- x86-64, espfix: Don't leak bits 31:16 of %esp returning to
  16-bit stack (bsc#907818,CVE-2014-9090).
- x86, espfix: Make espfix64 a Kconfig option, fix UML
  (bsc#907818,CVE-2014-9090).
- x86, espfix: Make it possible to disable 16-bit support
  (bsc#907818,CVE-2014-9090).
- x86/tls: Validate TLS entries to protect espfix
  (bsc#909077,CVE-2014-8133).
- x86_64/entry/xen: Do not invoke espfix64 on Xen
  (bsc#907818,CVE-2014-9090).
- x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C
  (bsc#907818,CVE-2014-9090).
- x86_64, traps: Rework bad_iret (bsc#909077,CVE-2014-8133).
- x86_64, traps: Stop using IST for #SS (bsc#907818,
  CVE-2014-9090, CVE-2014-9322).
- Update config files.
- Refresh patches.arch/x86_64-unwind-annotations.
- Refresh patches.fixes/rtc-cmos-add-an-alarm-disable-quirk.patch.
- Refresh patches.xen/xen3-patch-2.6.31.
Refresh patches.xen/xen-x86-EFI.
- Refresh patches.fixes/rtc-cmos-add-an-alarm-disable-quirk.patch.
- Refresh patches.xen/xen-x86-EFI.
netlink: Rename netlink_capable netlink_allowed (bsc#875051,
CVE-2014-0181).
net: add a permission check in sock_diag_put_filterinfo
(bsc#875051, CVE-2014-0181).
net: Add variants of capable for use on on sockets (bsc#875051,
CVE-2014-0181).
net: Add variants of capable for use on netlink messages
(bsc#875051, CVE-2014-0181).
net: Use netlink_ns_capable to verify the permisions of netlink
messages (bsc#875051, CVE-2014-0181).
netlink: Only check file credentials for implicit destinations
(bsc#875051, CVE-2014-0181).