diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/arc/include/uapi/asm/ptrace.h linux-libre-3.12.26-gnu/arch/arc/include/uapi/asm/ptrace.h
--- linux-libre-3.12.25-gnu/arch/arc/include/uapi/asm/ptrace.h	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/arc/include/uapi/asm/ptrace.h	2014-07-30 12:02:44.000000000 -0400
@@ -11,6 +11,7 @@
 #ifndef _UAPI__ASM_ARC_PTRACE_H
 #define _UAPI__ASM_ARC_PTRACE_H
 
+#define PTRACE_GET_THREAD_AREA	25
 
 #ifndef __ASSEMBLY__
 /*
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/arc/kernel/ptrace.c linux-libre-3.12.26-gnu/arch/arc/kernel/ptrace.c
--- linux-libre-3.12.25-gnu/arch/arc/kernel/ptrace.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/arc/kernel/ptrace.c	2014-07-30 12:02:44.000000000 -0400
@@ -146,6 +146,10 @@ long arch_ptrace(struct task_struct *chi
 	pr_debug("REQ=%ld: ADDR =0x%lx, DATA=0x%lx)\n", request, addr, data);
 
 	switch (request) {
+	case PTRACE_GET_THREAD_AREA:
+		ret = put_user(task_thread_info(child)->thr_ptr,
+			       (unsigned long __user *)data);
+		break;
 	default:
 		ret = ptrace_request(child, request, addr, data);
 		break;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/arm/boot/dts/imx25.dtsi linux-libre-3.12.26-gnu/arch/arm/boot/dts/imx25.dtsi
--- linux-libre-3.12.25-gnu/arch/arm/boot/dts/imx25.dtsi	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/arm/boot/dts/imx25.dtsi	2014-07-30 12:02:44.000000000 -0400
@@ -30,6 +30,7 @@
 		spi2 = &spi3;
 		usb0 = &usbotg;
 		usb1 = &usbhost1;
+		ethernet0 = &fec;
 	};
 
 	cpus {
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/arm/boot/dts/imx27.dtsi linux-libre-3.12.26-gnu/arch/arm/boot/dts/imx27.dtsi
--- linux-libre-3.12.25-gnu/arch/arm/boot/dts/imx27.dtsi	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/arm/boot/dts/imx27.dtsi	2014-07-30 12:02:44.000000000 -0400
@@ -30,6 +30,7 @@
 		spi0 = &cspi1;
 		spi1 = &cspi2;
 		spi2 = &cspi3;
+		ethernet0 = &fec;
 	};
 
 	aitc: aitc-interrupt-controller@e0000000 {
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/arm/boot/dts/imx51.dtsi linux-libre-3.12.26-gnu/arch/arm/boot/dts/imx51.dtsi
--- linux-libre-3.12.25-gnu/arch/arm/boot/dts/imx51.dtsi	2014-07-23 02:32:09.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/arm/boot/dts/imx51.dtsi	2014-08-01 13:31:46.000000000 -0400
@@ -27,6 +27,7 @@
 		spi0 = &ecspi1;
 		spi1 = &ecspi2;
 		spi2 = &cspi;
+		ethernet0 = &fec;
 	};
 
 	tzic: tz-interrupt-controller@e0000000 {
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/arm/boot/dts/imx53.dtsi linux-libre-3.12.26-gnu/arch/arm/boot/dts/imx53.dtsi
--- linux-libre-3.12.25-gnu/arch/arm/boot/dts/imx53.dtsi	2014-07-23 02:32:12.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/arm/boot/dts/imx53.dtsi	2014-08-01 13:31:48.000000000 -0400
@@ -33,6 +33,7 @@
 		spi0 = &ecspi1;
 		spi1 = &ecspi2;
 		spi2 = &cspi;
+		ethernet0 = &fec;
 	};
 
 	cpus {
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/arm/Kconfig linux-libre-3.12.26-gnu/arch/arm/Kconfig
--- linux-libre-3.12.25-gnu/arch/arm/Kconfig	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/arm/Kconfig	2014-07-30 12:02:44.000000000 -0400
@@ -5,6 +5,7 @@ config ARM
 	select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
 	select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
 	select ARCH_HAVE_CUSTOM_GPIO_H
+	select ARCH_SUPPORTS_ATOMIC_RMW
 	select ARCH_WANT_IPC_PARSE_VERSION
 	select BUILDTIME_EXTABLE_SORT if MMU
 	select CLONE_BACKWARDS
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/arm64/Kconfig linux-libre-3.12.26-gnu/arch/arm64/Kconfig
--- linux-libre-3.12.25-gnu/arch/arm64/Kconfig	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/arm64/Kconfig	2014-07-30 12:02:44.000000000 -0400
@@ -1,6 +1,7 @@
 config ARM64
 	def_bool y
 	select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+	select ARCH_SUPPORTS_ATOMIC_RMW
 	select ARCH_WANT_OPTIONAL_GPIOLIB
 	select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
 	select ARCH_WANT_FRAME_POINTERS
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/parisc/include/uapi/asm/signal.h linux-libre-3.12.26-gnu/arch/parisc/include/uapi/asm/signal.h
--- linux-libre-3.12.25-gnu/arch/parisc/include/uapi/asm/signal.h	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/parisc/include/uapi/asm/signal.h	2014-07-30 12:02:44.000000000 -0400
@@ -69,8 +69,6 @@
 #define SA_NOMASK	SA_NODEFER
 #define SA_ONESHOT	SA_RESETHAND
 
-#define SA_RESTORER	0x04000000 /* obsolete -- ignored */
-
 #define MINSIGSTKSZ	2048
 #define SIGSTKSZ	8192
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/powerpc/Kconfig linux-libre-3.12.26-gnu/arch/powerpc/Kconfig
--- linux-libre-3.12.25-gnu/arch/powerpc/Kconfig	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/powerpc/Kconfig	2014-07-30 12:02:44.000000000 -0400
@@ -138,6 +138,7 @@ config PPC
 	select OLD_SIGSUSPEND
 	select OLD_SIGACTION if PPC32
 	select HAVE_DEBUG_STACKOVERFLOW
+	select ARCH_SUPPORTS_ATOMIC_RMW
 
 config EARLY_PRINTK
 	bool
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/sparc/Kconfig linux-libre-3.12.26-gnu/arch/sparc/Kconfig
--- linux-libre-3.12.25-gnu/arch/sparc/Kconfig	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/sparc/Kconfig	2014-07-30 12:02:44.000000000 -0400
@@ -75,6 +75,7 @@ config SPARC64
 	select ARCH_HAVE_NMI_SAFE_CMPXCHG
 	select HAVE_C_RECORDMCOUNT
 	select NO_BOOTMEM
+	select ARCH_SUPPORTS_ATOMIC_RMW
 
 config ARCH_DEFCONFIG
 	string
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/x86/boot/header.S linux-libre-3.12.26-gnu/arch/x86/boot/header.S
--- linux-libre-3.12.25-gnu/arch/x86/boot/header.S	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/x86/boot/header.S	2014-07-30 12:02:44.000000000 -0400
@@ -91,10 +91,9 @@ bs_die:
 
 	.section ".bsdata", "a"
 bugger_off_msg:
-	.ascii	"Direct floppy boot is not supported. "
-	.ascii	"Use a boot loader program instead.\r\n"
+	.ascii	"Use a boot loader.\r\n"
 	.ascii	"\n"
-	.ascii	"Remove disk and press any key to reboot ...\r\n"
+	.ascii	"Remove disk and press any key to reboot...\r\n"
 	.byte	0
 
 #ifdef CONFIG_EFI_STUB
@@ -108,7 +107,7 @@ coff_header:
 #else
 	.word	0x8664				# x86-64
 #endif
-	.word	3				# nr_sections
+	.word	4				# nr_sections
 	.long	0 				# TimeDateStamp
 	.long	0				# PointerToSymbolTable
 	.long	1				# NumberOfSymbols
@@ -250,6 +249,25 @@ section_table:
 	.word	0				# NumberOfLineNumbers
 	.long	0x60500020			# Characteristics (section flags)
 
+	#
+	# The offset & size fields are filled in by build.c.
+	#
+	.ascii	".bss"
+	.byte	0
+	.byte	0
+	.byte	0
+	.byte	0
+	.long	0
+	.long	0x0
+	.long	0				# Size of initialized data
+						# on disk
+	.long	0x0
+	.long	0				# PointerToRelocations
+	.long	0				# PointerToLineNumbers
+	.word	0				# NumberOfRelocations
+	.word	0				# NumberOfLineNumbers
+	.long	0xc8000080			# Characteristics (section flags)
+
 #endif /* CONFIG_EFI_STUB */
 
 	# Kernel attributes; used by setup.  This is part 1 of the
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/x86/boot/tools/build.c linux-libre-3.12.26-gnu/arch/x86/boot/tools/build.c
--- linux-libre-3.12.25-gnu/arch/x86/boot/tools/build.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/x86/boot/tools/build.c	2014-07-30 12:02:44.000000000 -0400
@@ -141,7 +141,7 @@ static void usage(void)
 
 #ifdef CONFIG_EFI_STUB
 
-static void update_pecoff_section_header(char *section_name, u32 offset, u32 size)
+static void update_pecoff_section_header_fields(char *section_name, u32 vma, u32 size, u32 datasz, u32 offset)
 {
 	unsigned int pe_header;
 	unsigned short num_sections;
@@ -162,10 +162,10 @@ static void update_pecoff_section_header
 			put_unaligned_le32(size, section + 0x8);
 
 			/* section header vma field */
-			put_unaligned_le32(offset, section + 0xc);
+			put_unaligned_le32(vma, section + 0xc);
 
 			/* section header 'size of initialised data' field */
-			put_unaligned_le32(size, section + 0x10);
+			put_unaligned_le32(datasz, section + 0x10);
 
 			/* section header 'file offset' field */
 			put_unaligned_le32(offset, section + 0x14);
@@ -177,6 +177,11 @@ static void update_pecoff_section_header
 	}
 }
 
+static void update_pecoff_section_header(char *section_name, u32 offset, u32 size)
+{
+	update_pecoff_section_header_fields(section_name, offset, size, size, offset);
+}
+
 static void update_pecoff_setup_and_reloc(unsigned int size)
 {
 	u32 setup_offset = 0x200;
@@ -201,9 +206,6 @@ static void update_pecoff_text(unsigned
 
 	pe_header = get_unaligned_le32(&buf[0x3c]);
 
-	/* Size of image */
-	put_unaligned_le32(file_sz, &buf[pe_header + 0x50]);
-
 	/*
 	 * Size of code: Subtract the size of the first sector (512 bytes)
 	 * which includes the header.
@@ -218,6 +220,22 @@ static void update_pecoff_text(unsigned
 	update_pecoff_section_header(".text", text_start, text_sz);
 }
 
+static void update_pecoff_bss(unsigned int file_sz, unsigned int init_sz)
+{
+	unsigned int pe_header;
+	unsigned int bss_sz = init_sz - file_sz;
+
+	pe_header = get_unaligned_le32(&buf[0x3c]);
+
+	/* Size of uninitialized data */
+	put_unaligned_le32(bss_sz, &buf[pe_header + 0x24]);
+
+	/* Size of image */
+	put_unaligned_le32(init_sz, &buf[pe_header + 0x50]);
+
+	update_pecoff_section_header_fields(".bss", file_sz, bss_sz, 0, 0);
+}
+
 #endif /* CONFIG_EFI_STUB */
 
 
@@ -269,6 +287,9 @@ int main(int argc, char ** argv)
 	int fd;
 	void *kernel;
 	u32 crc = 0xffffffffUL;
+#ifdef CONFIG_EFI_STUB
+	unsigned int init_sz;
+#endif
 
 	/* Defaults for old kernel */
 #ifdef CONFIG_X86_32
@@ -339,7 +360,9 @@ int main(int argc, char ** argv)
 	put_unaligned_le32(sys_size, &buf[0x1f4]);
 
 #ifdef CONFIG_EFI_STUB
-	update_pecoff_text(setup_sectors * 512, sz + i + ((sys_size * 16) - sz));
+	update_pecoff_text(setup_sectors * 512, i + (sys_size * 16));
+	init_sz = get_unaligned_le32(&buf[0x260]);
+	update_pecoff_bss(i + (sys_size * 16), init_sz);
 
 #ifdef CONFIG_X86_64 /* Yes, this is really how we defined it :( */
 	efi_stub_entry -= 0x200;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/x86/Kconfig linux-libre-3.12.26-gnu/arch/x86/Kconfig
--- linux-libre-3.12.25-gnu/arch/x86/Kconfig	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/x86/Kconfig	2014-07-30 12:02:44.000000000 -0400
@@ -123,6 +123,7 @@ config X86
 	select COMPAT_OLD_SIGACTION if IA32_EMULATION
 	select RTC_LIB
 	select HAVE_DEBUG_STACKOVERFLOW
+	select ARCH_SUPPORTS_ATOMIC_RMW
 
 config INSTRUCTION_DECODER
 	def_bool y
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/x86/kernel/cpu/perf_event_intel.c linux-libre-3.12.26-gnu/arch/x86/kernel/cpu/perf_event_intel.c
--- linux-libre-3.12.25-gnu/arch/x86/kernel/cpu/perf_event_intel.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/x86/kernel/cpu/perf_event_intel.c	2014-07-30 12:02:44.000000000 -0400
@@ -1365,6 +1365,15 @@ again:
 	intel_pmu_lbr_read();
 
 	/*
+	 * CondChgd bit 63 doesn't mean any overflow status. Ignore
+	 * and clear the bit.
+	 */
+	if (__test_and_clear_bit(63, (unsigned long *)&status)) {
+		if (!status)
+			goto done;
+	}
+
+	/*
 	 * PEBS overflow sets bit 62 in the global status register
 	 */
 	if (__test_and_clear_bit(62, (unsigned long *)&status)) {
diff -druNp --no-dereference linux-libre-3.12.25-gnu/arch/x86/kernel/entry_32.S linux-libre-3.12.26-gnu/arch/x86/kernel/entry_32.S
--- linux-libre-3.12.25-gnu/arch/x86/kernel/entry_32.S	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/arch/x86/kernel/entry_32.S	2014-07-30 12:02:44.000000000 -0400
@@ -436,8 +436,8 @@ sysenter_do_call:
 	cmpl $(NR_syscalls), %eax
 	jae sysenter_badsys
 	call *sys_call_table(,%eax,4)
-	movl %eax,PT_EAX(%esp)
 sysenter_after_call:
+	movl %eax,PT_EAX(%esp)
 	LOCKDEP_SYS_EXIT
 	DISABLE_INTERRUPTS(CLBR_ANY)
 	TRACE_IRQS_OFF
@@ -517,6 +517,7 @@ ENTRY(system_call)
 	jae syscall_badsys
 syscall_call:
 	call *sys_call_table(,%eax,4)
+syscall_after_call:
 	movl %eax,PT_EAX(%esp)		# store the return value
 syscall_exit:
 	LOCKDEP_SYS_EXIT
@@ -686,12 +687,12 @@ syscall_fault:
 END(syscall_fault)
 
 syscall_badsys:
-	movl $-ENOSYS,PT_EAX(%esp)
-	jmp syscall_exit
+	movl $-ENOSYS,%eax
+	jmp syscall_after_call
 END(syscall_badsys)
 
 sysenter_badsys:
-	movl $-ENOSYS,PT_EAX(%esp)
+	movl $-ENOSYS,%eax
 	jmp sysenter_after_call
 END(syscall_badsys)
 	CFI_ENDPROC
diff -druNp --no-dereference linux-libre-3.12.25-gnu/block/blk-cgroup.c linux-libre-3.12.26-gnu/block/blk-cgroup.c
--- linux-libre-3.12.25-gnu/block/blk-cgroup.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/block/blk-cgroup.c	2014-07-30 12:02:44.000000000 -0400
@@ -859,6 +859,13 @@ void blkcg_drain_queue(struct request_qu
 {
 	lockdep_assert_held(q->queue_lock);
 
+	/*
+	 * @q could be exiting and already have destroyed all blkgs as
+	 * indicated by NULL root_blkg.  If so, don't confuse policies.
+	 */
+	if (!q->root_blkg)
+		return;
+
 	blk_throtl_drain(q);
 }
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/block/blk-tag.c linux-libre-3.12.26-gnu/block/blk-tag.c
--- linux-libre-3.12.25-gnu/block/blk-tag.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/block/blk-tag.c	2014-07-30 12:02:44.000000000 -0400
@@ -27,18 +27,15 @@ struct request *blk_queue_find_tag(struc
 EXPORT_SYMBOL(blk_queue_find_tag);
 
 /**
- * __blk_free_tags - release a given set of tag maintenance info
+ * blk_free_tags - release a given set of tag maintenance info
  * @bqt:	the tag map to free
  *
- * Tries to free the specified @bqt.  Returns true if it was
- * actually freed and false if there are still references using it
+ * Drop the reference count on @bqt and frees it when the last reference
+ * is dropped.
  */
-static int __blk_free_tags(struct blk_queue_tag *bqt)
+void blk_free_tags(struct blk_queue_tag *bqt)
 {
-	int retval;
-
-	retval = atomic_dec_and_test(&bqt->refcnt);
-	if (retval) {
+	if (atomic_dec_and_test(&bqt->refcnt)) {
 		BUG_ON(find_first_bit(bqt->tag_map, bqt->max_depth) <
 							bqt->max_depth);
 
@@ -50,9 +47,8 @@ static int __blk_free_tags(struct blk_qu
 
 		kfree(bqt);
 	}
-
-	return retval;
 }
+EXPORT_SYMBOL(blk_free_tags);
 
 /**
  * __blk_queue_free_tags - release tag maintenance info
@@ -69,28 +65,13 @@ void __blk_queue_free_tags(struct reques
 	if (!bqt)
 		return;
 
-	__blk_free_tags(bqt);
+	blk_free_tags(bqt);
 
 	q->queue_tags = NULL;
 	queue_flag_clear_unlocked(QUEUE_FLAG_QUEUED, q);
 }
 
 /**
- * blk_free_tags - release a given set of tag maintenance info
- * @bqt:	the tag map to free
- *
- * For externally managed @bqt frees the map.  Callers of this
- * function must guarantee to have released all the queues that
- * might have been using this tag map.
- */
-void blk_free_tags(struct blk_queue_tag *bqt)
-{
-	if (unlikely(!__blk_free_tags(bqt)))
-		BUG();
-}
-EXPORT_SYMBOL(blk_free_tags);
-
-/**
  * blk_queue_free_tags - release tag maintenance info
  * @q:  the request queue for the device
  *
diff -druNp --no-dereference linux-libre-3.12.25-gnu/block/compat_ioctl.c linux-libre-3.12.26-gnu/block/compat_ioctl.c
--- linux-libre-3.12.25-gnu/block/compat_ioctl.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/block/compat_ioctl.c	2014-07-30 12:02:44.000000000 -0400
@@ -690,6 +690,7 @@ long compat_blkdev_ioctl(struct file *fi
 	case BLKROSET:
 	case BLKDISCARD:
 	case BLKSECDISCARD:
+	case BLKZEROOUT:
 	/*
 	 * the ones below are implemented in blkdev_locked_ioctl,
 	 * but we call blkdev_ioctl, which gets the lock for us
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/acpi/resource.c linux-libre-3.12.26-gnu/drivers/acpi/resource.c
--- linux-libre-3.12.25-gnu/drivers/acpi/resource.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/acpi/resource.c	2014-07-30 12:02:44.000000000 -0400
@@ -77,7 +77,7 @@ bool acpi_dev_resource_memory(struct acp
 	switch (ares->type) {
 	case ACPI_RESOURCE_TYPE_MEMORY24:
 		memory24 = &ares->data.memory24;
-		if (!memory24->address_length)
+		if (!memory24->minimum && !memory24->address_length)
 			return false;
 		acpi_dev_get_memresource(res, memory24->minimum,
 					 memory24->address_length,
@@ -85,7 +85,7 @@ bool acpi_dev_resource_memory(struct acp
 		break;
 	case ACPI_RESOURCE_TYPE_MEMORY32:
 		memory32 = &ares->data.memory32;
-		if (!memory32->address_length)
+		if (!memory32->minimum && !memory32->address_length)
 			return false;
 		acpi_dev_get_memresource(res, memory32->minimum,
 					 memory32->address_length,
@@ -93,7 +93,7 @@ bool acpi_dev_resource_memory(struct acp
 		break;
 	case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
 		fixed_memory32 = &ares->data.fixed_memory32;
-		if (!fixed_memory32->address_length)
+		if (!fixed_memory32->address && !fixed_memory32->address_length)
 			return false;
 		acpi_dev_get_memresource(res, fixed_memory32->address,
 					 fixed_memory32->address_length,
@@ -150,7 +150,7 @@ bool acpi_dev_resource_io(struct acpi_re
 	switch (ares->type) {
 	case ACPI_RESOURCE_TYPE_IO:
 		io = &ares->data.io;
-		if (!io->address_length)
+		if (!io->minimum && !io->address_length)
 			return false;
 		acpi_dev_get_ioresource(res, io->minimum,
 					io->address_length,
@@ -158,7 +158,7 @@ bool acpi_dev_resource_io(struct acpi_re
 		break;
 	case ACPI_RESOURCE_TYPE_FIXED_IO:
 		fixed_io = &ares->data.fixed_io;
-		if (!fixed_io->address_length)
+		if (!fixed_io->address && !fixed_io->address_length)
 			return false;
 		acpi_dev_get_ioresource(res, fixed_io->address,
 					fixed_io->address_length,
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/ata/ahci.c linux-libre-3.12.26-gnu/drivers/ata/ahci.c
--- linux-libre-3.12.25-gnu/drivers/ata/ahci.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/ata/ahci.c	2014-07-30 12:02:44.000000000 -0400
@@ -455,6 +455,7 @@ static const struct pci_device_id ahci_p
 
 	/* Promise */
 	{ PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },	/* PDC42819 */
+	{ PCI_VDEVICE(PROMISE, 0x3781), board_ahci },   /* FastTrak TX8660 ahci-mode */
 
 	/* Asmedia */
 	{ PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci },	/* ASM1060 */
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/ata/libata-core.c linux-libre-3.12.26-gnu/drivers/ata/libata-core.c
--- linux-libre-3.12.25-gnu/drivers/ata/libata-core.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/ata/libata-core.c	2014-07-30 12:02:44.000000000 -0400
@@ -4787,6 +4787,10 @@ void swap_buf_le16(u16 *buf, unsigned in
  *	ata_qc_new - Request an available ATA command, for queueing
  *	@ap: target port
  *
+ *	Some ATA host controllers may implement a queue depth which is less
+ *	than ATA_MAX_QUEUE. So we shouldn't allocate a tag which is beyond
+ *	the hardware limitation.
+ *
  *	LOCKING:
  *	None.
  */
@@ -4794,14 +4798,15 @@ void swap_buf_le16(u16 *buf, unsigned in
 static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
 {
 	struct ata_queued_cmd *qc = NULL;
+	unsigned int max_queue = ap->host->n_tags;
 	unsigned int i, tag;
 
 	/* no command while frozen */
 	if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
 		return NULL;
 
-	for (i = 0; i < ATA_MAX_QUEUE; i++) {
-		tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
+	for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
+		tag = tag < max_queue ? tag : 0;
 
 		/* the last tag is reserved for internal command. */
 		if (tag == ATA_TAG_INTERNAL)
@@ -6103,6 +6108,7 @@ void ata_host_init(struct ata_host *host
 {
 	spin_lock_init(&host->lock);
 	mutex_init(&host->eh_mutex);
+	host->n_tags = ATA_MAX_QUEUE - 1;
 	host->dev = dev;
 	host->ops = ops;
 }
@@ -6184,6 +6190,8 @@ int ata_host_register(struct ata_host *h
 {
 	int i, rc;
 
+	host->n_tags = clamp(sht->can_queue, 1, ATA_MAX_QUEUE - 1);
+
 	/* host must have been started */
 	if (!(host->flags & ATA_HOST_STARTED)) {
 		dev_err(host->dev, "BUG: trying to register unstarted host\n");
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/bluetooth/hci_h5.c linux-libre-3.12.26-gnu/drivers/bluetooth/hci_h5.c
--- linux-libre-3.12.25-gnu/drivers/bluetooth/hci_h5.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/bluetooth/hci_h5.c	2014-07-30 12:02:44.000000000 -0400
@@ -406,6 +406,7 @@ static int h5_rx_3wire_hdr(struct hci_ua
 	    H5_HDR_PKT_TYPE(hdr) != HCI_3WIRE_LINK_PKT) {
 		BT_ERR("Non-link packet received in non-active state");
 		h5_reset_rx(h5);
+		return 0;
 	}
 
 	h5->rx_func = h5_rx_payload;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/gpu/drm/qxl/qxl_irq.c linux-libre-3.12.26-gnu/drivers/gpu/drm/qxl/qxl_irq.c
--- linux-libre-3.12.25-gnu/drivers/gpu/drm/qxl/qxl_irq.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/gpu/drm/qxl/qxl_irq.c	2014-07-30 12:02:44.000000000 -0400
@@ -33,6 +33,9 @@ irqreturn_t qxl_irq_handler(DRM_IRQ_ARGS
 
 	pending = xchg(&qdev->ram_header->int_pending, 0);
 
+	if (!pending)
+		return IRQ_NONE;
+
 	atomic_inc(&qdev->irq_received);
 
 	if (pending & QXL_INTERRUPT_DISPLAY) {
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/gpu/drm/radeon/atombios_encoders.c linux-libre-3.12.26-gnu/drivers/gpu/drm/radeon/atombios_encoders.c
--- linux-libre-3.12.25-gnu/drivers/gpu/drm/radeon/atombios_encoders.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/gpu/drm/radeon/atombios_encoders.c	2014-07-30 12:02:44.000000000 -0400
@@ -183,7 +183,6 @@ void radeon_atom_backlight_init(struct r
 	struct backlight_properties props;
 	struct radeon_backlight_privdata *pdata;
 	struct radeon_encoder_atom_dig *dig;
-	u8 backlight_level;
 	char bl_name[16];
 
 	/* Mac laptops with multiple GPUs use the gmux driver for backlight
@@ -222,12 +221,17 @@ void radeon_atom_backlight_init(struct r
 
 	pdata->encoder = radeon_encoder;
 
-	backlight_level = radeon_atom_get_backlight_level_from_reg(rdev);
-
 	dig = radeon_encoder->enc_priv;
 	dig->bl_dev = bd;
 
 	bd->props.brightness = radeon_atom_backlight_get_brightness(bd);
+	/* Set a reasonable default here if the level is 0 otherwise
+	 * fbdev will attempt to turn the backlight on after console
+	 * unblanking and it will try and restore 0 which turns the backlight
+	 * off again.
+	 */
+	if (bd->props.brightness == 0)
+		bd->props.brightness = RADEON_MAX_BL_LEVEL;
 	bd->props.power = FB_BLANK_UNBLANK;
 	backlight_update_status(bd);
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/gpu/drm/radeon/cik.c linux-libre-3.12.26-gnu/drivers/gpu/drm/radeon/cik.c
--- linux-libre-3.12.25-gnu/drivers/gpu/drm/radeon/cik.c	2014-07-23 02:31:59.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/gpu/drm/radeon/cik.c	2014-08-01 13:31:35.000000000 -0400
@@ -6535,6 +6535,7 @@ static inline u32 cik_get_ih_wptr(struct
 		tmp = RREG32(IH_RB_CNTL);
 		tmp |= IH_WPTR_OVERFLOW_CLEAR;
 		WREG32(IH_RB_CNTL, tmp);
+		wptr &= ~RB_OVERFLOW;
 	}
 	return (wptr & rdev->ih.ptr_mask);
 }
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/gpu/drm/radeon/evergreen.c linux-libre-3.12.26-gnu/drivers/gpu/drm/radeon/evergreen.c
--- linux-libre-3.12.25-gnu/drivers/gpu/drm/radeon/evergreen.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/gpu/drm/radeon/evergreen.c	2014-07-30 12:02:44.000000000 -0400
@@ -4664,6 +4664,7 @@ static u32 evergreen_get_ih_wptr(struct
 		tmp = RREG32(IH_RB_CNTL);
 		tmp |= IH_WPTR_OVERFLOW_CLEAR;
 		WREG32(IH_RB_CNTL, tmp);
+		wptr &= ~RB_OVERFLOW;
 	}
 	return (wptr & rdev->ih.ptr_mask);
 }
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/gpu/drm/radeon/r600.c linux-libre-3.12.26-gnu/drivers/gpu/drm/radeon/r600.c
--- linux-libre-3.12.25-gnu/drivers/gpu/drm/radeon/r600.c	2014-07-23 02:31:42.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/gpu/drm/radeon/r600.c	2014-08-01 13:31:19.000000000 -0400
@@ -3609,6 +3609,7 @@ static u32 r600_get_ih_wptr(struct radeo
 		tmp = RREG32(IH_RB_CNTL);
 		tmp |= IH_WPTR_OVERFLOW_CLEAR;
 		WREG32(IH_RB_CNTL, tmp);
+		wptr &= ~RB_OVERFLOW;
 	}
 	return (wptr & rdev->ih.ptr_mask);
 }
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/gpu/drm/radeon/radeon_display.c linux-libre-3.12.26-gnu/drivers/gpu/drm/radeon/radeon_display.c
--- linux-libre-3.12.25-gnu/drivers/gpu/drm/radeon/radeon_display.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/gpu/drm/radeon/radeon_display.c	2014-07-30 12:02:44.000000000 -0400
@@ -708,6 +708,10 @@ int radeon_ddc_get_modes(struct radeon_c
 	struct radeon_device *rdev = dev->dev_private;
 	int ret = 0;
 
+	/* don't leak the edid if we already fetched it in detect() */
+	if (radeon_connector->edid)
+		goto got_edid;
+
 	/* on hw with routers, select right port */
 	if (radeon_connector->router.ddc_valid)
 		radeon_router_select_ddc_port(radeon_connector);
@@ -747,6 +751,7 @@ int radeon_ddc_get_modes(struct radeon_c
 			radeon_connector->edid = radeon_bios_get_hardcoded_edid(rdev);
 	}
 	if (radeon_connector->edid) {
+got_edid:
 		drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid);
 		ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid);
 		drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid);
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/gpu/drm/radeon/si.c linux-libre-3.12.26-gnu/drivers/gpu/drm/radeon/si.c
--- linux-libre-3.12.25-gnu/drivers/gpu/drm/radeon/si.c	2014-07-23 02:31:53.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/gpu/drm/radeon/si.c	2014-08-01 13:31:30.000000000 -0400
@@ -6007,6 +6007,7 @@ static inline u32 si_get_ih_wptr(struct
 		tmp = RREG32(IH_RB_CNTL);
 		tmp |= IH_WPTR_OVERFLOW_CLEAR;
 		WREG32(IH_RB_CNTL, tmp);
+		wptr &= ~RB_OVERFLOW;
 	}
 	return (wptr & rdev->ih.ptr_mask);
 }
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/hv/hv_kvp.c linux-libre-3.12.26-gnu/drivers/hv/hv_kvp.c
--- linux-libre-3.12.25-gnu/drivers/hv/hv_kvp.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/hv/hv_kvp.c	2014-07-30 12:02:44.000000000 -0400
@@ -127,6 +127,15 @@ kvp_work_func(struct work_struct *dummy)
 	kvp_respond_to_host(NULL, HV_E_FAIL);
 }
 
+static void poll_channel(struct vmbus_channel *channel)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&channel->inbound_lock, flags);
+	hv_kvp_onchannelcallback(channel);
+	spin_unlock_irqrestore(&channel->inbound_lock, flags);
+}
+
 static int kvp_handle_handshake(struct hv_kvp_msg *msg)
 {
 	int ret = 1;
@@ -155,7 +164,7 @@ static int kvp_handle_handshake(struct h
 		kvp_register(dm_reg_value);
 		kvp_transaction.active = false;
 		if (kvp_transaction.kvp_context)
-			hv_kvp_onchannelcallback(kvp_transaction.kvp_context);
+			poll_channel(kvp_transaction.kvp_context);
 	}
 	return ret;
 }
@@ -568,6 +577,7 @@ response_done:
 
 	vmbus_sendpacket(channel, recv_buffer, buf_len, req_id,
 				VM_PKT_DATA_INBAND, 0);
+	poll_channel(channel);
 
 }
 
@@ -603,7 +613,7 @@ void hv_kvp_onchannelcallback(void *cont
 		return;
 	}
 
-	vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 2, &recvlen,
+	vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 4, &recvlen,
 			 &requestid);
 
 	if (recvlen > 0) {
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/hv/hv_util.c linux-libre-3.12.26-gnu/drivers/hv/hv_util.c
--- linux-libre-3.12.25-gnu/drivers/hv/hv_util.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/hv/hv_util.c	2014-07-30 12:02:44.000000000 -0400
@@ -312,7 +312,7 @@ static int util_probe(struct hv_device *
 		(struct hv_util_service *)dev_id->driver_data;
 	int ret;
 
-	srv->recv_buffer = kmalloc(PAGE_SIZE * 2, GFP_KERNEL);
+	srv->recv_buffer = kmalloc(PAGE_SIZE * 4, GFP_KERNEL);
 	if (!srv->recv_buffer)
 		return -ENOMEM;
 	if (srv->util_init) {
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/hwmon/adt7470.c linux-libre-3.12.26-gnu/drivers/hwmon/adt7470.c
--- linux-libre-3.12.25-gnu/drivers/hwmon/adt7470.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/hwmon/adt7470.c	2014-07-30 12:02:44.000000000 -0400
@@ -515,7 +515,7 @@ static ssize_t set_temp_min(struct devic
 		return -EINVAL;
 
 	temp = DIV_ROUND_CLOSEST(temp, 1000);
-	temp = clamp_val(temp, 0, 255);
+	temp = clamp_val(temp, -128, 127);
 
 	mutex_lock(&data->lock);
 	data->temp_min[attr->index] = temp;
@@ -549,7 +549,7 @@ static ssize_t set_temp_max(struct devic
 		return -EINVAL;
 
 	temp = DIV_ROUND_CLOSEST(temp, 1000);
-	temp = clamp_val(temp, 0, 255);
+	temp = clamp_val(temp, -128, 127);
 
 	mutex_lock(&data->lock);
 	data->temp_max[attr->index] = temp;
@@ -826,7 +826,7 @@ static ssize_t set_pwm_tmin(struct devic
 		return -EINVAL;
 
 	temp = DIV_ROUND_CLOSEST(temp, 1000);
-	temp = clamp_val(temp, 0, 255);
+	temp = clamp_val(temp, -128, 127);
 
 	mutex_lock(&data->lock);
 	data->pwm_tmin[attr->index] = temp;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/hwmon/da9052-hwmon.c linux-libre-3.12.26-gnu/drivers/hwmon/da9052-hwmon.c
--- linux-libre-3.12.25-gnu/drivers/hwmon/da9052-hwmon.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/hwmon/da9052-hwmon.c	2014-07-30 12:02:44.000000000 -0400
@@ -194,7 +194,7 @@ static ssize_t da9052_hwmon_show_name(st
 				      struct device_attribute *devattr,
 				      char *buf)
 {
-	return sprintf(buf, "da9052-hwmon\n");
+	return sprintf(buf, "da9052\n");
 }
 
 static ssize_t show_label(struct device *dev,
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/hwmon/da9055-hwmon.c linux-libre-3.12.26-gnu/drivers/hwmon/da9055-hwmon.c
--- linux-libre-3.12.25-gnu/drivers/hwmon/da9055-hwmon.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/hwmon/da9055-hwmon.c	2014-07-30 12:02:44.000000000 -0400
@@ -204,7 +204,7 @@ static ssize_t da9055_hwmon_show_name(st
 				      struct device_attribute *devattr,
 				      char *buf)
 {
-	return sprintf(buf, "da9055-hwmon\n");
+	return sprintf(buf, "da9055\n");
 }
 
 static ssize_t show_label(struct device *dev,
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/hwmon/smsc47m192.c linux-libre-3.12.26-gnu/drivers/hwmon/smsc47m192.c
--- linux-libre-3.12.25-gnu/drivers/hwmon/smsc47m192.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/hwmon/smsc47m192.c	2014-07-30 12:02:44.000000000 -0400
@@ -86,7 +86,7 @@ static inline u8 IN_TO_REG(unsigned long
  */
 static inline s8 TEMP_TO_REG(int val)
 {
-	return clamp_val(SCALE(val, 1, 1000), -128000, 127000);
+	return SCALE(clamp_val(val, -128000, 127000), 1, 1000);
 }
 
 static inline int TEMP_FROM_REG(s8 val)
@@ -384,6 +384,8 @@ static ssize_t set_vrm(struct device *de
 	err = kstrtoul(buf, 10, &val);
 	if (err)
 		return err;
+	if (val > 255)
+		return -EINVAL;
 
 	data->vrm = val;
 	return count;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/input/input.c linux-libre-3.12.26-gnu/drivers/input/input.c
--- linux-libre-3.12.25-gnu/drivers/input/input.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/input/input.c	2014-07-30 12:02:44.000000000 -0400
@@ -257,9 +257,10 @@ static int input_handle_abs_event(struct
 }
 
 static int input_get_disposition(struct input_dev *dev,
-			  unsigned int type, unsigned int code, int value)
+			  unsigned int type, unsigned int code, int *pval)
 {
 	int disposition = INPUT_IGNORE_EVENT;
+	int value = *pval;
 
 	switch (type) {
 
@@ -357,6 +358,7 @@ static int input_get_disposition(struct
 		break;
 	}
 
+	*pval = value;
 	return disposition;
 }
 
@@ -365,7 +367,7 @@ static void input_handle_event(struct in
 {
 	int disposition;
 
-	disposition = input_get_disposition(dev, type, code, value);
+	disposition = input_get_disposition(dev, type, code, &value);
 
 	if ((disposition & INPUT_PASS_TO_DEVICE) && dev->event)
 		dev->event(dev, type, code, value);
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/irqchip/irq-gic.c linux-libre-3.12.26-gnu/drivers/irqchip/irq-gic.c
--- linux-libre-3.12.25-gnu/drivers/irqchip/irq-gic.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/irqchip/irq-gic.c	2014-07-30 12:02:44.000000000 -0400
@@ -42,6 +42,7 @@
 #include <linux/irqchip/chained_irq.h>
 #include <linux/irqchip/arm-gic.h>
 
+#include <asm/cputype.h>
 #include <asm/irq.h>
 #include <asm/exception.h>
 #include <asm/smp_plat.h>
@@ -760,7 +761,9 @@ void __init gic_init_bases(unsigned int
 		}
 
 		for_each_possible_cpu(cpu) {
-			unsigned long offset = percpu_offset * cpu_logical_map(cpu);
+			u32 mpidr = cpu_logical_map(cpu);
+			u32 core_id = MPIDR_AFFINITY_LEVEL(mpidr, 0);
+			unsigned long offset = percpu_offset * core_id;
 			*per_cpu_ptr(gic->dist_base.percpu_base, cpu) = dist_base + offset;
 			*per_cpu_ptr(gic->cpu_base.percpu_base, cpu) = cpu_base + offset;
 		}
@@ -864,6 +867,7 @@ int __init gic_of_init(struct device_nod
 }
 IRQCHIP_DECLARE(cortex_a15_gic, "arm,cortex-a15-gic", gic_of_init);
 IRQCHIP_DECLARE(cortex_a9_gic, "arm,cortex-a9-gic", gic_of_init);
+IRQCHIP_DECLARE(cortex_a7_gic, "arm,cortex-a7-gic", gic_of_init);
 IRQCHIP_DECLARE(msm_8660_qgic, "qcom,msm-8660-qgic", gic_of_init);
 IRQCHIP_DECLARE(msm_qgic2, "qcom,msm-qgic2", gic_of_init);
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/md/dm-cache-metadata.c linux-libre-3.12.26-gnu/drivers/md/dm-cache-metadata.c
--- linux-libre-3.12.25-gnu/drivers/md/dm-cache-metadata.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/md/dm-cache-metadata.c	2014-07-30 12:02:44.000000000 -0400
@@ -407,6 +407,15 @@ static int __open_metadata(struct dm_cac
 
 	disk_super = dm_block_data(sblock);
 
+	/* Verify the data block size hasn't changed */
+	if (le32_to_cpu(disk_super->data_block_size) != cmd->data_block_size) {
+		DMERR("changing the data block size (from %u to %llu) is not supported",
+		      le32_to_cpu(disk_super->data_block_size),
+		      (unsigned long long)cmd->data_block_size);
+		r = -EINVAL;
+		goto bad;
+	}
+
 	r = __check_incompat_features(disk_super, cmd);
 	if (r < 0)
 		goto bad;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/md/dm-thin-metadata.c linux-libre-3.12.26-gnu/drivers/md/dm-thin-metadata.c
--- linux-libre-3.12.25-gnu/drivers/md/dm-thin-metadata.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/md/dm-thin-metadata.c	2014-07-30 12:02:44.000000000 -0400
@@ -613,6 +613,15 @@ static int __open_metadata(struct dm_poo
 
 	disk_super = dm_block_data(sblock);
 
+	/* Verify the data block size hasn't changed */
+	if (le32_to_cpu(disk_super->data_block_size) != pmd->data_block_size) {
+		DMERR("changing the data block size (from %u to %llu) is not supported",
+		      le32_to_cpu(disk_super->data_block_size),
+		      (unsigned long long)pmd->data_block_size);
+		r = -EINVAL;
+		goto bad_unlock_sblock;
+	}
+
 	r = __check_incompat_features(disk_super, pmd);
 	if (r < 0)
 		goto bad_unlock_sblock;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/media/dvb-frontends/tda10071.c linux-libre-3.12.26-gnu/drivers/media/dvb-frontends/tda10071.c
--- linux-libre-3.12.25-gnu/drivers/media/dvb-frontends/tda10071.c	2014-07-23 02:34:00.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/media/dvb-frontends/tda10071.c	2014-08-01 13:33:39.000000000 -0400
@@ -667,6 +667,7 @@ static int tda10071_set_frontend(struct
 	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
 	int ret, i;
 	u8 mode, rolloff, pilot, inversion, div;
+	fe_modulation_t modulation;
 
 	dev_dbg(&priv->i2c->dev, "%s: delivery_system=%d modulation=%d " \
 		"frequency=%d symbol_rate=%d inversion=%d pilot=%d " \
@@ -701,10 +702,13 @@ static int tda10071_set_frontend(struct
 
 	switch (c->delivery_system) {
 	case SYS_DVBS:
+		modulation = QPSK;
 		rolloff = 0;
 		pilot = 2;
 		break;
 	case SYS_DVBS2:
+		modulation = c->modulation;
+
 		switch (c->rolloff) {
 		case ROLLOFF_20:
 			rolloff = 2;
@@ -749,7 +753,7 @@ static int tda10071_set_frontend(struct
 
 	for (i = 0, mode = 0xff; i < ARRAY_SIZE(TDA10071_MODCOD); i++) {
 		if (c->delivery_system == TDA10071_MODCOD[i].delivery_system &&
-			c->modulation == TDA10071_MODCOD[i].modulation &&
+			modulation == TDA10071_MODCOD[i].modulation &&
 			c->fec_inner == TDA10071_MODCOD[i].fec) {
 			mode = TDA10071_MODCOD[i].val;
 			dev_dbg(&priv->i2c->dev, "%s: mode found=%02x\n",
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/media/usb/gspca/pac7302.c linux-libre-3.12.26-gnu/drivers/media/usb/gspca/pac7302.c
--- linux-libre-3.12.25-gnu/drivers/media/usb/gspca/pac7302.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/media/usb/gspca/pac7302.c	2014-07-30 12:02:44.000000000 -0400
@@ -928,6 +928,7 @@ static const struct usb_device_id device
 	{USB_DEVICE(0x093a, 0x2620)},
 	{USB_DEVICE(0x093a, 0x2621)},
 	{USB_DEVICE(0x093a, 0x2622), .driver_info = FL_VFLIP},
+	{USB_DEVICE(0x093a, 0x2623), .driver_info = FL_VFLIP},
 	{USB_DEVICE(0x093a, 0x2624), .driver_info = FL_VFLIP},
 	{USB_DEVICE(0x093a, 0x2625)},
 	{USB_DEVICE(0x093a, 0x2626)},
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/media/usb/hdpvr/hdpvr-video.c linux-libre-3.12.26-gnu/drivers/media/usb/hdpvr/hdpvr-video.c
--- linux-libre-3.12.25-gnu/drivers/media/usb/hdpvr/hdpvr-video.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/media/usb/hdpvr/hdpvr-video.c	2014-07-30 12:02:44.000000000 -0400
@@ -82,7 +82,7 @@ static void hdpvr_read_bulk_callback(str
 }
 
 /*=========================================================================*/
-/* bufffer bits */
+/* buffer bits */
 
 /* function expects dev->io_mutex to be hold by caller */
 int hdpvr_cancel_queue(struct hdpvr_device *dev)
@@ -926,7 +926,7 @@ static int hdpvr_s_ctrl(struct v4l2_ctrl
 	case V4L2_CID_MPEG_AUDIO_ENCODING:
 		if (dev->flags & HDPVR_FLAG_AC3_CAP) {
 			opt->audio_codec = ctrl->val;
-			return hdpvr_set_audio(dev, opt->audio_input,
+			return hdpvr_set_audio(dev, opt->audio_input + 1,
 					      opt->audio_codec);
 		}
 		return 0;
@@ -1198,7 +1198,7 @@ int hdpvr_register_videodev(struct hdpvr
 	v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
 		V4L2_CID_MPEG_AUDIO_ENCODING,
 		ac3 ? V4L2_MPEG_AUDIO_ENCODING_AC3 : V4L2_MPEG_AUDIO_ENCODING_AAC,
-		0x7, V4L2_MPEG_AUDIO_ENCODING_AAC);
+		0x7, ac3 ? dev->options.audio_codec : V4L2_MPEG_AUDIO_ENCODING_AAC);
 	v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
 		V4L2_CID_MPEG_VIDEO_ENCODING,
 		V4L2_MPEG_VIDEO_ENCODING_MPEG_4_AVC, 0x3,
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/media/v4l2-core/v4l2-dv-timings.c linux-libre-3.12.26-gnu/drivers/media/v4l2-core/v4l2-dv-timings.c
--- linux-libre-3.12.25-gnu/drivers/media/v4l2-core/v4l2-dv-timings.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/media/v4l2-core/v4l2-dv-timings.c	2014-07-30 12:02:44.000000000 -0400
@@ -594,10 +594,10 @@ struct v4l2_fract v4l2_calc_aspect_ratio
 		aspect.denominator = 9;
 	} else if (ratio == 34) {
 		aspect.numerator = 4;
-		aspect.numerator = 3;
+		aspect.denominator = 3;
 	} else if (ratio == 68) {
 		aspect.numerator = 15;
-		aspect.numerator = 9;
+		aspect.denominator = 9;
 	} else {
 		aspect.numerator = hor_landscape + 99;
 		aspect.denominator = 100;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/mtd/devices/elm.c linux-libre-3.12.26-gnu/drivers/mtd/devices/elm.c
--- linux-libre-3.12.25-gnu/drivers/mtd/devices/elm.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/mtd/devices/elm.c	2014-07-30 12:02:44.000000000 -0400
@@ -428,6 +428,7 @@ static int elm_context_save(struct elm_i
 					ELM_SYNDROME_FRAGMENT_1 + offset);
 			regs->elm_syndrome_fragment_0[i] = elm_read_reg(info,
 					ELM_SYNDROME_FRAGMENT_0 + offset);
+			break;
 		default:
 			return -EINVAL;
 		}
@@ -466,6 +467,7 @@ static int elm_context_restore(struct el
 					regs->elm_syndrome_fragment_1[i]);
 			elm_write_reg(info, ELM_SYNDROME_FRAGMENT_0 + offset,
 					regs->elm_syndrome_fragment_0[i]);
+			break;
 		default:
 			return -EINVAL;
 		}
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/can/c_can/c_can.c linux-libre-3.12.26-gnu/drivers/net/can/c_can/c_can.c
--- linux-libre-3.12.25-gnu/drivers/net/can/c_can/c_can.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/can/c_can/c_can.c	2014-07-30 12:02:44.000000000 -0400
@@ -830,9 +830,6 @@ static int c_can_do_rx_poll(struct net_d
 				continue;
 			}
 
-			if (msg_ctrl_save & IF_MCONT_EOB)
-				return num_rx_pkts;
-
 			if (!(msg_ctrl_save & IF_MCONT_NEWDAT))
 				continue;
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/can/slcan.c linux-libre-3.12.26-gnu/drivers/net/can/slcan.c
--- linux-libre-3.12.25-gnu/drivers/net/can/slcan.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/can/slcan.c	2014-07-30 12:02:44.000000000 -0400
@@ -54,6 +54,7 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/workqueue.h>
 #include <linux/can.h>
 #include <linux/can/skb.h>
 
@@ -87,6 +88,7 @@ struct slcan {
 	struct tty_struct	*tty;		/* ptr to TTY structure	     */
 	struct net_device	*dev;		/* easy for intr handling    */
 	spinlock_t		lock;
+	struct work_struct	tx_work;	/* Flushes transmit buffer   */
 
 	/* These are pointers to the malloc()ed frame buffers. */
 	unsigned char		rbuff[SLC_MTU];	/* receiver buffer	     */
@@ -311,34 +313,44 @@ static void slc_encaps(struct slcan *sl,
 	sl->dev->stats.tx_bytes += cf->can_dlc;
 }
 
-/*
- * Called by the driver when there's room for more data.  If we have
- * more packets to send, we send them here.
- */
-static void slcan_write_wakeup(struct tty_struct *tty)
+/* Write out any remaining transmit buffer. Scheduled when tty is writable */
+static void slcan_transmit(struct work_struct *work)
 {
+	struct slcan *sl = container_of(work, struct slcan, tx_work);
 	int actual;
-	struct slcan *sl = (struct slcan *) tty->disc_data;
 
+	spin_lock_bh(&sl->lock);
 	/* First make sure we're connected. */
-	if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
+	if (!sl->tty || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev)) {
+		spin_unlock_bh(&sl->lock);
 		return;
+	}
 
-	spin_lock(&sl->lock);
 	if (sl->xleft <= 0)  {
 		/* Now serial buffer is almost free & we can start
 		 * transmission of another packet */
 		sl->dev->stats.tx_packets++;
-		clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
-		spin_unlock(&sl->lock);
+		clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
+		spin_unlock_bh(&sl->lock);
 		netif_wake_queue(sl->dev);
 		return;
 	}
 
-	actual = tty->ops->write(tty, sl->xhead, sl->xleft);
+	actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft);
 	sl->xleft -= actual;
 	sl->xhead += actual;
-	spin_unlock(&sl->lock);
+	spin_unlock_bh(&sl->lock);
+}
+
+/*
+ * Called by the driver when there's room for more data.
+ * Schedule the transmit.
+ */
+static void slcan_write_wakeup(struct tty_struct *tty)
+{
+	struct slcan *sl = tty->disc_data;
+
+	schedule_work(&sl->tx_work);
 }
 
 /* Send a can_frame to a TTY queue. */
@@ -524,6 +536,7 @@ static struct slcan *slc_alloc(dev_t lin
 	sl->magic = SLCAN_MAGIC;
 	sl->dev	= dev;
 	spin_lock_init(&sl->lock);
+	INIT_WORK(&sl->tx_work, slcan_transmit);
 	slcan_devs[i] = dev;
 
 	return sl;
@@ -622,8 +635,12 @@ static void slcan_close(struct tty_struc
 	if (!sl || sl->magic != SLCAN_MAGIC || sl->tty != tty)
 		return;
 
+	spin_lock_bh(&sl->lock);
 	tty->disc_data = NULL;
 	sl->tty = NULL;
+	spin_unlock_bh(&sl->lock);
+
+	flush_work(&sl->tx_work);
 
 	/* Flush network side */
 	unregister_netdev(sl->dev);
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c linux-libre-3.12.26-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c	2014-07-23 02:36:19.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c	2014-08-01 13:36:00.000000000 -0400
@@ -755,7 +755,8 @@ static void bnx2x_tpa_stop(struct bnx2x
 
 		return;
 	}
-	bnx2x_frag_free(fp, new_data);
+	if (new_data)
+		bnx2x_frag_free(fp, new_data);
 drop:
 	/* drop the packet and keep the buffer in the bin */
 	DP(NETIF_MSG_RX_STATUS,
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/emulex/benet/be_main.c linux-libre-3.12.26-gnu/drivers/net/ethernet/emulex/benet/be_main.c
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/emulex/benet/be_main.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/emulex/benet/be_main.c	2014-07-30 12:02:44.000000000 -0400
@@ -2632,7 +2632,7 @@ static int be_open(struct net_device *ne
 
 	for_all_evt_queues(adapter, eqo, i) {
 		napi_enable(&eqo->napi);
-		be_eq_notify(adapter, eqo->q.id, true, false, 0);
+		be_eq_notify(adapter, eqo->q.id, true, true, 0);
 	}
 	adapter->flags |= BE_FLAGS_NAPI_ENABLED;
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/e1000e/ich8lan.c linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/e1000e/ich8lan.c
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/e1000e/ich8lan.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/e1000e/ich8lan.c	2014-07-30 12:02:44.000000000 -0400
@@ -1374,7 +1374,7 @@ static void e1000_rar_set_pch2lan(struct
 	/* RAR[1-6] are owned by manageability.  Skip those and program the
 	 * next address into the SHRA register array.
 	 */
-	if (index < (u32)(hw->mac.rar_entry_count - 6)) {
+	if (index < (u32)(hw->mac.rar_entry_count)) {
 		s32 ret_val;
 
 		ret_val = e1000_acquire_swflag_ich8lan(hw);
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/e1000e/ich8lan.h linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/e1000e/ich8lan.h
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/e1000e/ich8lan.h	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/e1000e/ich8lan.h	2014-07-30 12:02:44.000000000 -0400
@@ -98,7 +98,7 @@
 #define PCIE_ICH8_SNOOP_ALL	PCIE_NO_SNOOP_ALL
 
 #define E1000_ICH_RAR_ENTRIES	7
-#define E1000_PCH2_RAR_ENTRIES	11      /* RAR[0-6], SHRA[0-3] */
+#define E1000_PCH2_RAR_ENTRIES	5	/* RAR[0], SHRA[0-3] */
 #define E1000_PCH_LPT_RAR_ENTRIES	12	/* RAR[0], SHRA[0-10] */
 
 #define PHY_PAGE_SHIFT		5
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/e1000_82575.c linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/e1000_82575.c
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/e1000_82575.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/e1000_82575.c	2014-07-30 12:02:44.000000000 -0400
@@ -1403,6 +1403,13 @@ static s32 igb_init_hw_82575(struct e100
 	s32 ret_val;
 	u16 i, rar_count = mac->rar_entry_count;
 
+	if ((hw->mac.type >= e1000_i210) &&
+	    !(igb_get_flash_presence_i210(hw))) {
+		ret_val = igb_pll_workaround_i210(hw);
+		if (ret_val)
+			return ret_val;
+	}
+
 	/* Initialize identification LED */
 	ret_val = igb_id_led_init(hw);
 	if (ret_val) {
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/e1000_defines.h linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/e1000_defines.h
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/e1000_defines.h	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/e1000_defines.h	2014-07-30 12:02:44.000000000 -0400
@@ -46,14 +46,15 @@
 /* Extended Device Control */
 #define E1000_CTRL_EXT_SDP3_DATA 0x00000080 /* Value of SW Defineable Pin 3 */
 /* Physical Func Reset Done Indication */
-#define E1000_CTRL_EXT_PFRSTD    0x00004000
-#define E1000_CTRL_EXT_LINK_MODE_MASK 0x00C00000
-#define E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES  0x00C00000
-#define E1000_CTRL_EXT_LINK_MODE_1000BASE_KX  0x00400000
-#define E1000_CTRL_EXT_LINK_MODE_SGMII   0x00800000
-#define E1000_CTRL_EXT_LINK_MODE_GMII   0x00000000
-#define E1000_CTRL_EXT_EIAME          0x01000000
-#define E1000_CTRL_EXT_IRCA           0x00000001
+#define E1000_CTRL_EXT_PFRSTD	0x00004000
+#define E1000_CTRL_EXT_SDLPE	0X00040000  /* SerDes Low Power Enable */
+#define E1000_CTRL_EXT_LINK_MODE_MASK	0x00C00000
+#define E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES	0x00C00000
+#define E1000_CTRL_EXT_LINK_MODE_1000BASE_KX	0x00400000
+#define E1000_CTRL_EXT_LINK_MODE_SGMII	0x00800000
+#define E1000_CTRL_EXT_LINK_MODE_GMII	0x00000000
+#define E1000_CTRL_EXT_EIAME	0x01000000
+#define E1000_CTRL_EXT_IRCA		0x00000001
 /* Interrupt delay cancellation */
 /* Driver loaded bit for FW */
 #define E1000_CTRL_EXT_DRV_LOAD       0x10000000
@@ -62,6 +63,7 @@
 /* packet buffer parity error detection enabled */
 /* descriptor FIFO parity error detection enable */
 #define E1000_CTRL_EXT_PBA_CLR		0x80000000 /* PBA Clear */
+#define E1000_CTRL_EXT_PHYPDEN		0x00100000
 #define E1000_I2CCMD_REG_ADDR_SHIFT	16
 #define E1000_I2CCMD_PHY_ADDR_SHIFT	24
 #define E1000_I2CCMD_OPCODE_READ	0x08000000
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/e1000_hw.h linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/e1000_hw.h
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/e1000_hw.h	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/e1000_hw.h	2014-07-30 12:02:44.000000000 -0400
@@ -569,4 +569,7 @@ extern struct net_device *igb_get_hw_dev
 /* These functions must be implemented by drivers */
 s32  igb_read_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value);
 s32  igb_write_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value);
+
+void igb_read_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value);
+void igb_write_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value);
 #endif /* _E1000_HW_H_ */
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/e1000_i210.c linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/e1000_i210.c
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/e1000_i210.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/e1000_i210.c	2014-07-30 12:02:44.000000000 -0400
@@ -835,3 +835,69 @@ s32 igb_init_nvm_params_i210(struct e100
 	}
 	return ret_val;
 }
+
+/**
+ * igb_pll_workaround_i210
+ * @hw: pointer to the HW structure
+ *
+ * Works around an errata in the PLL circuit where it occasionally
+ * provides the wrong clock frequency after power up.
+ **/
+s32 igb_pll_workaround_i210(struct e1000_hw *hw)
+{
+	s32 ret_val;
+	u32 wuc, mdicnfg, ctrl, ctrl_ext, reg_val;
+	u16 nvm_word, phy_word, pci_word, tmp_nvm;
+	int i;
+
+	/* Get and set needed register values */
+	wuc = rd32(E1000_WUC);
+	mdicnfg = rd32(E1000_MDICNFG);
+	reg_val = mdicnfg & ~E1000_MDICNFG_EXT_MDIO;
+	wr32(E1000_MDICNFG, reg_val);
+
+	/* Get data from NVM, or set default */
+	ret_val = igb_read_invm_word_i210(hw, E1000_INVM_AUTOLOAD,
+					  &nvm_word);
+	if (ret_val)
+		nvm_word = E1000_INVM_DEFAULT_AL;
+	tmp_nvm = nvm_word | E1000_INVM_PLL_WO_VAL;
+	for (i = 0; i < E1000_MAX_PLL_TRIES; i++) {
+		/* check current state directly from internal PHY */
+		igb_read_phy_reg_gs40g(hw, (E1000_PHY_PLL_FREQ_PAGE |
+					 E1000_PHY_PLL_FREQ_REG), &phy_word);
+		if ((phy_word & E1000_PHY_PLL_UNCONF)
+		    != E1000_PHY_PLL_UNCONF) {
+			ret_val = 0;
+			break;
+		} else {
+			ret_val = -E1000_ERR_PHY;
+		}
+		/* directly reset the internal PHY */
+		ctrl = rd32(E1000_CTRL);
+		wr32(E1000_CTRL, ctrl|E1000_CTRL_PHY_RST);
+
+		ctrl_ext = rd32(E1000_CTRL_EXT);
+		ctrl_ext |= (E1000_CTRL_EXT_PHYPDEN | E1000_CTRL_EXT_SDLPE);
+		wr32(E1000_CTRL_EXT, ctrl_ext);
+
+		wr32(E1000_WUC, 0);
+		reg_val = (E1000_INVM_AUTOLOAD << 4) | (tmp_nvm << 16);
+		wr32(E1000_EEARBC_I210, reg_val);
+
+		igb_read_pci_cfg(hw, E1000_PCI_PMCSR, &pci_word);
+		pci_word |= E1000_PCI_PMCSR_D3;
+		igb_write_pci_cfg(hw, E1000_PCI_PMCSR, &pci_word);
+		usleep_range(1000, 2000);
+		pci_word &= ~E1000_PCI_PMCSR_D3;
+		igb_write_pci_cfg(hw, E1000_PCI_PMCSR, &pci_word);
+		reg_val = (E1000_INVM_AUTOLOAD << 4) | (nvm_word << 16);
+		wr32(E1000_EEARBC_I210, reg_val);
+
+		/* restore WUC register */
+		wr32(E1000_WUC, wuc);
+	}
+	/* restore MDICNFG setting */
+	wr32(E1000_MDICNFG, mdicnfg);
+	return ret_val;
+}
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/e1000_i210.h linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/e1000_i210.h
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/e1000_i210.h	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/e1000_i210.h	2014-07-30 12:02:44.000000000 -0400
@@ -48,6 +48,7 @@ extern s32 igb_write_xmdio_reg(struct e1
 			       u16 data);
 extern s32 igb_init_nvm_params_i210(struct e1000_hw *hw);
 extern bool igb_get_flash_presence_i210(struct e1000_hw *hw);
+s32 igb_pll_workaround_i210(struct e1000_hw *hw);
 
 #define E1000_STM_OPCODE		0xDB00
 #define E1000_EEPROM_FLASH_SIZE_WORD	0x11
@@ -93,4 +94,15 @@ enum E1000_INVM_STRUCTURE_TYPE {
 #define NVM_LED_1_CFG_DEFAULT_I211	0x0184
 #define NVM_LED_0_2_CFG_DEFAULT_I211	0x200C
 
+/* PLL Defines */
+#define E1000_PCI_PMCSR			0x44
+#define E1000_PCI_PMCSR_D3		0x03
+#define E1000_MAX_PLL_TRIES		5
+#define E1000_PHY_PLL_UNCONF		0xFF
+#define E1000_PHY_PLL_FREQ_PAGE		0xFC0000
+#define E1000_PHY_PLL_FREQ_REG		0x000E
+#define E1000_INVM_DEFAULT_AL		0x202F
+#define E1000_INVM_AUTOLOAD		0x0A
+#define E1000_INVM_PLL_WO_VAL		0x0010
+
 #endif
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/e1000_regs.h linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/e1000_regs.h
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/e1000_regs.h	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/e1000_regs.h	2014-07-30 12:02:44.000000000 -0400
@@ -69,6 +69,7 @@
 #define E1000_PBA      0x01000  /* Packet Buffer Allocation - RW */
 #define E1000_PBS      0x01008  /* Packet Buffer Size */
 #define E1000_EEMNGCTL 0x01010  /* MNG EEprom Control */
+#define E1000_EEARBC_I210 0x12024  /* EEPROM Auto Read Bus Control */
 #define E1000_EEWR     0x0102C  /* EEPROM Write Register - RW */
 #define E1000_I2CCMD   0x01028  /* SFPI2C Command Register - RW */
 #define E1000_FRTIMER  0x01048  /* Free Running Timer - RW */
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/igb_main.c linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/igb_main.c
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/intel/igb/igb_main.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/intel/igb/igb_main.c	2014-07-30 12:02:44.000000000 -0400
@@ -6918,6 +6918,20 @@ static int igb_ioctl(struct net_device *
 	}
 }
 
+void igb_read_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value)
+{
+	struct igb_adapter *adapter = hw->back;
+
+	pci_read_config_word(adapter->pdev, reg, value);
+}
+
+void igb_write_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value)
+{
+	struct igb_adapter *adapter = hw->back;
+
+	pci_write_config_word(adapter->pdev, reg, *value);
+}
+
 s32 igb_read_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value)
 {
 	struct igb_adapter *adapter = hw->back;
@@ -7281,6 +7295,8 @@ static int igb_sriov_reinit(struct pci_d
 
 	if (netif_running(netdev))
 		igb_close(netdev);
+	else
+		igb_reset(adapter);
 
 	igb_clear_interrupt_scheme(adapter);
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/marvell/mvneta.c linux-libre-3.12.26-gnu/drivers/net/ethernet/marvell/mvneta.c
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/marvell/mvneta.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/marvell/mvneta.c	2014-07-30 12:02:44.000000000 -0400
@@ -2358,7 +2358,7 @@ static void mvneta_adjust_link(struct ne
 
 			if (phydev->speed == SPEED_1000)
 				val |= MVNETA_GMAC_CONFIG_GMII_SPEED;
-			else
+			else if (phydev->speed == SPEED_100)
 				val |= MVNETA_GMAC_CONFIG_MII_SPEED;
 
 			mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, val);
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ethernet/sun/sunvnet.c linux-libre-3.12.26-gnu/drivers/net/ethernet/sun/sunvnet.c
--- linux-libre-3.12.25-gnu/drivers/net/ethernet/sun/sunvnet.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ethernet/sun/sunvnet.c	2014-07-30 12:02:44.000000000 -0400
@@ -1083,6 +1083,24 @@ static struct vnet *vnet_find_or_create(
 	return vp;
 }
 
+static void vnet_cleanup(void)
+{
+	struct vnet *vp;
+	struct net_device *dev;
+
+	mutex_lock(&vnet_list_mutex);
+	while (!list_empty(&vnet_list)) {
+		vp = list_first_entry(&vnet_list, struct vnet, list);
+		list_del(&vp->list);
+		dev = vp->dev;
+		/* vio_unregister_driver() should have cleaned up port_list */
+		BUG_ON(!list_empty(&vp->port_list));
+		unregister_netdev(dev);
+		free_netdev(dev);
+	}
+	mutex_unlock(&vnet_list_mutex);
+}
+
 static const char *local_mac_prop = "local-mac-address";
 
 static struct vnet *vnet_find_parent(struct mdesc_handle *hp,
@@ -1240,7 +1258,6 @@ static int vnet_port_remove(struct vio_d
 
 		kfree(port);
 
-		unregister_netdev(vp->dev);
 	}
 	return 0;
 }
@@ -1268,6 +1285,7 @@ static int __init vnet_init(void)
 static void __exit vnet_exit(void)
 {
 	vio_unregister_driver(&vnet_port_driver);
+	vnet_cleanup();
 }
 
 module_init(vnet_init);
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/ppp/pppoe.c linux-libre-3.12.26-gnu/drivers/net/ppp/pppoe.c
--- linux-libre-3.12.25-gnu/drivers/net/ppp/pppoe.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/ppp/pppoe.c	2014-07-30 12:02:44.000000000 -0400
@@ -675,7 +675,7 @@ static int pppoe_connect(struct socket *
 		po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
 				   dev->hard_header_len);
 
-		po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr);
+		po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
 		po->chan.private = sk;
 		po->chan.ops = &pppoe_chan_ops;
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/slip/slip.c linux-libre-3.12.26-gnu/drivers/net/slip/slip.c
--- linux-libre-3.12.25-gnu/drivers/net/slip/slip.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/slip/slip.c	2014-07-30 12:02:44.000000000 -0400
@@ -83,6 +83,7 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/workqueue.h>
 #include "slip.h"
 #ifdef CONFIG_INET
 #include <linux/ip.h>
@@ -416,36 +417,46 @@ static void sl_encaps(struct slip *sl, u
 #endif
 }
 
-/*
- * Called by the driver when there's room for more data.  If we have
- * more packets to send, we send them here.
- */
-static void slip_write_wakeup(struct tty_struct *tty)
+/* Write out any remaining transmit buffer. Scheduled when tty is writable */
+static void slip_transmit(struct work_struct *work)
 {
+	struct slip *sl = container_of(work, struct slip, tx_work);
 	int actual;
-	struct slip *sl = tty->disc_data;
 
+	spin_lock_bh(&sl->lock);
 	/* First make sure we're connected. */
-	if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
+	if (!sl->tty || sl->magic != SLIP_MAGIC || !netif_running(sl->dev)) {
+		spin_unlock_bh(&sl->lock);
 		return;
+	}
 
-	spin_lock_bh(&sl->lock);
 	if (sl->xleft <= 0)  {
 		/* Now serial buffer is almost free & we can start
 		 * transmission of another packet */
 		sl->dev->stats.tx_packets++;
-		clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+		clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
 		spin_unlock_bh(&sl->lock);
 		sl_unlock(sl);
 		return;
 	}
 
-	actual = tty->ops->write(tty, sl->xhead, sl->xleft);
+	actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft);
 	sl->xleft -= actual;
 	sl->xhead += actual;
 	spin_unlock_bh(&sl->lock);
 }
 
+/*
+ * Called by the driver when there's room for more data.
+ * Schedule the transmit.
+ */
+static void slip_write_wakeup(struct tty_struct *tty)
+{
+	struct slip *sl = tty->disc_data;
+
+	schedule_work(&sl->tx_work);
+}
+
 static void sl_tx_timeout(struct net_device *dev)
 {
 	struct slip *sl = netdev_priv(dev);
@@ -749,6 +760,7 @@ static struct slip *sl_alloc(dev_t line)
 	sl->magic       = SLIP_MAGIC;
 	sl->dev	      	= dev;
 	spin_lock_init(&sl->lock);
+	INIT_WORK(&sl->tx_work, slip_transmit);
 	sl->mode        = SL_MODE_DEFAULT;
 #ifdef CONFIG_SLIP_SMART
 	/* initialize timer_list struct */
@@ -872,8 +884,12 @@ static void slip_close(struct tty_struct
 	if (!sl || sl->magic != SLIP_MAGIC || sl->tty != tty)
 		return;
 
+	spin_lock_bh(&sl->lock);
 	tty->disc_data = NULL;
 	sl->tty = NULL;
+	spin_unlock_bh(&sl->lock);
+
+	flush_work(&sl->tx_work);
 
 	/* VSV = very important to remove timers */
 #ifdef CONFIG_SLIP_SMART
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/slip/slip.h linux-libre-3.12.26-gnu/drivers/net/slip/slip.h
--- linux-libre-3.12.25-gnu/drivers/net/slip/slip.h	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/slip/slip.h	2014-07-30 12:02:44.000000000 -0400
@@ -53,6 +53,7 @@ struct slip {
   struct tty_struct	*tty;		/* ptr to TTY structure		*/
   struct net_device	*dev;		/* easy for intr handling	*/
   spinlock_t		lock;
+  struct work_struct	tx_work;	/* Flushes transmit buffer	*/
 
 #ifdef SL_INCLUDE_CSLIP
   struct slcompress	*slcomp;	/* for header compression 	*/
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/usb/qmi_wwan.c linux-libre-3.12.26-gnu/drivers/net/usb/qmi_wwan.c
--- linux-libre-3.12.25-gnu/drivers/net/usb/qmi_wwan.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/usb/qmi_wwan.c	2014-07-30 12:02:44.000000000 -0400
@@ -647,6 +647,7 @@ static const struct usb_device_id produc
 	{QMI_FIXED_INTF(0x05c6, 0x9084, 4)},
 	{QMI_FIXED_INTF(0x05c6, 0x920d, 0)},
 	{QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
+	{QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
 	{QMI_FIXED_INTF(0x12d1, 0x140c, 1)},	/* Huawei E173 */
 	{QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},	/* Huawei E1820 */
 	{QMI_FIXED_INTF(0x16d8, 0x6003, 0)},	/* CMOTech 6003 */
@@ -721,6 +722,7 @@ static const struct usb_device_id produc
 	{QMI_FIXED_INTF(0x19d2, 0x1424, 2)},
 	{QMI_FIXED_INTF(0x19d2, 0x1425, 2)},
 	{QMI_FIXED_INTF(0x19d2, 0x1426, 2)},	/* ZTE MF91 */
+	{QMI_FIXED_INTF(0x19d2, 0x1428, 2)},	/* Telewell TW-LTE 4G v2 */
 	{QMI_FIXED_INTF(0x19d2, 0x2002, 4)},	/* ZTE (Vodafone) K3765-Z */
 	{QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
 	{QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
@@ -733,6 +735,7 @@ static const struct usb_device_id produc
 	{QMI_FIXED_INTF(0x1199, 0x901f, 8)},    /* Sierra Wireless EM7355 */
 	{QMI_FIXED_INTF(0x1199, 0x9041, 8)},	/* Sierra Wireless MC7305/MC7355 */
 	{QMI_FIXED_INTF(0x1199, 0x9051, 8)},	/* Netgear AirCard 340U */
+	{QMI_FIXED_INTF(0x1199, 0x9057, 8)},
 	{QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},	/* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
 	{QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},	/* Alcatel L800MA */
 	{QMI_FIXED_INTF(0x2357, 0x0201, 4)},	/* TP-LINK HSUPA Modem MA180 */
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/wireless/iwlwifi/dvm/rxon.c linux-libre-3.12.26-gnu/drivers/net/wireless/iwlwifi/dvm/rxon.c
--- linux-libre-3.12.25-gnu/drivers/net/wireless/iwlwifi/dvm/rxon.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/wireless/iwlwifi/dvm/rxon.c	2014-07-30 12:02:44.000000000 -0400
@@ -1068,13 +1068,6 @@ int iwlagn_commit_rxon(struct iwl_priv *
 	/* recalculate basic rates */
 	iwl_calc_basic_rates(priv, ctx);
 
-	/*
-	 * force CTS-to-self frames protection if RTS-CTS is not preferred
-	 * one aggregation protection method
-	 */
-	if (!priv->hw_params.use_rts_for_aggregation)
-		ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
-
 	if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) ||
 	    !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK))
 		ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
@@ -1480,11 +1473,6 @@ void iwlagn_bss_info_changed(struct ieee
 	else
 		ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
 
-	if (bss_conf->use_cts_prot)
-		ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
-	else
-		ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN;
-
 	memcpy(ctx->staging.bssid_addr, bss_conf->bssid, ETH_ALEN);
 
 	if (vif->type == NL80211_IFTYPE_AP ||
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/net/wireless/mwifiex/main.c linux-libre-3.12.26-gnu/drivers/net/wireless/mwifiex/main.c
--- linux-libre-3.12.25-gnu/drivers/net/wireless/mwifiex/main.c	2014-07-23 02:39:30.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/net/wireless/mwifiex/main.c	2014-08-01 13:39:11.000000000 -0400
@@ -654,6 +654,7 @@ mwifiex_hard_start_xmit(struct sk_buff *
 	}
 
 	tx_info = MWIFIEX_SKB_TXCB(skb);
+	memset(tx_info, 0, sizeof(*tx_info));
 	tx_info->bss_num = priv->bss_num;
 	tx_info->bss_type = priv->bss_type;
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/tty/serial/sirfsoc_uart.c linux-libre-3.12.26-gnu/drivers/tty/serial/sirfsoc_uart.c
--- linux-libre-3.12.25-gnu/drivers/tty/serial/sirfsoc_uart.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/tty/serial/sirfsoc_uart.c	2014-07-30 12:02:44.000000000 -0400
@@ -359,9 +359,11 @@ static irqreturn_t sirfsoc_uart_usp_cts_
 {
 	struct sirfsoc_uart_port *sirfport = (struct sirfsoc_uart_port *)dev_id;
 	struct uart_port *port = &sirfport->port;
+	spin_lock(&port->lock);
 	if (gpio_is_valid(sirfport->cts_gpio) && sirfport->ms_enabled)
 		uart_handle_cts_change(port,
 				!gpio_get_value(sirfport->cts_gpio));
+	spin_unlock(&port->lock);
 	return IRQ_HANDLED;
 }
 
@@ -429,10 +431,6 @@ sirfsoc_uart_pio_rx_chars(struct uart_po
 	sirfport->rx_io_count += rx_count;
 	port->icount.rx += rx_count;
 
-	spin_unlock(&port->lock);
-	tty_flip_buffer_push(&port->state->port);
-	spin_lock(&port->lock);
-
 	return rx_count;
 }
 
@@ -466,6 +464,7 @@ static void sirfsoc_uart_tx_dma_complete
 	struct circ_buf *xmit = &port->state->xmit;
 	unsigned long flags;
 
+	spin_lock_irqsave(&port->lock, flags);
 	xmit->tail = (xmit->tail + sirfport->transfer_size) &
 				(UART_XMIT_SIZE - 1);
 	port->icount.tx += sirfport->transfer_size;
@@ -474,10 +473,9 @@ static void sirfsoc_uart_tx_dma_complete
 	if (sirfport->tx_dma_addr)
 		dma_unmap_single(port->dev, sirfport->tx_dma_addr,
 				sirfport->transfer_size, DMA_TO_DEVICE);
-	spin_lock_irqsave(&sirfport->tx_lock, flags);
 	sirfport->tx_dma_state = TX_DMA_IDLE;
 	sirfsoc_uart_tx_with_dma(sirfport);
-	spin_unlock_irqrestore(&sirfport->tx_lock, flags);
+	spin_unlock_irqrestore(&port->lock, flags);
 }
 
 static void sirfsoc_uart_insert_rx_buf_to_tty(
@@ -490,7 +488,6 @@ static void sirfsoc_uart_insert_rx_buf_t
 	inserted = tty_insert_flip_string(tport,
 		sirfport->rx_dma_items[sirfport->rx_completed].xmit.buf, count);
 	port->icount.rx += inserted;
-	tty_flip_buffer_push(tport);
 }
 
 static void sirfsoc_rx_submit_one_dma_desc(struct uart_port *port, int index)
@@ -525,7 +522,7 @@ static void sirfsoc_rx_tmo_process_tl(un
 	unsigned int count;
 	unsigned long flags;
 
-	spin_lock_irqsave(&sirfport->rx_lock, flags);
+	spin_lock_irqsave(&port->lock, flags);
 	while (sirfport->rx_completed != sirfport->rx_issued) {
 		sirfsoc_uart_insert_rx_buf_to_tty(sirfport,
 					SIRFSOC_RX_DMA_BUF_SIZE);
@@ -540,12 +537,8 @@ static void sirfsoc_rx_tmo_process_tl(un
 	wr_regl(port, ureg->sirfsoc_rx_dma_io_ctrl,
 			rd_regl(port, ureg->sirfsoc_rx_dma_io_ctrl) |
 			SIRFUART_IO_MODE);
-	spin_unlock_irqrestore(&sirfport->rx_lock, flags);
-	spin_lock(&port->lock);
 	sirfsoc_uart_pio_rx_chars(port, 4 - sirfport->rx_io_count);
-	spin_unlock(&port->lock);
 	if (sirfport->rx_io_count == 4) {
-		spin_lock_irqsave(&sirfport->rx_lock, flags);
 		sirfport->rx_io_count = 0;
 		wr_regl(port, ureg->sirfsoc_int_st_reg,
 				uint_st->sirfsoc_rx_done);
@@ -556,11 +549,8 @@ static void sirfsoc_rx_tmo_process_tl(un
 		else
 			wr_regl(port, SIRFUART_INT_EN_CLR,
 					uint_en->sirfsoc_rx_done_en);
-		spin_unlock_irqrestore(&sirfport->rx_lock, flags);
-
 		sirfsoc_uart_start_next_rx_dma(port);
 	} else {
-		spin_lock_irqsave(&sirfport->rx_lock, flags);
 		wr_regl(port, ureg->sirfsoc_int_st_reg,
 				uint_st->sirfsoc_rx_done);
 		if (!sirfport->is_marco)
@@ -570,8 +560,9 @@ static void sirfsoc_rx_tmo_process_tl(un
 		else
 			wr_regl(port, ureg->sirfsoc_int_en_reg,
 					uint_en->sirfsoc_rx_done_en);
-		spin_unlock_irqrestore(&sirfport->rx_lock, flags);
 	}
+	spin_unlock_irqrestore(&port->lock, flags);
+	tty_flip_buffer_push(&port->state->port);
 }
 
 static void sirfsoc_uart_handle_rx_tmo(struct sirfsoc_uart_port *sirfport)
@@ -580,8 +571,6 @@ static void sirfsoc_uart_handle_rx_tmo(s
 	struct sirfsoc_register *ureg = &sirfport->uart_reg->uart_reg;
 	struct sirfsoc_int_en *uint_en = &sirfport->uart_reg->uart_int_en;
 	struct dma_tx_state tx_state;
-	spin_lock(&sirfport->rx_lock);
-
 	dmaengine_tx_status(sirfport->rx_dma_chan,
 		sirfport->rx_dma_items[sirfport->rx_issued].cookie, &tx_state);
 	dmaengine_terminate_all(sirfport->rx_dma_chan);
@@ -594,7 +583,6 @@ static void sirfsoc_uart_handle_rx_tmo(s
 	else
 		wr_regl(port, SIRFUART_INT_EN_CLR,
 				uint_en->sirfsoc_rx_timeout_en);
-	spin_unlock(&sirfport->rx_lock);
 	tasklet_schedule(&sirfport->rx_tmo_process_tasklet);
 }
 
@@ -658,7 +646,6 @@ static irqreturn_t sirfsoc_uart_isr(int
 		intr_status &= port->read_status_mask;
 		uart_insert_char(port, intr_status,
 					uint_en->sirfsoc_rx_oflow_en, 0, flag);
-		tty_flip_buffer_push(&state->port);
 	}
 recv_char:
 	if ((sirfport->uart_reg->uart_type == SIRF_REAL_UART) &&
@@ -683,6 +670,9 @@ recv_char:
 			sirfsoc_uart_pio_rx_chars(port,
 					SIRFSOC_UART_IO_RX_MAX_CNT);
 	}
+	spin_unlock(&port->lock);
+	tty_flip_buffer_push(&state->port);
+	spin_lock(&port->lock);
 	if (intr_status & uint_st->sirfsoc_txfifo_empty) {
 		if (IS_DMA_CHAN_VALID(sirfport->tx_dma_no))
 			sirfsoc_uart_tx_with_dma(sirfport);
@@ -701,6 +691,7 @@ recv_char:
 		}
 	}
 	spin_unlock(&port->lock);
+
 	return IRQ_HANDLED;
 }
 
@@ -709,24 +700,27 @@ static void sirfsoc_uart_rx_dma_complete
 	struct sirfsoc_uart_port *sirfport = (struct sirfsoc_uart_port *)param;
 	struct uart_port *port = &sirfport->port;
 	unsigned long flags;
-	spin_lock_irqsave(&sirfport->rx_lock, flags);
+	spin_lock_irqsave(&port->lock, flags);
 	while (sirfport->rx_completed != sirfport->rx_issued) {
 		sirfsoc_uart_insert_rx_buf_to_tty(sirfport,
 					SIRFSOC_RX_DMA_BUF_SIZE);
 		sirfsoc_rx_submit_one_dma_desc(port, sirfport->rx_completed++);
 		sirfport->rx_completed %= SIRFSOC_RX_LOOP_BUF_CNT;
 	}
-	spin_unlock_irqrestore(&sirfport->rx_lock, flags);
+	spin_unlock_irqrestore(&port->lock, flags);
+	tty_flip_buffer_push(&port->state->port);
 }
 
 static void sirfsoc_uart_rx_dma_complete_callback(void *param)
 {
 	struct sirfsoc_uart_port *sirfport = (struct sirfsoc_uart_port *)param;
-	spin_lock(&sirfport->rx_lock);
+	unsigned long flags;
+
+	spin_lock_irqsave(&sirfport->port.lock, flags);
 	sirfport->rx_issued++;
 	sirfport->rx_issued %= SIRFSOC_RX_LOOP_BUF_CNT;
-	spin_unlock(&sirfport->rx_lock);
 	tasklet_schedule(&sirfport->rx_dma_complete_tasklet);
+	spin_unlock_irqrestore(&sirfport->port.lock, flags);
 }
 
 /* submit rx dma task into dmaengine */
@@ -735,18 +729,14 @@ static void sirfsoc_uart_start_next_rx_d
 	struct sirfsoc_uart_port *sirfport = to_sirfport(port);
 	struct sirfsoc_register *ureg = &sirfport->uart_reg->uart_reg;
 	struct sirfsoc_int_en *uint_en = &sirfport->uart_reg->uart_int_en;
-	unsigned long flags;
 	int i;
-	spin_lock_irqsave(&sirfport->rx_lock, flags);
 	sirfport->rx_io_count = 0;
 	wr_regl(port, ureg->sirfsoc_rx_dma_io_ctrl,
 		rd_regl(port, ureg->sirfsoc_rx_dma_io_ctrl) &
 		~SIRFUART_IO_MODE);
-	spin_unlock_irqrestore(&sirfport->rx_lock, flags);
 	for (i = 0; i < SIRFSOC_RX_LOOP_BUF_CNT; i++)
 		sirfsoc_rx_submit_one_dma_desc(port, i);
 	sirfport->rx_completed = sirfport->rx_issued = 0;
-	spin_lock_irqsave(&sirfport->rx_lock, flags);
 	if (!sirfport->is_marco)
 		wr_regl(port, ureg->sirfsoc_int_en_reg,
 				rd_regl(port, ureg->sirfsoc_int_en_reg) |
@@ -754,7 +744,6 @@ static void sirfsoc_uart_start_next_rx_d
 	else
 		wr_regl(port, ureg->sirfsoc_int_en_reg,
 			SIRFUART_RX_DMA_INT_EN(port, uint_en));
-	spin_unlock_irqrestore(&sirfport->rx_lock, flags);
 }
 
 static void sirfsoc_uart_start_rx(struct uart_port *port)
@@ -1455,8 +1444,6 @@ usp_no_flow_control:
 		ret = -EFAULT;
 		goto err;
 	}
-	spin_lock_init(&sirfport->rx_lock);
-	spin_lock_init(&sirfport->tx_lock);
 	tasklet_init(&sirfport->rx_dma_complete_tasklet,
 			sirfsoc_uart_rx_dma_complete_tl, (unsigned long)sirfport);
 	tasklet_init(&sirfport->rx_tmo_process_tasklet,
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/tty/serial/sirfsoc_uart.h linux-libre-3.12.26-gnu/drivers/tty/serial/sirfsoc_uart.h
--- linux-libre-3.12.25-gnu/drivers/tty/serial/sirfsoc_uart.h	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/tty/serial/sirfsoc_uart.h	2014-07-30 12:02:44.000000000 -0400
@@ -438,8 +438,6 @@ struct sirfsoc_uart_port {
 	struct dma_chan			*tx_dma_chan;
 	dma_addr_t			tx_dma_addr;
 	struct dma_async_tx_descriptor	*tx_dma_desc;
-	spinlock_t			rx_lock;
-	spinlock_t			tx_lock;
 	struct tasklet_struct		rx_dma_complete_tasklet;
 	struct tasklet_struct		rx_tmo_process_tasklet;
 	unsigned int			rx_io_count;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/usb/chipidea/udc.c linux-libre-3.12.26-gnu/drivers/usb/chipidea/udc.c
--- linux-libre-3.12.25-gnu/drivers/usb/chipidea/udc.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/usb/chipidea/udc.c	2014-07-30 12:02:44.000000000 -0400
@@ -1178,8 +1178,8 @@ static int ep_enable(struct usb_ep *ep,
 
 	if (hwep->type == USB_ENDPOINT_XFER_CONTROL)
 		cap |= QH_IOS;
-	if (hwep->num)
-		cap |= QH_ZLT;
+
+	cap |= QH_ZLT;
 	cap |= (hwep->ep.maxpacket << __ffs(QH_MAX_PKT)) & QH_MAX_PKT;
 	/*
 	 * For ISO-TX, we set mult at QH as the largest value, and use
diff -druNp --no-dereference linux-libre-3.12.25-gnu/drivers/usb/core/hub.c linux-libre-3.12.26-gnu/drivers/usb/core/hub.c
--- linux-libre-3.12.25-gnu/drivers/usb/core/hub.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/drivers/usb/core/hub.c	2014-07-30 12:02:44.000000000 -0400
@@ -891,6 +891,25 @@ static int hub_usb3_port_disable(struct
 	if (!hub_is_superspeed(hub->hdev))
 		return -EINVAL;
 
+	ret = hub_port_status(hub, port1, &portstatus, &portchange);
+	if (ret < 0)
+		return ret;
+
+	/*
+	 * USB controller Advanced Micro Devices, Inc. [AMD] FCH USB XHCI
+	 * Controller [1022:7814] will have spurious result making the following
+	 * usb 3.0 device hotplugging route to the 2.0 root hub and recognized
+	 * as high-speed device if we set the usb 3.0 port link state to
+	 * Disabled. Since it's already in USB_SS_PORT_LS_RX_DETECT state, we
+	 * check the state here to avoid the bug.
+	 */
+	if ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+				USB_SS_PORT_LS_RX_DETECT) {
+		dev_dbg(&hub->ports[port1 - 1]->dev,
+			 "Not disabling port; link state is RxDetect\n");
+		return ret;
+	}
+
 	ret = hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_SS_DISABLED);
 	if (ret)
 		return ret;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/fs/aio.c linux-libre-3.12.26-gnu/fs/aio.c
--- linux-libre-3.12.25-gnu/fs/aio.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/fs/aio.c	2014-07-30 12:02:44.000000000 -0400
@@ -830,16 +830,20 @@ void exit_aio(struct mm_struct *mm)
 static void put_reqs_available(struct kioctx *ctx, unsigned nr)
 {
 	struct kioctx_cpu *kcpu;
+	unsigned long flags;
 
 	preempt_disable();
 	kcpu = this_cpu_ptr(ctx->cpu);
 
+	local_irq_save(flags);
 	kcpu->reqs_available += nr;
+
 	while (kcpu->reqs_available >= ctx->req_batch * 2) {
 		kcpu->reqs_available -= ctx->req_batch;
 		atomic_add(ctx->req_batch, &ctx->reqs_available);
 	}
 
+	local_irq_restore(flags);
 	preempt_enable();
 }
 
@@ -847,10 +851,12 @@ static bool get_reqs_available(struct ki
 {
 	struct kioctx_cpu *kcpu;
 	bool ret = false;
+	unsigned long flags;
 
 	preempt_disable();
 	kcpu = this_cpu_ptr(ctx->cpu);
 
+	local_irq_save(flags);
 	if (!kcpu->reqs_available) {
 		int old, avail = atomic_read(&ctx->reqs_available);
 
@@ -869,6 +875,7 @@ static bool get_reqs_available(struct ki
 	ret = true;
 	kcpu->reqs_available--;
 out:
+	local_irq_restore(flags);
 	preempt_enable();
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.12.25-gnu/fs/coredump.c linux-libre-3.12.26-gnu/fs/coredump.c
--- linux-libre-3.12.25-gnu/fs/coredump.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/fs/coredump.c	2014-07-30 12:02:44.000000000 -0400
@@ -307,7 +307,7 @@ static int zap_threads(struct task_struc
 	if (unlikely(nr < 0))
 		return nr;
 
-	tsk->flags = PF_DUMPCORE;
+	tsk->flags |= PF_DUMPCORE;
 	if (atomic_read(&mm->mm_users) == nr + 1)
 		goto done;
 	/*
diff -druNp --no-dereference linux-libre-3.12.25-gnu/fs/fuse/dir.c linux-libre-3.12.26-gnu/fs/fuse/dir.c
--- linux-libre-3.12.25-gnu/fs/fuse/dir.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/fs/fuse/dir.c	2014-07-30 12:02:44.000000000 -0400
@@ -188,7 +188,8 @@ static int fuse_dentry_revalidate(struct
 	inode = ACCESS_ONCE(entry->d_inode);
 	if (inode && is_bad_inode(inode))
 		goto invalid;
-	else if (fuse_dentry_time(entry) < get_jiffies_64()) {
+	else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) ||
+		 (flags & LOOKUP_REVAL)) {
 		int err;
 		struct fuse_entry_out outarg;
 		struct fuse_req *req;
@@ -945,7 +946,7 @@ int fuse_update_attributes(struct inode
 	int err;
 	bool r;
 
-	if (fi->i_time < get_jiffies_64()) {
+	if (time_before64(fi->i_time, get_jiffies_64())) {
 		r = true;
 		err = fuse_do_getattr(inode, stat, file);
 	} else {
@@ -1131,7 +1132,7 @@ static int fuse_permission(struct inode
 	    ((mask & MAY_EXEC) && S_ISREG(inode->i_mode))) {
 		struct fuse_inode *fi = get_fuse_inode(inode);
 
-		if (fi->i_time < get_jiffies_64()) {
+		if (time_before64(fi->i_time, get_jiffies_64())) {
 			refreshed = true;
 
 			err = fuse_perm_getattr(inode, mask);
diff -druNp --no-dereference linux-libre-3.12.25-gnu/fs/fuse/inode.c linux-libre-3.12.26-gnu/fs/fuse/inode.c
--- linux-libre-3.12.25-gnu/fs/fuse/inode.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/fs/fuse/inode.c	2014-07-30 12:02:44.000000000 -0400
@@ -461,6 +461,17 @@ static const match_table_t tokens = {
 	{OPT_ERR,			NULL}
 };
 
+static int fuse_match_uint(substring_t *s, unsigned int *res)
+{
+	int err = -ENOMEM;
+	char *buf = match_strdup(s);
+	if (buf) {
+		err = kstrtouint(buf, 10, res);
+		kfree(buf);
+	}
+	return err;
+}
+
 static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev)
 {
 	char *p;
@@ -471,6 +482,7 @@ static int parse_fuse_opt(char *opt, str
 	while ((p = strsep(&opt, ",")) != NULL) {
 		int token;
 		int value;
+		unsigned uv;
 		substring_t args[MAX_OPT_ARGS];
 		if (!*p)
 			continue;
@@ -494,18 +506,18 @@ static int parse_fuse_opt(char *opt, str
 			break;
 
 		case OPT_USER_ID:
-			if (match_int(&args[0], &value))
+			if (fuse_match_uint(&args[0], &uv))
 				return 0;
-			d->user_id = make_kuid(current_user_ns(), value);
+			d->user_id = make_kuid(current_user_ns(), uv);
 			if (!uid_valid(d->user_id))
 				return 0;
 			d->user_id_present = 1;
 			break;
 
 		case OPT_GROUP_ID:
-			if (match_int(&args[0], &value))
+			if (fuse_match_uint(&args[0], &uv))
 				return 0;
-			d->group_id = make_kgid(current_user_ns(), value);
+			d->group_id = make_kgid(current_user_ns(), uv);
 			if (!gid_valid(d->group_id))
 				return 0;
 			d->group_id_present = 1;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/fs/namei.c linux-libre-3.12.26-gnu/fs/namei.c
--- linux-libre-3.12.25-gnu/fs/namei.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/fs/namei.c	2014-07-30 12:02:44.000000000 -0400
@@ -2281,9 +2281,10 @@ done:
 		goto out;
 	}
 	path->dentry = dentry;
-	path->mnt = mntget(nd->path.mnt);
+	path->mnt = nd->path.mnt;
 	if (should_follow_link(dentry->d_inode, nd->flags & LOOKUP_FOLLOW))
 		return 1;
+	mntget(path->mnt);
 	follow_mount(path);
 	error = 0;
 out:
diff -druNp --no-dereference linux-libre-3.12.25-gnu/fs/quota/dquot.c linux-libre-3.12.26-gnu/fs/quota/dquot.c
--- linux-libre-3.12.25-gnu/fs/quota/dquot.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/fs/quota/dquot.c	2014-07-30 12:02:44.000000000 -0400
@@ -702,6 +702,7 @@ dqcache_shrink_scan(struct shrinker *shr
 	struct dquot *dquot;
 	unsigned long freed = 0;
 
+	spin_lock(&dq_list_lock);
 	head = free_dquots.prev;
 	while (head != &free_dquots && sc->nr_to_scan) {
 		dquot = list_entry(head, struct dquot, dq_free);
@@ -713,6 +714,7 @@ dqcache_shrink_scan(struct shrinker *shr
 		freed++;
 		head = free_dquots.prev;
 	}
+	spin_unlock(&dq_list_lock);
 	return freed;
 }
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/include/linux/libata.h linux-libre-3.12.26-gnu/include/linux/libata.h
--- linux-libre-3.12.25-gnu/include/linux/libata.h	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/include/linux/libata.h	2014-07-30 12:02:44.000000000 -0400
@@ -593,6 +593,7 @@ struct ata_host {
 	struct device 		*dev;
 	void __iomem * const	*iomap;
 	unsigned int		n_ports;
+	unsigned int		n_tags;			/* nr of NCQ tags */
 	void			*private_data;
 	struct ata_port_operations *ops;
 	unsigned long		flags;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/include/net/sock.h linux-libre-3.12.26-gnu/include/net/sock.h
--- linux-libre-3.12.25-gnu/include/net/sock.h	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/include/net/sock.h	2014-07-30 12:02:44.000000000 -0400
@@ -1749,8 +1749,8 @@ sk_dst_get(struct sock *sk)
 
 	rcu_read_lock();
 	dst = rcu_dereference(sk->sk_dst_cache);
-	if (dst)
-		dst_hold(dst);
+	if (dst && !atomic_inc_not_zero(&dst->__refcnt))
+		dst = NULL;
 	rcu_read_unlock();
 	return dst;
 }
@@ -1789,9 +1789,11 @@ __sk_dst_set(struct sock *sk, struct dst
 static inline void
 sk_dst_set(struct sock *sk, struct dst_entry *dst)
 {
-	spin_lock(&sk->sk_dst_lock);
-	__sk_dst_set(sk, dst);
-	spin_unlock(&sk->sk_dst_lock);
+	struct dst_entry *old_dst;
+
+	sk_tx_queue_clear(sk);
+	old_dst = xchg(&sk->sk_dst_cache, dst);
+	dst_release(old_dst);
 }
 
 static inline void
@@ -1803,9 +1805,7 @@ __sk_dst_reset(struct sock *sk)
 static inline void
 sk_dst_reset(struct sock *sk)
 {
-	spin_lock(&sk->sk_dst_lock);
-	__sk_dst_reset(sk);
-	spin_unlock(&sk->sk_dst_lock);
+	sk_dst_set(sk, NULL);
 }
 
 extern struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie);
diff -druNp --no-dereference linux-libre-3.12.25-gnu/kernel/Kconfig.locks linux-libre-3.12.26-gnu/kernel/Kconfig.locks
--- linux-libre-3.12.25-gnu/kernel/Kconfig.locks	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/kernel/Kconfig.locks	2014-07-30 12:02:44.000000000 -0400
@@ -220,6 +220,9 @@ config INLINE_WRITE_UNLOCK_IRQRESTORE
 
 endif
 
+config ARCH_SUPPORTS_ATOMIC_RMW
+	bool
+
 config MUTEX_SPIN_ON_OWNER
 	def_bool y
-	depends on SMP && !DEBUG_MUTEXES
+	depends on SMP && !DEBUG_MUTEXES && ARCH_SUPPORTS_ATOMIC_RMW
diff -druNp --no-dereference linux-libre-3.12.25-gnu/kernel/power/process.c linux-libre-3.12.26-gnu/kernel/power/process.c
--- linux-libre-3.12.25-gnu/kernel/power/process.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/kernel/power/process.c	2014-07-30 12:02:44.000000000 -0400
@@ -184,6 +184,7 @@ void thaw_processes(void)
 
 	printk("Restarting tasks ... ");
 
+	__usermodehelper_set_disable_depth(UMH_FREEZING);
 	thaw_workqueues();
 
 	read_lock(&tasklist_lock);
diff -druNp --no-dereference linux-libre-3.12.25-gnu/kernel/sched/debug.c linux-libre-3.12.26-gnu/kernel/sched/debug.c
--- linux-libre-3.12.25-gnu/kernel/sched/debug.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/kernel/sched/debug.c	2014-07-30 12:02:44.000000000 -0400
@@ -554,7 +554,7 @@ void proc_sched_show_task(struct task_st
 
 		avg_atom = p->se.sum_exec_runtime;
 		if (nr_switches)
-			do_div(avg_atom, nr_switches);
+			avg_atom = div64_ul(avg_atom, nr_switches);
 		else
 			avg_atom = -1LL;
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/kernel/time/alarmtimer.c linux-libre-3.12.26-gnu/kernel/time/alarmtimer.c
--- linux-libre-3.12.25-gnu/kernel/time/alarmtimer.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/kernel/time/alarmtimer.c	2014-07-30 12:02:44.000000000 -0400
@@ -585,9 +585,14 @@ static int alarm_timer_set(struct k_itim
 				struct itimerspec *new_setting,
 				struct itimerspec *old_setting)
 {
+	ktime_t exp;
+
 	if (!rtcdev)
 		return -ENOTSUPP;
 
+	if (flags & ~TIMER_ABSTIME)
+		return -EINVAL;
+
 	if (old_setting)
 		alarm_timer_get(timr, old_setting);
 
@@ -597,8 +602,16 @@ static int alarm_timer_set(struct k_itim
 
 	/* start the timer */
 	timr->it.alarm.interval = timespec_to_ktime(new_setting->it_interval);
-	alarm_start(&timr->it.alarm.alarmtimer,
-			timespec_to_ktime(new_setting->it_value));
+	exp = timespec_to_ktime(new_setting->it_value);
+	/* Convert (if necessary) to absolute time */
+	if (flags != TIMER_ABSTIME) {
+		ktime_t now;
+
+		now = alarm_bases[timr->it.alarm.alarmtimer.type].gettime();
+		exp = ktime_add(now, exp);
+	}
+
+	alarm_start(&timr->it.alarm.alarmtimer, exp);
 	return 0;
 }
 
@@ -730,6 +743,9 @@ static int alarm_timer_nsleep(const cloc
 	if (!alarmtimer_get_rtcdev())
 		return -ENOTSUPP;
 
+	if (flags & ~TIMER_ABSTIME)
+		return -EINVAL;
+
 	if (!capable(CAP_WAKE_ALARM))
 		return -EPERM;
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/kernel/trace/ftrace.c linux-libre-3.12.26-gnu/kernel/trace/ftrace.c
--- linux-libre-3.12.25-gnu/kernel/trace/ftrace.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/kernel/trace/ftrace.c	2014-07-30 12:02:44.000000000 -0400
@@ -331,12 +331,12 @@ static void update_ftrace_function(void)
 		func = ftrace_ops_list_func;
 	}
 
+	update_function_graph_func();
+
 	/* If there's no change, then do nothing more here */
 	if (ftrace_trace_function == func)
 		return;
 
-	update_function_graph_func();
-
 	/*
 	 * If we are using the list function, it doesn't care
 	 * about the function_trace_ops.
diff -druNp --no-dereference linux-libre-3.12.25-gnu/kernel/trace/ring_buffer.c linux-libre-3.12.26-gnu/kernel/trace/ring_buffer.c
--- linux-libre-3.12.25-gnu/kernel/trace/ring_buffer.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/kernel/trace/ring_buffer.c	2014-07-30 12:02:44.000000000 -0400
@@ -616,10 +616,6 @@ int ring_buffer_poll_wait(struct ring_bu
 	struct ring_buffer_per_cpu *cpu_buffer;
 	struct rb_irq_work *work;
 
-	if ((cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) ||
-	    (cpu != RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu(buffer, cpu)))
-		return POLLIN | POLLRDNORM;
-
 	if (cpu == RING_BUFFER_ALL_CPUS)
 		work = &buffer->irq_work;
 	else {
diff -druNp --no-dereference linux-libre-3.12.25-gnu/kernel/trace/trace.c linux-libre-3.12.26-gnu/kernel/trace/trace.c
--- linux-libre-3.12.25-gnu/kernel/trace/trace.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/kernel/trace/trace.c	2014-07-30 12:02:44.000000000 -0400
@@ -434,6 +434,12 @@ int __trace_puts(unsigned long ip, const
 	struct print_entry *entry;
 	unsigned long irq_flags;
 	int alloc;
+	int pc;
+
+	if (!(trace_flags & TRACE_ITER_PRINTK))
+		return 0;
+
+	pc = preempt_count();
 
 	if (unlikely(tracing_selftest_running || tracing_disabled))
 		return 0;
@@ -443,7 +449,7 @@ int __trace_puts(unsigned long ip, const
 	local_save_flags(irq_flags);
 	buffer = global_trace.trace_buffer.buffer;
 	event = trace_buffer_lock_reserve(buffer, TRACE_PRINT, alloc, 
-					  irq_flags, preempt_count());
+					  irq_flags, pc);
 	if (!event)
 		return 0;
 
@@ -460,6 +466,7 @@ int __trace_puts(unsigned long ip, const
 		entry->buf[size] = '\0';
 
 	__buffer_unlock_commit(buffer, event);
+	ftrace_trace_stack(buffer, irq_flags, 4, pc);
 
 	return size;
 }
@@ -477,6 +484,12 @@ int __trace_bputs(unsigned long ip, cons
 	struct bputs_entry *entry;
 	unsigned long irq_flags;
 	int size = sizeof(struct bputs_entry);
+	int pc;
+
+	if (!(trace_flags & TRACE_ITER_PRINTK))
+		return 0;
+
+	pc = preempt_count();
 
 	if (unlikely(tracing_selftest_running || tracing_disabled))
 		return 0;
@@ -484,7 +497,7 @@ int __trace_bputs(unsigned long ip, cons
 	local_save_flags(irq_flags);
 	buffer = global_trace.trace_buffer.buffer;
 	event = trace_buffer_lock_reserve(buffer, TRACE_BPUTS, size,
-					  irq_flags, preempt_count());
+					  irq_flags, pc);
 	if (!event)
 		return 0;
 
@@ -493,6 +506,7 @@ int __trace_bputs(unsigned long ip, cons
 	entry->str			= str;
 
 	__buffer_unlock_commit(buffer, event);
+	ftrace_trace_stack(buffer, irq_flags, 4, pc);
 
 	return 1;
 }
@@ -750,7 +764,7 @@ static struct {
 	{ trace_clock_local,	"local",	1 },
 	{ trace_clock_global,	"global",	1 },
 	{ trace_clock_counter,	"counter",	0 },
-	{ trace_clock_jiffies,	"uptime",	1 },
+	{ trace_clock_jiffies,	"uptime",	0 },
 	{ trace_clock,		"perf",		1 },
 	ARCH_TRACE_CLOCKS
 };
diff -druNp --no-dereference linux-libre-3.12.25-gnu/kernel/trace/trace_clock.c linux-libre-3.12.26-gnu/kernel/trace/trace_clock.c
--- linux-libre-3.12.25-gnu/kernel/trace/trace_clock.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/kernel/trace/trace_clock.c	2014-07-30 12:02:44.000000000 -0400
@@ -59,13 +59,14 @@ u64 notrace trace_clock(void)
 
 /*
  * trace_jiffy_clock(): Simply use jiffies as a clock counter.
+ * Note that this use of jiffies_64 is not completely safe on
+ * 32-bit systems. But the window is tiny, and the effect if
+ * we are affected is that we will have an obviously bogus
+ * timestamp on a trace event - i.e. not life threatening.
  */
 u64 notrace trace_clock_jiffies(void)
 {
-	u64 jiffy = jiffies - INITIAL_JIFFIES;
-
-	/* Return nsecs */
-	return (u64)jiffies_to_usecs(jiffy) * 1000ULL;
+	return jiffies_64_to_clock_t(jiffies_64 - INITIAL_JIFFIES);
 }
 
 /*
diff -druNp --no-dereference linux-libre-3.12.25-gnu/Makefile linux-libre-3.12.26-gnu/Makefile
--- linux-libre-3.12.25-gnu/Makefile	2014-07-23 02:30:10.000000000 -0400
+++ linux-libre-3.12.26-gnu/Makefile	2014-08-01 13:29:55.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 12
-SUBLEVEL = 25
+SUBLEVEL = 26
 EXTRAVERSION =-gnu
 NAME = One Giant Leap for Frogkind
 
@@ -614,6 +614,8 @@ KBUILD_CFLAGS	+= -fomit-frame-pointer
 endif
 endif
 
+KBUILD_CFLAGS   += $(call cc-option, -fno-var-tracking-assignments)
+
 ifdef CONFIG_DEBUG_INFO
 KBUILD_CFLAGS	+= -g
 KBUILD_AFLAGS	+= -gdwarf-2
diff -druNp --no-dereference linux-libre-3.12.25-gnu/mm/kmemleak.c linux-libre-3.12.26-gnu/mm/kmemleak.c
--- linux-libre-3.12.25-gnu/mm/kmemleak.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/mm/kmemleak.c	2014-07-30 12:02:44.000000000 -0400
@@ -753,7 +753,9 @@ static void add_scan_area(unsigned long
 	}
 
 	spin_lock_irqsave(&object->lock, flags);
-	if (ptr + size > object->pointer + object->size) {
+	if (size == SIZE_MAX) {
+		size = object->pointer + object->size - ptr;
+	} else if (ptr + size > object->pointer + object->size) {
 		kmemleak_warn("Scan area larger than object 0x%08lx\n", ptr);
 		dump_object_info(object);
 		kmem_cache_free(scan_area_cache, area);
diff -druNp --no-dereference linux-libre-3.12.25-gnu/mm/shmem.c linux-libre-3.12.26-gnu/mm/shmem.c
--- linux-libre-3.12.25-gnu/mm/shmem.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/mm/shmem.c	2014-07-30 12:02:44.000000000 -0400
@@ -80,11 +80,12 @@ static struct vfsmount *shm_mnt;
 #define SHORT_SYMLINK_LEN 128
 
 /*
- * shmem_fallocate and shmem_writepage communicate via inode->i_private
- * (with i_mutex making sure that it has only one user at a time):
- * we would prefer not to enlarge the shmem inode just for that.
+ * shmem_fallocate communicates with shmem_fault or shmem_writepage via
+ * inode->i_private (with i_mutex making sure that it has only one user at
+ * a time): we would prefer not to enlarge the shmem inode just for that.
  */
 struct shmem_falloc {
+	wait_queue_head_t *waitq; /* faults into hole wait for punch to end */
 	pgoff_t start;		/* start of range currently being fallocated */
 	pgoff_t next;		/* the next page offset to be fallocated */
 	pgoff_t nr_falloced;	/* how many new pages have been fallocated */
@@ -533,22 +534,19 @@ static void shmem_undo_range(struct inod
 		return;
 
 	index = start;
-	for ( ; ; ) {
+	while (index < end) {
 		cond_resched();
 		pvec.nr = shmem_find_get_pages_and_swap(mapping, index,
 				min(end - index, (pgoff_t)PAGEVEC_SIZE),
 							pvec.pages, indices);
 		if (!pvec.nr) {
-			if (index == start || unfalloc)
+			/* If all gone or hole-punch or unfalloc, we're done */
+			if (index == start || end != -1)
 				break;
+			/* But if truncating, restart to make sure all gone */
 			index = start;
 			continue;
 		}
-		if ((index == start || unfalloc) && indices[0] >= end) {
-			shmem_deswap_pagevec(&pvec);
-			pagevec_release(&pvec);
-			break;
-		}
 		mem_cgroup_uncharge_start();
 		for (i = 0; i < pagevec_count(&pvec); i++) {
 			struct page *page = pvec.pages[i];
@@ -560,8 +558,12 @@ static void shmem_undo_range(struct inod
 			if (radix_tree_exceptional_entry(page)) {
 				if (unfalloc)
 					continue;
-				nr_swaps_freed += !shmem_free_swap(mapping,
-								index, page);
+				if (shmem_free_swap(mapping, index, page)) {
+					/* Swap was replaced by page: retry */
+					index--;
+					break;
+				}
+				nr_swaps_freed++;
 				continue;
 			}
 
@@ -570,6 +572,11 @@ static void shmem_undo_range(struct inod
 				if (page->mapping == mapping) {
 					VM_BUG_ON(PageWriteback(page));
 					truncate_inode_page(mapping, page);
+				} else {
+					/* Page was replaced by swap: retry */
+					unlock_page(page);
+					index--;
+					break;
 				}
 			}
 			unlock_page(page);
@@ -826,6 +833,7 @@ static int shmem_writepage(struct page *
 			spin_lock(&inode->i_lock);
 			shmem_falloc = inode->i_private;
 			if (shmem_falloc &&
+			    !shmem_falloc->waitq &&
 			    index >= shmem_falloc->start &&
 			    index < shmem_falloc->next)
 				shmem_falloc->nr_unswapped++;
@@ -1300,6 +1308,64 @@ static int shmem_fault(struct vm_area_st
 	int error;
 	int ret = VM_FAULT_LOCKED;
 
+	/*
+	 * Trinity finds that probing a hole which tmpfs is punching can
+	 * prevent the hole-punch from ever completing: which in turn
+	 * locks writers out with its hold on i_mutex.  So refrain from
+	 * faulting pages into the hole while it's being punched.  Although
+	 * shmem_undo_range() does remove the additions, it may be unable to
+	 * keep up, as each new page needs its own unmap_mapping_range() call,
+	 * and the i_mmap tree grows ever slower to scan if new vmas are added.
+	 *
+	 * It does not matter if we sometimes reach this check just before the
+	 * hole-punch begins, so that one fault then races with the punch:
+	 * we just need to make racing faults a rare case.
+	 *
+	 * The implementation below would be much simpler if we just used a
+	 * standard mutex or completion: but we cannot take i_mutex in fault,
+	 * and bloating every shmem inode for this unlikely case would be sad.
+	 */
+	if (unlikely(inode->i_private)) {
+		struct shmem_falloc *shmem_falloc;
+
+		spin_lock(&inode->i_lock);
+		shmem_falloc = inode->i_private;
+		if (shmem_falloc &&
+		    shmem_falloc->waitq &&
+		    vmf->pgoff >= shmem_falloc->start &&
+		    vmf->pgoff < shmem_falloc->next) {
+			wait_queue_head_t *shmem_falloc_waitq;
+			DEFINE_WAIT(shmem_fault_wait);
+
+			ret = VM_FAULT_NOPAGE;
+			if ((vmf->flags & FAULT_FLAG_ALLOW_RETRY) &&
+			   !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
+				/* It's polite to up mmap_sem if we can */
+				up_read(&vma->vm_mm->mmap_sem);
+				ret = VM_FAULT_RETRY;
+			}
+
+			shmem_falloc_waitq = shmem_falloc->waitq;
+			prepare_to_wait(shmem_falloc_waitq, &shmem_fault_wait,
+					TASK_UNINTERRUPTIBLE);
+			spin_unlock(&inode->i_lock);
+			schedule();
+
+			/*
+			 * shmem_falloc_waitq points into the shmem_fallocate()
+			 * stack of the hole-punching task: shmem_falloc_waitq
+			 * is usually invalid by the time we reach here, but
+			 * finish_wait() does not dereference it in that case;
+			 * though i_lock needed lest racing with wake_up_all().
+			 */
+			spin_lock(&inode->i_lock);
+			finish_wait(shmem_falloc_waitq, &shmem_fault_wait);
+			spin_unlock(&inode->i_lock);
+			return ret;
+		}
+		spin_unlock(&inode->i_lock);
+	}
+
 	error = shmem_getpage(inode, vmf->pgoff, &vmf->page, SGP_CACHE, &ret);
 	if (error)
 		return ((error == -ENOMEM) ? VM_FAULT_OOM : VM_FAULT_SIGBUS);
@@ -1819,12 +1885,25 @@ static long shmem_fallocate(struct file
 		struct address_space *mapping = file->f_mapping;
 		loff_t unmap_start = round_up(offset, PAGE_SIZE);
 		loff_t unmap_end = round_down(offset + len, PAGE_SIZE) - 1;
+		DECLARE_WAIT_QUEUE_HEAD_ONSTACK(shmem_falloc_waitq);
+
+		shmem_falloc.waitq = &shmem_falloc_waitq;
+		shmem_falloc.start = unmap_start >> PAGE_SHIFT;
+		shmem_falloc.next = (unmap_end + 1) >> PAGE_SHIFT;
+		spin_lock(&inode->i_lock);
+		inode->i_private = &shmem_falloc;
+		spin_unlock(&inode->i_lock);
 
 		if ((u64)unmap_end > (u64)unmap_start)
 			unmap_mapping_range(mapping, unmap_start,
 					    1 + unmap_end - unmap_start, 0);
 		shmem_truncate_range(inode, offset, offset + len - 1);
 		/* No need to unmap again: hole-punching leaves COWed pages */
+
+		spin_lock(&inode->i_lock);
+		inode->i_private = NULL;
+		wake_up_all(&shmem_falloc_waitq);
+		spin_unlock(&inode->i_lock);
 		error = 0;
 		goto out;
 	}
@@ -1842,6 +1921,7 @@ static long shmem_fallocate(struct file
 		goto out;
 	}
 
+	shmem_falloc.waitq = NULL;
 	shmem_falloc.start = start;
 	shmem_falloc.next  = start;
 	shmem_falloc.nr_falloced = 0;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/mm/slab_common.c linux-libre-3.12.26-gnu/mm/slab_common.c
--- linux-libre-3.12.25-gnu/mm/slab_common.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/mm/slab_common.c	2014-07-30 12:02:44.000000000 -0400
@@ -56,7 +56,7 @@ static int kmem_cache_sanity_check(struc
 			continue;
 		}
 
-#if !defined(CONFIG_SLUB) || !defined(CONFIG_SLUB_DEBUG_ON)
+#if !defined(CONFIG_SLUB)
 		/*
 		 * For simplicity, we won't check this in the list of memcg
 		 * caches. We have control over memcg naming, and if there
diff -druNp --no-dereference linux-libre-3.12.25-gnu/mm/vmalloc.c linux-libre-3.12.26-gnu/mm/vmalloc.c
--- linux-libre-3.12.25-gnu/mm/vmalloc.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/mm/vmalloc.c	2014-07-30 12:02:44.000000000 -0400
@@ -359,6 +359,12 @@ static struct vmap_area *alloc_vmap_area
 	if (unlikely(!va))
 		return ERR_PTR(-ENOMEM);
 
+	/*
+	 * Only scan the relevant parts containing pointers to other objects
+	 * to avoid false negatives.
+	 */
+	kmemleak_scan_area(&va->rb_node, SIZE_MAX, gfp_mask & GFP_RECLAIM_MASK);
+
 retry:
 	spin_lock(&vmap_area_lock);
 	/*
@@ -1646,11 +1652,11 @@ void *__vmalloc_node_range(unsigned long
 	clear_vm_uninitialized_flag(area);
 
 	/*
-	 * A ref_count = 3 is needed because the vm_struct and vmap_area
-	 * structures allocated in the __get_vm_area_node() function contain
-	 * references to the virtual address of the vmalloc'ed block.
+	 * A ref_count = 2 is needed because vm_struct allocated in
+	 * __get_vm_area_node() contains a reference to the virtual address of
+	 * the vmalloc'ed block.
 	 */
-	kmemleak_alloc(addr, real_size, 3, gfp_mask);
+	kmemleak_alloc(addr, real_size, 2, gfp_mask);
 
 	return addr;
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/mm/vmscan.c linux-libre-3.12.26-gnu/mm/vmscan.c
--- linux-libre-3.12.25-gnu/mm/vmscan.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/mm/vmscan.c	2014-07-30 12:02:44.000000000 -0400
@@ -1522,19 +1522,18 @@ shrink_inactive_list(unsigned long nr_to
 		 * If dirty pages are scanned that are not queued for IO, it
 		 * implies that flushers are not keeping up. In this case, flag
 		 * the zone ZONE_TAIL_LRU_DIRTY and kswapd will start writing
-		 * pages from reclaim context. It will forcibly stall in the
-		 * next check.
+		 * pages from reclaim context.
 		 */
 		if (nr_unqueued_dirty == nr_taken)
 			zone_set_flag(zone, ZONE_TAIL_LRU_DIRTY);
 
 		/*
-		 * In addition, if kswapd scans pages marked marked for
-		 * immediate reclaim and under writeback (nr_immediate), it
-		 * implies that pages are cycling through the LRU faster than
+		 * If kswapd scans pages marked marked for immediate
+		 * reclaim and under writeback (nr_immediate), it implies
+		 * that pages are cycling through the LRU faster than
 		 * they are written so also forcibly stall.
 		 */
-		if (nr_unqueued_dirty == nr_taken || nr_immediate)
+		if (nr_immediate)
 			congestion_wait(BLK_RW_ASYNC, HZ/10);
 	}
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/8021q/vlan_core.c linux-libre-3.12.26-gnu/net/8021q/vlan_core.c
--- linux-libre-3.12.25-gnu/net/8021q/vlan_core.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/8021q/vlan_core.c	2014-07-30 12:02:44.000000000 -0400
@@ -108,8 +108,11 @@ EXPORT_SYMBOL(vlan_dev_vlan_id);
 
 static struct sk_buff *vlan_reorder_header(struct sk_buff *skb)
 {
-	if (skb_cow(skb, skb_headroom(skb)) < 0)
+	if (skb_cow(skb, skb_headroom(skb)) < 0) {
+		kfree_skb(skb);
 		return NULL;
+	}
+
 	memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN);
 	skb->mac_header += VLAN_HLEN;
 	return skb;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/appletalk/ddp.c linux-libre-3.12.26-gnu/net/appletalk/ddp.c
--- linux-libre-3.12.25-gnu/net/appletalk/ddp.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/appletalk/ddp.c	2014-07-30 12:02:44.000000000 -0400
@@ -1489,8 +1489,6 @@ static int atalk_rcv(struct sk_buff *skb
 		goto drop;
 
 	/* Queue packet (standard) */
-	skb->sk = sock;
-
 	if (sock_queue_rcv_skb(sock, skb) < 0)
 		goto drop;
 
@@ -1644,7 +1642,6 @@ static int atalk_sendmsg(struct kiocb *i
 	if (!skb)
 		goto out;
 
-	skb->sk = sk;
 	skb_reserve(skb, ddp_dl->header_length);
 	skb_reserve(skb, dev->hard_header_len);
 	skb->dev = dev;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/core/dev.c linux-libre-3.12.26-gnu/net/core/dev.c
--- linux-libre-3.12.25-gnu/net/core/dev.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/core/dev.c	2014-07-30 12:02:44.000000000 -0400
@@ -1202,7 +1202,11 @@ EXPORT_SYMBOL(netdev_features_change);
 void netdev_state_change(struct net_device *dev)
 {
 	if (dev->flags & IFF_UP) {
-		call_netdevice_notifiers(NETDEV_CHANGE, dev);
+		struct netdev_notifier_change_info change_info;
+
+		change_info.flags_changed = 0;
+		call_netdevice_notifiers_info(NETDEV_CHANGE, dev,
+					      &change_info.info);
 		rtmsg_ifinfo(RTM_NEWLINK, dev, 0);
 	}
 }
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/core/dst.c linux-libre-3.12.26-gnu/net/core/dst.c
--- linux-libre-3.12.25-gnu/net/core/dst.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/core/dst.c	2014-07-30 12:02:44.000000000 -0400
@@ -267,6 +267,15 @@ again:
 }
 EXPORT_SYMBOL(dst_destroy);
 
+static void dst_destroy_rcu(struct rcu_head *head)
+{
+	struct dst_entry *dst = container_of(head, struct dst_entry, rcu_head);
+
+	dst = dst_destroy(dst);
+	if (dst)
+		__dst_free(dst);
+}
+
 void dst_release(struct dst_entry *dst)
 {
 	if (dst) {
@@ -274,11 +283,8 @@ void dst_release(struct dst_entry *dst)
 
 		newrefcnt = atomic_dec_return(&dst->__refcnt);
 		WARN_ON(newrefcnt < 0);
-		if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) {
-			dst = dst_destroy(dst);
-			if (dst)
-				__dst_free(dst);
-		}
+		if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
+			call_rcu(&dst->rcu_head, dst_destroy_rcu);
 	}
 }
 EXPORT_SYMBOL(dst_release);
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/core/skbuff.c linux-libre-3.12.26-gnu/net/core/skbuff.c
--- linux-libre-3.12.25-gnu/net/core/skbuff.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/core/skbuff.c	2014-07-30 12:02:44.000000000 -0400
@@ -2744,12 +2744,13 @@ struct sk_buff *skb_segment(struct sk_bu
 	int i = 0;
 	int pos;
 
+	__skb_push(head_skb, doffset);
 	proto = skb_network_protocol(head_skb);
 	if (unlikely(!proto))
 		return ERR_PTR(-EINVAL);
 
 	csum = !!can_checksum_protocol(features, proto);
-	__skb_push(head_skb, doffset);
+
 	headroom = skb_headroom(head_skb);
 	pos = skb_headlen(head_skb);
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/dns_resolver/dns_query.c linux-libre-3.12.26-gnu/net/dns_resolver/dns_query.c
--- linux-libre-3.12.25-gnu/net/dns_resolver/dns_query.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/dns_resolver/dns_query.c	2014-07-30 12:02:44.000000000 -0400
@@ -150,7 +150,9 @@ int dns_query(const char *type, const ch
 	if (!*_result)
 		goto put;
 
-	memcpy(*_result, upayload->data, len + 1);
+	memcpy(*_result, upayload->data, len);
+	*_result[len] = '\0';
+
 	if (_expiry)
 		*_expiry = rkey->expiry;
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/ipv4/icmp.c linux-libre-3.12.26-gnu/net/ipv4/icmp.c
--- linux-libre-3.12.25-gnu/net/ipv4/icmp.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/ipv4/icmp.c	2014-07-30 12:02:44.000000000 -0400
@@ -705,8 +705,6 @@ static void icmp_unreach(struct sk_buff
 					       &iph->daddr);
 			} else {
 				info = ntohs(icmph->un.frag.mtu);
-				if (!info)
-					goto out;
 			}
 			break;
 		case ICMP_SR_FAILED:
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/ipv4/igmp.c linux-libre-3.12.26-gnu/net/ipv4/igmp.c
--- linux-libre-3.12.25-gnu/net/ipv4/igmp.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/ipv4/igmp.c	2014-07-30 12:02:44.000000000 -0400
@@ -1952,6 +1952,10 @@ int ip_mc_leave_group(struct sock *sk, s
 
 	rtnl_lock();
 	in_dev = ip_mc_find_dev(net, imr);
+	if (!in_dev) {
+		ret = -ENODEV;
+		goto out;
+	}
 	ifindex = imr->imr_ifindex;
 	for (imlp = &inet->mc_list;
 	     (iml = rtnl_dereference(*imlp)) != NULL;
@@ -1969,16 +1973,14 @@ int ip_mc_leave_group(struct sock *sk, s
 
 		*imlp = iml->next_rcu;
 
-		if (in_dev)
-			ip_mc_dec_group(in_dev, group);
+		ip_mc_dec_group(in_dev, group);
 		rtnl_unlock();
 		/* decrease mem now to avoid the memleak warning */
 		atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
 		kfree_rcu(iml, rcu);
 		return 0;
 	}
-	if (!in_dev)
-		ret = -ENODEV;
+out:
 	rtnl_unlock();
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/ipv4/ip_options.c linux-libre-3.12.26-gnu/net/ipv4/ip_options.c
--- linux-libre-3.12.25-gnu/net/ipv4/ip_options.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/ipv4/ip_options.c	2014-07-30 12:02:44.000000000 -0400
@@ -288,6 +288,10 @@ int ip_options_compile(struct net *net,
 			optptr++;
 			continue;
 		}
+		if (unlikely(l < 2)) {
+			pp_ptr = optptr;
+			goto error;
+		}
 		optlen = optptr[1];
 		if (optlen<2 || optlen>l) {
 			pp_ptr = optptr;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/ipv4/ip_tunnel.c linux-libre-3.12.26-gnu/net/ipv4/ip_tunnel.c
--- linux-libre-3.12.25-gnu/net/ipv4/ip_tunnel.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/ipv4/ip_tunnel.c	2014-07-30 12:02:44.000000000 -0400
@@ -166,6 +166,7 @@ struct ip_tunnel *ip_tunnel_lookup(struc
 
 	hlist_for_each_entry_rcu(t, head, hash_node) {
 		if (remote != t->parms.iph.daddr ||
+		    t->parms.iph.saddr != 0 ||
 		    !(t->dev->flags & IFF_UP))
 			continue;
 
@@ -182,10 +183,11 @@ struct ip_tunnel *ip_tunnel_lookup(struc
 	head = &itn->tunnels[hash];
 
 	hlist_for_each_entry_rcu(t, head, hash_node) {
-		if ((local != t->parms.iph.saddr &&
-		     (local != t->parms.iph.daddr ||
-		      !ipv4_is_multicast(local))) ||
-		    !(t->dev->flags & IFF_UP))
+		if ((local != t->parms.iph.saddr || t->parms.iph.daddr != 0) &&
+		    (local != t->parms.iph.daddr || !ipv4_is_multicast(local)))
+			continue;
+
+		if (!(t->dev->flags & IFF_UP))
 			continue;
 
 		if (!ip_tunnel_key_match(&t->parms, flags, key))
@@ -202,6 +204,8 @@ struct ip_tunnel *ip_tunnel_lookup(struc
 
 	hlist_for_each_entry_rcu(t, head, hash_node) {
 		if (t->parms.i_key != key ||
+		    t->parms.iph.saddr != 0 ||
+		    t->parms.iph.daddr != 0 ||
 		    !(t->dev->flags & IFF_UP))
 			continue;
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/ipv4/route.c linux-libre-3.12.26-gnu/net/ipv4/route.c
--- linux-libre-3.12.25-gnu/net/ipv4/route.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/ipv4/route.c	2014-07-30 12:02:44.000000000 -0400
@@ -1032,20 +1032,21 @@ void ipv4_sk_update_pmtu(struct sk_buff
 	const struct iphdr *iph = (const struct iphdr *) skb->data;
 	struct flowi4 fl4;
 	struct rtable *rt;
-	struct dst_entry *dst;
+	struct dst_entry *odst = NULL;
 	bool new = false;
 
 	bh_lock_sock(sk);
-	rt = (struct rtable *) __sk_dst_get(sk);
+	odst = sk_dst_get(sk);
 
-	if (sock_owned_by_user(sk) || !rt) {
+	if (sock_owned_by_user(sk) || !odst) {
 		__ipv4_sk_update_pmtu(skb, sk, mtu);
 		goto out;
 	}
 
 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
 
-	if (!__sk_dst_check(sk, 0)) {
+	rt = (struct rtable *)odst;
+	if (odst->obsolete && odst->ops->check(odst, 0) == NULL) {
 		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
 		if (IS_ERR(rt))
 			goto out;
@@ -1055,8 +1056,7 @@ void ipv4_sk_update_pmtu(struct sk_buff
 
 	__ip_rt_update_pmtu((struct rtable *) rt->dst.path, &fl4, mtu);
 
-	dst = dst_check(&rt->dst, 0);
-	if (!dst) {
+	if (!dst_check(&rt->dst, 0)) {
 		if (new)
 			dst_release(&rt->dst);
 
@@ -1068,10 +1068,11 @@ void ipv4_sk_update_pmtu(struct sk_buff
 	}
 
 	if (new)
-		__sk_dst_set(sk, &rt->dst);
+		sk_dst_set(sk, &rt->dst);
 
 out:
 	bh_unlock_sock(sk);
+	dst_release(odst);
 }
 EXPORT_SYMBOL_GPL(ipv4_sk_update_pmtu);
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/ipv4/tcp.c linux-libre-3.12.26-gnu/net/ipv4/tcp.c
--- linux-libre-3.12.25-gnu/net/ipv4/tcp.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/ipv4/tcp.c	2014-07-30 12:02:44.000000000 -0400
@@ -1064,7 +1064,7 @@ int tcp_sendmsg(struct kiocb *iocb, stru
 	if (unlikely(tp->repair)) {
 		if (tp->repair_queue == TCP_RECV_QUEUE) {
 			copied = tcp_send_rcvq(sk, msg, size);
-			goto out;
+			goto out_nopush;
 		}
 
 		err = -EINVAL;
@@ -1237,6 +1237,7 @@ wait_for_memory:
 out:
 	if (copied)
 		tcp_push(sk, flags, mss_now, tp->nonagle);
+out_nopush:
 	release_sock(sk);
 	return copied + copied_syn;
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/ipv4/tcp_input.c linux-libre-3.12.26-gnu/net/ipv4/tcp_input.c
--- linux-libre-3.12.25-gnu/net/ipv4/tcp_input.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/ipv4/tcp_input.c	2014-07-30 12:02:44.000000000 -0400
@@ -1064,7 +1064,7 @@ static bool tcp_check_dsack(struct sock
 	}
 
 	/* D-SACK for already forgotten data... Do dumb counting. */
-	if (dup_sack && tp->undo_marker && tp->undo_retrans &&
+	if (dup_sack && tp->undo_marker && tp->undo_retrans > 0 &&
 	    !after(end_seq_0, prior_snd_una) &&
 	    after(end_seq_0, tp->undo_marker))
 		tp->undo_retrans--;
@@ -1120,7 +1120,7 @@ static int tcp_match_skb_to_sack(struct
 			unsigned int new_len = (pkt_len / mss) * mss;
 			if (!in_sack && new_len < pkt_len) {
 				new_len += mss;
-				if (new_len > skb->len)
+				if (new_len >= skb->len)
 					return 0;
 			}
 			pkt_len = new_len;
@@ -1144,7 +1144,7 @@ static u8 tcp_sacktag_one(struct sock *s
 
 	/* Account D-SACK for retransmitted packet. */
 	if (dup_sack && (sacked & TCPCB_RETRANS)) {
-		if (tp->undo_marker && tp->undo_retrans &&
+		if (tp->undo_marker && tp->undo_retrans > 0 &&
 		    after(end_seq, tp->undo_marker))
 			tp->undo_retrans--;
 		if (sacked & TCPCB_SACKED_ACKED)
@@ -1845,7 +1845,7 @@ static void tcp_clear_retrans_partial(st
 	tp->lost_out = 0;
 
 	tp->undo_marker = 0;
-	tp->undo_retrans = 0;
+	tp->undo_retrans = -1;
 }
 
 void tcp_clear_retrans(struct tcp_sock *tp)
@@ -2613,7 +2613,7 @@ static void tcp_enter_recovery(struct so
 
 	tp->prior_ssthresh = 0;
 	tp->undo_marker = tp->snd_una;
-	tp->undo_retrans = tp->retrans_out;
+	tp->undo_retrans = tp->retrans_out ? : -1;
 
 	if (inet_csk(sk)->icsk_ca_state < TCP_CA_CWR) {
 		if (!ece_ack)
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/ipv4/tcp_output.c linux-libre-3.12.26-gnu/net/ipv4/tcp_output.c
--- linux-libre-3.12.25-gnu/net/ipv4/tcp_output.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/ipv4/tcp_output.c	2014-07-30 12:02:44.000000000 -0400
@@ -2437,8 +2437,6 @@ int tcp_retransmit_skb(struct sock *sk,
 		if (!tp->retrans_stamp)
 			tp->retrans_stamp = TCP_SKB_CB(skb)->when;
 
-		tp->undo_retrans += tcp_skb_pcount(skb);
-
 		/* snd_nxt is stored to detect loss of retransmitted segment,
 		 * see tcp_input.c tcp_sacktag_write_queue().
 		 */
@@ -2446,6 +2444,10 @@ int tcp_retransmit_skb(struct sock *sk,
 	} else {
 		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL);
 	}
+
+	if (tp->undo_retrans < 0)
+		tp->undo_retrans = 0;
+	tp->undo_retrans += tcp_skb_pcount(skb);
 	return err;
 }
 
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/netlink/af_netlink.c linux-libre-3.12.26-gnu/net/netlink/af_netlink.c
--- linux-libre-3.12.25-gnu/net/netlink/af_netlink.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/netlink/af_netlink.c	2014-07-30 12:02:44.000000000 -0400
@@ -628,7 +628,7 @@ static unsigned int netlink_poll(struct
 		while (nlk->cb_running && netlink_dump_space(nlk)) {
 			err = netlink_dump(sk);
 			if (err < 0) {
-				sk->sk_err = err;
+				sk->sk_err = -err;
 				sk->sk_error_report(sk);
 				break;
 			}
@@ -2440,7 +2440,7 @@ static int netlink_recvmsg(struct kiocb
 	    atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
 		ret = netlink_dump(sk);
 		if (ret) {
-			sk->sk_err = ret;
+			sk->sk_err = -ret;
 			sk->sk_error_report(sk);
 		}
 	}
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/sctp/sysctl.c linux-libre-3.12.26-gnu/net/sctp/sysctl.c
--- linux-libre-3.12.25-gnu/net/sctp/sysctl.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/sctp/sysctl.c	2014-07-30 12:02:44.000000000 -0400
@@ -303,41 +303,40 @@ static int proc_sctp_do_hmac_alg(struct
 				loff_t *ppos)
 {
 	struct net *net = current->nsproxy->net_ns;
-	char tmp[8];
 	struct ctl_table tbl;
-	int ret;
-	int changed = 0;
+	bool changed = false;
 	char *none = "none";
+	char tmp[8];
+	int ret;
 
 	memset(&tbl, 0, sizeof(struct ctl_table));
 
 	if (write) {
 		tbl.data = tmp;
-		tbl.maxlen = 8;
+		tbl.maxlen = sizeof(tmp);
 	} else {
 		tbl.data = net->sctp.sctp_hmac_alg ? : none;
 		tbl.maxlen = strlen(tbl.data);
 	}
-		ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 
-	if (write) {
+	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
+	if (write && ret == 0) {
 #ifdef CONFIG_CRYPTO_MD5
 		if (!strncmp(tmp, "md5", 3)) {
 			net->sctp.sctp_hmac_alg = "md5";
-			changed = 1;
+			changed = true;
 		}
 #endif
 #ifdef CONFIG_CRYPTO_SHA1
 		if (!strncmp(tmp, "sha1", 4)) {
 			net->sctp.sctp_hmac_alg = "sha1";
-			changed = 1;
+			changed = true;
 		}
 #endif
 		if (!strncmp(tmp, "none", 4)) {
 			net->sctp.sctp_hmac_alg = NULL;
-			changed = 1;
+			changed = true;
 		}
-
 		if (!changed)
 			ret = -EINVAL;
 	}
@@ -362,8 +361,7 @@ static int proc_sctp_do_auth(struct ctl_
 		tbl.data = &net->sctp.auth_enable;
 
 	ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
-
-	if (write) {
+	if (write && ret == 0) {
 		struct sock *sk = net->sctp.ctl_sock;
 
 		net->sctp.auth_enable = new_value;
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/sctp/ulpevent.c linux-libre-3.12.26-gnu/net/sctp/ulpevent.c
--- linux-libre-3.12.25-gnu/net/sctp/ulpevent.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/sctp/ulpevent.c	2014-07-30 12:02:44.000000000 -0400
@@ -367,9 +367,10 @@ fail:
  * specification [SCTP] and any extensions for a list of possible
  * error formats.
  */
-struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
-	const struct sctp_association *asoc, struct sctp_chunk *chunk,
-	__u16 flags, gfp_t gfp)
+struct sctp_ulpevent *
+sctp_ulpevent_make_remote_error(const struct sctp_association *asoc,
+				struct sctp_chunk *chunk, __u16 flags,
+				gfp_t gfp)
 {
 	struct sctp_ulpevent *event;
 	struct sctp_remote_error *sre;
@@ -388,8 +389,7 @@ struct sctp_ulpevent *sctp_ulpevent_make
 	/* Copy the skb to a new skb with room for us to prepend
 	 * notification with.
 	 */
-	skb = skb_copy_expand(chunk->skb, sizeof(struct sctp_remote_error),
-			      0, gfp);
+	skb = skb_copy_expand(chunk->skb, sizeof(*sre), 0, gfp);
 
 	/* Pull off the rest of the cause TLV from the chunk.  */
 	skb_pull(chunk->skb, elen);
@@ -400,62 +400,21 @@ struct sctp_ulpevent *sctp_ulpevent_make
 	event = sctp_skb2event(skb);
 	sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
 
-	sre = (struct sctp_remote_error *)
-		skb_push(skb, sizeof(struct sctp_remote_error));
+	sre = (struct sctp_remote_error *) skb_push(skb, sizeof(*sre));
 
 	/* Trim the buffer to the right length.  */
-	skb_trim(skb, sizeof(struct sctp_remote_error) + elen);
+	skb_trim(skb, sizeof(*sre) + elen);
 
-	/* Socket Extensions for SCTP
-	 * 5.3.1.3 SCTP_REMOTE_ERROR
-	 *
-	 * sre_type:
-	 *   It should be SCTP_REMOTE_ERROR.
-	 */
+	/* RFC6458, Section 6.1.3. SCTP_REMOTE_ERROR */
+	memset(sre, 0, sizeof(*sre));
 	sre->sre_type = SCTP_REMOTE_ERROR;
-
-	/*
-	 * Socket Extensions for SCTP
-	 * 5.3.1.3 SCTP_REMOTE_ERROR
-	 *
-	 * sre_flags: 16 bits (unsigned integer)
-	 *   Currently unused.
-	 */
 	sre->sre_flags = 0;
-
-	/* Socket Extensions for SCTP
-	 * 5.3.1.3 SCTP_REMOTE_ERROR
-	 *
-	 * sre_length: sizeof (__u32)
-	 *
-	 * This field is the total length of the notification data,
-	 * including the notification header.
-	 */
 	sre->sre_length = skb->len;
-
-	/* Socket Extensions for SCTP
-	 * 5.3.1.3 SCTP_REMOTE_ERROR
-	 *
-	 * sre_error: 16 bits (unsigned integer)
-	 * This value represents one of the Operational Error causes defined in
-	 * the SCTP specification, in network byte order.
-	 */
 	sre->sre_error = cause;
-
-	/* Socket Extensions for SCTP
-	 * 5.3.1.3 SCTP_REMOTE_ERROR
-	 *
-	 * sre_assoc_id: sizeof (sctp_assoc_t)
-	 *
-	 * The association id field, holds the identifier for the association.
-	 * All notifications for a given association have the same association
-	 * identifier.  For TCP style socket, this field is ignored.
-	 */
 	sctp_ulpevent_set_owner(event, asoc);
 	sre->sre_assoc_id = sctp_assoc2id(asoc);
 
 	return event;
-
 fail:
 	return NULL;
 }
@@ -900,7 +859,9 @@ __u16 sctp_ulpevent_get_notification_typ
 	return notification->sn_header.sn_type;
 }
 
-/* Copy out the sndrcvinfo into a msghdr.  */
+/* RFC6458, Section 5.3.2. SCTP Header Information Structure
+ * (SCTP_SNDRCV, DEPRECATED)
+ */
 void sctp_ulpevent_read_sndrcvinfo(const struct sctp_ulpevent *event,
 				   struct msghdr *msghdr)
 {
@@ -909,74 +870,21 @@ void sctp_ulpevent_read_sndrcvinfo(const
 	if (sctp_ulpevent_is_notification(event))
 		return;
 
-	/* Sockets API Extensions for SCTP
-	 * Section 5.2.2 SCTP Header Information Structure (SCTP_SNDRCV)
-	 *
-	 * sinfo_stream: 16 bits (unsigned integer)
-	 *
-	 * For recvmsg() the SCTP stack places the message's stream number in
-	 * this value.
-	*/
+	memset(&sinfo, 0, sizeof(sinfo));
 	sinfo.sinfo_stream = event->stream;
-	/* sinfo_ssn: 16 bits (unsigned integer)
-	 *
-	 * For recvmsg() this value contains the stream sequence number that
-	 * the remote endpoint placed in the DATA chunk.  For fragmented
-	 * messages this is the same number for all deliveries of the message
-	 * (if more than one recvmsg() is needed to read the message).
-	 */
 	sinfo.sinfo_ssn = event->ssn;
-	/* sinfo_ppid: 32 bits (unsigned integer)
-	 *
-	 * In recvmsg() this value is
-	 * the same information that was passed by the upper layer in the peer
-	 * application.  Please note that byte order issues are NOT accounted
-	 * for and this information is passed opaquely by the SCTP stack from
-	 * one end to the other.
-	 */
 	sinfo.sinfo_ppid = event->ppid;
-	/* sinfo_flags: 16 bits (unsigned integer)
-	 *
-	 * This field may contain any of the following flags and is composed of
-	 * a bitwise OR of these values.
-	 *
-	 * recvmsg() flags:
-	 *
-	 * SCTP_UNORDERED - This flag is present when the message was sent
-	 *                 non-ordered.
-	 */
 	sinfo.sinfo_flags = event->flags;
-	/* sinfo_tsn: 32 bit (unsigned integer)
-	 *
-	 * For the receiving side, this field holds a TSN that was
-	 * assigned to one of the SCTP Data Chunks.
-	 */
 	sinfo.sinfo_tsn = event->tsn;
-	/* sinfo_cumtsn: 32 bit (unsigned integer)
-	 *
-	 * This field will hold the current cumulative TSN as
-	 * known by the underlying SCTP layer.  Note this field is
-	 * ignored when sending and only valid for a receive
-	 * operation when sinfo_flags are set to SCTP_UNORDERED.
-	 */
 	sinfo.sinfo_cumtsn = event->cumtsn;
-	/* sinfo_assoc_id: sizeof (sctp_assoc_t)
-	 *
-	 * The association handle field, sinfo_assoc_id, holds the identifier
-	 * for the association announced in the COMMUNICATION_UP notification.
-	 * All notifications for a given association have the same identifier.
-	 * Ignored for one-to-one style sockets.
-	 */
 	sinfo.sinfo_assoc_id = sctp_assoc2id(event->asoc);
-
-	/* context value that is set via SCTP_CONTEXT socket option. */
+	/* Context value that is set via SCTP_CONTEXT socket option. */
 	sinfo.sinfo_context = event->asoc->default_rcv_context;
-
 	/* These fields are not used while receiving. */
 	sinfo.sinfo_timetolive = 0;
 
 	put_cmsg(msghdr, IPPROTO_SCTP, SCTP_SNDRCV,
-		 sizeof(struct sctp_sndrcvinfo), (void *)&sinfo);
+		 sizeof(sinfo), &sinfo);
 }
 
 /* Do accounting for bytes received and hold a reference to the association
diff -druNp --no-dereference linux-libre-3.12.25-gnu/net/tipc/bcast.c linux-libre-3.12.26-gnu/net/tipc/bcast.c
--- linux-libre-3.12.25-gnu/net/tipc/bcast.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/net/tipc/bcast.c	2014-07-30 12:02:44.000000000 -0400
@@ -531,6 +531,7 @@ receive:
 
 		buf = node->bclink.deferred_head;
 		node->bclink.deferred_head = buf->next;
+		buf->next = NULL;
 		node->bclink.deferred_size--;
 		goto receive;
 	}
diff -druNp --no-dereference linux-libre-3.12.25-gnu/sound/pci/hda/hda_intel.c linux-libre-3.12.26-gnu/sound/pci/hda/hda_intel.c
--- linux-libre-3.12.25-gnu/sound/pci/hda/hda_intel.c	2014-07-18 09:51:31.000000000 -0400
+++ linux-libre-3.12.26-gnu/sound/pci/hda/hda_intel.c	2014-07-30 12:02:44.000000000 -0400
@@ -2917,7 +2917,7 @@ static int azx_suspend(struct device *de
 	struct azx *chip = card->private_data;
 	struct azx_pcm *p;
 
-	if (chip->disabled)
+	if (chip->disabled || chip->init_failed)
 		return 0;
 
 	snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
@@ -2948,7 +2948,7 @@ static int azx_resume(struct device *dev
 	struct snd_card *card = dev_get_drvdata(dev);
 	struct azx *chip = card->private_data;
 
-	if (chip->disabled)
+	if (chip->disabled || chip->init_failed)
 		return 0;
 
 	if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
@@ -2983,7 +2983,7 @@ static int azx_runtime_suspend(struct de
 	struct snd_card *card = dev_get_drvdata(dev);
 	struct azx *chip = card->private_data;
 
-	if (chip->disabled)
+	if (chip->disabled || chip->init_failed)
 		return 0;
 
 	if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME))
@@ -3009,7 +3009,7 @@ static int azx_runtime_resume(struct dev
 	struct hda_codec *codec;
 	int status;
 
-	if (chip->disabled)
+	if (chip->disabled || chip->init_failed)
 		return 0;
 
 	if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME))
@@ -3044,7 +3044,7 @@ static int azx_runtime_idle(struct devic
 	struct snd_card *card = dev_get_drvdata(dev);
 	struct azx *chip = card->private_data;
 
-	if (chip->disabled)
+	if (chip->disabled || chip->init_failed)
 		return 0;
 
 	if (!power_save_controller ||
