0000_README	2013-11-14 16:37:35 UTC (rev 2581)
+++ genpatches-2.6/trunk/3.10/0000_README	2013-11-21 00:37:00 UTC (rev 2582)
@@ -118,6 +118,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.10.19
 
+Patch:  1019_linux-3.10.20.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.20
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.10/1019_linux-3.10.20.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1019_linux-3.10.20.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10/1019_linux-3.10.20.patch	2013-11-21 00:37:00 UTC (rev 2582)
@@ -0,0 +1,1143 @@
+diff --git a/Makefile b/Makefile
+index 83a02f5b2c00..ba784b7b0f51 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 19
++SUBLEVEL = 20
+ EXTRAVERSION =
+ NAME = TOSSUG Baby Fish
+ 
+diff --git a/drivers/media/platform/sh_vou.c b/drivers/media/platform/sh_vou.c
+index 7d0235069c87..5d538e7cd1bb 100644
+--- a/drivers/media/platform/sh_vou.c
++++ b/drivers/media/platform/sh_vou.c
+@@ -776,7 +776,7 @@ static int sh_vou_try_fmt_vid_out(struct file *file, void *priv,
+ 	v4l_bound_align_image(&pix->width, 0, VOU_MAX_IMAGE_WIDTH, 1,
+ 			      &pix->height, 0, VOU_MAX_IMAGE_HEIGHT, 1, 0);
+ 
+-	for (i = 0; ARRAY_SIZE(vou_fmt); i++)
++	for (i = 0; i < ARRAY_SIZE(vou_fmt); i++)
+ 		if (vou_fmt[i].pfmt == pix->pixelformat)
+ 			return 0;
+ 
+diff --git a/drivers/misc/atmel_pwm.c b/drivers/misc/atmel_pwm.c
+index 494d0500bda6..a6dc56e1bc58 100644
+--- a/drivers/misc/atmel_pwm.c
++++ b/drivers/misc/atmel_pwm.c
+@@ -90,8 +90,10 @@ int pwm_channel_alloc(int index, struct pwm_channel *ch)
+ 	unsigned long	flags;
+ 	int		status = 0;
+ 
+-	/* insist on PWM init, with this signal pinned out */
+-	if (!pwm || !(pwm->mask & 1 << index))
++	if (!pwm)
++		return -EPROBE_DEFER;
++
++	if (!(pwm->mask & 1 << index))
+ 		return -ENODEV;
+ 
+ 	if (index < 0 || index >= PWM_NCHAN || !ch)
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c
+index f12e6b85a653..f057a189d975 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c
+@@ -1600,7 +1600,8 @@ static void write_ofld_wr(struct adapter *adap, struct sk_buff *skb,
+ 	flits = skb_transport_offset(skb) / 8;
+ 	sgp = ndesc == 1 ? (struct sg_ent *)&d->flit[flits] : sgl;
+ 	sgl_flits = make_sgl(skb, sgp, skb_transport_header(skb),
+-			     skb->tail - skb->transport_header,
++			     skb_tail_pointer(skb) -
++			     skb_transport_header(skb),
+ 			     adap->pdev);
+ 	if (need_skb_unmap()) {
+ 		setup_deferred_unmapping(skb, adap->pdev, sgp, sgl_flits);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+index 0e572a527154..28d706bd12eb 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+@@ -1544,7 +1544,7 @@ static void mlx4_master_deactivate_admin_state(struct mlx4_priv *priv, int slave
+ 			vp_oper->vlan_idx = NO_INDX;
+ 		}
+ 		if (NO_INDX != vp_oper->mac_idx) {
+-			__mlx4_unregister_mac(&priv->dev, port, vp_oper->mac_idx);
++			__mlx4_unregister_mac(&priv->dev, port, vp_oper->state.mac);
+ 			vp_oper->mac_idx = NO_INDX;
+ 		}
+ 	}
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 1d01534c2020..64cf70247048 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1096,11 +1096,6 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
+ {
+ 	struct virtnet_info *vi = container_of(nfb, struct virtnet_info, nb);
+ 
+-	mutex_lock(&vi->config_lock);
+-
+-	if (!vi->config_enable)
+-		goto done;
+-
+ 	switch(action & ~CPU_TASKS_FROZEN) {
+ 	case CPU_ONLINE:
+ 	case CPU_DOWN_FAILED:
+@@ -1114,8 +1109,6 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
+ 		break;
+ 	}
+ 
+-done:
+-	mutex_unlock(&vi->config_lock);
+ 	return NOTIFY_OK;
+ }
+ 
+@@ -1672,6 +1665,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
+ 	struct virtnet_info *vi = vdev->priv;
+ 	int i;
+ 
++	unregister_hotcpu_notifier(&vi->nb);
++
+ 	/* Prevent config work handler from accessing the device */
+ 	mutex_lock(&vi->config_lock);
+ 	vi->config_enable = false;
+@@ -1720,6 +1715,10 @@ static int virtnet_restore(struct virtio_device *vdev)
+ 	virtnet_set_queues(vi, vi->curr_queue_pairs);
+ 	rtnl_unlock();
+ 
++	err = register_hotcpu_notifier(&vi->nb);
++	if (err)
++		return err;
++
+ 	return 0;
+ }
+ #endif
+diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
+index dc94d44d95cd..822443c5a3b5 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
+@@ -125,7 +125,7 @@ static const struct iwl_ht_params iwl7000_ht_params = {
+ 
+ 
+ const struct iwl_cfg iwl7260_2ac_cfg = {
+-	.name = "Intel(R) Dual Band Wireless AC7260",
++	.name = "Intel(R) Dual Band Wireless AC 7260",
+ 	.fw_name_pre = IWL7260_FW_PRE,
+ 	IWL_DEVICE_7000,
+ 	.ht_params = &iwl7000_ht_params,
+@@ -133,8 +133,44 @@ const struct iwl_cfg iwl7260_2ac_cfg = {
+ 	.nvm_calib_ver = IWL7260_TX_POWER_VERSION,
+ };
+ 
+-const struct iwl_cfg iwl3160_ac_cfg = {
+-	.name = "Intel(R) Dual Band Wireless AC3160",
++const struct iwl_cfg iwl7260_2n_cfg = {
++	.name = "Intel(R) Dual Band Wireless N 7260",
++	.fw_name_pre = IWL7260_FW_PRE,
++	IWL_DEVICE_7000,
++	.ht_params = &iwl7000_ht_params,
++	.nvm_ver = IWL7260_NVM_VERSION,
++	.nvm_calib_ver = IWL7260_TX_POWER_VERSION,
++};
++
++const struct iwl_cfg iwl7260_n_cfg = {
++	.name = "Intel(R) Wireless N 7260",
++	.fw_name_pre = IWL7260_FW_PRE,
++	IWL_DEVICE_7000,
++	.ht_params = &iwl7000_ht_params,
++	.nvm_ver = IWL7260_NVM_VERSION,
++	.nvm_calib_ver = IWL7260_TX_POWER_VERSION,
++};
++
++const struct iwl_cfg iwl3160_2ac_cfg = {
++	.name = "Intel(R) Dual Band Wireless AC 3160",
++	.fw_name_pre = IWL3160_FW_PRE,
++	IWL_DEVICE_7000,
++	.ht_params = &iwl7000_ht_params,
++	.nvm_ver = IWL3160_NVM_VERSION,
++	.nvm_calib_ver = IWL3160_TX_POWER_VERSION,
++};
++
++const struct iwl_cfg iwl3160_2n_cfg = {
++	.name = "Intel(R) Dual Band Wireless N 3160",
++	.fw_name_pre = IWL3160_FW_PRE,
++	IWL_DEVICE_7000,
++	.ht_params = &iwl7000_ht_params,
++	.nvm_ver = IWL3160_NVM_VERSION,
++	.nvm_calib_ver = IWL3160_TX_POWER_VERSION,
++};
++
++const struct iwl_cfg iwl3160_n_cfg = {
++	.name = "Intel(R) Wireless N 3160",
+ 	.fw_name_pre = IWL3160_FW_PRE,
+ 	IWL_DEVICE_7000,
+ 	.ht_params = &iwl7000_ht_params,
+diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
+index c67e29655b2d..44e3370ce343 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/iwlwifi/iwl-config.h
+@@ -321,6 +321,10 @@ extern const struct iwl_cfg iwl105_bgn_cfg;
+ extern const struct iwl_cfg iwl105_bgn_d_cfg;
+ extern const struct iwl_cfg iwl135_bgn_cfg;
+ extern const struct iwl_cfg iwl7260_2ac_cfg;
+-extern const struct iwl_cfg iwl3160_ac_cfg;
++extern const struct iwl_cfg iwl7260_2n_cfg;
++extern const struct iwl_cfg iwl7260_n_cfg;
++extern const struct iwl_cfg iwl3160_2ac_cfg;
++extern const struct iwl_cfg iwl3160_2n_cfg;
++extern const struct iwl_cfg iwl3160_n_cfg;
+ 
+ #endif /* __IWL_CONFIG_H__ */
+diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
+index b7858a595973..b53e5c3f403b 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
+@@ -267,10 +267,83 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
+ 
+ /* 7000 Series */
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4070, iwl7260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x08B1, 0x4062, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4072, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4170, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4060, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x406A, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4160, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4062, iwl7260_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4162, iwl7260_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0x4270, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0x4272, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0x4260, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0x426A, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0x4262, iwl7260_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4470, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4472, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4460, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x446A, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4462, iwl7260_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4870, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x486E, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4570, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4560, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0x4370, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0x4360, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x5070, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4020, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x402A, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0x4220, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4420, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0xC070, iwl7260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x08B3, 0x0070, iwl3160_ac_cfg)},
+-	{IWL_PCI_DEVICE(0x08B3, 0x8070, iwl3160_ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC072, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC170, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC060, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC06A, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC160, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC062, iwl7260_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC162, iwl7260_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC770, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC760, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0xC270, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0xC272, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0xC260, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0xC26A, iwl7260_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0xC262, iwl7260_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC470, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC472, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC460, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC462, iwl7260_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC570, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC560, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0xC370, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC360, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC020, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC02A, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0xC220, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC420, iwl7260_2n_cfg)},
++
++/* 3160 Series */
++	{IWL_PCI_DEVICE(0x08B3, 0x0070, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x0072, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x0170, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x0172, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x0060, iwl3160_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x0062, iwl3160_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B4, 0x0270, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B4, 0x0272, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x0470, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x0472, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B4, 0x0370, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x8070, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x8072, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x8170, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x8172, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x8060, iwl3160_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x8062, iwl3160_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B4, 0x8270, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x8470, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x8570, iwl3160_2ac_cfg)},
+ 
+ 	{0}
+ };
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 1a285083d24a..f2faa779e3fe 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -88,6 +88,7 @@ struct xenvif {
+ 	unsigned long   credit_usec;
+ 	unsigned long   remaining_credit;
+ 	struct timer_list credit_timeout;
++	u64 credit_window_start;
+ 
+ 	/* Statistics */
+ 	unsigned long rx_gso_checksum_fixup;
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index 3a294c2528d5..c4a2eb2cd8a0 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -275,8 +275,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
+ 	vif->credit_bytes = vif->remaining_credit = ~0UL;
+ 	vif->credit_usec  = 0UL;
+ 	init_timer(&vif->credit_timeout);
+-	/* Initialize 'expires' now: it's used to track the credit window. */
+-	vif->credit_timeout.expires = jiffies;
++	vif->credit_window_start = get_jiffies_64();
+ 
+ 	dev->netdev_ops	= &xenvif_netdev_ops;
+ 	dev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index 0071f211a08a..36efb418c26f 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -1423,9 +1423,8 @@ out:
+ 
+ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
+ {
+-	unsigned long now = jiffies;
+-	unsigned long next_credit =
+-		vif->credit_timeout.expires +
++	u64 now = get_jiffies_64();
++	u64 next_credit = vif->credit_window_start +
+ 		msecs_to_jiffies(vif->credit_usec / 1000);
+ 
+ 	/* Timer could already be pending in rare cases. */
+@@ -1433,8 +1432,8 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
+ 		return true;
+ 
+ 	/* Passed the point where we can replenish credit? */
+-	if (time_after_eq(now, next_credit)) {
+-		vif->credit_timeout.expires = now;
++	if (time_after_eq64(now, next_credit)) {
++		vif->credit_window_start = now;
+ 		tx_add_credit(vif);
+ 	}
+ 
+@@ -1446,6 +1445,7 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
+ 			tx_credit_callback;
+ 		mod_timer(&vif->credit_timeout,
+ 			  next_credit);
++		vif->credit_window_start = next_credit;
+ 
+ 		return true;
+ 	}
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index abe24ff000f0..8a9e8750703f 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -24,6 +24,12 @@
+ struct backend_info {
+ 	struct xenbus_device *dev;
+ 	struct xenvif *vif;
++
++	/* This is the state that will be reflected in xenstore when any
++	 * active hotplug script completes.
++	 */
++	enum xenbus_state state;
++
+ 	enum xenbus_state frontend_state;
+ 	struct xenbus_watch hotplug_status_watch;
+ 	u8 have_hotplug_status_watch:1;
+@@ -33,11 +39,15 @@ static int connect_rings(struct backend_info *);
+ static void connect(struct backend_info *);
+ static void backend_create_xenvif(struct backend_info *be);
+ static void unregister_hotplug_status_watch(struct backend_info *be);
++static void set_backend_state(struct backend_info *be,
++			      enum xenbus_state state);
+ 
+ static int netback_remove(struct xenbus_device *dev)
+ {
+ 	struct backend_info *be = dev_get_drvdata(&dev->dev);
+ 
++	set_backend_state(be, XenbusStateClosed);
++
+ 	unregister_hotplug_status_watch(be);
+ 	if (be->vif) {
+ 		kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
+@@ -126,6 +136,8 @@ static int netback_probe(struct xenbus_device *dev,
+ 	if (err)
+ 		goto fail;
+ 
++	be->state = XenbusStateInitWait;
++
+ 	/* This kicks hotplug scripts, so do it immediately. */
+ 	backend_create_xenvif(be);
+ 
+@@ -198,24 +210,113 @@ static void backend_create_xenvif(struct backend_info *be)
+ 	kobject_uevent(&dev->dev.kobj, KOBJ_ONLINE);
+ }
+ 
+-
+-static void disconnect_backend(struct xenbus_device *dev)
++static void backend_disconnect(struct backend_info *be)
+ {
+-	struct backend_info *be = dev_get_drvdata(&dev->dev);
+-
+ 	if (be->vif)
+ 		xenvif_disconnect(be->vif);
+ }
+ 
+-static void destroy_backend(struct xenbus_device *dev)
++static void backend_connect(struct backend_info *be)
+ {
+-	struct backend_info *be = dev_get_drvdata(&dev->dev);
++	if (be->vif)
++		connect(be);
++}
+ 
+-	if (be->vif) {
+-		kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
+-		xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status");
+-		xenvif_free(be->vif);
+-		be->vif = NULL;
++static inline void backend_switch_state(struct backend_info *be,
++					enum xenbus_state state)
++{
++	struct xenbus_device *dev = be->dev;
++
++	pr_debug("%s -> %s\n", dev->nodename, xenbus_strstate(state));
++	be->state = state;
++
++	/* If we are waiting for a hotplug script then defer the
++	 * actual xenbus state change.
++	 */
++	if (!be->have_hotplug_status_watch)
++		xenbus_switch_state(dev, state);
++}
++
++/* Handle backend state transitions:
++ *
++ * The backend state starts in InitWait and the following transitions are
++ * allowed.
++ *
++ * InitWait -> Connected
++ *
++ *    ^    \         |
++ *    |     \        |
++ *    |      \       |
++ *    |       \      |
++ *    |        \     |
++ *    |         \    |
++ *    |          V   V
++ *
++ *  Closed  <-> Closing
++ *
++ * The state argument specifies the eventual state of the backend and the
++ * function transitions to that state via the shortest path.
++ */
++static void set_backend_state(struct backend_info *be,
++			      enum xenbus_state state)
++{
++	while (be->state != state) {
++		switch (be->state) {
++		case XenbusStateClosed:
++			switch (state) {
++			case XenbusStateInitWait:
++			case XenbusStateConnected:
++				pr_info("%s: prepare for reconnect\n",
++					be->dev->nodename);
++				backend_switch_state(be, XenbusStateInitWait);
++				break;
++			case XenbusStateClosing:
++				backend_switch_state(be, XenbusStateClosing);
++				break;
++			default:
++				BUG();
++			}
++			break;
++		case XenbusStateInitWait:
++			switch (state) {
++			case XenbusStateConnected:
++				backend_connect(be);
++				backend_switch_state(be, XenbusStateConnected);
++				break;
++			case XenbusStateClosing:
++			case XenbusStateClosed:
++				backend_switch_state(be, XenbusStateClosing);
++				break;
++			default:
++				BUG();
++			}
++			break;
++		case XenbusStateConnected:
++			switch (state) {
++			case XenbusStateInitWait:
++			case XenbusStateClosing:
++			case XenbusStateClosed:
++				backend_disconnect(be);
++				backend_switch_state(be, XenbusStateClosing);
++				break;
++			default:
++				BUG();
++			}
++			break;
++		case XenbusStateClosing:
++			switch (state) {
++			case XenbusStateInitWait:
++			case XenbusStateConnected:
++			case XenbusStateClosed:
++				backend_switch_state(be, XenbusStateClosed);
++				break;
++			default:
++				BUG();
++			}
++			break;
++		default:
++			BUG();
++		}
+ 	}
+ }
+ 
+@@ -227,41 +328,33 @@ static void frontend_changed(struct xenbus_device *dev,
+ {
+ 	struct backend_info *be = dev_get_drvdata(&dev->dev);
+ 
+-	pr_debug("frontend state %s", xenbus_strstate(frontend_state));
++	pr_debug("%s -> %s\n", dev->otherend, xenbus_strstate(frontend_state));
+ 
+ 	be->frontend_state = frontend_state;
+ 
+ 	switch (frontend_state) {
+ 	case XenbusStateInitialising:
+-		if (dev->state == XenbusStateClosed) {
+-			printk(KERN_INFO "%s: %s: prepare for reconnect\n",
+-			       __func__, dev->nodename);
+-			xenbus_switch_state(dev, XenbusStateInitWait);
+-		}
++		set_backend_state(be, XenbusStateInitWait);
+ 		break;
+ 
+ 	case XenbusStateInitialised:
+ 		break;
+ 
+ 	case XenbusStateConnected:
+-		if (dev->state == XenbusStateConnected)
+-			break;
+-		if (be->vif)
+-			connect(be);
++		set_backend_state(be, XenbusStateConnected);
+ 		break;
+ 
+ 	case XenbusStateClosing:
+-		disconnect_backend(dev);
+-		xenbus_switch_state(dev, XenbusStateClosing);
++		set_backend_state(be, XenbusStateClosing);
+ 		break;
+ 
+ 	case XenbusStateClosed:
+-		xenbus_switch_state(dev, XenbusStateClosed);
++		set_backend_state(be, XenbusStateClosed);
+ 		if (xenbus_dev_is_online(dev))
+ 			break;
+-		destroy_backend(dev);
+ 		/* fall through if not online */
+ 	case XenbusStateUnknown:
++		set_backend_state(be, XenbusStateClosed);
+ 		device_unregister(&dev->dev);
+ 		break;
+ 
+@@ -354,7 +447,9 @@ static void hotplug_status_changed(struct xenbus_watch *watch,
+ 	if (IS_ERR(str))
+ 		return;
+ 	if (len == sizeof("connected")-1 && !memcmp(str, "connected", len)) {
+-		xenbus_switch_state(be->dev, XenbusStateConnected);
++		/* Complete any pending state change */
++		xenbus_switch_state(be->dev, be->state);
++
+ 		/* Not interested in this watch anymore. */
+ 		unregister_hotplug_status_watch(be);
+ 	}
+@@ -384,12 +479,8 @@ static void connect(struct backend_info *be)
+ 	err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
+ 				   hotplug_status_changed,
+ 				   "%s/%s", dev->nodename, "hotplug-status");
+-	if (err) {
+-		/* Switch now, since we can't do a watch. */
+-		xenbus_switch_state(dev, XenbusStateConnected);
+-	} else {
++	if (!err)
+ 		be->have_hotplug_status_watch = 1;
+-	}
+ 
+ 	netif_wake_queue(be->vif->dev);
+ }
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index d53547d2e4c7..d3aa353908aa 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1010,6 +1010,7 @@ static int register_root_hub(struct usb_hcd *hcd)
+ 					dev_name(&usb_dev->dev), retval);
+ 			return retval;
+ 		}
++		usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
+ 	}
+ 
+ 	retval = usb_new_device (usb_dev);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 6cf2ae0aa1f7..c8b9fa0e9275 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -135,7 +135,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
+ 	return usb_get_intfdata(hdev->actconfig->interface[0]);
+ }
+ 
+-static int usb_device_supports_lpm(struct usb_device *udev)
++int usb_device_supports_lpm(struct usb_device *udev)
+ {
+ 	/* USB 2.1 (and greater) devices indicate LPM support through
+ 	 * their USB 2.0 Extended Capabilities BOS descriptor.
+@@ -156,6 +156,11 @@ static int usb_device_supports_lpm(struct usb_device *udev)
+ 				"Power management will be impacted.\n");
+ 		return 0;
+ 	}
++
++	/* udev is root hub */
++	if (!udev->parent)
++		return 1;
++
+ 	if (udev->parent->lpm_capable)
+ 		return 1;
+ 
+@@ -1557,10 +1562,15 @@ static int hub_configure(struct usb_hub *hub,
+ 	if (hub->has_indicators && blinkenlights)
+ 		hub->indicator [0] = INDICATOR_CYCLE;
+ 
+-	for (i = 0; i < hdev->maxchild; i++)
+-		if (usb_hub_create_port_device(hub, i + 1) < 0)
++	for (i = 0; i < hdev->maxchild; i++) {
++		ret = usb_hub_create_port_device(hub, i + 1);
++		if (ret < 0) {
+ 			dev_err(hub->intfdev,
+ 				"couldn't create port%d device.\n", i + 1);
++			hdev->maxchild = i;
++			goto fail_keep_maxchild;
++		}
++	}
+ 
+ 	usb_hub_adjust_deviceremovable(hdev, hub->descriptor);
+ 
+@@ -1568,6 +1578,8 @@ static int hub_configure(struct usb_hub *hub,
+ 	return 0;
+ 
+ fail:
++	hdev->maxchild = 0;
++fail_keep_maxchild:
+ 	dev_err (hub_dev, "config failed, %s (err %d)\n",
+ 			message, ret);
+ 	/* hub_disconnect() frees urb and descriptor */
+diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
+index 823857767a16..c49383669cd8 100644
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -35,6 +35,7 @@ extern int usb_get_device_descriptor(struct usb_device *dev,
+ 		unsigned int size);
+ extern int usb_get_bos_descriptor(struct usb_device *dev);
+ extern void usb_release_bos_descriptor(struct usb_device *dev);
++extern int usb_device_supports_lpm(struct usb_device *udev);
+ extern char *usb_cache_string(struct usb_device *udev, int index);
+ extern int usb_set_configuration(struct usb_device *dev, int configuration);
+ extern int usb_choose_configuration(struct usb_device *udev);
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index acaee066b99a..c3d94853b4ab 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1376,6 +1376,23 @@ static const struct usb_device_id option_ids[] = {
+ 		.driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff),  /* ZTE MF91 */
+ 		.driver_info = (kernel_ulong_t)&net_intf2_blacklist },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1545, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1546, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1547, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1565, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1566, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1567, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1589, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1590, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1591, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1592, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1594, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1596, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1598, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1600, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
+ 	  0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
+index a60d6afca97c..30e4ed52d701 100644
+--- a/drivers/video/backlight/atmel-pwm-bl.c
++++ b/drivers/video/backlight/atmel-pwm-bl.c
+@@ -118,7 +118,7 @@ static const struct backlight_ops atmel_pwm_bl_ops = {
+ 	.update_status  = atmel_pwm_bl_set_intensity,
+ };
+ 
+-static int __init atmel_pwm_bl_probe(struct platform_device *pdev)
++static int atmel_pwm_bl_probe(struct platform_device *pdev)
+ {
+ 	struct backlight_properties props;
+ 	const struct atmel_pwm_bl_platform_data *pdata;
+@@ -203,7 +203,7 @@ err_free_mem:
+ 	return retval;
+ }
+ 
+-static int __exit atmel_pwm_bl_remove(struct platform_device *pdev)
++static int atmel_pwm_bl_remove(struct platform_device *pdev)
+ {
+ 	struct atmel_pwm_bl *pwmbl = platform_get_drvdata(pdev);
+ 
+@@ -222,10 +222,11 @@ static struct platform_driver atmel_pwm_bl_driver = {
+ 		.name = "atmel-pwm-bl",
+ 	},
+ 	/* REVISIT add suspend() and resume() */
+-	.remove = __exit_p(atmel_pwm_bl_remove),
++	.probe = atmel_pwm_bl_probe,
++	.remove = atmel_pwm_bl_remove,
+ };
+ 
+-module_platform_driver_probe(atmel_pwm_bl_driver, atmel_pwm_bl_probe);
++module_platform_driver(atmel_pwm_bl_driver);
+ 
+ MODULE_AUTHOR("Hans-Christian egtvedt <hans-christian.egtvedt@×××××.com>");
+ MODULE_DESCRIPTION("Atmel PWM backlight driver");
+diff --git a/drivers/video/hyperv_fb.c b/drivers/video/hyperv_fb.c
+index d4d2c5fe2488..0f3b33cf13ef 100644
+--- a/drivers/video/hyperv_fb.c
++++ b/drivers/video/hyperv_fb.c
+@@ -795,12 +795,21 @@ static int hvfb_remove(struct hv_device *hdev)
+ }
+ 
+ 
++static DEFINE_PCI_DEVICE_TABLE(pci_stub_id_table) = {
++	{
++		.vendor      = PCI_VENDOR_ID_MICROSOFT,
++		.device      = PCI_DEVICE_ID_HYPERV_VIDEO,
++	},
++	{ /* end of list */ }
++};
++
+ static const struct hv_vmbus_device_id id_table[] = {
+ 	/* Synthetic Video Device GUID */
+ 	{HV_SYNTHVID_GUID},
+ 	{}
+ };
+ 
++MODULE_DEVICE_TABLE(pci, pci_stub_id_table);
+ MODULE_DEVICE_TABLE(vmbus, id_table);
+ 
+ static struct hv_driver hvfb_drv = {
+@@ -810,14 +819,43 @@ static struct hv_driver hvfb_drv = {
+ 	.remove = hvfb_remove,
+ };
+ 
++static int hvfb_pci_stub_probe(struct pci_dev *pdev,
++			       const struct pci_device_id *ent)
++{
++	return 0;
++}
++
++static void hvfb_pci_stub_remove(struct pci_dev *pdev)
++{
++}
++
++static struct pci_driver hvfb_pci_stub_driver = {
++	.name =		KBUILD_MODNAME,
++	.id_table =	pci_stub_id_table,
++	.probe =	hvfb_pci_stub_probe,
++	.remove =	hvfb_pci_stub_remove,
++};
+ 
+ static int __init hvfb_drv_init(void)
+ {
+-	return vmbus_driver_register(&hvfb_drv);
++	int ret;
++
++	ret = vmbus_driver_register(&hvfb_drv);
++	if (ret != 0)
++		return ret;
++
++	ret = pci_register_driver(&hvfb_pci_stub_driver);
++	if (ret != 0) {
++		vmbus_driver_unregister(&hvfb_drv);
++		return ret;
++	}
++
++	return 0;
+ }
+ 
+ static void __exit hvfb_drv_exit(void)
+ {
++	pci_unregister_driver(&hvfb_pci_stub_driver);
+ 	vmbus_driver_unregister(&hvfb_drv);
+ }
+ 
+diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
+index 2a601e7da1bf..665e0cee59bd 100644
+--- a/include/net/ip6_fib.h
++++ b/include/net/ip6_fib.h
+@@ -165,6 +165,7 @@ static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
+ static inline void rt6_clean_expires(struct rt6_info *rt)
+ {
+ 	rt->rt6i_flags &= ~RTF_EXPIRES;
++	rt->dst.expires = 0;
+ }
+ 
+ static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires)
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index a9942e1faefb..7ac7f91f0242 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -113,7 +113,7 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
+ 				   __be32 key);
+ 
+ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
+-		  const struct tnl_ptk_info *tpi, bool log_ecn_error);
++		  const struct tnl_ptk_info *tpi, int hdr_len, bool log_ecn_error);
+ int ip_tunnel_changelink(struct net_device *dev, struct nlattr *tb[],
+ 			 struct ip_tunnel_parm *p);
+ int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
+diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
+index fb104e51496e..9e59950f55cf 100644
+--- a/include/uapi/linux/perf_event.h
++++ b/include/uapi/linux/perf_event.h
+@@ -425,13 +425,15 @@ struct perf_event_mmap_page {
+ 	/*
+ 	 * Control data for the mmap() data buffer.
+ 	 *
+-	 * User-space reading the @data_head value should issue an rmb(), on
+-	 * SMP capable platforms, after reading this value -- see
+-	 * perf_event_wakeup().
++	 * User-space reading the @data_head value should issue an smp_rmb(),
++	 * after reading this value.
+ 	 *
+ 	 * When the mapping is PROT_WRITE the @data_tail value should be
+-	 * written by userspace to reflect the last read data. In this case
+-	 * the kernel will not over-write unread data.
++	 * written by userspace to reflect the last read data, after issueing
++	 * an smp_mb() to separate the data read from the ->data_tail store.
++	 * In this case the kernel will not over-write unread data.
++	 *
++	 * See perf_output_put_handle() for the data ordering.
+ 	 */
+ 	__u64   data_head;		/* head in the data section */
+ 	__u64	data_tail;		/* user-space written tail */
+diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
+index cd55144270b5..9c2ddfbf4525 100644
+--- a/kernel/events/ring_buffer.c
++++ b/kernel/events/ring_buffer.c
+@@ -87,10 +87,31 @@ again:
+ 		goto out;
+ 
+ 	/*
+-	 * Publish the known good head. Rely on the full barrier implied
+-	 * by atomic_dec_and_test() order the rb->head read and this
+-	 * write.
++	 * Since the mmap() consumer (userspace) can run on a different CPU:
++	 *
++	 *   kernel				user
++	 *
++	 *   READ ->data_tail			READ ->data_head
++	 *   smp_mb()	(A)			smp_rmb()	(C)
++	 *   WRITE $data			READ $data
++	 *   smp_wmb()	(B)			smp_mb()	(D)
++	 *   STORE ->data_head			WRITE ->data_tail
++	 *
++	 * Where A pairs with D, and B pairs with C.
++	 *
++	 * I don't think A needs to be a full barrier because we won't in fact
++	 * write data until we see the store from userspace. So we simply don't
++	 * issue the data WRITE until we observe it. Be conservative for now.
++	 *
++	 * OTOH, D needs to be a full barrier since it separates the data READ
++	 * from the tail WRITE.
++	 *
++	 * For B a WMB is sufficient since it separates two WRITEs, and for C
++	 * an RMB is sufficient since it separates two READs.
++	 *
++	 * See perf_output_begin().
+ 	 */
++	smp_wmb();
+ 	rb->user_page->data_head = head;
+ 
+ 	/*
+@@ -154,9 +175,11 @@ int perf_output_begin(struct perf_output_handle *handle,
+ 		 * Userspace could choose to issue a mb() before updating the
+ 		 * tail pointer. So that all reads will be completed before the
+ 		 * write is issued.
++		 *
++		 * See perf_output_put_handle().
+ 		 */
+ 		tail = ACCESS_ONCE(rb->user_page->data_tail);
+-		smp_rmb();
++		smp_mb();
+ 		offset = head = local_read(&rb->head);
+ 		head += size;
+ 		if (unlikely(!perf_output_space(rb, tail, offset, head)))
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 0582a01a81e3..5546ae9c84f9 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -826,9 +826,12 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf,
+ 	if (isspace(ch)) {
+ 		parser->buffer[parser->idx] = 0;
+ 		parser->cont = false;
+-	} else {
++	} else if (parser->idx < parser->size - 1) {
+ 		parser->cont = true;
+ 		parser->buffer[parser->idx++] = ch;
++	} else {
++		ret = -EINVAL;
++		goto out;
+ 	}
+ 
+ 	*ppos += read;
+diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
+index 51aafd669cbb..f1cb1f56cda9 100644
+--- a/net/batman-adv/main.c
++++ b/net/batman-adv/main.c
+@@ -61,6 +61,7 @@ static int __init batadv_init(void)
+ 	batadv_recv_handler_init();
+ 
+ 	batadv_iv_init();
++	batadv_nc_init();
+ 
+ 	batadv_event_workqueue = create_singlethread_workqueue("bat_events");
+ 
+@@ -138,7 +139,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
+ 	if (ret < 0)
+ 		goto err;
+ 
+-	ret = batadv_nc_init(bat_priv);
++	ret = batadv_nc_mesh_init(bat_priv);
+ 	if (ret < 0)
+ 		goto err;
+ 
+@@ -163,7 +164,7 @@ void batadv_mesh_free(struct net_device *soft_iface)
+ 	batadv_vis_quit(bat_priv);
+ 
+ 	batadv_gw_node_purge(bat_priv);
+-	batadv_nc_free(bat_priv);
++	batadv_nc_mesh_free(bat_priv);
+ 	batadv_dat_free(bat_priv);
+ 	batadv_bla_free(bat_priv);
+ 
+diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
+index e84629ece9b7..f97aeee2201c 100644
+--- a/net/batman-adv/network-coding.c
++++ b/net/batman-adv/network-coding.c
+@@ -35,6 +35,20 @@ static int batadv_nc_recv_coded_packet(struct sk_buff *skb,
+ 				       struct batadv_hard_iface *recv_if);
+ 
+ /**
++ * batadv_nc_init - one-time initialization for network coding
++ */
++int __init batadv_nc_init(void)
++{
++	int ret;
++
++	/* Register our packet type */
++	ret = batadv_recv_handler_register(BATADV_CODED,
++					   batadv_nc_recv_coded_packet);
++
++	return ret;
++}
++
++/**
+  * batadv_nc_start_timer - initialise the nc periodic worker
+  * @bat_priv: the bat priv with all the soft interface information
+  */
+@@ -45,10 +59,10 @@ static void batadv_nc_start_timer(struct batadv_priv *bat_priv)
+ }
+ 
+ /**
+- * batadv_nc_init - initialise coding hash table and start house keeping
++ * batadv_nc_mesh_init - initialise coding hash table and start house keeping
+  * @bat_priv: the bat priv with all the soft interface information
+  */
+-int batadv_nc_init(struct batadv_priv *bat_priv)
++int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
+ {
+ 	bat_priv->nc.timestamp_fwd_flush = jiffies;
+ 	bat_priv->nc.timestamp_sniffed_purge = jiffies;
+@@ -70,11 +84,6 @@ int batadv_nc_init(struct batadv_priv *bat_priv)
+ 	batadv_hash_set_lock_class(bat_priv->nc.coding_hash,
+ 				   &batadv_nc_decoding_hash_lock_class_key);
+ 
+-	/* Register our packet type */
+-	if (batadv_recv_handler_register(BATADV_CODED,
+-					 batadv_nc_recv_coded_packet) < 0)
+-		goto err;
+-
+ 	INIT_DELAYED_WORK(&bat_priv->nc.work, batadv_nc_worker);
+ 	batadv_nc_start_timer(bat_priv);
+ 
+@@ -1722,12 +1731,11 @@ free_nc_packet:
+ }
+ 
+ /**
+- * batadv_nc_free - clean up network coding memory
++ * batadv_nc_mesh_free - clean up network coding memory
+  * @bat_priv: the bat priv with all the soft interface information
+  */
+-void batadv_nc_free(struct batadv_priv *bat_priv)
++void batadv_nc_mesh_free(struct batadv_priv *bat_priv)
+ {
+-	batadv_recv_handler_unregister(BATADV_CODED);
+ 	cancel_delayed_work_sync(&bat_priv->nc.work);
+ 
+ 	batadv_nc_purge_paths(bat_priv, bat_priv->nc.coding_hash, NULL);
+diff --git a/net/batman-adv/network-coding.h b/net/batman-adv/network-coding.h
+index 4fa6d0caddbd..bd4295fb960f 100644
+--- a/net/batman-adv/network-coding.h
++++ b/net/batman-adv/network-coding.h
+@@ -22,8 +22,9 @@
+ 
+ #ifdef CONFIG_BATMAN_ADV_NC
+ 
+-int batadv_nc_init(struct batadv_priv *bat_priv);
+-void batadv_nc_free(struct batadv_priv *bat_priv);
++int batadv_nc_init(void);
++int batadv_nc_mesh_init(struct batadv_priv *bat_priv);
++void batadv_nc_mesh_free(struct batadv_priv *bat_priv);
+ void batadv_nc_update_nc_node(struct batadv_priv *bat_priv,
+ 			      struct batadv_orig_node *orig_node,
+ 			      struct batadv_orig_node *orig_neigh_node,
+@@ -47,12 +48,17 @@ int batadv_nc_init_debugfs(struct batadv_priv *bat_priv);
+ 
+ #else /* ifdef CONFIG_BATMAN_ADV_NC */
+ 
+-static inline int batadv_nc_init(struct batadv_priv *bat_priv)
++static inline int batadv_nc_init(void)
+ {
+ 	return 0;
+ }
+ 
+-static inline void batadv_nc_free(struct batadv_priv *bat_priv)
++static inline int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
++{
++	return 0;
++}
++
++static inline void batadv_nc_mesh_free(struct batadv_priv *bat_priv)
+ {
+ 	return;
+ }
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index 44db78ae6a65..f97101b4d373 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -40,7 +40,7 @@ again:
+ 		struct iphdr _iph;
+ ip:
+ 		iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
+-		if (!iph)
++		if (!iph || iph->ihl < 5)
+ 			return false;
+ 
+ 		if (ip_is_fragment(iph))
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index c52fee0976da..64e4e98c8786 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -335,7 +335,7 @@ static int ipgre_rcv(struct sk_buff *skb)
+ 				  iph->saddr, iph->daddr, tpi.key);
+ 
+ 	if (tunnel) {
+-		ip_tunnel_rcv(tunnel, skb, &tpi, log_ecn_error);
++		ip_tunnel_rcv(tunnel, skb, &tpi, hdr_len, log_ecn_error);
+ 		return 0;
+ 	}
+ 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 92d2f0f5d7bf..46dcf32c012e 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -402,7 +402,7 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,
+ }
+ 
+ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
+-		  const struct tnl_ptk_info *tpi, bool log_ecn_error)
++		  const struct tnl_ptk_info *tpi, int hdr_len, bool log_ecn_error)
+ {
+ 	struct pcpu_tstats *tstats;
+ 	const struct iphdr *iph = ip_hdr(skb);
+@@ -413,7 +413,7 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
+ 	skb->protocol = tpi->proto;
+ 
+ 	skb->mac_header = skb->network_header;
+-	__pskb_pull(skb, tunnel->hlen);
++	__pskb_pull(skb, hdr_len);
+ 	skb_postpull_rcsum(skb, skb_transport_header(skb), tunnel->hlen);
+ #ifdef CONFIG_NET_IPGRE_BROADCAST
+ 	if (ipv4_is_multicast(iph->daddr)) {
+diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
+index 7cfc45624b6d..f5cc7b331511 100644
+--- a/net/ipv4/ipip.c
++++ b/net/ipv4/ipip.c
+@@ -195,7 +195,7 @@ static int ipip_rcv(struct sk_buff *skb)
+ 	if (tunnel) {
+ 		if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+ 			goto drop;
+-		return ip_tunnel_rcv(tunnel, skb, &tpi, log_ecn_error);
++		return ip_tunnel_rcv(tunnel, skb, &tpi, 0, log_ecn_error);
+ 	}
+ 
+ 	return -1;
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 3c1f493ccc63..548a1f7c1a29 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1084,10 +1084,13 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
+ 	if (rt->rt6i_genid != rt_genid(dev_net(rt->dst.dev)))
+ 		return NULL;
+ 
+-	if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+-		return dst;
++	if (!rt->rt6i_node || (rt->rt6i_node->fn_sernum != cookie))
++		return NULL;
+ 
+-	return NULL;
++	if (rt6_check_expired(rt))
++		return NULL;
++
++	return dst;
+ }
+ 
+ static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index aecf088f40af..b93799201578 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -738,9 +738,10 @@ static int hdmi_manual_setup_channel_mapping(struct hda_codec *codec,
+ static void hdmi_setup_fake_chmap(unsigned char *map, int ca)
+ {
+ 	int i;
++	int ordered_ca = get_channel_allocation_order(ca);
+ 	for (i = 0; i < 8; i++) {
+-		if (i < channel_allocations[ca].channels)
+-			map[i] = from_cea_slot((hdmi_channel_mapping[ca][i] >> 4) & 0x0f);
++		if (i < channel_allocations[ordered_ca].channels)
++			map[i] = from_cea_slot(hdmi_channel_mapping[ca][i] & 0x0f);
+ 		else
+ 			map[i] = 0;
+ 	}

Modified: genpatches-2.6/trunk/3.11/0000_README
===================================================================
--- genpatches-2.6/trunk/3.11/0000_README	2013-11-14 16:37:35 UTC (rev 2581)
+++ genpatches-2.6/trunk/3.11/0000_README	2013-11-21 00:37:00 UTC (rev 2582)
@@ -74,6 +74,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.11.8
 
+Patch:  1008_linux-3.11.9.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.11.9
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.11/1008_linux-3.11.9.patch
===================================================================
--- genpatches-2.6/trunk/3.11/1008_linux-3.11.9.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.11/1008_linux-3.11.9.patch	2013-11-21 00:37:00 UTC (rev 2582)
@@ -0,0 +1,1013 @@
+diff --git a/Makefile b/Makefile
+index 7521adbea135..06379bd78b64 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 11
+-SUBLEVEL = 8
++SUBLEVEL = 9
+ EXTRAVERSION =
+ NAME = Linux for Workgroups
+ 
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 3a0f3a2d1666..96a410eb43c0 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1389,6 +1389,26 @@ static void intel_dp_get_config(struct intel_encoder *encoder,
+ 	}
+ 
+ 	pipe_config->adjusted_mode.flags |= flags;
++
++	if (is_edp(intel_dp) && dev_priv->vbt.edp_bpp &&
++	    pipe_config->pipe_bpp > dev_priv->vbt.edp_bpp) {
++		/*
++		 * This is a big fat ugly hack.
++		 *
++		 * Some machines in UEFI boot mode provide us a VBT that has 18
++		 * bpp and 1.62 GHz link bandwidth for eDP, which for reasons
++		 * unknown we fail to light up. Yet the same BIOS boots up with
++		 * 24 bpp and 2.7 GHz link. Use the same bpp as the BIOS uses as
++		 * max, not what it tells us to use.
++		 *
++		 * Note: This will still be broken if the eDP panel is not lit
++		 * up by the BIOS, and thus we can't get the mode at module
++		 * load.
++		 */
++		DRM_DEBUG_KMS("pipe has %d bpp for eDP panel, overriding BIOS-provided max %d bpp\n",
++			      pipe_config->pipe_bpp, dev_priv->vbt.edp_bpp);
++		dev_priv->vbt.edp_bpp = pipe_config->pipe_bpp;
++	}
+ }
+ 
+ static void intel_disable_dp(struct intel_encoder *encoder)
+diff --git a/drivers/media/platform/sh_vou.c b/drivers/media/platform/sh_vou.c
+index 7a9c5e9329f2..4f30341dc2ab 100644
+--- a/drivers/media/platform/sh_vou.c
++++ b/drivers/media/platform/sh_vou.c
+@@ -776,7 +776,7 @@ static int sh_vou_try_fmt_vid_out(struct file *file, void *priv,
+ 	v4l_bound_align_image(&pix->width, 0, VOU_MAX_IMAGE_WIDTH, 1,
+ 			      &pix->height, 0, VOU_MAX_IMAGE_HEIGHT, 1, 0);
+ 
+-	for (i = 0; ARRAY_SIZE(vou_fmt); i++)
++	for (i = 0; i < ARRAY_SIZE(vou_fmt); i++)
+ 		if (vou_fmt[i].pfmt == pix->pixelformat)
+ 			return 0;
+ 
+diff --git a/drivers/misc/atmel_pwm.c b/drivers/misc/atmel_pwm.c
+index 494d0500bda6..a6dc56e1bc58 100644
+--- a/drivers/misc/atmel_pwm.c
++++ b/drivers/misc/atmel_pwm.c
+@@ -90,8 +90,10 @@ int pwm_channel_alloc(int index, struct pwm_channel *ch)
+ 	unsigned long	flags;
+ 	int		status = 0;
+ 
+-	/* insist on PWM init, with this signal pinned out */
+-	if (!pwm || !(pwm->mask & 1 << index))
++	if (!pwm)
++		return -EPROBE_DEFER;
++
++	if (!(pwm->mask & 1 << index))
+ 		return -ENODEV;
+ 
+ 	if (index < 0 || index >= PWM_NCHAN || !ch)
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c
+index 9c89dc8fe105..632b318eb38a 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c
+@@ -1599,7 +1599,8 @@ static void write_ofld_wr(struct adapter *adap, struct sk_buff *skb,
+ 	flits = skb_transport_offset(skb) / 8;
+ 	sgp = ndesc == 1 ? (struct sg_ent *)&d->flit[flits] : sgl;
+ 	sgl_flits = make_sgl(skb, sgp, skb_transport_header(skb),
+-			     skb->tail - skb->transport_header,
++			     skb_tail_pointer(skb) -
++			     skb_transport_header(skb),
+ 			     adap->pdev);
+ 	if (need_skb_unmap()) {
+ 		setup_deferred_unmapping(skb, adap->pdev, sgp, sgl_flits);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+index 299d0184f983..e5f6bf4dc8a3 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+@@ -1673,7 +1673,7 @@ static void mlx4_master_deactivate_admin_state(struct mlx4_priv *priv, int slave
+ 			vp_oper->vlan_idx = NO_INDX;
+ 		}
+ 		if (NO_INDX != vp_oper->mac_idx) {
+-			__mlx4_unregister_mac(&priv->dev, port, vp_oper->mac_idx);
++			__mlx4_unregister_mac(&priv->dev, port, vp_oper->state.mac);
+ 			vp_oper->mac_idx = NO_INDX;
+ 		}
+ 	}
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 1d01534c2020..64cf70247048 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1096,11 +1096,6 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
+ {
+ 	struct virtnet_info *vi = container_of(nfb, struct virtnet_info, nb);
+ 
+-	mutex_lock(&vi->config_lock);
+-
+-	if (!vi->config_enable)
+-		goto done;
+-
+ 	switch(action & ~CPU_TASKS_FROZEN) {
+ 	case CPU_ONLINE:
+ 	case CPU_DOWN_FAILED:
+@@ -1114,8 +1109,6 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
+ 		break;
+ 	}
+ 
+-done:
+-	mutex_unlock(&vi->config_lock);
+ 	return NOTIFY_OK;
+ }
+ 
+@@ -1672,6 +1665,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
+ 	struct virtnet_info *vi = vdev->priv;
+ 	int i;
+ 
++	unregister_hotcpu_notifier(&vi->nb);
++
+ 	/* Prevent config work handler from accessing the device */
+ 	mutex_lock(&vi->config_lock);
+ 	vi->config_enable = false;
+@@ -1720,6 +1715,10 @@ static int virtnet_restore(struct virtio_device *vdev)
+ 	virtnet_set_queues(vi, vi->curr_queue_pairs);
+ 	rtnl_unlock();
+ 
++	err = register_hotcpu_notifier(&vi->nb);
++	if (err)
++		return err;
++
+ 	return 0;
+ }
+ #endif
+diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
+index 058c6aa58b7a..e2272ba37656 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
+@@ -270,54 +270,83 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
+ #if IS_ENABLED(CONFIG_IWLMVM)
+ /* 7000 Series */
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4070, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4072, iwl7260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4170, iwl7260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4060, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x406A, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4160, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4062, iwl7260_n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4162, iwl7260_n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B2, 0x4270, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0x4272, iwl7260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B2, 0x4260, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0x426A, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B2, 0x4262, iwl7260_n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4470, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4472, iwl7260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4460, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x446A, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4462, iwl7260_n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4870, iwl7260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0x486E, iwl7260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x08B1, 0x4A70, iwl7260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x08B1, 0x4A6E, iwl7260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x08B1, 0x4A6C, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4570, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x4560, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0x4370, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0x4360, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x5070, iwl7260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4020, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0x402A, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B2, 0x4220, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0x4420, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0xC070, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC072, iwl7260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0xC170, iwl7260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0xC060, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC06A, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0xC160, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0xC062, iwl7260_n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0xC162, iwl7260_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC770, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC760, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B2, 0xC270, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0xC272, iwl7260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B2, 0xC260, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0xC26A, iwl7260_n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B2, 0xC262, iwl7260_n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0xC470, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC472, iwl7260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0xC460, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0xC462, iwl7260_n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC570, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC560, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B2, 0xC370, iwl7260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC360, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0xC020, iwl7260_2n_cfg)},
++	{IWL_PCI_DEVICE(0x08B1, 0xC02A, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B2, 0xC220, iwl7260_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B1, 0xC420, iwl7260_2n_cfg)},
+ 
+ /* 3160 Series */
+ 	{IWL_PCI_DEVICE(0x08B3, 0x0070, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x0072, iwl3160_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B3, 0x0170, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x0172, iwl3160_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B3, 0x0060, iwl3160_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B3, 0x0062, iwl3160_n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B4, 0x0270, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B4, 0x0272, iwl3160_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B3, 0x0470, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x0472, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B4, 0x0370, iwl3160_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B3, 0x8070, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x8072, iwl3160_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B3, 0x8170, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x8172, iwl3160_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B3, 0x8060, iwl3160_2n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B3, 0x8062, iwl3160_n_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B4, 0x8270, iwl3160_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x08B3, 0x8470, iwl3160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x08B3, 0x8570, iwl3160_2ac_cfg)},
+ #endif /* CONFIG_IWLMVM */
+ 
+ 	{0}
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 4d9a5e70c992..b2d442f102da 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -92,6 +92,7 @@ struct xenvif {
+ 	unsigned long   credit_usec;
+ 	unsigned long   remaining_credit;
+ 	struct timer_list credit_timeout;
++	u64 credit_window_start;
+ 
+ 	/* Statistics */
+ 	unsigned long rx_gso_checksum_fixup;
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index 73336c144d92..d28324a87231 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -297,8 +297,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
+ 	vif->credit_bytes = vif->remaining_credit = ~0UL;
+ 	vif->credit_usec  = 0UL;
+ 	init_timer(&vif->credit_timeout);
+-	/* Initialize 'expires' now: it's used to track the credit window. */
+-	vif->credit_timeout.expires = jiffies;
++	vif->credit_window_start = get_jiffies_64();
+ 
+ 	dev->netdev_ops	= &xenvif_netdev_ops;
+ 	dev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index fc7867ce90e5..ac55997bd90e 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -1430,9 +1430,8 @@ out:
+ 
+ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
+ {
+-	unsigned long now = jiffies;
+-	unsigned long next_credit =
+-		vif->credit_timeout.expires +
++	u64 now = get_jiffies_64();
++	u64 next_credit = vif->credit_window_start +
+ 		msecs_to_jiffies(vif->credit_usec / 1000);
+ 
+ 	/* Timer could already be pending in rare cases. */
+@@ -1440,8 +1439,8 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
+ 		return true;
+ 
+ 	/* Passed the point where we can replenish credit? */
+-	if (time_after_eq(now, next_credit)) {
+-		vif->credit_timeout.expires = now;
++	if (time_after_eq64(now, next_credit)) {
++		vif->credit_window_start = now;
+ 		tx_add_credit(vif);
+ 	}
+ 
+@@ -1453,6 +1452,7 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
+ 			tx_credit_callback;
+ 		mod_timer(&vif->credit_timeout,
+ 			  next_credit);
++		vif->credit_window_start = next_credit;
+ 
+ 		return true;
+ 	}
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index a53782ef1540..1b08d8798372 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -24,6 +24,12 @@
+ struct backend_info {
+ 	struct xenbus_device *dev;
+ 	struct xenvif *vif;
++
++	/* This is the state that will be reflected in xenstore when any
++	 * active hotplug script completes.
++	 */
++	enum xenbus_state state;
++
+ 	enum xenbus_state frontend_state;
+ 	struct xenbus_watch hotplug_status_watch;
+ 	u8 have_hotplug_status_watch:1;
+@@ -33,11 +39,15 @@ static int connect_rings(struct backend_info *);
+ static void connect(struct backend_info *);
+ static void backend_create_xenvif(struct backend_info *be);
+ static void unregister_hotplug_status_watch(struct backend_info *be);
++static void set_backend_state(struct backend_info *be,
++			      enum xenbus_state state);
+ 
+ static int netback_remove(struct xenbus_device *dev)
+ {
+ 	struct backend_info *be = dev_get_drvdata(&dev->dev);
+ 
++	set_backend_state(be, XenbusStateClosed);
++
+ 	unregister_hotplug_status_watch(be);
+ 	if (be->vif) {
+ 		kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
+@@ -136,6 +146,8 @@ static int netback_probe(struct xenbus_device *dev,
+ 	if (err)
+ 		goto fail;
+ 
++	be->state = XenbusStateInitWait;
++
+ 	/* This kicks hotplug scripts, so do it immediately. */
+ 	backend_create_xenvif(be);
+ 
+@@ -208,24 +220,113 @@ static void backend_create_xenvif(struct backend_info *be)
+ 	kobject_uevent(&dev->dev.kobj, KOBJ_ONLINE);
+ }
+ 
+-
+-static void disconnect_backend(struct xenbus_device *dev)
++static void backend_disconnect(struct backend_info *be)
+ {
+-	struct backend_info *be = dev_get_drvdata(&dev->dev);
+-
+ 	if (be->vif)
+ 		xenvif_disconnect(be->vif);
+ }
+ 
+-static void destroy_backend(struct xenbus_device *dev)
++static void backend_connect(struct backend_info *be)
+ {
+-	struct backend_info *be = dev_get_drvdata(&dev->dev);
++	if (be->vif)
++		connect(be);
++}
+ 
+-	if (be->vif) {
+-		kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
+-		xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status");
+-		xenvif_free(be->vif);
+-		be->vif = NULL;
++static inline void backend_switch_state(struct backend_info *be,
++					enum xenbus_state state)
++{
++	struct xenbus_device *dev = be->dev;
++
++	pr_debug("%s -> %s\n", dev->nodename, xenbus_strstate(state));
++	be->state = state;
++
++	/* If we are waiting for a hotplug script then defer the
++	 * actual xenbus state change.
++	 */
++	if (!be->have_hotplug_status_watch)
++		xenbus_switch_state(dev, state);
++}
++
++/* Handle backend state transitions:
++ *
++ * The backend state starts in InitWait and the following transitions are
++ * allowed.
++ *
++ * InitWait -> Connected
++ *
++ *    ^    \         |
++ *    |     \        |
++ *    |      \       |
++ *    |       \      |
++ *    |        \     |
++ *    |         \    |
++ *    |          V   V
++ *
++ *  Closed  <-> Closing
++ *
++ * The state argument specifies the eventual state of the backend and the
++ * function transitions to that state via the shortest path.
++ */
++static void set_backend_state(struct backend_info *be,
++			      enum xenbus_state state)
++{
++	while (be->state != state) {
++		switch (be->state) {
++		case XenbusStateClosed:
++			switch (state) {
++			case XenbusStateInitWait:
++			case XenbusStateConnected:
++				pr_info("%s: prepare for reconnect\n",
++					be->dev->nodename);
++				backend_switch_state(be, XenbusStateInitWait);
++				break;
++			case XenbusStateClosing:
++				backend_switch_state(be, XenbusStateClosing);
++				break;
++			default:
++				BUG();
++			}
++			break;
++		case XenbusStateInitWait:
++			switch (state) {
++			case XenbusStateConnected:
++				backend_connect(be);
++				backend_switch_state(be, XenbusStateConnected);
++				break;
++			case XenbusStateClosing:
++			case XenbusStateClosed:
++				backend_switch_state(be, XenbusStateClosing);
++				break;
++			default:
++				BUG();
++			}
++			break;
++		case XenbusStateConnected:
++			switch (state) {
++			case XenbusStateInitWait:
++			case XenbusStateClosing:
++			case XenbusStateClosed:
++				backend_disconnect(be);
++				backend_switch_state(be, XenbusStateClosing);
++				break;
++			default:
++				BUG();
++			}
++			break;
++		case XenbusStateClosing:
++			switch (state) {
++			case XenbusStateInitWait:
++			case XenbusStateConnected:
++			case XenbusStateClosed:
++				backend_switch_state(be, XenbusStateClosed);
++				break;
++			default:
++				BUG();
++			}
++			break;
++		default:
++			BUG();
++		}
+ 	}
+ }
+ 
+@@ -237,40 +338,33 @@ static void frontend_changed(struct xenbus_device *dev,
+ {
+ 	struct backend_info *be = dev_get_drvdata(&dev->dev);
+ 
+-	pr_debug("frontend state %s\n", xenbus_strstate(frontend_state));
++	pr_debug("%s -> %s\n", dev->otherend, xenbus_strstate(frontend_state));
+ 
+ 	be->frontend_state = frontend_state;
+ 
+ 	switch (frontend_state) {
+ 	case XenbusStateInitialising:
+-		if (dev->state == XenbusStateClosed) {
+-			pr_info("%s: prepare for reconnect\n", dev->nodename);
+-			xenbus_switch_state(dev, XenbusStateInitWait);
+-		}
++		set_backend_state(be, XenbusStateInitWait);
+ 		break;
+ 
+ 	case XenbusStateInitialised:
+ 		break;
+ 
+ 	case XenbusStateConnected:
+-		if (dev->state == XenbusStateConnected)
+-			break;
+-		if (be->vif)
+-			connect(be);
++		set_backend_state(be, XenbusStateConnected);
+ 		break;
+ 
+ 	case XenbusStateClosing:
+-		disconnect_backend(dev);
+-		xenbus_switch_state(dev, XenbusStateClosing);
++		set_backend_state(be, XenbusStateClosing);
+ 		break;
+ 
+ 	case XenbusStateClosed:
+-		xenbus_switch_state(dev, XenbusStateClosed);
++		set_backend_state(be, XenbusStateClosed);
+ 		if (xenbus_dev_is_online(dev))
+ 			break;
+-		destroy_backend(dev);
+ 		/* fall through if not online */
+ 	case XenbusStateUnknown:
++		set_backend_state(be, XenbusStateClosed);
+ 		device_unregister(&dev->dev);
+ 		break;
+ 
+@@ -363,7 +457,9 @@ static void hotplug_status_changed(struct xenbus_watch *watch,
+ 	if (IS_ERR(str))
+ 		return;
+ 	if (len == sizeof("connected")-1 && !memcmp(str, "connected", len)) {
+-		xenbus_switch_state(be->dev, XenbusStateConnected);
++		/* Complete any pending state change */
++		xenbus_switch_state(be->dev, be->state);
++
+ 		/* Not interested in this watch anymore. */
+ 		unregister_hotplug_status_watch(be);
+ 	}
+@@ -393,12 +489,8 @@ static void connect(struct backend_info *be)
+ 	err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
+ 				   hotplug_status_changed,
+ 				   "%s/%s", dev->nodename, "hotplug-status");
+-	if (err) {
+-		/* Switch now, since we can't do a watch. */
+-		xenbus_switch_state(dev, XenbusStateConnected);
+-	} else {
++	if (!err)
+ 		be->have_hotplug_status_watch = 1;
+-	}
+ 
+ 	netif_wake_queue(be->vif->dev);
+ }
+diff --git a/drivers/thermal/x86_pkg_temp_thermal.c b/drivers/thermal/x86_pkg_temp_thermal.c
+index f36950e4134f..7722cb9d5a80 100644
+--- a/drivers/thermal/x86_pkg_temp_thermal.c
++++ b/drivers/thermal/x86_pkg_temp_thermal.c
+@@ -316,18 +316,19 @@ static void pkg_temp_thermal_threshold_work_fn(struct work_struct *work)
+ 	int phy_id = topology_physical_package_id(cpu);
+ 	struct phy_dev_entry *phdev = pkg_temp_thermal_get_phy_entry(cpu);
+ 	bool notify = false;
++	unsigned long flags;
+ 
+ 	if (!phdev)
+ 		return;
+ 
+-	spin_lock(&pkg_work_lock);
++	spin_lock_irqsave(&pkg_work_lock, flags);
+ 	++pkg_work_cnt;
+ 	if (unlikely(phy_id > max_phy_id)) {
+-		spin_unlock(&pkg_work_lock);
++		spin_unlock_irqrestore(&pkg_work_lock, flags);
+ 		return;
+ 	}
+ 	pkg_work_scheduled[phy_id] = 0;
+-	spin_unlock(&pkg_work_lock);
++	spin_unlock_irqrestore(&pkg_work_lock, flags);
+ 
+ 	enable_pkg_thres_interrupt();
+ 	rdmsrl(MSR_IA32_PACKAGE_THERM_STATUS, msr_val);
+@@ -397,6 +398,7 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
+ 	int thres_count;
+ 	u32 eax, ebx, ecx, edx;
+ 	u8 *temp;
++	unsigned long flags;
+ 
+ 	cpuid(6, &eax, &ebx, &ecx, &edx);
+ 	thres_count = ebx & 0x07;
+@@ -420,19 +422,19 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
+ 		goto err_ret_unlock;
+ 	}
+ 
+-	spin_lock(&pkg_work_lock);
++	spin_lock_irqsave(&pkg_work_lock, flags);
+ 	if (topology_physical_package_id(cpu) > max_phy_id)
+ 		max_phy_id = topology_physical_package_id(cpu);
+ 	temp = krealloc(pkg_work_scheduled,
+ 			(max_phy_id+1) * sizeof(u8), GFP_ATOMIC);
+ 	if (!temp) {
+-		spin_unlock(&pkg_work_lock);
++		spin_unlock_irqrestore(&pkg_work_lock, flags);
+ 		err = -ENOMEM;
+ 		goto err_ret_free;
+ 	}
+ 	pkg_work_scheduled = temp;
+ 	pkg_work_scheduled[topology_physical_package_id(cpu)] = 0;
+-	spin_unlock(&pkg_work_lock);
++	spin_unlock_irqrestore(&pkg_work_lock, flags);
+ 
+ 	phy_dev_entry->phys_proc_id = topology_physical_package_id(cpu);
+ 	phy_dev_entry->first_cpu = cpu;
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 014dc996b4f6..7b8bc0bdc5da 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1035,6 +1035,7 @@ static int register_root_hub(struct usb_hcd *hcd)
+ 					dev_name(&usb_dev->dev), retval);
+ 			return retval;
+ 		}
++		usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
+ 	}
+ 
+ 	retval = usb_new_device (usb_dev);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 17c3785241a4..1c110891fac0 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -135,7 +135,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
+ 	return usb_get_intfdata(hdev->actconfig->interface[0]);
+ }
+ 
+-static int usb_device_supports_lpm(struct usb_device *udev)
++int usb_device_supports_lpm(struct usb_device *udev)
+ {
+ 	/* USB 2.1 (and greater) devices indicate LPM support through
+ 	 * their USB 2.0 Extended Capabilities BOS descriptor.
+@@ -156,6 +156,11 @@ static int usb_device_supports_lpm(struct usb_device *udev)
+ 				"Power management will be impacted.\n");
+ 		return 0;
+ 	}
++
++	/* udev is root hub */
++	if (!udev->parent)
++		return 1;
++
+ 	if (udev->parent->lpm_capable)
+ 		return 1;
+ 
+@@ -1557,10 +1562,15 @@ static int hub_configure(struct usb_hub *hub,
+ 	if (hub->has_indicators && blinkenlights)
+ 		hub->indicator [0] = INDICATOR_CYCLE;
+ 
+-	for (i = 0; i < hdev->maxchild; i++)
+-		if (usb_hub_create_port_device(hub, i + 1) < 0)
++	for (i = 0; i < hdev->maxchild; i++) {
++		ret = usb_hub_create_port_device(hub, i + 1);
++		if (ret < 0) {
+ 			dev_err(hub->intfdev,
+ 				"couldn't create port%d device.\n", i + 1);
++			hdev->maxchild = i;
++			goto fail_keep_maxchild;
++		}
++	}
+ 
+ 	usb_hub_adjust_deviceremovable(hdev, hub->descriptor);
+ 
+@@ -1568,6 +1578,8 @@ static int hub_configure(struct usb_hub *hub,
+ 	return 0;
+ 
+ fail:
++	hdev->maxchild = 0;
++fail_keep_maxchild:
+ 	dev_err (hub_dev, "config failed, %s (err %d)\n",
+ 			message, ret);
+ 	/* hub_disconnect() frees urb and descriptor */
+diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
+index 823857767a16..c49383669cd8 100644
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -35,6 +35,7 @@ extern int usb_get_device_descriptor(struct usb_device *dev,
+ 		unsigned int size);
+ extern int usb_get_bos_descriptor(struct usb_device *dev);
+ extern void usb_release_bos_descriptor(struct usb_device *dev);
++extern int usb_device_supports_lpm(struct usb_device *udev);
+ extern char *usb_cache_string(struct usb_device *udev, int index);
+ extern int usb_set_configuration(struct usb_device *dev, int configuration);
+ extern int usb_choose_configuration(struct usb_device *udev);
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index acaee066b99a..c3d94853b4ab 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1376,6 +1376,23 @@ static const struct usb_device_id option_ids[] = {
+ 		.driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff),  /* ZTE MF91 */
+ 		.driver_info = (kernel_ulong_t)&net_intf2_blacklist },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1545, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1546, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1547, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1565, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1566, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1567, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1589, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1590, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1591, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1592, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1594, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1596, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1598, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1600, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
+ 	  0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
+index 0393d827dd44..f7447f7004fb 100644
+--- a/drivers/video/backlight/atmel-pwm-bl.c
++++ b/drivers/video/backlight/atmel-pwm-bl.c
+@@ -118,7 +118,7 @@ static const struct backlight_ops atmel_pwm_bl_ops = {
+ 	.update_status  = atmel_pwm_bl_set_intensity,
+ };
+ 
+-static int __init atmel_pwm_bl_probe(struct platform_device *pdev)
++static int atmel_pwm_bl_probe(struct platform_device *pdev)
+ {
+ 	struct backlight_properties props;
+ 	const struct atmel_pwm_bl_platform_data *pdata;
+@@ -202,7 +202,7 @@ err_free_mem:
+ 	return retval;
+ }
+ 
+-static int __exit atmel_pwm_bl_remove(struct platform_device *pdev)
++static int atmel_pwm_bl_remove(struct platform_device *pdev)
+ {
+ 	struct atmel_pwm_bl *pwmbl = platform_get_drvdata(pdev);
+ 
+@@ -220,10 +220,11 @@ static struct platform_driver atmel_pwm_bl_driver = {
+ 		.name = "atmel-pwm-bl",
+ 	},
+ 	/* REVISIT add suspend() and resume() */
+-	.remove = __exit_p(atmel_pwm_bl_remove),
++	.probe = atmel_pwm_bl_probe,
++	.remove = atmel_pwm_bl_remove,
+ };
+ 
+-module_platform_driver_probe(atmel_pwm_bl_driver, atmel_pwm_bl_probe);
++module_platform_driver(atmel_pwm_bl_driver);
+ 
+ MODULE_AUTHOR("Hans-Christian egtvedt <hans-christian.egtvedt@×××××.com>");
+ MODULE_DESCRIPTION("Atmel PWM backlight driver");
+diff --git a/drivers/video/hyperv_fb.c b/drivers/video/hyperv_fb.c
+index d4d2c5fe2488..0f3b33cf13ef 100644
+--- a/drivers/video/hyperv_fb.c
++++ b/drivers/video/hyperv_fb.c
+@@ -795,12 +795,21 @@ static int hvfb_remove(struct hv_device *hdev)
+ }
+ 
+ 
++static DEFINE_PCI_DEVICE_TABLE(pci_stub_id_table) = {
++	{
++		.vendor      = PCI_VENDOR_ID_MICROSOFT,
++		.device      = PCI_DEVICE_ID_HYPERV_VIDEO,
++	},
++	{ /* end of list */ }
++};
++
+ static const struct hv_vmbus_device_id id_table[] = {
+ 	/* Synthetic Video Device GUID */
+ 	{HV_SYNTHVID_GUID},
+ 	{}
+ };
+ 
++MODULE_DEVICE_TABLE(pci, pci_stub_id_table);
+ MODULE_DEVICE_TABLE(vmbus, id_table);
+ 
+ static struct hv_driver hvfb_drv = {
+@@ -810,14 +819,43 @@ static struct hv_driver hvfb_drv = {
+ 	.remove = hvfb_remove,
+ };
+ 
++static int hvfb_pci_stub_probe(struct pci_dev *pdev,
++			       const struct pci_device_id *ent)
++{
++	return 0;
++}
++
++static void hvfb_pci_stub_remove(struct pci_dev *pdev)
++{
++}
++
++static struct pci_driver hvfb_pci_stub_driver = {
++	.name =		KBUILD_MODNAME,
++	.id_table =	pci_stub_id_table,
++	.probe =	hvfb_pci_stub_probe,
++	.remove =	hvfb_pci_stub_remove,
++};
+ 
+ static int __init hvfb_drv_init(void)
+ {
+-	return vmbus_driver_register(&hvfb_drv);
++	int ret;
++
++	ret = vmbus_driver_register(&hvfb_drv);
++	if (ret != 0)
++		return ret;
++
++	ret = pci_register_driver(&hvfb_pci_stub_driver);
++	if (ret != 0) {
++		vmbus_driver_unregister(&hvfb_drv);
++		return ret;
++	}
++
++	return 0;
+ }
+ 
+ static void __exit hvfb_drv_exit(void)
+ {
++	pci_unregister_driver(&hvfb_pci_stub_driver);
+ 	vmbus_driver_unregister(&hvfb_drv);
+ }
+ 
+diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
+index 48ec25a7fcb6..5e661a979694 100644
+--- a/include/net/ip6_fib.h
++++ b/include/net/ip6_fib.h
+@@ -165,6 +165,7 @@ static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
+ static inline void rt6_clean_expires(struct rt6_info *rt)
+ {
+ 	rt->rt6i_flags &= ~RTF_EXPIRES;
++	rt->dst.expires = 0;
+ }
+ 
+ static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires)
+diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
+index 0b1df41691e8..1517442595d3 100644
+--- a/include/uapi/linux/perf_event.h
++++ b/include/uapi/linux/perf_event.h
+@@ -428,13 +428,15 @@ struct perf_event_mmap_page {
+ 	/*
+ 	 * Control data for the mmap() data buffer.
+ 	 *
+-	 * User-space reading the @data_head value should issue an rmb(), on
+-	 * SMP capable platforms, after reading this value -- see
+-	 * perf_event_wakeup().
++	 * User-space reading the @data_head value should issue an smp_rmb(),
++	 * after reading this value.
+ 	 *
+ 	 * When the mapping is PROT_WRITE the @data_tail value should be
+-	 * written by userspace to reflect the last read data. In this case
+-	 * the kernel will not over-write unread data.
++	 * written by userspace to reflect the last read data, after issueing
++	 * an smp_mb() to separate the data read from the ->data_tail store.
++	 * In this case the kernel will not over-write unread data.
++	 *
++	 * See perf_output_put_handle() for the data ordering.
+ 	 */
+ 	__u64   data_head;		/* head in the data section */
+ 	__u64	data_tail;		/* user-space written tail */
+diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
+index cd55144270b5..9c2ddfbf4525 100644
+--- a/kernel/events/ring_buffer.c
++++ b/kernel/events/ring_buffer.c
+@@ -87,10 +87,31 @@ again:
+ 		goto out;
+ 
+ 	/*
+-	 * Publish the known good head. Rely on the full barrier implied
+-	 * by atomic_dec_and_test() order the rb->head read and this
+-	 * write.
++	 * Since the mmap() consumer (userspace) can run on a different CPU:
++	 *
++	 *   kernel				user
++	 *
++	 *   READ ->data_tail			READ ->data_head
++	 *   smp_mb()	(A)			smp_rmb()	(C)
++	 *   WRITE $data			READ $data
++	 *   smp_wmb()	(B)			smp_mb()	(D)
++	 *   STORE ->data_head			WRITE ->data_tail
++	 *
++	 * Where A pairs with D, and B pairs with C.
++	 *
++	 * I don't think A needs to be a full barrier because we won't in fact
++	 * write data until we see the store from userspace. So we simply don't
++	 * issue the data WRITE until we observe it. Be conservative for now.
++	 *
++	 * OTOH, D needs to be a full barrier since it separates the data READ
++	 * from the tail WRITE.
++	 *
++	 * For B a WMB is sufficient since it separates two WRITEs, and for C
++	 * an RMB is sufficient since it separates two READs.
++	 *
++	 * See perf_output_begin().
+ 	 */
++	smp_wmb();
+ 	rb->user_page->data_head = head;
+ 
+ 	/*
+@@ -154,9 +175,11 @@ int perf_output_begin(struct perf_output_handle *handle,
+ 		 * Userspace could choose to issue a mb() before updating the
+ 		 * tail pointer. So that all reads will be completed before the
+ 		 * write is issued.
++		 *
++		 * See perf_output_put_handle().
+ 		 */
+ 		tail = ACCESS_ONCE(rb->user_page->data_tail);
+-		smp_rmb();
++		smp_mb();
+ 		offset = head = local_read(&rb->head);
+ 		head += size;
+ 		if (unlikely(!perf_output_space(rb, tail, offset, head)))
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 496f94d57698..207f5fc61ec8 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -843,9 +843,12 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf,
+ 	if (isspace(ch)) {
+ 		parser->buffer[parser->idx] = 0;
+ 		parser->cont = false;
+-	} else {
++	} else if (parser->idx < parser->size - 1) {
+ 		parser->cont = true;
+ 		parser->buffer[parser->idx++] = ch;
++	} else {
++		ret = -EINVAL;
++		goto out;
+ 	}
+ 
+ 	*ppos += read;
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index 52d0f8356071..4a1d06488082 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -40,7 +40,7 @@ again:
+ 		struct iphdr _iph;
+ ip:
+ 		iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
+-		if (!iph)
++		if (!iph || iph->ihl < 5)
+ 			return false;
+ 
+ 		if (ip_is_fragment(iph))
+diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
+index 3a7525e6c086..533c58a5cfb7 100644
+--- a/net/ipv4/tcp_offload.c
++++ b/net/ipv4/tcp_offload.c
+@@ -18,6 +18,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
+ 				netdev_features_t features)
+ {
+ 	struct sk_buff *segs = ERR_PTR(-EINVAL);
++	unsigned int sum_truesize = 0;
+ 	struct tcphdr *th;
+ 	unsigned int thlen;
+ 	unsigned int seq;
+@@ -102,13 +103,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
+ 		if (copy_destructor) {
+ 			skb->destructor = gso_skb->destructor;
+ 			skb->sk = gso_skb->sk;
+-			/* {tcp|sock}_wfree() use exact truesize accounting :
+-			 * sum(skb->truesize) MUST be exactly be gso_skb->truesize
+-			 * So we account mss bytes of 'true size' for each segment.
+-			 * The last segment will contain the remaining.
+-			 */
+-			skb->truesize = mss;
+-			gso_skb->truesize -= mss;
++			sum_truesize += skb->truesize;
+ 		}
+ 		skb = skb->next;
+ 		th = tcp_hdr(skb);
+@@ -125,7 +120,9 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
+ 	if (copy_destructor) {
+ 		swap(gso_skb->sk, skb->sk);
+ 		swap(gso_skb->destructor, skb->destructor);
+-		swap(gso_skb->truesize, skb->truesize);
++		sum_truesize += skb->truesize;
++		atomic_add(sum_truesize - gso_skb->truesize,
++			   &skb->sk->sk_wmem_alloc);
+ 	}
+ 
+ 	delta = htonl(oldlen + (skb_tail_pointer(skb) -
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 1e32d5c0b615..c9bd97bfd855 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1088,10 +1088,13 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
+ 	if (rt->rt6i_genid != rt_genid(dev_net(rt->dst.dev)))
+ 		return NULL;
+ 
+-	if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+-		return dst;
++	if (!rt->rt6i_node || (rt->rt6i_node->fn_sernum != cookie))
++		return NULL;
+ 
+-	return NULL;
++	if (rt6_check_expired(rt))
++		return NULL;
++
++	return dst;
+ }
+ 
+ static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 9da68852ee94..8b5b4b7b9941 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -866,7 +866,6 @@ static void sctp_cmd_delete_tcb(sctp_cmd_seq_t *cmds,
+ 	    (!asoc->temp) && (sk->sk_shutdown != SHUTDOWN_MASK))
+ 		return;
+ 
+-	BUG_ON(asoc->peer.primary_path == NULL);
+ 	sctp_unhash_established(asoc);
+ 	sctp_association_free(asoc);
+ }
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 48657565265e..4fb8bc30333a 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -738,9 +738,10 @@ static int hdmi_manual_setup_channel_mapping(struct hda_codec *codec,
+ static void hdmi_setup_fake_chmap(unsigned char *map, int ca)
+ {
+ 	int i;
++	int ordered_ca = get_channel_allocation_order(ca);
+ 	for (i = 0; i < 8; i++) {
+-		if (i < channel_allocations[ca].channels)
+-			map[i] = from_cea_slot((hdmi_channel_mapping[ca][i] >> 4) & 0x0f);
++		if (i < channel_allocations[ordered_ca].channels)
++			map[i] = from_cea_slot(hdmi_channel_mapping[ca][i] & 0x0f);
+ 		else
+ 			map[i] = 0;
+ 	}

Modified: genpatches-2.6/trunk/3.12/0000_README
===================================================================
--- genpatches-2.6/trunk/3.12/0000_README	2013-11-14 16:37:35 UTC (rev 2581)
+++ genpatches-2.6/trunk/3.12/0000_README	2013-11-21 00:37:00 UTC (rev 2582)
@@ -42,6 +42,10 @@
 
 Individual Patch Descriptions:
 --------------------------------------------------------------------------
+Patch:  1000_linux-3.12.1.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.12.1
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.12/1000_linux-3.12.1.patch
===================================================================
--- genpatches-2.6/trunk/3.12/1000_linux-3.12.1.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.12/1000_linux-3.12.1.patch	2013-11-21 00:37:00 UTC (rev 2582)
@@ -0,0 +1,583 @@
+diff --git a/Makefile b/Makefile
+index 67077ad..eb29ec7 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 12
+-SUBLEVEL = 0
++SUBLEVEL = 1
+ EXTRAVERSION =
+ NAME = One Giant Leap for Frogkind
+ 
+diff --git a/drivers/misc/atmel_pwm.c b/drivers/misc/atmel_pwm.c
+index 494d050..a6dc56e 100644
+--- a/drivers/misc/atmel_pwm.c
++++ b/drivers/misc/atmel_pwm.c
+@@ -90,8 +90,10 @@ int pwm_channel_alloc(int index, struct pwm_channel *ch)
+ 	unsigned long	flags;
+ 	int		status = 0;
+ 
+-	/* insist on PWM init, with this signal pinned out */
+-	if (!pwm || !(pwm->mask & 1 << index))
++	if (!pwm)
++		return -EPROBE_DEFER;
++
++	if (!(pwm->mask & 1 << index))
+ 		return -ENODEV;
+ 
+ 	if (index < 0 || index >= PWM_NCHAN || !ch)
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c
+index 9c89dc8..632b318 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c
+@@ -1599,7 +1599,8 @@ static void write_ofld_wr(struct adapter *adap, struct sk_buff *skb,
+ 	flits = skb_transport_offset(skb) / 8;
+ 	sgp = ndesc == 1 ? (struct sg_ent *)&d->flit[flits] : sgl;
+ 	sgl_flits = make_sgl(skb, sgp, skb_transport_header(skb),
+-			     skb->tail - skb->transport_header,
++			     skb_tail_pointer(skb) -
++			     skb_transport_header(skb),
+ 			     adap->pdev);
+ 	if (need_skb_unmap()) {
+ 		setup_deferred_unmapping(skb, adap->pdev, sgp, sgl_flits);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+index ea20182..bb11624 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+@@ -1691,7 +1691,7 @@ static void mlx4_master_deactivate_admin_state(struct mlx4_priv *priv, int slave
+ 			vp_oper->vlan_idx = NO_INDX;
+ 		}
+ 		if (NO_INDX != vp_oper->mac_idx) {
+-			__mlx4_unregister_mac(&priv->dev, port, vp_oper->mac_idx);
++			__mlx4_unregister_mac(&priv->dev, port, vp_oper->state.mac);
+ 			vp_oper->mac_idx = NO_INDX;
+ 		}
+ 	}
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 9fbdfcd..bbc9cb8 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1118,11 +1118,6 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
+ {
+ 	struct virtnet_info *vi = container_of(nfb, struct virtnet_info, nb);
+ 
+-	mutex_lock(&vi->config_lock);
+-
+-	if (!vi->config_enable)
+-		goto done;
+-
+ 	switch(action & ~CPU_TASKS_FROZEN) {
+ 	case CPU_ONLINE:
+ 	case CPU_DOWN_FAILED:
+@@ -1136,8 +1131,6 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
+ 		break;
+ 	}
+ 
+-done:
+-	mutex_unlock(&vi->config_lock);
+ 	return NOTIFY_OK;
+ }
+ 
+@@ -1699,6 +1692,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
+ 	struct virtnet_info *vi = vdev->priv;
+ 	int i;
+ 
++	unregister_hotcpu_notifier(&vi->nb);
++
+ 	/* Prevent config work handler from accessing the device */
+ 	mutex_lock(&vi->config_lock);
+ 	vi->config_enable = false;
+@@ -1747,6 +1742,10 @@ static int virtnet_restore(struct virtio_device *vdev)
+ 	virtnet_set_queues(vi, vi->curr_queue_pairs);
+ 	rtnl_unlock();
+ 
++	err = register_hotcpu_notifier(&vi->nb);
++	if (err)
++		return err;
++
+ 	return 0;
+ }
+ #endif
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 5715318..400fea1 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -163,6 +163,7 @@ struct xenvif {
+ 	unsigned long   credit_usec;
+ 	unsigned long   remaining_credit;
+ 	struct timer_list credit_timeout;
++	u64 credit_window_start;
+ 
+ 	/* Statistics */
+ 	unsigned long rx_gso_checksum_fixup;
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index 01bb854..459935a 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -312,8 +312,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
+ 	vif->credit_bytes = vif->remaining_credit = ~0UL;
+ 	vif->credit_usec  = 0UL;
+ 	init_timer(&vif->credit_timeout);
+-	/* Initialize 'expires' now: it's used to track the credit window. */
+-	vif->credit_timeout.expires = jiffies;
++	vif->credit_window_start = get_jiffies_64();
+ 
+ 	dev->netdev_ops	= &xenvif_netdev_ops;
+ 	dev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index f3e591c..900da4b 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -1185,9 +1185,8 @@ out:
+ 
+ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
+ {
+-	unsigned long now = jiffies;
+-	unsigned long next_credit =
+-		vif->credit_timeout.expires +
++	u64 now = get_jiffies_64();
++	u64 next_credit = vif->credit_window_start +
+ 		msecs_to_jiffies(vif->credit_usec / 1000);
+ 
+ 	/* Timer could already be pending in rare cases. */
+@@ -1195,8 +1194,8 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
+ 		return true;
+ 
+ 	/* Passed the point where we can replenish credit? */
+-	if (time_after_eq(now, next_credit)) {
+-		vif->credit_timeout.expires = now;
++	if (time_after_eq64(now, next_credit)) {
++		vif->credit_window_start = now;
+ 		tx_add_credit(vif);
+ 	}
+ 
+@@ -1208,6 +1207,7 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
+ 			tx_credit_callback;
+ 		mod_timer(&vif->credit_timeout,
+ 			  next_credit);
++		vif->credit_window_start = next_credit;
+ 
+ 		return true;
+ 	}
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index d6a8d23..f20a044 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1033,6 +1033,7 @@ static int register_root_hub(struct usb_hcd *hcd)
+ 					dev_name(&usb_dev->dev), retval);
+ 			return retval;
+ 		}
++		usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
+ 	}
+ 
+ 	retval = usb_new_device (usb_dev);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index e6b682c..879651c 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -135,7 +135,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
+ 	return usb_get_intfdata(hdev->actconfig->interface[0]);
+ }
+ 
+-static int usb_device_supports_lpm(struct usb_device *udev)
++int usb_device_supports_lpm(struct usb_device *udev)
+ {
+ 	/* USB 2.1 (and greater) devices indicate LPM support through
+ 	 * their USB 2.0 Extended Capabilities BOS descriptor.
+@@ -156,6 +156,11 @@ static int usb_device_supports_lpm(struct usb_device *udev)
+ 				"Power management will be impacted.\n");
+ 		return 0;
+ 	}
++
++	/* udev is root hub */
++	if (!udev->parent)
++		return 1;
++
+ 	if (udev->parent->lpm_capable)
+ 		return 1;
+ 
+diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
+index 8238577..c493836 100644
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -35,6 +35,7 @@ extern int usb_get_device_descriptor(struct usb_device *dev,
+ 		unsigned int size);
+ extern int usb_get_bos_descriptor(struct usb_device *dev);
+ extern void usb_release_bos_descriptor(struct usb_device *dev);
++extern int usb_device_supports_lpm(struct usb_device *udev);
+ extern char *usb_cache_string(struct usb_device *udev, int index);
+ extern int usb_set_configuration(struct usb_device *dev, int configuration);
+ extern int usb_choose_configuration(struct usb_device *udev);
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index acaee06..c3d9485 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1376,6 +1376,23 @@ static const struct usb_device_id option_ids[] = {
+ 		.driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff),  /* ZTE MF91 */
+ 		.driver_info = (kernel_ulong_t)&net_intf2_blacklist },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1545, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1546, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1547, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1565, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1566, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1567, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1589, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1590, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1591, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1592, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1594, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1596, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1598, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1600, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
+ 	  0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
+index 0393d82..f7447f7 100644
+--- a/drivers/video/backlight/atmel-pwm-bl.c
++++ b/drivers/video/backlight/atmel-pwm-bl.c
+@@ -118,7 +118,7 @@ static const struct backlight_ops atmel_pwm_bl_ops = {
+ 	.update_status  = atmel_pwm_bl_set_intensity,
+ };
+ 
+-static int __init atmel_pwm_bl_probe(struct platform_device *pdev)
++static int atmel_pwm_bl_probe(struct platform_device *pdev)
+ {
+ 	struct backlight_properties props;
+ 	const struct atmel_pwm_bl_platform_data *pdata;
+@@ -202,7 +202,7 @@ err_free_mem:
+ 	return retval;
+ }
+ 
+-static int __exit atmel_pwm_bl_remove(struct platform_device *pdev)
++static int atmel_pwm_bl_remove(struct platform_device *pdev)
+ {
+ 	struct atmel_pwm_bl *pwmbl = platform_get_drvdata(pdev);
+ 
+@@ -220,10 +220,11 @@ static struct platform_driver atmel_pwm_bl_driver = {
+ 		.name = "atmel-pwm-bl",
+ 	},
+ 	/* REVISIT add suspend() and resume() */
+-	.remove = __exit_p(atmel_pwm_bl_remove),
++	.probe = atmel_pwm_bl_probe,
++	.remove = atmel_pwm_bl_remove,
+ };
+ 
+-module_platform_driver_probe(atmel_pwm_bl_driver, atmel_pwm_bl_probe);
++module_platform_driver(atmel_pwm_bl_driver);
+ 
+ MODULE_AUTHOR("Hans-Christian egtvedt <hans-christian.egtvedt@×××××.com>");
+ MODULE_DESCRIPTION("Atmel PWM backlight driver");
+diff --git a/drivers/video/hyperv_fb.c b/drivers/video/hyperv_fb.c
+index 8ac99b8..8d456dc 100644
+--- a/drivers/video/hyperv_fb.c
++++ b/drivers/video/hyperv_fb.c
+@@ -795,12 +795,21 @@ static int hvfb_remove(struct hv_device *hdev)
+ }
+ 
+ 
++static DEFINE_PCI_DEVICE_TABLE(pci_stub_id_table) = {
++	{
++		.vendor      = PCI_VENDOR_ID_MICROSOFT,
++		.device      = PCI_DEVICE_ID_HYPERV_VIDEO,
++	},
++	{ /* end of list */ }
++};
++
+ static const struct hv_vmbus_device_id id_table[] = {
+ 	/* Synthetic Video Device GUID */
+ 	{HV_SYNTHVID_GUID},
+ 	{}
+ };
+ 
++MODULE_DEVICE_TABLE(pci, pci_stub_id_table);
+ MODULE_DEVICE_TABLE(vmbus, id_table);
+ 
+ static struct hv_driver hvfb_drv = {
+@@ -810,14 +819,43 @@ static struct hv_driver hvfb_drv = {
+ 	.remove = hvfb_remove,
+ };
+ 
++static int hvfb_pci_stub_probe(struct pci_dev *pdev,
++			       const struct pci_device_id *ent)
++{
++	return 0;
++}
++
++static void hvfb_pci_stub_remove(struct pci_dev *pdev)
++{
++}
++
++static struct pci_driver hvfb_pci_stub_driver = {
++	.name =		KBUILD_MODNAME,
++	.id_table =	pci_stub_id_table,
++	.probe =	hvfb_pci_stub_probe,
++	.remove =	hvfb_pci_stub_remove,
++};
+ 
+ static int __init hvfb_drv_init(void)
+ {
+-	return vmbus_driver_register(&hvfb_drv);
++	int ret;
++
++	ret = vmbus_driver_register(&hvfb_drv);
++	if (ret != 0)
++		return ret;
++
++	ret = pci_register_driver(&hvfb_pci_stub_driver);
++	if (ret != 0) {
++		vmbus_driver_unregister(&hvfb_drv);
++		return ret;
++	}
++
++	return 0;
+ }
+ 
+ static void __exit hvfb_drv_exit(void)
+ {
++	pci_unregister_driver(&hvfb_pci_stub_driver);
+ 	vmbus_driver_unregister(&hvfb_drv);
+ }
+ 
+diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
+index 48ec25a..5e661a9 100644
+--- a/include/net/ip6_fib.h
++++ b/include/net/ip6_fib.h
+@@ -165,6 +165,7 @@ static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
+ static inline void rt6_clean_expires(struct rt6_info *rt)
+ {
+ 	rt->rt6i_flags &= ~RTF_EXPIRES;
++	rt->dst.expires = 0;
+ }
+ 
+ static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires)
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 7974ba2..b778e96 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -843,9 +843,12 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf,
+ 	if (isspace(ch)) {
+ 		parser->buffer[parser->idx] = 0;
+ 		parser->cont = false;
+-	} else {
++	} else if (parser->idx < parser->size - 1) {
+ 		parser->cont = true;
+ 		parser->buffer[parser->idx++] = ch;
++	} else {
++		ret = -EINVAL;
++		goto out;
+ 	}
+ 
+ 	*ppos += read;
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index 8d7d0dd..143b6fd 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -40,7 +40,7 @@ again:
+ 		struct iphdr _iph;
+ ip:
+ 		iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
+-		if (!iph)
++		if (!iph || iph->ihl < 5)
+ 			return false;
+ 
+ 		if (ip_is_fragment(iph))
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index a16b01b..068c8fb 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2856,7 +2856,8 @@ static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
+ 	 * left edge of the send window.
+ 	 * See draft-ietf-tcplw-high-performance-00, section 3.3.
+ 	 */
+-	if (seq_rtt < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
++	if (seq_rtt < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
++	    flag & FLAG_ACKED)
+ 		seq_rtt = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
+ 
+ 	if (seq_rtt < 0)
+@@ -2871,14 +2872,19 @@ static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
+ }
+ 
+ /* Compute time elapsed between (last) SYNACK and the ACK completing 3WHS. */
+-static void tcp_synack_rtt_meas(struct sock *sk, struct request_sock *req)
++static void tcp_synack_rtt_meas(struct sock *sk, const u32 synack_stamp)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	s32 seq_rtt = -1;
+ 
+-	if (tp->lsndtime && !tp->total_retrans)
+-		seq_rtt = tcp_time_stamp - tp->lsndtime;
+-	tcp_ack_update_rtt(sk, FLAG_SYN_ACKED, seq_rtt, -1);
++	if (synack_stamp && !tp->total_retrans)
++		seq_rtt = tcp_time_stamp - synack_stamp;
++
++	/* If the ACK acks both the SYNACK and the (Fast Open'd) data packets
++	 * sent in SYN_RECV, SYNACK RTT is the smooth RTT computed in tcp_ack()
++	 */
++	if (!tp->srtt)
++		tcp_ack_update_rtt(sk, FLAG_SYN_ACKED, seq_rtt, -1);
+ }
+ 
+ static void tcp_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
+@@ -2981,6 +2987,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
+ 	s32 seq_rtt = -1;
+ 	s32 ca_seq_rtt = -1;
+ 	ktime_t last_ackt = net_invalid_timestamp();
++	bool rtt_update;
+ 
+ 	while ((skb = tcp_write_queue_head(sk)) && skb != tcp_send_head(sk)) {
+ 		struct tcp_skb_cb *scb = TCP_SKB_CB(skb);
+@@ -3057,14 +3064,13 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
+ 	if (skb && (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
+ 		flag |= FLAG_SACK_RENEGING;
+ 
+-	if (tcp_ack_update_rtt(sk, flag, seq_rtt, sack_rtt) ||
+-	    (flag & FLAG_ACKED))
+-		tcp_rearm_rto(sk);
++	rtt_update = tcp_ack_update_rtt(sk, flag, seq_rtt, sack_rtt);
+ 
+ 	if (flag & FLAG_ACKED) {
+ 		const struct tcp_congestion_ops *ca_ops
+ 			= inet_csk(sk)->icsk_ca_ops;
+ 
++		tcp_rearm_rto(sk);
+ 		if (unlikely(icsk->icsk_mtup.probe_size &&
+ 			     !after(tp->mtu_probe.probe_seq_end, tp->snd_una))) {
+ 			tcp_mtup_probe_success(sk);
+@@ -3103,6 +3109,13 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
+ 
+ 			ca_ops->pkts_acked(sk, pkts_acked, rtt_us);
+ 		}
++	} else if (skb && rtt_update && sack_rtt >= 0 &&
++		   sack_rtt > (s32)(now - TCP_SKB_CB(skb)->when)) {
++		/* Do not re-arm RTO if the sack RTT is measured from data sent
++		 * after when the head was last (re)transmitted. Otherwise the
++		 * timeout may continue to extend in loss recovery.
++		 */
++		tcp_rearm_rto(sk);
+ 	}
+ 
+ #if FASTRETRANS_DEBUG > 0
+@@ -5587,6 +5600,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ 	struct request_sock *req;
+ 	int queued = 0;
+ 	bool acceptable;
++	u32 synack_stamp;
+ 
+ 	tp->rx_opt.saw_tstamp = 0;
+ 
+@@ -5669,9 +5683,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ 		 * so release it.
+ 		 */
+ 		if (req) {
++			synack_stamp = tcp_rsk(req)->snt_synack;
+ 			tp->total_retrans = req->num_retrans;
+ 			reqsk_fastopen_remove(sk, req, false);
+ 		} else {
++			synack_stamp = tp->lsndtime;
+ 			/* Make sure socket is routed, for correct metrics. */
+ 			icsk->icsk_af_ops->rebuild_header(sk);
+ 			tcp_init_congestion_control(sk);
+@@ -5694,7 +5710,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ 		tp->snd_una = TCP_SKB_CB(skb)->ack_seq;
+ 		tp->snd_wnd = ntohs(th->window) << tp->rx_opt.snd_wscale;
+ 		tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
+-		tcp_synack_rtt_meas(sk, req);
++		tcp_synack_rtt_meas(sk, synack_stamp);
+ 
+ 		if (tp->rx_opt.tstamp_ok)
+ 			tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
+diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
+index 3a7525e..533c58a 100644
+--- a/net/ipv4/tcp_offload.c
++++ b/net/ipv4/tcp_offload.c
+@@ -18,6 +18,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
+ 				netdev_features_t features)
+ {
+ 	struct sk_buff *segs = ERR_PTR(-EINVAL);
++	unsigned int sum_truesize = 0;
+ 	struct tcphdr *th;
+ 	unsigned int thlen;
+ 	unsigned int seq;
+@@ -102,13 +103,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
+ 		if (copy_destructor) {
+ 			skb->destructor = gso_skb->destructor;
+ 			skb->sk = gso_skb->sk;
+-			/* {tcp|sock}_wfree() use exact truesize accounting :
+-			 * sum(skb->truesize) MUST be exactly be gso_skb->truesize
+-			 * So we account mss bytes of 'true size' for each segment.
+-			 * The last segment will contain the remaining.
+-			 */
+-			skb->truesize = mss;
+-			gso_skb->truesize -= mss;
++			sum_truesize += skb->truesize;
+ 		}
+ 		skb = skb->next;
+ 		th = tcp_hdr(skb);
+@@ -125,7 +120,9 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
+ 	if (copy_destructor) {
+ 		swap(gso_skb->sk, skb->sk);
+ 		swap(gso_skb->destructor, skb->destructor);
+-		swap(gso_skb->truesize, skb->truesize);
++		sum_truesize += skb->truesize;
++		atomic_add(sum_truesize - gso_skb->truesize,
++			   &skb->sk->sk_wmem_alloc);
+ 	}
+ 
+ 	delta = htonl(oldlen + (skb_tail_pointer(skb) -
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index f54e3a1..04e17b3 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1087,10 +1087,13 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
+ 	if (rt->rt6i_genid != rt_genid_ipv6(dev_net(rt->dst.dev)))
+ 		return NULL;
+ 
+-	if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+-		return dst;
++	if (!rt->rt6i_node || (rt->rt6i_node->fn_sernum != cookie))
++		return NULL;
+ 
+-	return NULL;
++	if (rt6_check_expired(rt))
++		return NULL;
++
++	return dst;
+ }
+ 
+ static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 666c668..1a6eef3 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -860,7 +860,6 @@ static void sctp_cmd_delete_tcb(sctp_cmd_seq_t *cmds,
+ 	    (!asoc->temp) && (sk->sk_shutdown != SHUTDOWN_MASK))
+ 		return;
+ 
+-	BUG_ON(asoc->peer.primary_path == NULL);
+ 	sctp_unhash_established(asoc);
+ 	sctp_association_free(asoc);
+ }
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 50173d4..8d2d01b 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -740,9 +740,10 @@ static int hdmi_manual_setup_channel_mapping(struct hda_codec *codec,
+ static void hdmi_setup_fake_chmap(unsigned char *map, int ca)
+ {
+ 	int i;
++	int ordered_ca = get_channel_allocation_order(ca);
+ 	for (i = 0; i < 8; i++) {
+-		if (i < channel_allocations[ca].channels)
+-			map[i] = from_cea_slot((hdmi_channel_mapping[ca][i] >> 4) & 0x0f);
++		if (i < channel_allocations[ordered_ca].channels)
++			map[i] = from_cea_slot(hdmi_channel_mapping[ca][i] & 0x0f);
+ 		else
+ 			map[i] = 0;
+ 	}

Modified: genpatches-2.6/trunk/3.4/0000_README
===================================================================
--- genpatches-2.6/trunk/3.4/0000_README	2013-11-14 16:37:35 UTC (rev 2581)
+++ genpatches-2.6/trunk/3.4/0000_README	2013-11-21 00:37:00 UTC (rev 2582)
@@ -315,6 +315,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.4.69
 
+Patch:  1069_linux-3.4.70.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.4.70
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.4/1069_linux-3.4.70.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1069_linux-3.4.70.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.4/1069_linux-3.4.70.patch	2013-11-21 00:37:00 UTC (rev 2582)
@@ -0,0 +1,424 @@
+diff --git a/Makefile b/Makefile
+index 2f9a0467..d7c0a383 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 69
++SUBLEVEL = 70
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/lib/memset.S b/arch/arm/lib/memset.S
+index 650d5923..94b0650e 100644
+--- a/arch/arm/lib/memset.S
++++ b/arch/arm/lib/memset.S
+@@ -14,27 +14,15 @@
+ 
+ 	.text
+ 	.align	5
+-	.word	0
+-
+-1:	subs	r2, r2, #4		@ 1 do we have enough
+-	blt	5f			@ 1 bytes to align with?
+-	cmp	r3, #2			@ 1
+-	strltb	r1, [r0], #1		@ 1
+-	strleb	r1, [r0], #1		@ 1
+-	strb	r1, [r0], #1		@ 1
+-	add	r2, r2, r3		@ 1 (r2 = r2 - (4 - r3))
+-/*
+- * The pointer is now aligned and the length is adjusted.  Try doing the
+- * memset again.
+- */
+ 
+ ENTRY(memset)
+ 	ands	r3, r0, #3		@ 1 unaligned?
+-	bne	1b			@ 1
++	mov	ip, r0			@ preserve r0 as return value
++	bne	6f			@ 1
+ /*
+- * we know that the pointer in r0 is aligned to a word boundary.
++ * we know that the pointer in ip is aligned to a word boundary.
+  */
+-	orr	r1, r1, r1, lsl #8
++1:	orr	r1, r1, r1, lsl #8
+ 	orr	r1, r1, r1, lsl #16
+ 	mov	r3, r1
+ 	cmp	r2, #16
+@@ -43,29 +31,28 @@ ENTRY(memset)
+ #if ! CALGN(1)+0
+ 
+ /*
+- * We need an extra register for this loop - save the return address and
+- * use the LR
++ * We need 2 extra registers for this loop - use r8 and the LR
+  */
+-	str	lr, [sp, #-4]!
+-	mov	ip, r1
++	stmfd	sp!, {r8, lr}
++	mov	r8, r1
+ 	mov	lr, r1
+ 
+ 2:	subs	r2, r2, #64
+-	stmgeia	r0!, {r1, r3, ip, lr}	@ 64 bytes at a time.
+-	stmgeia	r0!, {r1, r3, ip, lr}
+-	stmgeia	r0!, {r1, r3, ip, lr}
+-	stmgeia	r0!, {r1, r3, ip, lr}
++	stmgeia	ip!, {r1, r3, r8, lr}	@ 64 bytes at a time.
++	stmgeia	ip!, {r1, r3, r8, lr}
++	stmgeia	ip!, {r1, r3, r8, lr}
++	stmgeia	ip!, {r1, r3, r8, lr}
+ 	bgt	2b
+-	ldmeqfd	sp!, {pc}		@ Now <64 bytes to go.
++	ldmeqfd	sp!, {r8, pc}		@ Now <64 bytes to go.
+ /*
+  * No need to correct the count; we're only testing bits from now on
+  */
+ 	tst	r2, #32
+-	stmneia	r0!, {r1, r3, ip, lr}
+-	stmneia	r0!, {r1, r3, ip, lr}
++	stmneia	ip!, {r1, r3, r8, lr}
++	stmneia	ip!, {r1, r3, r8, lr}
+ 	tst	r2, #16
+-	stmneia	r0!, {r1, r3, ip, lr}
+-	ldr	lr, [sp], #4
++	stmneia	ip!, {r1, r3, r8, lr}
++	ldmfd	sp!, {r8, lr}
+ 
+ #else
+ 
+@@ -74,54 +61,63 @@ ENTRY(memset)
+  * whole cache lines at once.
+  */
+ 
+-	stmfd	sp!, {r4-r7, lr}
++	stmfd	sp!, {r4-r8, lr}
+ 	mov	r4, r1
+ 	mov	r5, r1
+ 	mov	r6, r1
+ 	mov	r7, r1
+-	mov	ip, r1
++	mov	r8, r1
+ 	mov	lr, r1
+ 
+ 	cmp	r2, #96
+-	tstgt	r0, #31
++	tstgt	ip, #31
+ 	ble	3f
+ 
+-	and	ip, r0, #31
+-	rsb	ip, ip, #32
+-	sub	r2, r2, ip
+-	movs	ip, ip, lsl #(32 - 4)
+-	stmcsia	r0!, {r4, r5, r6, r7}
+-	stmmiia	r0!, {r4, r5}
+-	tst	ip, #(1 << 30)
+-	mov	ip, r1
+-	strne	r1, [r0], #4
++	and	r8, ip, #31
++	rsb	r8, r8, #32
++	sub	r2, r2, r8
++	movs	r8, r8, lsl #(32 - 4)
++	stmcsia	ip!, {r4, r5, r6, r7}
++	stmmiia	ip!, {r4, r5}
++	tst	r8, #(1 << 30)
++	mov	r8, r1
++	strne	r1, [ip], #4
+ 
+ 3:	subs	r2, r2, #64
+-	stmgeia	r0!, {r1, r3-r7, ip, lr}
+-	stmgeia	r0!, {r1, r3-r7, ip, lr}
++	stmgeia	ip!, {r1, r3-r8, lr}
++	stmgeia	ip!, {r1, r3-r8, lr}
+ 	bgt	3b
+-	ldmeqfd	sp!, {r4-r7, pc}
++	ldmeqfd	sp!, {r4-r8, pc}
+ 
+ 	tst	r2, #32
+-	stmneia	r0!, {r1, r3-r7, ip, lr}
++	stmneia	ip!, {r1, r3-r8, lr}
+ 	tst	r2, #16
+-	stmneia	r0!, {r4-r7}
+-	ldmfd	sp!, {r4-r7, lr}
++	stmneia	ip!, {r4-r7}
++	ldmfd	sp!, {r4-r8, lr}
+ 
+ #endif
+ 
+ 4:	tst	r2, #8
+-	stmneia	r0!, {r1, r3}
++	stmneia	ip!, {r1, r3}
+ 	tst	r2, #4
+-	strne	r1, [r0], #4
++	strne	r1, [ip], #4
+ /*
+  * When we get here, we've got less than 4 bytes to zero.  We
+  * may have an unaligned pointer as well.
+  */
+ 5:	tst	r2, #2
+-	strneb	r1, [r0], #1
+-	strneb	r1, [r0], #1
++	strneb	r1, [ip], #1
++	strneb	r1, [ip], #1
+ 	tst	r2, #1
+-	strneb	r1, [r0], #1
++	strneb	r1, [ip], #1
+ 	mov	pc, lr
++
++6:	subs	r2, r2, #4		@ 1 do we have enough
++	blt	5b			@ 1 bytes to align with?
++	cmp	r3, #2			@ 1
++	strltb	r1, [ip], #1		@ 1
++	strleb	r1, [ip], #1		@ 1
++	strb	r1, [ip], #1		@ 1
++	add	r2, r2, r3		@ 1 (r2 = r2 - (4 - r3))
++	b	1b
+ ENDPROC(memset)
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 9d7f1723..093bf0a2 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -88,6 +88,7 @@ struct xenvif {
+ 	unsigned long   credit_usec;
+ 	unsigned long   remaining_credit;
+ 	struct timer_list credit_timeout;
++	u64 credit_window_start;
+ 
+ 	/* Statistics */
+ 	unsigned long rx_gso_checksum_fixup;
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index 221f4265..cfaaf685 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -273,8 +273,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
+ 	vif->credit_bytes = vif->remaining_credit = ~0UL;
+ 	vif->credit_usec  = 0UL;
+ 	init_timer(&vif->credit_timeout);
+-	/* Initialize 'expires' now: it's used to track the credit window. */
+-	vif->credit_timeout.expires = jiffies;
++	vif->credit_window_start = get_jiffies_64();
+ 
+ 	dev->netdev_ops	= &xenvif_netdev_ops;
+ 	dev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index 0d22cff0..d8ffbf84 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -1197,9 +1197,8 @@ out:
+ 
+ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
+ {
+-	unsigned long now = jiffies;
+-	unsigned long next_credit =
+-		vif->credit_timeout.expires +
++	u64 now = get_jiffies_64();
++	u64 next_credit = vif->credit_window_start +
+ 		msecs_to_jiffies(vif->credit_usec / 1000);
+ 
+ 	/* Timer could already be pending in rare cases. */
+@@ -1207,8 +1206,8 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
+ 		return true;
+ 
+ 	/* Passed the point where we can replenish credit? */
+-	if (time_after_eq(now, next_credit)) {
+-		vif->credit_timeout.expires = now;
++	if (time_after_eq64(now, next_credit)) {
++		vif->credit_window_start = now;
+ 		tx_add_credit(vif);
+ 	}
+ 
+@@ -1220,6 +1219,7 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
+ 			tx_credit_callback;
+ 		mod_timer(&vif->credit_timeout,
+ 			  next_credit);
++		vif->credit_window_start = next_credit;
+ 
+ 		return true;
+ 	}
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 54fc9880..21b9ed1d 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -680,6 +680,7 @@ static int pci_pm_suspend(struct device *dev)
+ 		goto Fixup;
+ 	}
+ 
++	pci_dev->state_saved = false;
+ 	if (pm->suspend) {
+ 		pci_power_t prev = pci_dev->current_state;
+ 		int error;
+@@ -826,6 +827,7 @@ static int pci_pm_freeze(struct device *dev)
+ 		return 0;
+ 	}
+ 
++	pci_dev->state_saved = false;
+ 	if (pm->freeze) {
+ 		int error;
+ 
+@@ -914,6 +916,7 @@ static int pci_pm_poweroff(struct device *dev)
+ 		goto Fixup;
+ 	}
+ 
++	pci_dev->state_saved = false;
+ 	if (pm->poweroff) {
+ 		int error;
+ 
+@@ -1032,6 +1035,7 @@ static int pci_pm_runtime_suspend(struct device *dev)
+ 	if (!pm || !pm->runtime_suspend)
+ 		return -ENOSYS;
+ 
++	pci_dev->state_saved = false;
+ 	error = pm->runtime_suspend(dev);
+ 	suspend_report_result(pm->runtime_suspend, error);
+ 	if (error)
+diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
+index eea85daf..be76ebac 100644
+--- a/drivers/pci/setup-res.c
++++ b/drivers/pci/setup-res.c
+@@ -206,7 +206,8 @@ static int pci_revert_fw_address(struct resource *res, struct pci_dev *dev,
+ 	return ret;
+ }
+ 
+-static int _pci_assign_resource(struct pci_dev *dev, int resno, int size, resource_size_t min_align)
++static int _pci_assign_resource(struct pci_dev *dev, int resno,
++				resource_size_t size, resource_size_t min_align)
+ {
+ 	struct resource *res = dev->resource + resno;
+ 	struct pci_bus *bus;
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index aa54fad7..82fce32c 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1335,6 +1335,7 @@ static int hub_configure(struct usb_hub *hub,
+ 	return 0;
+ 
+ fail:
++	hdev->maxchild = 0;
+ 	dev_err (hub_dev, "config failed, %s (err %d)\n",
+ 			message, ret);
+ 	/* hub_disconnect() frees urb and descriptor */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 57277bcc..a5477554 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1391,6 +1391,23 @@ static const struct usb_device_id option_ids[] = {
+ 		.driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff),  /* ZTE MF91 */
+ 		.driver_info = (kernel_ulong_t)&net_intf2_blacklist },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1545, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1546, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1547, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1565, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1566, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1567, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1589, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1590, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1591, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1592, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1594, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1596, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1598, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1600, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
+ 	  0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 5dd96266..022940f0 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -590,9 +590,12 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf,
+ 	if (isspace(ch)) {
+ 		parser->buffer[parser->idx] = 0;
+ 		parser->cont = false;
+-	} else {
++	} else if (parser->idx < parser->size - 1) {
+ 		parser->cont = true;
+ 		parser->buffer[parser->idx++] = ch;
++	} else {
++		ret = -EINVAL;
++		goto out;
+ 	}
+ 
+ 	*ppos += read;
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index 27747881..200707c6 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -35,7 +35,7 @@ again:
+ 		struct iphdr _iph;
+ ip:
+ 		iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
+-		if (!iph)
++		if (!iph || iph->ihl < 5)
+ 			return false;
+ 
+ 		if (ip_is_fragment(iph))
+diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
+index 93faf6a3..4a8c55bd 100644
+--- a/net/netfilter/nf_conntrack_sip.c
++++ b/net/netfilter/nf_conntrack_sip.c
+@@ -1468,7 +1468,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
+ 
+ 		msglen = origlen = end - dptr;
+ 		if (msglen > datalen)
+-			return NF_DROP;
++			return NF_ACCEPT;
+ 
+ 		ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen);
+ 		if (ret != NF_ACCEPT)
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 02a6e3f4..ef917bf2 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1282,23 +1282,34 @@ static int generic_hdmi_build_controls(struct hda_codec *codec)
+ 	return 0;
+ }
+ 
+-static int generic_hdmi_init(struct hda_codec *codec)
++static int generic_hdmi_init_per_pins(struct hda_codec *codec)
+ {
+ 	struct hdmi_spec *spec = codec->spec;
+ 	int pin_idx;
+ 
+ 	for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
+ 		struct hdmi_spec_per_pin *per_pin = &spec->pins[pin_idx];
+-		hda_nid_t pin_nid = per_pin->pin_nid;
+ 		struct hdmi_eld *eld = &per_pin->sink_eld;
+ 
+-		hdmi_init_pin(codec, pin_nid);
+-		snd_hda_jack_detect_enable(codec, pin_nid, pin_nid);
+-
+ 		per_pin->codec = codec;
+ 		INIT_DELAYED_WORK(&per_pin->work, hdmi_repoll_eld);
+ 		snd_hda_eld_proc_new(codec, eld, pin_idx);
+ 	}
++	return 0;
++}
++
++static int generic_hdmi_init(struct hda_codec *codec)
++{
++	struct hdmi_spec *spec = codec->spec;
++	int pin_idx;
++
++	for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
++		struct hdmi_spec_per_pin *per_pin = &spec->pins[pin_idx];
++		hda_nid_t pin_nid = per_pin->pin_nid;
++
++		hdmi_init_pin(codec, pin_nid);
++		snd_hda_jack_detect_enable(codec, pin_nid, pin_nid);
++	}
+ 	snd_hda_jack_report_sync(codec);
+ 	return 0;
+ }
+@@ -1343,6 +1354,7 @@ static int patch_generic_hdmi(struct hda_codec *codec)
+ 		return -EINVAL;
+ 	}
+ 	codec->patch_ops = generic_hdmi_patch_ops;
++	generic_hdmi_init_per_pins(codec);
+ 
+ 	init_channel_allocations();
+