[gentoo-commits] linux-patches r2162 - genpatches-2.6/trunk/3.0

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2012-06-19 00:00:27 +0000 (Tue, 19 Jun 2012)
New Revision: 2162

Added:
   genpatches-2.6/trunk/3.0/1033_linux-3.0.34.patch
   genpatches-2.6/trunk/3.0/1034_linux-3.0.35.patch
Modified:
   genpatches-2.6/trunk/3.0/0000_README
Log:
Linux patches 3.0.34 and 3.0.35

Modified: genpatches-2.6/trunk/3.0/0000_README
===================================================================
--- genpatches-2.6/trunk/3.0/0000_README	2012-06-18 17:49:37 UTC (rev 2161)
+++ genpatches-2.6/trunk/3.0/0000_README	2012-06-19 00:00:27 UTC (rev 2162)
@@ -167,6 +167,14 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.0.33
 
+Patch:  1033_linux-3.0.34.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.0.34
+
+Patch:  1034_linux-3.0.35.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.0.35
+
 Patch:  1800_fix-zcache-build.patch
 From:   http://bugs.gentoo.org/show_bug.cgi?id=376325
 Desc:   Fix zcache build error

Added: genpatches-2.6/trunk/3.0/1033_linux-3.0.34.patch
===================================================================
--- genpatches-2.6/trunk/3.0/1033_linux-3.0.34.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.0/1033_linux-3.0.34.patch	2012-06-19 00:00:27 UTC (rev 2162)
@@ -0,0 +1,1483 @@
+diff --git a/Makefile b/Makefile
+index c621c70..61ef485 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 0
+-SUBLEVEL = 33
++SUBLEVEL = 34
+ EXTRAVERSION =
+ NAME = Sneaky Weasel
+ 
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index 5350342..07ef351 100644
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -552,7 +552,7 @@
+ 	 * entry (identifying the physical page) and %r23 up with
+ 	 * the from tlb entry (or nothing if only a to entry---for
+ 	 * clear_user_page_asm) */
+-	.macro		do_alias	spc,tmp,tmp1,va,pte,prot,fault
++	.macro		do_alias	spc,tmp,tmp1,va,pte,prot,fault,patype
+ 	cmpib,COND(<>),n 0,\spc,\fault
+ 	ldil		L%(TMPALIAS_MAP_START),\tmp
+ #if defined(CONFIG_64BIT) && (TMPALIAS_MAP_START >= 0x80000000)
+@@ -581,11 +581,15 @@
+ 	 */
+ 	cmpiclr,=	0x01,\tmp,%r0
+ 	ldi		(_PAGE_DIRTY|_PAGE_READ|_PAGE_WRITE),\prot
+-#ifdef CONFIG_64BIT
++.ifc \patype,20
+ 	depd,z		\prot,8,7,\prot
+-#else
++.else
++.ifc \patype,11
+ 	depw,z		\prot,8,7,\prot
+-#endif
++.else
++	.error "undefined PA type to do_alias"
++.endif
++.endif
+ 	/*
+ 	 * OK, it is in the temp alias region, check whether "from" or "to".
+ 	 * Check "subtle" note in pacache.S re: r23/r26.
+@@ -1189,7 +1193,7 @@ dtlb_miss_20w:
+ 	nop
+ 
+ dtlb_check_alias_20w:
+-	do_alias	spc,t0,t1,va,pte,prot,dtlb_fault
++	do_alias	spc,t0,t1,va,pte,prot,dtlb_fault,20
+ 
+ 	idtlbt          pte,prot
+ 
+@@ -1213,7 +1217,7 @@ nadtlb_miss_20w:
+ 	nop
+ 
+ nadtlb_check_alias_20w:
+-	do_alias	spc,t0,t1,va,pte,prot,nadtlb_emulate
++	do_alias	spc,t0,t1,va,pte,prot,nadtlb_emulate,20
+ 
+ 	idtlbt          pte,prot
+ 
+@@ -1245,7 +1249,7 @@ dtlb_miss_11:
+ 	nop
+ 
+ dtlb_check_alias_11:
+-	do_alias	spc,t0,t1,va,pte,prot,dtlb_fault
++	do_alias	spc,t0,t1,va,pte,prot,dtlb_fault,11
+ 
+ 	idtlba          pte,(va)
+ 	idtlbp          prot,(va)
+@@ -1277,7 +1281,7 @@ nadtlb_miss_11:
+ 	nop
+ 
+ nadtlb_check_alias_11:
+-	do_alias	spc,t0,t1,va,pte,prot,nadtlb_emulate
++	do_alias	spc,t0,t1,va,pte,prot,nadtlb_emulate,11
+ 
+ 	idtlba          pte,(va)
+ 	idtlbp          prot,(va)
+@@ -1304,7 +1308,7 @@ dtlb_miss_20:
+ 	nop
+ 
+ dtlb_check_alias_20:
+-	do_alias	spc,t0,t1,va,pte,prot,dtlb_fault
++	do_alias	spc,t0,t1,va,pte,prot,dtlb_fault,20
+ 	
+ 	idtlbt          pte,prot
+ 
+@@ -1330,7 +1334,7 @@ nadtlb_miss_20:
+ 	nop
+ 
+ nadtlb_check_alias_20:
+-	do_alias	spc,t0,t1,va,pte,prot,nadtlb_emulate
++	do_alias	spc,t0,t1,va,pte,prot,nadtlb_emulate,20
+ 
+ 	idtlbt          pte,prot
+ 
+@@ -1457,7 +1461,7 @@ naitlb_miss_20w:
+ 	nop
+ 
+ naitlb_check_alias_20w:
+-	do_alias	spc,t0,t1,va,pte,prot,naitlb_fault
++	do_alias	spc,t0,t1,va,pte,prot,naitlb_fault,20
+ 
+ 	iitlbt		pte,prot
+ 
+@@ -1511,7 +1515,7 @@ naitlb_miss_11:
+ 	nop
+ 
+ naitlb_check_alias_11:
+-	do_alias	spc,t0,t1,va,pte,prot,itlb_fault
++	do_alias	spc,t0,t1,va,pte,prot,itlb_fault,11
+ 
+ 	iitlba          pte,(%sr0, va)
+ 	iitlbp          prot,(%sr0, va)
+@@ -1557,7 +1561,7 @@ naitlb_miss_20:
+ 	nop
+ 
+ naitlb_check_alias_20:
+-	do_alias	spc,t0,t1,va,pte,prot,naitlb_fault
++	do_alias	spc,t0,t1,va,pte,prot,naitlb_fault,20
+ 
+ 	iitlbt          pte,prot
+ 
+diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
+index fa6f2b8..64a9998 100644
+--- a/arch/parisc/kernel/vmlinux.lds.S
++++ b/arch/parisc/kernel/vmlinux.lds.S
+@@ -50,8 +50,10 @@ SECTIONS
+ 	. = KERNEL_BINARY_TEXT_START;
+ 
+ 	_text = .;		/* Text and read-only data */
+-	.text ALIGN(16) : {
++	.head ALIGN(16) : {
+ 		HEAD_TEXT
++	} = 0
++	.text ALIGN(16) : {
+ 		TEXT_TEXT
+ 		SCHED_TEXT
+ 		LOCK_TEXT
+@@ -65,7 +67,7 @@ SECTIONS
+ 		*(.fixup)
+ 		*(.lock.text)		/* out-of-line lock text */
+ 		*(.gnu.warning)
+-	} = 0
++	}
+ 	/* End of text section */
+ 	_etext = .;
+ 
+diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
+index effff47..43876f1 100644
+--- a/arch/x86/include/asm/pgtable-3level.h
++++ b/arch/x86/include/asm/pgtable-3level.h
+@@ -31,6 +31,56 @@ static inline void native_set_pte(pte_t *ptep, pte_t pte)
+ 	ptep->pte_low = pte.pte_low;
+ }
+ 
++#define pmd_read_atomic pmd_read_atomic
++/*
++ * pte_offset_map_lock on 32bit PAE kernels was reading the pmd_t with
++ * a "*pmdp" dereference done by gcc. Problem is, in certain places
++ * where pte_offset_map_lock is called, concurrent page faults are
++ * allowed, if the mmap_sem is hold for reading. An example is mincore
++ * vs page faults vs MADV_DONTNEED. On the page fault side
++ * pmd_populate rightfully does a set_64bit, but if we're reading the
++ * pmd_t with a "*pmdp" on the mincore side, a SMP race can happen
++ * because gcc will not read the 64bit of the pmd atomically. To fix
++ * this all places running pmd_offset_map_lock() while holding the
++ * mmap_sem in read mode, shall read the pmdp pointer using this
++ * function to know if the pmd is null nor not, and in turn to know if
++ * they can run pmd_offset_map_lock or pmd_trans_huge or other pmd
++ * operations.
++ *
++ * Without THP if the mmap_sem is hold for reading, the
++ * pmd can only transition from null to not null while pmd_read_atomic runs.
++ * So there's no need of literally reading it atomically.
++ *
++ * With THP if the mmap_sem is hold for reading, the pmd can become
++ * THP or null or point to a pte (and in turn become "stable") at any
++ * time under pmd_read_atomic, so it's mandatory to read it atomically
++ * with cmpxchg8b.
++ */
++#ifndef CONFIG_TRANSPARENT_HUGEPAGE
++static inline pmd_t pmd_read_atomic(pmd_t *pmdp)
++{
++	pmdval_t ret;
++	u32 *tmp = (u32 *)pmdp;
++
++	ret = (pmdval_t) (*tmp);
++	if (ret) {
++		/*
++		 * If the low part is null, we must not read the high part
++		 * or we can end up with a partial pmd.
++		 */
++		smp_rmb();
++		ret |= ((pmdval_t)*(tmp + 1)) << 32;
++	}
++
++	return (pmd_t) { ret };
++}
++#else /* CONFIG_TRANSPARENT_HUGEPAGE */
++static inline pmd_t pmd_read_atomic(pmd_t *pmdp)
++{
++	return (pmd_t) { atomic64_read((atomic64_t *)pmdp) };
++}
++#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
++
+ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
+ {
+ 	set_64bit((unsigned long long *)(ptep), native_pte_val(pte));
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index fcc13ac..d77c97d 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -635,11 +635,19 @@ static int acpi_battery_update(struct acpi_battery *battery)
+ 
+ static void acpi_battery_refresh(struct acpi_battery *battery)
+ {
++	int power_unit;
++
+ 	if (!battery->bat.dev)
+ 		return;
+ 
++	power_unit = battery->power_unit;
++
+ 	acpi_battery_get_info(battery);
+-	/* The battery may have changed its reporting units. */
++
++	if (power_unit == battery->power_unit)
++		return;
++
++	/* The battery has changed its reporting units. */
+ 	sysfs_remove_battery(battery);
+ 	sysfs_add_battery(battery);
+ }
+diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
+index 5d1d076..d452592 100644
+--- a/drivers/atm/solos-pci.c
++++ b/drivers/atm/solos-pci.c
+@@ -984,6 +984,7 @@ static uint32_t fpga_tx(struct solos_card *card)
+ 			} else if (skb && card->using_dma) {
+ 				SKB_CB(skb)->dma_addr = pci_map_single(card->dev, skb->data,
+ 								       skb->len, PCI_DMA_TODEVICE);
++				card->tx_skb[port] = skb;
+ 				iowrite32(SKB_CB(skb)->dma_addr,
+ 					  card->config_regs + TX_DMA_ADDR(port));
+ 			}
+@@ -1152,7 +1153,8 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 		db_fpga_upgrade = db_firmware_upgrade = 0;
+ 	}
+ 
+-	if (card->fpga_version >= DMA_SUPPORTED){
++	if (card->fpga_version >= DMA_SUPPORTED) {
++		pci_set_master(dev);
+ 		card->using_dma = 1;
+ 	} else {
+ 		card->using_dma = 0;
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index a714c73..305e752 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -78,6 +78,9 @@ static struct usb_device_id ath3k_table[] = {
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xE02C) },
+ 
++	/* Atheros AR5BBU22 with sflash firmware */
++	{ USB_DEVICE(0x0489, 0xE03C) },
++
+ 	{ }	/* Terminating entry */
+ };
+ 
+@@ -94,6 +97,9 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 
++	/* Atheros AR5BBU22 with sflash firmware */
++	{ USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
++
+ 	{ }	/* Terminating entry */
+ };
+ 
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 8fbda40..f4585b9 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -61,7 +61,7 @@ static struct usb_device_id btusb_table[] = {
+ 	{ USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
+ 
+ 	/* Broadcom SoftSailing reporting vendor specific */
+-	{ USB_DEVICE(0x05ac, 0x21e1) },
++	{ USB_DEVICE(0x0a5c, 0x21e1) },
+ 
+ 	/* Apple MacBookPro 7,1 */
+ 	{ USB_DEVICE(0x05ac, 0x8213) },
+@@ -100,6 +100,17 @@ static struct usb_device_id btusb_table[] = {
+ 	/* Canyon CN-BTU1 with HID interfaces */
+ 	{ USB_DEVICE(0x0c10, 0x0000) },
+ 
++	/* Broadcom BCM20702A0 */
++	{ USB_DEVICE(0x0489, 0xe042) },
++	{ USB_DEVICE(0x0a5c, 0x21e3) },
++	{ USB_DEVICE(0x0a5c, 0x21e6) },
++	{ USB_DEVICE(0x0a5c, 0x21e8) },
++	{ USB_DEVICE(0x0a5c, 0x21f3) },
++	{ USB_DEVICE(0x413c, 0x8197) },
++
++	/* Foxconn - Hon Hai */
++	{ USB_DEVICE(0x0489, 0xe033) },
++
+ 	{ }	/* Terminating entry */
+ };
+ 
+@@ -130,6 +141,9 @@ static struct usb_device_id blacklist_table[] = {
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+ 
++	/* Atheros AR5BBU12 with sflash firmware */
++	{ USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
++
+ 	/* Broadcom BCM2035 */
+ 	{ USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
+ 	{ USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index 06bc46e..c901060 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -762,10 +762,12 @@ static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd,
+ 		((v_sync_len & 0x30) >> 4);
+ 
+ 	dtd->part2.dtd_flags = 0x18;
++	if (mode->flags & DRM_MODE_FLAG_INTERLACE)
++		dtd->part2.dtd_flags |= DTD_FLAG_INTERLACE;
+ 	if (mode->flags & DRM_MODE_FLAG_PHSYNC)
+-		dtd->part2.dtd_flags |= 0x2;
++		dtd->part2.dtd_flags |= DTD_FLAG_HSYNC_POSITIVE;
+ 	if (mode->flags & DRM_MODE_FLAG_PVSYNC)
+-		dtd->part2.dtd_flags |= 0x4;
++		dtd->part2.dtd_flags |= DTD_FLAG_VSYNC_POSITIVE;
+ 
+ 	dtd->part2.sdvo_flags = 0;
+ 	dtd->part2.v_sync_off_high = v_sync_offset & 0xc0;
+@@ -799,9 +801,11 @@ static void intel_sdvo_get_mode_from_dtd(struct drm_display_mode * mode,
+ 	mode->clock = dtd->part1.clock * 10;
+ 
+ 	mode->flags &= ~(DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC);
+-	if (dtd->part2.dtd_flags & 0x2)
++	if (dtd->part2.dtd_flags & DTD_FLAG_INTERLACE)
++		mode->flags |= DRM_MODE_FLAG_INTERLACE;
++	if (dtd->part2.dtd_flags & DTD_FLAG_HSYNC_POSITIVE)
+ 		mode->flags |= DRM_MODE_FLAG_PHSYNC;
+-	if (dtd->part2.dtd_flags & 0x4)
++	if (dtd->part2.dtd_flags & DTD_FLAG_VSYNC_POSITIVE)
+ 		mode->flags |= DRM_MODE_FLAG_PVSYNC;
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/intel_sdvo_regs.h b/drivers/gpu/drm/i915/intel_sdvo_regs.h
+index 4f4e23b..c5c8ddf 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo_regs.h
++++ b/drivers/gpu/drm/i915/intel_sdvo_regs.h
+@@ -61,6 +61,11 @@ struct intel_sdvo_caps {
+     u16 output_flags;
+ } __attribute__((packed));
+ 
++/* Note: SDVO detailed timing flags match EDID misc flags. */
++#define DTD_FLAG_HSYNC_POSITIVE (1 << 1)
++#define DTD_FLAG_VSYNC_POSITIVE (1 << 2)
++#define DTD_FLAG_INTERLACE	(1 << 7)
++
+ /** This matches the EDID DTD structure, more or less */
+ struct intel_sdvo_dtd {
+     struct {
+diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
+index f57b08b..2136e6b 100644
+--- a/drivers/gpu/drm/i915/intel_tv.c
++++ b/drivers/gpu/drm/i915/intel_tv.c
+@@ -1301,6 +1301,11 @@ intel_tv_detect_type (struct intel_tv *intel_tv,
+ 
+ 	I915_WRITE(TV_DAC, save_tv_dac & ~TVDAC_STATE_CHG_EN);
+ 	I915_WRITE(TV_CTL, save_tv_ctl);
++	POSTING_READ(TV_CTL);
++
++	/* For unknown reasons the hw barfs if we don't do this vblank wait. */
++	intel_wait_for_vblank(intel_tv->base.base.dev,
++			      to_intel_crtc(intel_tv->base.base.crtc)->pipe);
+ 
+ 	/* Restore interrupt config */
+ 	if (connector->polled & DRM_CONNECTOR_POLL_HPD) {
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index fe052c6..8846bad 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -926,6 +926,11 @@ int evergreen_pcie_gart_enable(struct radeon_device *rdev)
+ 		WREG32(MC_VM_MD_L1_TLB0_CNTL, tmp);
+ 		WREG32(MC_VM_MD_L1_TLB1_CNTL, tmp);
+ 		WREG32(MC_VM_MD_L1_TLB2_CNTL, tmp);
++		if ((rdev->family == CHIP_JUNIPER) ||
++		    (rdev->family == CHIP_CYPRESS) ||
++		    (rdev->family == CHIP_HEMLOCK) ||
++		    (rdev->family == CHIP_BARTS))
++			WREG32(MC_VM_MD_L1_TLB3_CNTL, tmp);
+ 	}
+ 	WREG32(MC_VM_MB_L1_TLB0_CNTL, tmp);
+ 	WREG32(MC_VM_MB_L1_TLB1_CNTL, tmp);
+@@ -2064,9 +2069,9 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
+ 		WREG32(CC_SYS_RB_BACKEND_DISABLE, rb);
+ 		WREG32(GC_USER_RB_BACKEND_DISABLE, rb);
+ 		WREG32(CC_GC_SHADER_PIPE_CONFIG, sp);
+-        }
++	}
+ 
+-	grbm_gfx_index |= SE_BROADCAST_WRITES;
++	grbm_gfx_index = INSTANCE_BROADCAST_WRITES | SE_BROADCAST_WRITES;
+ 	WREG32(GRBM_GFX_INDEX, grbm_gfx_index);
+ 	WREG32(RLC_GFX_INDEX, grbm_gfx_index);
+ 
+diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
+index b7b2714..6078ae4 100644
+--- a/drivers/gpu/drm/radeon/evergreend.h
++++ b/drivers/gpu/drm/radeon/evergreend.h
+@@ -230,6 +230,7 @@
+ #define	MC_VM_MD_L1_TLB0_CNTL				0x2654
+ #define	MC_VM_MD_L1_TLB1_CNTL				0x2658
+ #define	MC_VM_MD_L1_TLB2_CNTL				0x265C
++#define	MC_VM_MD_L1_TLB3_CNTL				0x2698
+ 
+ #define	FUS_MC_VM_MD_L1_TLB0_CNTL			0x265C
+ #define	FUS_MC_VM_MD_L1_TLB1_CNTL			0x2660
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index a324564..ef6b426 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -480,7 +480,9 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
+ 	 */
+ 	if ((dev->pdev->device == 0x9498) &&
+ 	    (dev->pdev->subsystem_vendor == 0x1682) &&
+-	    (dev->pdev->subsystem_device == 0x2452)) {
++	    (dev->pdev->subsystem_device == 0x2452) &&
++	    (i2c_bus->valid == false) &&
++	    !(supported_device & (ATOM_DEVICE_TV_SUPPORT | ATOM_DEVICE_CV_SUPPORT))) {
+ 		struct radeon_device *rdev = dev->dev_private;
+ 		*i2c_bus = radeon_lookup_i2c_gpio(rdev, 0x93);
+ 	}
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index 84cf82f..51d20aa 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -151,6 +151,8 @@ int rv770_pcie_gart_enable(struct radeon_device *rdev)
+ 	WREG32(MC_VM_MD_L1_TLB0_CNTL, tmp);
+ 	WREG32(MC_VM_MD_L1_TLB1_CNTL, tmp);
+ 	WREG32(MC_VM_MD_L1_TLB2_CNTL, tmp);
++	if (rdev->family == CHIP_RV740)
++		WREG32(MC_VM_MD_L1_TLB3_CNTL, tmp);
+ 	WREG32(MC_VM_MB_L1_TLB0_CNTL, tmp);
+ 	WREG32(MC_VM_MB_L1_TLB1_CNTL, tmp);
+ 	WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+diff --git a/drivers/gpu/drm/radeon/rv770d.h b/drivers/gpu/drm/radeon/rv770d.h
+index 79fa588..7538092 100644
+--- a/drivers/gpu/drm/radeon/rv770d.h
++++ b/drivers/gpu/drm/radeon/rv770d.h
+@@ -174,6 +174,7 @@
+ #define	MC_VM_MD_L1_TLB0_CNTL				0x2654
+ #define	MC_VM_MD_L1_TLB1_CNTL				0x2658
+ #define	MC_VM_MD_L1_TLB2_CNTL				0x265C
++#define	MC_VM_MD_L1_TLB3_CNTL				0x2698
+ #define	MC_VM_SYSTEM_APERTURE_DEFAULT_ADDR		0x203C
+ #define	MC_VM_SYSTEM_APERTURE_HIGH_ADDR			0x2038
+ #define	MC_VM_SYSTEM_APERTURE_LOW_ADDR			0x2034
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 81b6850..7632edb 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -1809,6 +1809,7 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink)
+ 			spin_unlock(&glob->lru_lock);
+ 			(void) ttm_bo_cleanup_refs(bo, false, false, false);
+ 			kref_put(&bo->list_kref, ttm_bo_release_list);
++			spin_lock(&glob->lru_lock);
+ 			continue;
+ 		}
+ 
+diff --git a/drivers/mtd/nand/nand_bbt.c b/drivers/mtd/nand/nand_bbt.c
+index ccbeaa1..cc81cd6 100644
+--- a/drivers/mtd/nand/nand_bbt.c
++++ b/drivers/mtd/nand/nand_bbt.c
+@@ -360,6 +360,7 @@ static int scan_read_raw_oob(struct mtd_info *mtd, uint8_t *buf, loff_t offs,
+ 
+ 		buf += mtd->oobsize + mtd->writesize;
+ 		len -= mtd->writesize;
++		offs += mtd->writesize;
+ 	}
+ 	return 0;
+ }
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index ab4723d..735f726 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -247,7 +247,7 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
+ 
+ xmit_world:
+ 	skb->ip_summed = ip_summed;
+-	skb_set_dev(skb, vlan->lowerdev);
++	skb->dev = vlan->lowerdev;
+ 	return dev_queue_xmit(skb);
+ }
+ 
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+index 592b0cf..2aed7a0 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+@@ -878,6 +878,7 @@ static void rs_bt_update_lq(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
+ 	if ((priv->bt_traffic_load != priv->last_bt_traffic_load) ||
+ 	    (priv->bt_full_concurrent != full_concurrent)) {
+ 		priv->bt_full_concurrent = full_concurrent;
++		priv->last_bt_traffic_load = priv->bt_traffic_load;
+ 
+ 		/* Update uCode's rate table. */
+ 		tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
+diff --git a/drivers/net/wireless/wl1251/sdio.c b/drivers/net/wireless/wl1251/sdio.c
+index 85a7101..4cf5c2e 100644
+--- a/drivers/net/wireless/wl1251/sdio.c
++++ b/drivers/net/wireless/wl1251/sdio.c
+@@ -259,6 +259,7 @@ static int wl1251_sdio_probe(struct sdio_func *func,
+ 	}
+ 
+ 	if (wl->irq) {
++		irq_set_status_flags(wl->irq, IRQ_NOAUTOEN);
+ 		ret = request_irq(wl->irq, wl1251_line_irq, 0, "wl1251", wl);
+ 		if (ret < 0) {
+ 			wl1251_error("request_irq() failed: %d", ret);
+@@ -266,7 +267,6 @@ static int wl1251_sdio_probe(struct sdio_func *func,
+ 		}
+ 
+ 		irq_set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
+-		disable_irq(wl->irq);
+ 
+ 		wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
+ 		wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
+diff --git a/drivers/net/wireless/wl1251/spi.c b/drivers/net/wireless/wl1251/spi.c
+index af6448c..49f3651 100644
+--- a/drivers/net/wireless/wl1251/spi.c
++++ b/drivers/net/wireless/wl1251/spi.c
+@@ -280,6 +280,7 @@ static int __devinit wl1251_spi_probe(struct spi_device *spi)
+ 
+ 	wl->use_eeprom = pdata->use_eeprom;
+ 
++	irq_set_status_flags(wl->irq, IRQ_NOAUTOEN);
+ 	ret = request_irq(wl->irq, wl1251_irq, 0, DRIVER_NAME, wl);
+ 	if (ret < 0) {
+ 		wl1251_error("request_irq() failed: %d", ret);
+@@ -288,8 +289,6 @@ static int __devinit wl1251_spi_probe(struct spi_device *spi)
+ 
+ 	irq_set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
+ 
+-	disable_irq(wl->irq);
+-
+ 	ret = wl1251_init_ieee80211(wl);
+ 	if (ret)
+ 		goto out_irq;
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 72ab1e6..99fc45b 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1380,16 +1380,19 @@ static int scsi_lld_busy(struct request_queue *q)
+ {
+ 	struct scsi_device *sdev = q->queuedata;
+ 	struct Scsi_Host *shost;
+-	struct scsi_target *starget;
+ 
+ 	if (!sdev)
+ 		return 0;
+ 
+ 	shost = sdev->host;
+-	starget = scsi_target(sdev);
+ 
+-	if (scsi_host_in_recovery(shost) || scsi_host_is_busy(shost) ||
+-	    scsi_target_is_busy(starget) || scsi_device_is_busy(sdev))
++	/*
++	 * Ignore host/starget busy state.
++	 * Since block layer does not have a concept of fairness across
++	 * multiple queues, congestion of host/starget needs to be handled
++	 * in SCSI layer.
++	 */
++	if (scsi_host_in_recovery(shost) || scsi_device_is_busy(sdev))
+ 		return 1;
+ 
+ 	return 0;
+diff --git a/drivers/scsi/scsi_wait_scan.c b/drivers/scsi/scsi_wait_scan.c
+index 74708fc..ae78148 100644
+--- a/drivers/scsi/scsi_wait_scan.c
++++ b/drivers/scsi/scsi_wait_scan.c
+@@ -12,7 +12,7 @@
+ 
+ #include <linux/module.h>
+ #include <linux/device.h>
+-#include <scsi/scsi_scan.h>
++#include "scsi_priv.h"
+ 
+ static int __init wait_scan_init(void)
+ {
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 6255fa8..7cb9dd2 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -43,6 +43,7 @@
+ 
+ #define CIFS_MIN_RCV_POOL 4
+ 
++#define MAX_REOPEN_ATT	5 /* these many maximum attempts to reopen a file */
+ /*
+  * default attribute cache timeout (jiffies)
+  */
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index a9b4a24..9040cb0 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -973,10 +973,11 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
+ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
+ 					bool fsuid_only)
+ {
+-	struct cifsFileInfo *open_file;
++	struct cifsFileInfo *open_file, *inv_file = NULL;
+ 	struct cifs_sb_info *cifs_sb;
+ 	bool any_available = false;
+ 	int rc;
++	unsigned int refind = 0;
+ 
+ 	/* Having a null inode here (because mapping->host was set to zero by
+ 	the VFS or MM) should not happen but we had reports of on oops (due to
+@@ -996,40 +997,25 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
+ 
+ 	spin_lock(&cifs_file_list_lock);
+ refind_writable:
++	if (refind > MAX_REOPEN_ATT) {
++		spin_unlock(&cifs_file_list_lock);
++		return NULL;
++	}
+ 	list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
+ 		if (!any_available && open_file->pid != current->tgid)
+ 			continue;
+ 		if (fsuid_only && open_file->uid != current_fsuid())
+ 			continue;
+ 		if (OPEN_FMODE(open_file->f_flags) & FMODE_WRITE) {
+-			cifsFileInfo_get(open_file);
+-
+ 			if (!open_file->invalidHandle) {
+ 				/* found a good writable file */
++				cifsFileInfo_get(open_file);
+ 				spin_unlock(&cifs_file_list_lock);
+ 				return open_file;
++			} else {
++				if (!inv_file)
++					inv_file = open_file;
+ 			}
+-
+-			spin_unlock(&cifs_file_list_lock);
+-
+-			/* Had to unlock since following call can block */
+-			rc = cifs_reopen_file(open_file, false);
+-			if (!rc)
+-				return open_file;
+-
+-			/* if it fails, try another handle if possible */
+-			cFYI(1, "wp failed on reopen file");
+-			cifsFileInfo_put(open_file);
+-
+-			spin_lock(&cifs_file_list_lock);
+-
+-			/* else we simply continue to the next entry. Thus
+-			   we do not loop on reopen errors.  If we
+-			   can not reopen the file, for example if we
+-			   reconnected to a server with another client
+-			   racing to delete or lock the file we would not
+-			   make progress if we restarted before the beginning
+-			   of the loop here. */
+ 		}
+ 	}
+ 	/* couldn't find useable FH with same pid, try any available */
+@@ -1037,7 +1023,30 @@ refind_writable:
+ 		any_available = true;
+ 		goto refind_writable;
+ 	}
++
++	if (inv_file) {
++		any_available = false;
++		cifsFileInfo_get(inv_file);
++	}
++
+ 	spin_unlock(&cifs_file_list_lock);
++
++	if (inv_file) {
++		rc = cifs_reopen_file(inv_file, false);
++		if (!rc)
++			return inv_file;
++		else {
++			spin_lock(&cifs_file_list_lock);
++			list_move_tail(&inv_file->flist,
++					&cifs_inode->openFileList);
++			spin_unlock(&cifs_file_list_lock);
++			cifsFileInfo_put(inv_file);
++			spin_lock(&cifs_file_list_lock);
++			++refind;
++			goto refind_writable;
++		}
++	}
++
+ 	return NULL;
+ }
+ 
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 808c554..4cbe1c2 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -35,7 +35,7 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ 		handle_t *handle = NULL;
+ 		int err, migrate = 0;
+ 		struct ext4_iloc iloc;
+-		unsigned int oldflags;
++		unsigned int oldflags, mask, i;
+ 		unsigned int jflag;
+ 
+ 		if (!inode_owner_or_capable(inode))
+@@ -112,9 +112,14 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ 		if (err)
+ 			goto flags_err;
+ 
+-		flags = flags & EXT4_FL_USER_MODIFIABLE;
+-		flags |= oldflags & ~EXT4_FL_USER_MODIFIABLE;
+-		ei->i_flags = flags;
++		for (i = 0, mask = 1; i < 32; i++, mask <<= 1) {
++			if (!(mask & EXT4_FL_USER_MODIFIABLE))
++				continue;
++			if (mask & flags)
++				ext4_set_inode_flag(inode, i);
++			else
++				ext4_clear_inode_flag(inode, i);
++		}
+ 
+ 		ext4_set_inode_flags(inode);
+ 		inode->i_ctime = ext4_current_time(inode);
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 0f1be7f..b6adf68 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -2528,6 +2528,9 @@ int ext4_mb_release(struct super_block *sb)
+ 	struct ext4_sb_info *sbi = EXT4_SB(sb);
+ 	struct kmem_cache *cachep = get_groupinfo_cache(sb->s_blocksize_bits);
+ 
++	if (sbi->s_proc)
++		remove_proc_entry("mb_groups", sbi->s_proc);
++
+ 	if (sbi->s_group_info) {
+ 		for (i = 0; i < ngroups; i++) {
+ 			grinfo = ext4_get_group_info(sb, i);
+@@ -2575,8 +2578,6 @@ int ext4_mb_release(struct super_block *sb)
+ 	}
+ 
+ 	free_percpu(sbi->s_locality_groups);
+-	if (sbi->s_proc)
+-		remove_proc_entry("mb_groups", sbi->s_proc);
+ 
+ 	return 0;
+ }
+@@ -4583,6 +4584,7 @@ do_more:
+ 		 */
+ 		new_entry = kmem_cache_alloc(ext4_free_ext_cachep, GFP_NOFS);
+ 		if (!new_entry) {
++			ext4_mb_unload_buddy(&e4b);
+ 			err = -ENOMEM;
+ 			goto error_return;
+ 		}
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index df121b2..113b107 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -433,6 +433,7 @@ void __ext4_error(struct super_block *sb, const char *function,
+ 	printk(KERN_CRIT "EXT4-fs error (device %s): %s:%d: comm %s: %pV\n",
+ 	       sb->s_id, function, line, current->comm, &vaf);
+ 	va_end(args);
++	save_error_info(sb, function, line);
+ 
+ 	ext4_handle_error(sb);
+ }
+@@ -3618,7 +3619,8 @@ no_journal:
+ 		goto failed_mount4;
+ 	}
+ 
+-	ext4_setup_super(sb, es, sb->s_flags & MS_RDONLY);
++	if (ext4_setup_super(sb, es, sb->s_flags & MS_RDONLY))
++		sb->s_flags |= MS_RDONLY;
+ 
+ 	/* determine the minimum size of new large inodes, if present */
+ 	if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE) {
+diff --git a/fs/namespace.c b/fs/namespace.c
+index edc1c4a..b3d8f51 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1244,8 +1244,9 @@ void umount_tree(struct vfsmount *mnt, int propagate, struct list_head *kill)
+ 		list_del_init(&p->mnt_expire);
+ 		list_del_init(&p->mnt_list);
+ 		__touch_mnt_namespace(p->mnt_ns);
++		if (p->mnt_ns)
++			__mnt_make_shortterm(p);
+ 		p->mnt_ns = NULL;
+-		__mnt_make_shortterm(p);
+ 		list_del_init(&p->mnt_child);
+ 		if (p->mnt_parent != p) {
+ 			p->mnt_parent->mnt_ghosts++;
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 30f6548..b7a7e5f 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -94,6 +94,8 @@ static int nfs4_map_errors(int err)
+ 	case -NFS4ERR_BADOWNER:
+ 	case -NFS4ERR_BADNAME:
+ 		return -EINVAL;
++	case -NFS4ERR_SHARE_DENIED:
++		return -EACCES;
+ 	default:
+ 		dprintk("%s could not handle NFSv4 error %d\n",
+ 				__func__, -err);
+diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
+index a03c098..831924a 100644
+--- a/include/asm-generic/pgtable.h
++++ b/include/asm-generic/pgtable.h
+@@ -445,6 +445,18 @@ static inline int pmd_write(pmd_t pmd)
+ #endif /* __HAVE_ARCH_PMD_WRITE */
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+ 
++#ifndef pmd_read_atomic
++static inline pmd_t pmd_read_atomic(pmd_t *pmdp)
++{
++	/*
++	 * Depend on compiler for an atomic pmd read. NOTE: this is
++	 * only going to work, if the pmdval_t isn't larger than
++	 * an unsigned long.
++	 */
++	return *pmdp;
++}
++#endif
++
+ /*
+  * This function is meant to be used by sites walking pagetables with
+  * the mmap_sem hold in read mode to protect against MADV_DONTNEED and
+@@ -458,11 +470,17 @@ static inline int pmd_write(pmd_t pmd)
+  * undefined so behaving like if the pmd was none is safe (because it
+  * can return none anyway). The compiler level barrier() is critically
+  * important to compute the two checks atomically on the same pmdval.
++ *
++ * For 32bit kernels with a 64bit large pmd_t this automatically takes
++ * care of reading the pmd atomically to avoid SMP race conditions
++ * against pmd_populate() when the mmap_sem is hold for reading by the
++ * caller (a special atomic read not done by "gcc" as in the generic
++ * version above, is also needed when THP is disabled because the page
++ * fault can populate the pmd from under us).
+  */
+ static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t *pmd)
+ {
+-	/* depend on compiler for an atomic pmd read */
+-	pmd_t pmdval = *pmd;
++	pmd_t pmdval = pmd_read_atomic(pmd);
+ 	/*
+ 	 * The barrier will stabilize the pmdval in a register or on
+ 	 * the stack so that it will stop changing under the code.
+diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
+index 14b6cd0..4306811 100644
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -181,6 +181,7 @@
+ 	{0x1002, 0x6747, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+ 	{0x1002, 0x6748, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+ 	{0x1002, 0x6749, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
++	{0x1002, 0x674A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+ 	{0x1002, 0x6750, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+ 	{0x1002, 0x6751, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+ 	{0x1002, 0x6758, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+@@ -198,6 +199,7 @@
+ 	{0x1002, 0x6767, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+ 	{0x1002, 0x6768, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+ 	{0x1002, 0x6770, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
++	{0x1002, 0x6771, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+ 	{0x1002, 0x6772, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+ 	{0x1002, 0x6778, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+ 	{0x1002, 0x6779, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 33b5968..c6d6d48 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1453,15 +1453,6 @@ static inline bool netdev_uses_dsa_tags(struct net_device *dev)
+ 	return 0;
+ }
+ 
+-#ifndef CONFIG_NET_NS
+-static inline void skb_set_dev(struct sk_buff *skb, struct net_device *dev)
+-{
+-	skb->dev = dev;
+-}
+-#else /* CONFIG_NET_NS */
+-void skb_set_dev(struct sk_buff *skb, struct net_device *dev);
+-#endif
+-
+ static inline bool netdev_uses_trailer_tags(struct net_device *dev)
+ {
+ #ifdef CONFIG_NET_DSA_TAG_TRAILER
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index f13b52b..37b643b 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1633,8 +1633,6 @@ static inline int __skb_cow(struct sk_buff *skb, unsigned int headroom,
+ {
+ 	int delta = 0;
+ 
+-	if (headroom < NET_SKB_PAD)
+-		headroom = NET_SKB_PAD;
+ 	if (headroom > skb_headroom(skb))
+ 		delta = headroom - skb_headroom(skb);
+ 
+diff --git a/include/net/dst.h b/include/net/dst.h
+index d020134..7907ff1 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -78,6 +78,7 @@ struct dst_entry {
+ #define DST_NOHASH		0x0008
+ #define DST_NOCACHE		0x0010
+ #define DST_NOCOUNT		0x0020
++#define DST_XFRM_TUNNEL		0x0100
+ 	union {
+ 		struct dst_entry	*next;
+ 		struct rtable __rcu	*rt_next;
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index b2c2366..f686066 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -700,4 +700,17 @@ static inline void sctp_v4_map_v6(union sctp_addr *addr)
+ 	addr->v6.sin6_addr.s6_addr32[2] = htonl(0x0000ffff);
+ }
+ 
++/* The cookie is always 0 since this is how it's used in the
++ * pmtu code.
++ */
++static inline struct dst_entry *sctp_transport_dst_check(struct sctp_transport *t)
++{
++	if (t->dst && !dst_check(t->dst, 0)) {
++		dst_release(t->dst);
++		t->dst = NULL;
++	}
++
++	return t->dst;
++}
++
+ #endif /* __net_sctp_h__ */
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 6072d74..769935d 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -665,7 +665,7 @@ static enum page_references page_check_references(struct page *page,
+ 		return PAGEREF_RECLAIM;
+ 
+ 	if (referenced_ptes) {
+-		if (PageAnon(page))
++		if (PageSwapBacked(page))
+ 			return PAGEREF_ACTIVATE;
+ 		/*
+ 		 * All mapped pages start out with page table
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 5b4f51d..d548456 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -154,7 +154,7 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
+ 		skb = __vlan_hwaccel_put_tag(skb, vlan_tci);
+ 	}
+ 
+-	skb_set_dev(skb, vlan_dev_info(dev)->real_dev);
++	skb->dev = vlan_dev_info(dev)->real_dev;
+ 	len = skb->len;
+ 	ret = dev_queue_xmit(skb);
+ 
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 1e77897..a71eafc 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1533,10 +1533,14 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
+ 		kfree_skb(skb);
+ 		return NET_RX_DROP;
+ 	}
+-	skb_set_dev(skb, dev);
++	skb->dev = dev;
++	skb_dst_drop(skb);
+ 	skb->tstamp.tv64 = 0;
+ 	skb->pkt_type = PACKET_HOST;
+ 	skb->protocol = eth_type_trans(skb, dev);
++	skb->mark = 0;
++	secpath_reset(skb);
++	nf_reset(skb);
+ 	return netif_rx(skb);
+ }
+ EXPORT_SYMBOL_GPL(dev_forward_skb);
+@@ -1791,36 +1795,6 @@ void netif_device_attach(struct net_device *dev)
+ }
+ EXPORT_SYMBOL(netif_device_attach);
+ 
+-/**
+- * skb_dev_set -- assign a new device to a buffer
+- * @skb: buffer for the new device
+- * @dev: network device
+- *
+- * If an skb is owned by a device already, we have to reset
+- * all data private to the namespace a device belongs to
+- * before assigning it a new device.
+- */
+-#ifdef CONFIG_NET_NS
+-void skb_set_dev(struct sk_buff *skb, struct net_device *dev)
+-{
+-	skb_dst_drop(skb);
+-	if (skb->dev && !net_eq(dev_net(skb->dev), dev_net(dev))) {
+-		secpath_reset(skb);
+-		nf_reset(skb);
+-		skb_init_secmark(skb);
+-		skb->mark = 0;
+-		skb->priority = 0;
+-		skb->nf_trace = 0;
+-		skb->ipvs_property = 0;
+-#ifdef CONFIG_NET_SCHED
+-		skb->tc_index = 0;
+-#endif
+-	}
+-	skb->dev = dev;
+-}
+-EXPORT_SYMBOL(skb_set_dev);
+-#endif /* CONFIG_NET_NS */
+-
+ /*
+  * Invalidate hardware checksum when packet is to be mangled, and
+  * complete checksum manually on outgoing path.
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index e35a6fb..c0e0f76 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -1932,7 +1932,7 @@ static int pktgen_device_event(struct notifier_block *unused,
+ {
+ 	struct net_device *dev = ptr;
+ 
+-	if (!net_eq(dev_net(dev), &init_net))
++	if (!net_eq(dev_net(dev), &init_net) || pktgen_exiting)
+ 		return NOTIFY_DONE;
+ 
+ 	/* It is OK that we do not hold the group lock right now,
+@@ -3755,12 +3755,18 @@ static void __exit pg_cleanup(void)
+ {
+ 	struct pktgen_thread *t;
+ 	struct list_head *q, *n;
++	LIST_HEAD(list);
+ 
+ 	/* Stop all interfaces & threads */
+ 	pktgen_exiting = true;
+ 
+-	list_for_each_safe(q, n, &pktgen_threads) {
++	mutex_lock(&pktgen_thread_lock);
++	list_splice_init(&pktgen_threads, &list);
++	mutex_unlock(&pktgen_thread_lock);
++
++	list_for_each_safe(q, n, &list) {
+ 		t = list_entry(q, struct pktgen_thread, th_list);
++		list_del(&t->th_list);
+ 		kthread_stop(t->tsk);
+ 		kfree(t);
+ 	}
+diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
+index a5b4134..530787b 100644
+--- a/net/ipv4/esp4.c
++++ b/net/ipv4/esp4.c
+@@ -457,28 +457,22 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu)
+ 	struct esp_data *esp = x->data;
+ 	u32 blksize = ALIGN(crypto_aead_blocksize(esp->aead), 4);
+ 	u32 align = max_t(u32, blksize, esp->padlen);
+-	u32 rem;
+-
+-	mtu -= x->props.header_len + crypto_aead_authsize(esp->aead);
+-	rem = mtu & (align - 1);
+-	mtu &= ~(align - 1);
++	unsigned int net_adj;
+ 
+ 	switch (x->props.mode) {
+-	case XFRM_MODE_TUNNEL:
+-		break;
+-	default:
+ 	case XFRM_MODE_TRANSPORT:
+-		/* The worst case */
+-		mtu -= blksize - 4;
+-		mtu += min_t(u32, blksize - 4, rem);
+-		break;
+ 	case XFRM_MODE_BEET:
+-		/* The worst case. */
+-		mtu += min_t(u32, IPV4_BEET_PHMAXLEN, rem);
++		net_adj = sizeof(struct iphdr);
+ 		break;
++	case XFRM_MODE_TUNNEL:
++		net_adj = 0;
++		break;
++	default:
++		BUG();
+ 	}
+ 
+-	return mtu - 2;
++	return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
++		 net_adj) & ~(align - 1)) + (net_adj - 2);
+ }
+ 
+ static void esp4_err(struct sk_buff *skb, u32 info)
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index 33e2c35..7e454ba 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -142,6 +142,18 @@ const struct fib_prop fib_props[RTN_MAX + 1] = {
+ };
+ 
+ /* Release a nexthop info record */
++static void free_fib_info_rcu(struct rcu_head *head)
++{
++	struct fib_info *fi = container_of(head, struct fib_info, rcu);
++
++	change_nexthops(fi) {
++		if (nexthop_nh->nh_dev)
++			dev_put(nexthop_nh->nh_dev);
++	} endfor_nexthops(fi);
++
++	release_net(fi->fib_net);
++	kfree(fi);
++}
+ 
+ void free_fib_info(struct fib_info *fi)
+ {
+@@ -149,14 +161,8 @@ void free_fib_info(struct fib_info *fi)
+ 		pr_warning("Freeing alive fib_info %p\n", fi);
+ 		return;
+ 	}
+-	change_nexthops(fi) {
+-		if (nexthop_nh->nh_dev)
+-			dev_put(nexthop_nh->nh_dev);
+-		nexthop_nh->nh_dev = NULL;
+-	} endfor_nexthops(fi);
+ 	fib_info_cnt--;
+-	release_net(fi->fib_net);
+-	kfree_rcu(fi, rcu);
++	call_rcu(&fi->rcu, free_fib_info_rcu);
+ }
+ 
+ void fib_release_info(struct fib_info *fi)
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 58c25ea..0d884eb 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1371,6 +1371,8 @@ static int check_leaf(struct fib_table *tb, struct trie *t, struct leaf *l,
+ 
+ 			if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos)
+ 				continue;
++			if (fi->fib_dead)
++				continue;
+ 			if (fa->fa_info->fib_scope < flp->flowi4_scope)
+ 				continue;
+ 			fib_alias_accessed(fa);
+diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
+index 1ac7938..65dd543 100644
+--- a/net/ipv6/esp6.c
++++ b/net/ipv6/esp6.c
+@@ -411,19 +411,15 @@ static u32 esp6_get_mtu(struct xfrm_state *x, int mtu)
+ 	struct esp_data *esp = x->data;
+ 	u32 blksize = ALIGN(crypto_aead_blocksize(esp->aead), 4);
+ 	u32 align = max_t(u32, blksize, esp->padlen);
+-	u32 rem;
++	unsigned int net_adj;
+ 
+-	mtu -= x->props.header_len + crypto_aead_authsize(esp->aead);
+-	rem = mtu & (align - 1);
+-	mtu &= ~(align - 1);
+-
+-	if (x->props.mode != XFRM_MODE_TUNNEL) {
+-		u32 padsize = ((blksize - 1) & 7) + 1;
+-		mtu -= blksize - padsize;
+-		mtu += min_t(u32, blksize - padsize, rem);
+-	}
++	if (x->props.mode != XFRM_MODE_TUNNEL)
++		net_adj = sizeof(struct ipv6hdr);
++	else
++		net_adj = 0;
+ 
+-	return mtu - 2;
++	return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
++		 net_adj) & ~(align - 1)) + (net_adj - 2);
+ }
+ 
+ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 9cbf176..ae9f6d4 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1194,6 +1194,29 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
+ 	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+ }
+ 
++static void ip6_append_data_mtu(int *mtu,
++				int *maxfraglen,
++				unsigned int fragheaderlen,
++				struct sk_buff *skb,
++				struct rt6_info *rt)
++{
++	if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
++		if (skb == NULL) {
++			/* first fragment, reserve header_len */
++			*mtu = *mtu - rt->dst.header_len;
++
++		} else {
++			/*
++			 * this fragment is not first, the headers
++			 * space is regarded as data space.
++			 */
++			*mtu = dst_mtu(rt->dst.path);
++		}
++		*maxfraglen = ((*mtu - fragheaderlen) & ~7)
++			      + fragheaderlen - sizeof(struct frag_hdr);
++	}
++}
++
+ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ 	int offset, int len, int odd, struct sk_buff *skb),
+ 	void *from, int length, int transhdrlen,
+@@ -1203,7 +1226,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ 	struct inet_sock *inet = inet_sk(sk);
+ 	struct ipv6_pinfo *np = inet6_sk(sk);
+ 	struct inet_cork *cork;
+-	struct sk_buff *skb;
++	struct sk_buff *skb, *skb_prev = NULL;
+ 	unsigned int maxfraglen, fragheaderlen;
+ 	int exthdrlen;
+ 	int hh_len;
+@@ -1260,8 +1283,12 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ 		inet->cork.fl.u.ip6 = *fl6;
+ 		np->cork.hop_limit = hlimit;
+ 		np->cork.tclass = tclass;
+-		mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
+-		      rt->dst.dev->mtu : dst_mtu(rt->dst.path);
++		if (rt->dst.flags & DST_XFRM_TUNNEL)
++			mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
++			      rt->dst.dev->mtu : dst_mtu(&rt->dst);
++		else
++			mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
++			      rt->dst.dev->mtu : dst_mtu(rt->dst.path);
+ 		if (np->frag_size < mtu) {
+ 			if (np->frag_size)
+ 				mtu = np->frag_size;
+@@ -1356,38 +1383,43 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ 			unsigned int fraglen;
+ 			unsigned int fraggap;
+ 			unsigned int alloclen;
+-			struct sk_buff *skb_prev;
+ alloc_new_skb:
+-			skb_prev = skb;
+-
+ 			/* There's no room in the current skb */
+-			if (skb_prev)
+-				fraggap = skb_prev->len - maxfraglen;
++			if (skb)
++				fraggap = skb->len - maxfraglen;
+ 			else
+ 				fraggap = 0;
++			/* update mtu and maxfraglen if necessary */
++			if (skb == NULL || skb_prev == NULL)
++				ip6_append_data_mtu(&mtu, &maxfraglen,
++						    fragheaderlen, skb, rt);
++
++			skb_prev = skb;
+ 
+ 			/*
+ 			 * If remaining data exceeds the mtu,
+ 			 * we know we need more fragment(s).
+ 			 */
+ 			datalen = length + fraggap;
+-			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
+-				datalen = maxfraglen - fragheaderlen;
+ 
+-			fraglen = datalen + fragheaderlen;
++			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
++				datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
+ 			if ((flags & MSG_MORE) &&
+ 			    !(rt->dst.dev->features&NETIF_F_SG))
+ 				alloclen = mtu;
+ 			else
+ 				alloclen = datalen + fragheaderlen;
+ 
+-			/*
+-			 * The last fragment gets additional space at tail.
+-			 * Note: we overallocate on fragments with MSG_MODE
+-			 * because we have no idea if we're the last one.
+-			 */
+-			if (datalen == length + fraggap)
+-				alloclen += rt->dst.trailer_len;
++			if (datalen != length + fraggap) {
++				/*
++				 * this is not the last fragment, the trailer
++				 * space is regarded as data space.
++				 */
++				datalen += rt->dst.trailer_len;
++			}
++
++			alloclen += rt->dst.trailer_len;
++			fraglen = datalen + fragheaderlen;
+ 
+ 			/*
+ 			 * We just reserve space for fragment header.
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index ea52d02..78bc442 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -251,9 +251,16 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ {
+ 	struct inet_sock *inet = inet_sk(sk);
+ 	struct sockaddr_l2tpip *addr = (struct sockaddr_l2tpip *) uaddr;
+-	int ret = -EINVAL;
++	int ret;
+ 	int chk_addr_ret;
+ 
++	if (!sock_flag(sk, SOCK_ZAPPED))
++		return -EINVAL;
++	if (addr_len < sizeof(struct sockaddr_l2tpip))
++		return -EINVAL;
++	if (addr->l2tp_family != AF_INET)
++		return -EINVAL;
++
+ 	ret = -EADDRINUSE;
+ 	read_lock_bh(&l2tp_ip_lock);
+ 	if (__l2tp_ip_bind_lookup(&init_net, addr->l2tp_addr.s_addr, sk->sk_bound_dev_if, addr->l2tp_conn_id))
+@@ -283,6 +290,8 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ 	sk_del_node_init(sk);
+ 	write_unlock_bh(&l2tp_ip_lock);
+ 	ret = 0;
++	sock_reset_flag(sk, SOCK_ZAPPED);
++
+ out:
+ 	release_sock(sk);
+ 
+@@ -303,13 +312,14 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
+ 	__be32 saddr;
+ 	int oif, rc;
+ 
+-	rc = -EINVAL;
++	if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
++		return -EINVAL;
++
+ 	if (addr_len < sizeof(*lsa))
+-		goto out;
++		return -EINVAL;
+ 
+-	rc = -EAFNOSUPPORT;
+ 	if (lsa->l2tp_family != AF_INET)
+-		goto out;
++		return -EAFNOSUPPORT;
+ 
+ 	lock_sock(sk);
+ 
+@@ -363,6 +373,14 @@ out:
+ 	return rc;
+ }
+ 
++static int l2tp_ip_disconnect(struct sock *sk, int flags)
++{
++	if (sock_flag(sk, SOCK_ZAPPED))
++		return 0;
++
++	return udp_disconnect(sk, flags);
++}
++
+ static int l2tp_ip_getname(struct socket *sock, struct sockaddr *uaddr,
+ 			   int *uaddr_len, int peer)
+ {
+@@ -591,7 +609,7 @@ static struct proto l2tp_ip_prot = {
+ 	.close		   = l2tp_ip_close,
+ 	.bind		   = l2tp_ip_bind,
+ 	.connect	   = l2tp_ip_connect,
+-	.disconnect	   = udp_disconnect,
++	.disconnect	   = l2tp_ip_disconnect,
+ 	.ioctl		   = udp_ioctl,
+ 	.destroy	   = l2tp_ip_destroy_sock,
+ 	.setsockopt	   = ip_setsockopt,
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 2124db8..11d9d49 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1254,6 +1254,12 @@ int ieee80211_reconfig(struct ieee80211_local *local)
+ 		}
+ 	}
+ 
++	/* add back keys */
++	list_for_each_entry(sdata, &local->interfaces, list)
++		if (ieee80211_sdata_running(sdata))
++			ieee80211_enable_keys(sdata);
++
++ wake_up:
+ 	/*
+ 	 * Clear the WLAN_STA_BLOCK_BA flag so new aggregation
+ 	 * sessions can be established after a resume.
+@@ -1275,12 +1281,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
+ 		mutex_unlock(&local->sta_mtx);
+ 	}
+ 
+-	/* add back keys */
+-	list_for_each_entry(sdata, &local->interfaces, list)
+-		if (ieee80211_sdata_running(sdata))
+-			ieee80211_enable_keys(sdata);
+-
+- wake_up:
+ 	ieee80211_wake_queues_by_reason(hw,
+ 			IEEE80211_QUEUE_STOP_REASON_SUSPEND);
+ 
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index 817174e..8fc4dcd 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -377,9 +377,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
+ 	 */
+ 	skb_set_owner_w(nskb, sk);
+ 
+-	/* The 'obsolete' field of dst is set to 2 when a dst is freed. */
+-	if (!dst || (dst->obsolete > 1)) {
+-		dst_release(dst);
++	if (!sctp_transport_dst_check(tp)) {
+ 		sctp_transport_route(tp, NULL, sctp_sk(sk));
+ 		if (asoc && (asoc->param_flags & SPP_PMTUD_ENABLE)) {
+ 			sctp_assoc_sync_pmtu(asoc);
+diff --git a/net/sctp/transport.c b/net/sctp/transport.c
+index 394c57c..8da4481 100644
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -226,23 +226,6 @@ void sctp_transport_pmtu(struct sctp_transport *transport, struct sock *sk)
+ 		transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
+ }
+ 
+-/* this is a complete rip-off from __sk_dst_check
+- * the cookie is always 0 since this is how it's used in the
+- * pmtu code
+- */
+-static struct dst_entry *sctp_transport_dst_check(struct sctp_transport *t)
+-{
+-	struct dst_entry *dst = t->dst;
+-
+-	if (dst && dst->obsolete && dst->ops->check(dst, 0) == NULL) {
+-		dst_release(t->dst);
+-		t->dst = NULL;
+-		return NULL;
+-	}
+-
+-	return dst;
+-}
+-
+ void sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
+ {
+ 	struct dst_entry *dst;
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 7803eb6..0c0e40e 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1917,6 +1917,9 @@ no_transform:
+ 	}
+ ok:
+ 	xfrm_pols_put(pols, drop_pols);
++	if (dst && dst->xfrm &&
++	    dst->xfrm->props.mode == XFRM_MODE_TUNNEL)
++		dst->flags |= DST_XFRM_TUNNEL;
+ 	return dst;
+ 
+ nopol:
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index b8dcbf4..506c0fa 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -670,6 +670,9 @@ static int snd_usb_pcm_check_knot(struct snd_pcm_runtime *runtime,
+ 	int count = 0, needs_knot = 0;
+ 	int err;
+ 
++	kfree(subs->rate_list.list);
++	subs->rate_list.list = NULL;
++
+ 	list_for_each_entry(fp, &subs->fmt_list, list) {
+ 		if (fp->rates & SNDRV_PCM_RATE_CONTINUOUS)
+ 			return 0;

Added: genpatches-2.6/trunk/3.0/1034_linux-3.0.35.patch
===================================================================
--- genpatches-2.6/trunk/3.0/1034_linux-3.0.35.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.0/1034_linux-3.0.35.patch	2012-06-19 00:00:27 UTC (rev 2162)
@@ -0,0 +1,811 @@
+diff --git a/Makefile b/Makefile
+index 61ef485..fe91076 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 0
+-SUBLEVEL = 34
++SUBLEVEL = 35
+ EXTRAVERSION =
+ NAME = Sneaky Weasel
+ 
+diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
+index f832773..449a7e0 100644
+--- a/arch/powerpc/kernel/module_32.c
++++ b/arch/powerpc/kernel/module_32.c
+@@ -187,8 +187,8 @@ int apply_relocate(Elf32_Shdr *sechdrs,
+ 
+ static inline int entry_matches(struct ppc_plt_entry *entry, Elf32_Addr val)
+ {
+-	if (entry->jump[0] == 0x3d600000 + ((val + 0x8000) >> 16)
+-	    && entry->jump[1] == 0x396b0000 + (val & 0xffff))
++	if (entry->jump[0] == 0x3d800000 + ((val + 0x8000) >> 16)
++	    && entry->jump[1] == 0x398c0000 + (val & 0xffff))
+ 		return 1;
+ 	return 0;
+ }
+@@ -215,10 +215,9 @@ static uint32_t do_plt_call(void *location,
+ 		entry++;
+ 	}
+ 
+-	/* Stolen from Paul Mackerras as well... */
+-	entry->jump[0] = 0x3d600000+((val+0x8000)>>16);	/* lis r11,sym@ha */
+-	entry->jump[1] = 0x396b0000 + (val&0xffff);	/* addi r11,r11,sym@l*/
+-	entry->jump[2] = 0x7d6903a6;			/* mtctr r11 */
++	entry->jump[0] = 0x3d800000+((val+0x8000)>>16); /* lis r12,sym@ha */
++	entry->jump[1] = 0x398c0000 + (val&0xffff);     /* addi r12,r12,sym@l*/
++	entry->jump[2] = 0x7d8903a6;                    /* mtctr r12 */
+ 	entry->jump[3] = 0x4e800420;			/* bctr */
+ 
+ 	DEBUGP("Initialized plt for 0x%x at %p\n", val, entry);
+diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
+index be6d9e3..3470624 100644
+--- a/arch/x86/crypto/aesni-intel_asm.S
++++ b/arch/x86/crypto/aesni-intel_asm.S
+@@ -2460,10 +2460,12 @@ ENTRY(aesni_cbc_dec)
+ 	pxor IN3, STATE4
+ 	movaps IN4, IV
+ #else
+-	pxor (INP), STATE2
+-	pxor 0x10(INP), STATE3
+ 	pxor IN1, STATE4
+ 	movaps IN2, IV
++	movups (INP), IN1
++	pxor IN1, STATE2
++	movups 0x10(INP), IN2
++	pxor IN2, STATE3
+ #endif
+ 	movups STATE1, (OUTP)
+ 	movups STATE2, 0x10(OUTP)
+diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+index bb0adad..dc4fb77 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+@@ -52,6 +52,7 @@ struct threshold_block {
+ 	unsigned int		cpu;
+ 	u32			address;
+ 	u16			interrupt_enable;
++	bool			interrupt_capable;
+ 	u16			threshold_limit;
+ 	struct kobject		kobj;
+ 	struct list_head	miscj;
+@@ -86,6 +87,21 @@ struct thresh_restart {
+ 	u16			old_limit;
+ };
+ 
++static bool lvt_interrupt_supported(unsigned int bank, u32 msr_high_bits)
++{
++	/*
++	 * bank 4 supports APIC LVT interrupts implicitly since forever.
++	 */
++	if (bank == 4)
++		return true;
++
++	/*
++	 * IntP: interrupt present; if this bit is set, the thresholding
++	 * bank can generate APIC LVT interrupts
++	 */
++	return msr_high_bits & BIT(28);
++}
++
+ static int lvt_off_valid(struct threshold_block *b, int apic, u32 lo, u32 hi)
+ {
+ 	int msr = (hi & MASK_LVTOFF_HI) >> 20;
+@@ -107,8 +123,10 @@ static int lvt_off_valid(struct threshold_block *b, int apic, u32 lo, u32 hi)
+ 	return 1;
+ };
+ 
+-/* must be called with correct cpu affinity */
+-/* Called via smp_call_function_single() */
++/*
++ * Called via smp_call_function_single(), must be called with correct
++ * cpu affinity.
++ */
+ static void threshold_restart_bank(void *_tr)
+ {
+ 	struct thresh_restart *tr = _tr;
+@@ -131,6 +149,12 @@ static void threshold_restart_bank(void *_tr)
+ 		    (new_count & THRESHOLD_MAX);
+ 	}
+ 
++	/* clear IntType */
++	hi &= ~MASK_INT_TYPE_HI;
++
++	if (!tr->b->interrupt_capable)
++		goto done;
++
+ 	if (tr->set_lvt_off) {
+ 		if (lvt_off_valid(tr->b, tr->lvt_off, lo, hi)) {
+ 			/* set new lvt offset */
+@@ -139,9 +163,10 @@ static void threshold_restart_bank(void *_tr)
+ 		}
+ 	}
+ 
+-	tr->b->interrupt_enable ?
+-	    (hi = (hi & ~MASK_INT_TYPE_HI) | INT_TYPE_APIC) :
+-	    (hi &= ~MASK_INT_TYPE_HI);
++	if (tr->b->interrupt_enable)
++		hi |= INT_TYPE_APIC;
++
++ done:
+ 
+ 	hi |= MASK_COUNT_EN_HI;
+ 	wrmsr(tr->b->address, lo, hi);
+@@ -206,14 +231,18 @@ void mce_amd_feature_init(struct cpuinfo_x86 *c)
+ 			if (shared_bank[bank] && c->cpu_core_id)
+ 				break;
+ #endif
+-			offset = setup_APIC_mce(offset,
+-						(high & MASK_LVTOFF_HI) >> 20);
+ 
+ 			memset(&b, 0, sizeof(b));
+-			b.cpu		= cpu;
+-			b.bank		= bank;
+-			b.block		= block;
+-			b.address	= address;
++			b.cpu			= cpu;
++			b.bank			= bank;
++			b.block			= block;
++			b.address		= address;
++			b.interrupt_capable	= lvt_interrupt_supported(bank, high);
++
++			if (b.interrupt_capable) {
++				int new = (high & MASK_LVTOFF_HI) >> 20;
++				offset  = setup_APIC_mce(offset, new);
++			}
+ 
+ 			mce_threshold_block_init(&b, offset);
+ 			mce_threshold_vector = amd_threshold_interrupt;
+@@ -313,6 +342,9 @@ store_interrupt_enable(struct threshold_block *b, const char *buf, size_t size)
+ 	struct thresh_restart tr;
+ 	unsigned long new;
+ 
++	if (!b->interrupt_capable)
++		return -EINVAL;
++
+ 	if (strict_strtoul(buf, 0, &new) < 0)
+ 		return -EINVAL;
+ 
+@@ -471,6 +503,7 @@ static __cpuinit int allocate_threshold_blocks(unsigned int cpu,
+ 	b->cpu			= cpu;
+ 	b->address		= address;
+ 	b->interrupt_enable	= 0;
++	b->interrupt_capable	= lvt_interrupt_supported(bank, high);
+ 	b->threshold_limit	= THRESHOLD_MAX;
+ 
+ 	INIT_LIST_HEAD(&b->miscj);
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index db39e9e..623a335 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -1732,6 +1732,7 @@ static int acpi_video_bus_remove(struct acpi_device *device, int type)
+ 
+ static int __init intel_opregion_present(void)
+ {
++	int i915 = 0;
+ #if defined(CONFIG_DRM_I915) || defined(CONFIG_DRM_I915_MODULE)
+ 	struct pci_dev *dev = NULL;
+ 	u32 address;
+@@ -1744,10 +1745,10 @@ static int __init intel_opregion_present(void)
+ 		pci_read_config_dword(dev, 0xfc, &address);
+ 		if (!address)
+ 			continue;
+-		return 1;
++		i915 = 1;
+ 	}
+ #endif
+-	return 0;
++	return i915;
+ }
+ 
+ int acpi_video_register(void)
+diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
+index b427711..58b49d1 100644
+--- a/drivers/char/agp/intel-agp.c
++++ b/drivers/char/agp/intel-agp.c
+@@ -897,6 +897,7 @@ static struct pci_device_id agp_intel_pci_table[] = {
+ 	ID(PCI_DEVICE_ID_INTEL_B43_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_B43_1_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB),
++	ID(PCI_DEVICE_ID_INTEL_IRONLAKE_D2_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB),
+diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
+index 5da67f1..6f24604 100644
+--- a/drivers/char/agp/intel-agp.h
++++ b/drivers/char/agp/intel-agp.h
+@@ -211,6 +211,7 @@
+ #define PCI_DEVICE_ID_INTEL_G41_HB          0x2E30
+ #define PCI_DEVICE_ID_INTEL_G41_IG          0x2E32
+ #define PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB	    0x0040
++#define PCI_DEVICE_ID_INTEL_IRONLAKE_D2_HB	    0x0069
+ #define PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG	    0x0042
+ #define PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB	    0x0044
+ #define PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB	    0x0062
+diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
+index 9a4c3ab..e8e18ca 100644
+--- a/drivers/hwmon/fam15h_power.c
++++ b/drivers/hwmon/fam15h_power.c
+@@ -61,14 +61,14 @@ static ssize_t show_power(struct device *dev,
+ 				  REG_TDP_RUNNING_AVERAGE, &val);
+ 	running_avg_capture = (val >> 4) & 0x3fffff;
+ 	running_avg_capture = sign_extend32(running_avg_capture, 21);
+-	running_avg_range = val & 0xf;
++	running_avg_range = (val & 0xf) + 1;
+ 
+ 	pci_bus_read_config_dword(f4->bus, PCI_DEVFN(PCI_SLOT(f4->devfn), 5),
+ 				  REG_TDP_LIMIT3, &val);
+ 
+ 	tdp_limit = val >> 16;
+-	curr_pwr_watts = tdp_limit + data->base_tdp -
+-		(s32)(running_avg_capture >> (running_avg_range + 1));
++	curr_pwr_watts = (tdp_limit + data->base_tdp) << running_avg_range;
++	curr_pwr_watts -= running_avg_capture;
+ 	curr_pwr_watts *= data->tdp_to_watts;
+ 
+ 	/*
+@@ -78,7 +78,7 @@ static ssize_t show_power(struct device *dev,
+ 	 * scaling factor 1/(2^16).  For conversion we use
+ 	 * (10^6)/(2^16) = 15625/(2^10)
+ 	 */
+-	curr_pwr_watts = (curr_pwr_watts * 15625) >> 10;
++	curr_pwr_watts = (curr_pwr_watts * 15625) >> (10 + running_avg_range);
+ 	return sprintf(buf, "%u\n", (unsigned int) curr_pwr_watts);
+ }
+ static DEVICE_ATTR(power1_input, S_IRUGO, show_power, NULL);
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 7e5cc0b..1f8a824 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -688,7 +688,7 @@ static int c_can_get_berr_counter(const struct net_device *dev,
+  *
+  * We iterate from priv->tx_echo to priv->tx_next and check if the
+  * packet has been transmitted, echo it back to the CAN framework.
+- * If we discover a not yet transmitted package, stop looking for more.
++ * If we discover a not yet transmitted packet, stop looking for more.
+  */
+ static void c_can_do_tx(struct net_device *dev)
+ {
+@@ -700,7 +700,7 @@ static void c_can_do_tx(struct net_device *dev)
+ 	for (/* nix */; (priv->tx_next - priv->tx_echo) > 0; priv->tx_echo++) {
+ 		msg_obj_no = get_tx_echo_msg_obj(priv);
+ 		val = c_can_read_reg32(priv, &priv->regs->txrqst1);
+-		if (!(val & (1 << msg_obj_no))) {
++		if (!(val & (1 << (msg_obj_no - 1)))) {
+ 			can_get_echo_skb(dev,
+ 					msg_obj_no - C_CAN_MSG_OBJ_TX_FIRST);
+ 			stats->tx_bytes += priv->read_reg(priv,
+@@ -708,6 +708,8 @@ static void c_can_do_tx(struct net_device *dev)
+ 					& IF_MCONT_DLC_MASK;
+ 			stats->tx_packets++;
+ 			c_can_inval_msg_object(dev, 0, msg_obj_no);
++		} else {
++			break;
+ 		}
+ 	}
+ 
+@@ -952,7 +954,7 @@ static int c_can_poll(struct napi_struct *napi, int quota)
+ 	struct net_device *dev = napi->dev;
+ 	struct c_can_priv *priv = netdev_priv(dev);
+ 
+-	irqstatus = priv->read_reg(priv, &priv->regs->interrupt);
++	irqstatus = priv->irqstatus;
+ 	if (!irqstatus)
+ 		goto end;
+ 
+@@ -1030,12 +1032,11 @@ end:
+ 
+ static irqreturn_t c_can_isr(int irq, void *dev_id)
+ {
+-	u16 irqstatus;
+ 	struct net_device *dev = (struct net_device *)dev_id;
+ 	struct c_can_priv *priv = netdev_priv(dev);
+ 
+-	irqstatus = priv->read_reg(priv, &priv->regs->interrupt);
+-	if (!irqstatus)
++	priv->irqstatus = priv->read_reg(priv, &priv->regs->interrupt);
++	if (!priv->irqstatus)
+ 		return IRQ_NONE;
+ 
+ 	/* disable all interrupts and schedule the NAPI */
+@@ -1065,10 +1066,11 @@ static int c_can_open(struct net_device *dev)
+ 		goto exit_irq_fail;
+ 	}
+ 
++	napi_enable(&priv->napi);
++
+ 	/* start the c_can controller */
+ 	c_can_start(dev);
+ 
+-	napi_enable(&priv->napi);
+ 	netif_start_queue(dev);
+ 
+ 	return 0;
+diff --git a/drivers/net/can/c_can/c_can.h b/drivers/net/can/c_can/c_can.h
+index 9b7fbef..5f32d34 100644
+--- a/drivers/net/can/c_can/c_can.h
++++ b/drivers/net/can/c_can/c_can.h
+@@ -76,6 +76,7 @@ struct c_can_priv {
+ 	unsigned int tx_next;
+ 	unsigned int tx_echo;
+ 	void *priv;		/* for board-specific data */
++	u16 irqstatus;
+ };
+ 
+ struct net_device *alloc_c_can_dev(void);
+diff --git a/drivers/net/e1000/e1000.h b/drivers/net/e1000/e1000.h
+index 8676899..2c71884 100644
+--- a/drivers/net/e1000/e1000.h
++++ b/drivers/net/e1000/e1000.h
+@@ -150,6 +150,8 @@ struct e1000_buffer {
+ 	unsigned long time_stamp;
+ 	u16 length;
+ 	u16 next_to_watch;
++	unsigned int segs;
++	unsigned int bytecount;
+ 	u16 mapped_as_page;
+ };
+ 
+diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
+index 76e8af0..99525f9 100644
+--- a/drivers/net/e1000/e1000_main.c
++++ b/drivers/net/e1000/e1000_main.c
+@@ -2798,7 +2798,7 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
+ 	struct e1000_buffer *buffer_info;
+ 	unsigned int len = skb_headlen(skb);
+ 	unsigned int offset = 0, size, count = 0, i;
+-	unsigned int f;
++	unsigned int f, bytecount, segs;
+ 
+ 	i = tx_ring->next_to_use;
+ 
+@@ -2899,7 +2899,13 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
+ 		}
+ 	}
+ 
++	segs = skb_shinfo(skb)->gso_segs ?: 1;
++	/* multiply data chunks by size of headers */
++	bytecount = ((segs - 1) * skb_headlen(skb)) + skb->len;
++
+ 	tx_ring->buffer_info[i].skb = skb;
++	tx_ring->buffer_info[i].segs = segs;
++	tx_ring->buffer_info[i].bytecount = bytecount;
+ 	tx_ring->buffer_info[first].next_to_watch = i;
+ 
+ 	return count;
+@@ -3573,14 +3579,8 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter,
+ 			cleaned = (i == eop);
+ 
+ 			if (cleaned) {
+-				struct sk_buff *skb = buffer_info->skb;
+-				unsigned int segs, bytecount;
+-				segs = skb_shinfo(skb)->gso_segs ?: 1;
+-				/* multiply data chunks by size of headers */
+-				bytecount = ((segs - 1) * skb_headlen(skb)) +
+-				            skb->len;
+-				total_tx_packets += segs;
+-				total_tx_bytes += bytecount;
++				total_tx_packets += buffer_info->segs;
++				total_tx_bytes += buffer_info->bytecount;
+ 			}
+ 			e1000_unmap_and_free_tx_resource(adapter, buffer_info);
+ 			tx_desc->upper.data = 0;
+diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
+index ed1b432..864448b 100644
+--- a/drivers/net/usb/sierra_net.c
++++ b/drivers/net/usb/sierra_net.c
+@@ -943,7 +943,7 @@ struct sk_buff *sierra_net_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ }
+ 
+ static const u8 sierra_net_ifnum_list[] = { 7, 10, 11 };
+-static const struct sierra_net_info_data sierra_net_info_data_68A3 = {
++static const struct sierra_net_info_data sierra_net_info_data_direct_ip = {
+ 	.rx_urb_size = 8 * 1024,
+ 	.whitelist = {
+ 		.infolen = ARRAY_SIZE(sierra_net_ifnum_list),
+@@ -951,7 +951,7 @@ static const struct sierra_net_info_data sierra_net_info_data_68A3 = {
+ 	}
+ };
+ 
+-static const struct driver_info sierra_net_info_68A3 = {
++static const struct driver_info sierra_net_info_direct_ip = {
+ 	.description = "Sierra Wireless USB-to-WWAN Modem",
+ 	.flags = FLAG_WWAN | FLAG_SEND_ZLP,
+ 	.bind = sierra_net_bind,
+@@ -959,12 +959,18 @@ static const struct driver_info sierra_net_info_68A3 = {
+ 	.status = sierra_net_status,
+ 	.rx_fixup = sierra_net_rx_fixup,
+ 	.tx_fixup = sierra_net_tx_fixup,
+-	.data = (unsigned long)&sierra_net_info_data_68A3,
++	.data = (unsigned long)&sierra_net_info_data_direct_ip,
+ };
+ 
+ static const struct usb_device_id products[] = {
+ 	{USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless USB-to-WWAN modem */
+-	.driver_info = (unsigned long) &sierra_net_info_68A3},
++	.driver_info = (unsigned long) &sierra_net_info_direct_ip},
++	{USB_DEVICE(0x0F3D, 0x68A3), /* AT&T Direct IP modem */
++	.driver_info = (unsigned long) &sierra_net_info_direct_ip},
++	{USB_DEVICE(0x1199, 0x68AA), /* Sierra Wireless Direct IP LTE modem */
++	.driver_info = (unsigned long) &sierra_net_info_direct_ip},
++	{USB_DEVICE(0x0F3D, 0x68AA), /* AT&T Direct IP LTE modem */
++	.driver_info = (unsigned long) &sierra_net_info_direct_ip},
+ 
+ 	{}, /* last item */
+ };
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+index 0bd722c..5c9999d 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+@@ -477,7 +477,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
+ 					sizeof(struct iwl_keyinfo));
+ 	priv->stations[sta_id].sta.key.key_flags =
+ 			STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
+-	priv->stations[sta_id].sta.key.key_offset = WEP_INVALID_OFFSET;
++	priv->stations[sta_id].sta.key.key_offset = keyconf->hw_key_idx;
+ 	priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
+ 	priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+ 
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index d5016071..c04a025 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -858,6 +858,7 @@ int fuse_update_attributes(struct inode *inode, struct kstat *stat,
+ 		if (stat) {
+ 			generic_fillattr(inode, stat);
+ 			stat->mode = fi->orig_i_mode;
++			stat->ino = fi->orig_ino;
+ 		}
+ 	}
+ 
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index b788bec..f621550 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -82,6 +82,9 @@ struct fuse_inode {
+ 	    preserve the original mode */
+ 	mode_t orig_i_mode;
+ 
++	/** 64 bit inode number */
++	u64 orig_ino;
++
+ 	/** Version of last attribute change */
+ 	u64 attr_version;
+ 
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 38f84cd..69a1e0f 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -91,6 +91,7 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
+ 	fi->nlookup = 0;
+ 	fi->attr_version = 0;
+ 	fi->writectr = 0;
++	fi->orig_ino = 0;
+ 	INIT_LIST_HEAD(&fi->write_files);
+ 	INIT_LIST_HEAD(&fi->queued_writes);
+ 	INIT_LIST_HEAD(&fi->writepages);
+@@ -140,6 +141,18 @@ static int fuse_remount_fs(struct super_block *sb, int *flags, char *data)
+ 	return 0;
+ }
+ 
++/*
++ * ino_t is 32-bits on 32-bit arch. We have to squash the 64-bit value down
++ * so that it will fit.
++ */
++static ino_t fuse_squash_ino(u64 ino64)
++{
++	ino_t ino = (ino_t) ino64;
++	if (sizeof(ino_t) < sizeof(u64))
++		ino ^= ino64 >> (sizeof(u64) - sizeof(ino_t)) * 8;
++	return ino;
++}
++
+ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
+ 				   u64 attr_valid)
+ {
+@@ -149,7 +162,7 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
+ 	fi->attr_version = ++fc->attr_version;
+ 	fi->i_time = attr_valid;
+ 
+-	inode->i_ino     = attr->ino;
++	inode->i_ino     = fuse_squash_ino(attr->ino);
+ 	inode->i_mode    = (inode->i_mode & S_IFMT) | (attr->mode & 07777);
+ 	inode->i_nlink   = attr->nlink;
+ 	inode->i_uid     = attr->uid;
+@@ -175,6 +188,8 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
+ 	fi->orig_i_mode = inode->i_mode;
+ 	if (!(fc->flags & FUSE_DEFAULT_PERMISSIONS))
+ 		inode->i_mode &= ~S_ISVTX;
++
++	fi->orig_ino = attr->ino;
+ }
+ 
+ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
+diff --git a/kernel/sched.c b/kernel/sched.c
+index 03dff14..8ef48f0 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -7220,11 +7220,8 @@ int sched_domain_level_max;
+ 
+ static int __init setup_relax_domain_level(char *str)
+ {
+-	unsigned long val;
+-
+-	val = simple_strtoul(str, NULL, 0);
+-	if (val < sched_domain_level_max)
+-		default_relax_domain_level = val;
++	if (kstrtoint(str, 0, &default_relax_domain_level))
++		pr_warn("Unable to set relax_domain_level\n");
+ 
+ 	return 1;
+ }
+@@ -7417,7 +7414,6 @@ struct sched_domain *build_sched_domain(struct sched_domain_topology_level *tl,
+ 	if (!sd)
+ 		return child;
+ 
+-	set_domain_attribute(sd, attr);
+ 	cpumask_and(sched_domain_span(sd), cpu_map, tl->mask(cpu));
+ 	if (child) {
+ 		sd->level = child->level + 1;
+@@ -7425,6 +7421,7 @@ struct sched_domain *build_sched_domain(struct sched_domain_topology_level *tl,
+ 		child->parent = sd;
+ 	}
+ 	sd->child = child;
++	set_domain_attribute(sd, attr);
+ 
+ 	return sd;
+ }
+diff --git a/lib/btree.c b/lib/btree.c
+index 2a34392..297124d 100644
+--- a/lib/btree.c
++++ b/lib/btree.c
+@@ -319,8 +319,8 @@ void *btree_get_prev(struct btree_head *head, struct btree_geo *geo,
+ 
+ 	if (head->height == 0)
+ 		return NULL;
+-retry:
+ 	longcpy(key, __key, geo->keylen);
++retry:
+ 	dec_key(geo, key);
+ 
+ 	node = head->node;
+@@ -351,7 +351,7 @@ retry:
+ 	}
+ miss:
+ 	if (retry_key) {
+-		__key = retry_key;
++		longcpy(key, retry_key, geo->keylen);
+ 		retry_key = NULL;
+ 		goto retry;
+ 	}
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 00b0abb..05f8fd4 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2060,6 +2060,15 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
+ 		kref_get(&reservations->refs);
+ }
+ 
++static void resv_map_put(struct vm_area_struct *vma)
++{
++	struct resv_map *reservations = vma_resv_map(vma);
++
++	if (!reservations)
++		return;
++	kref_put(&reservations->refs, resv_map_release);
++}
++
+ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
+ {
+ 	struct hstate *h = hstate_vma(vma);
+@@ -2075,7 +2084,7 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
+ 		reserve = (end - start) -
+ 			region_count(&reservations->regions, start, end);
+ 
+-		kref_put(&reservations->refs, resv_map_release);
++		resv_map_put(vma);
+ 
+ 		if (reserve) {
+ 			hugetlb_acct_memory(h, -reserve);
+@@ -2877,12 +2886,16 @@ int hugetlb_reserve_pages(struct inode *inode,
+ 		set_vma_resv_flags(vma, HPAGE_RESV_OWNER);
+ 	}
+ 
+-	if (chg < 0)
+-		return chg;
++	if (chg < 0) {
++		ret = chg;
++		goto out_err;
++	}
+ 
+ 	/* There must be enough filesystem quota for the mapping */
+-	if (hugetlb_get_quota(inode->i_mapping, chg))
+-		return -ENOSPC;
++	if (hugetlb_get_quota(inode->i_mapping, chg)) {
++		ret = -ENOSPC;
++		goto out_err;
++	}
+ 
+ 	/*
+ 	 * Check enough hugepages are available for the reservation.
+@@ -2891,7 +2904,7 @@ int hugetlb_reserve_pages(struct inode *inode,
+ 	ret = hugetlb_acct_memory(h, chg);
+ 	if (ret < 0) {
+ 		hugetlb_put_quota(inode->i_mapping, chg);
+-		return ret;
++		goto out_err;
+ 	}
+ 
+ 	/*
+@@ -2908,6 +2921,10 @@ int hugetlb_reserve_pages(struct inode *inode,
+ 	if (!vma || vma->vm_flags & VM_MAYSHARE)
+ 		region_add(&inode->i_mapping->private_list, from, to);
+ 	return 0;
++out_err:
++	if (vma)
++		resv_map_put(vma);
++	return ret;
+ }
+ 
+ void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed)
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 43b44db..bdb7004 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -256,7 +256,7 @@ struct vmap_area {
+ 	struct rb_node rb_node;		/* address sorted rbtree */
+ 	struct list_head list;		/* address sorted list */
+ 	struct list_head purge_list;	/* "lazy purge" list */
+-	void *private;
++	struct vm_struct *vm;
+ 	struct rcu_head rcu_head;
+ };
+ 
+@@ -1174,9 +1174,10 @@ void __init vmalloc_init(void)
+ 	/* Import existing vmlist entries. */
+ 	for (tmp = vmlist; tmp; tmp = tmp->next) {
+ 		va = kzalloc(sizeof(struct vmap_area), GFP_NOWAIT);
+-		va->flags = tmp->flags | VM_VM_AREA;
++		va->flags = VM_VM_AREA;
+ 		va->va_start = (unsigned long)tmp->addr;
+ 		va->va_end = va->va_start + tmp->size;
++		va->vm = tmp;
+ 		__insert_vmap_area(va);
+ 	}
+ 
+@@ -1274,7 +1275,7 @@ static void setup_vmalloc_vm(struct vm_struct *vm, struct vmap_area *va,
+ 	vm->addr = (void *)va->va_start;
+ 	vm->size = va->va_end - va->va_start;
+ 	vm->caller = caller;
+-	va->private = vm;
++	va->vm = vm;
+ 	va->flags |= VM_VM_AREA;
+ }
+ 
+@@ -1397,7 +1398,7 @@ static struct vm_struct *find_vm_area(const void *addr)
+ 
+ 	va = find_vmap_area((unsigned long)addr);
+ 	if (va && va->flags & VM_VM_AREA)
+-		return va->private;
++		return va->vm;
+ 
+ 	return NULL;
+ }
+@@ -1416,7 +1417,7 @@ struct vm_struct *remove_vm_area(const void *addr)
+ 
+ 	va = find_vmap_area((unsigned long)addr);
+ 	if (va && va->flags & VM_VM_AREA) {
+-		struct vm_struct *vm = va->private;
++		struct vm_struct *vm = va->vm;
+ 
+ 		if (!(vm->flags & VM_UNLIST)) {
+ 			struct vm_struct *tmp, **p;
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 895eec1..65f3764c 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -498,6 +498,18 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+ 		ieee80211_configure_filter(local);
+ 		break;
+ 	default:
++		mutex_lock(&local->mtx);
++		if (local->hw_roc_dev == sdata->dev &&
++		    local->hw_roc_channel) {
++			/* ignore return value since this is racy */
++			drv_cancel_remain_on_channel(local);
++			ieee80211_queue_work(&local->hw, &local->hw_roc_done);
++		}
++		mutex_unlock(&local->mtx);
++
++		flush_work(&local->hw_roc_start);
++		flush_work(&local->hw_roc_done);
++
+ 		flush_work(&sdata->work);
+ 		/*
+ 		 * When we get here, the interface is marked down.
+diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
+index 13427b1..c55eb9d 100644
+--- a/net/mac80211/offchannel.c
++++ b/net/mac80211/offchannel.c
+@@ -251,6 +251,22 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
+ 		return;
+ 	}
+ 
++	/* was never transmitted */
++	if (local->hw_roc_skb) {
++		u64 cookie;
++
++		cookie = local->hw_roc_cookie ^ 2;
++
++		cfg80211_mgmt_tx_status(local->hw_roc_dev, cookie,
++					local->hw_roc_skb->data,
++					local->hw_roc_skb->len, false,
++					GFP_KERNEL);
++
++		kfree_skb(local->hw_roc_skb);
++		local->hw_roc_skb = NULL;
++		local->hw_roc_skb_for_status = NULL;
++	}
++
+ 	if (!local->hw_roc_for_tx)
+ 		cfg80211_remain_on_channel_expired(local->hw_roc_dev,
+ 						   local->hw_roc_cookie,
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 9c22330..30f68dc 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -937,6 +937,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+ 				  enum nl80211_iftype iftype)
+ {
+ 	struct wireless_dev *wdev_iter;
++	u32 used_iftypes = BIT(iftype);
+ 	int num[NUM_NL80211_IFTYPES];
+ 	int total = 1;
+ 	int i, j;
+@@ -970,12 +971,14 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+ 
+ 		num[wdev_iter->iftype]++;
+ 		total++;
++		used_iftypes |= BIT(wdev_iter->iftype);
+ 	}
+ 	mutex_unlock(&rdev->devlist_mtx);
+ 
+ 	for (i = 0; i < rdev->wiphy.n_iface_combinations; i++) {
+ 		const struct ieee80211_iface_combination *c;
+ 		struct ieee80211_iface_limit *limits;
++		u32 all_iftypes = 0;
+ 
+ 		c = &rdev->wiphy.iface_combinations[i];
+ 
+@@ -990,6 +993,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+ 			if (rdev->wiphy.software_iftypes & BIT(iftype))
+ 				continue;
+ 			for (j = 0; j < c->n_limits; j++) {
++				all_iftypes |= limits[j].types;
+ 				if (!(limits[j].types & BIT(iftype)))
+ 					continue;
+ 				if (limits[j].max < num[iftype])
+@@ -997,7 +1001,20 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+ 				limits[j].max -= num[iftype];
+ 			}
+ 		}
+-		/* yay, it fits */
++
++		/*
++		 * Finally check that all iftypes that we're currently
++		 * using are actually part of this combination. If they
++		 * aren't then we can't use this combination and have
++		 * to continue to the next.
++		 */
++		if ((all_iftypes & used_iftypes) != used_iftypes)
++			goto cont;
++
++		/*
++		 * This combination covered all interface types and
++		 * supported the requested numbers, so we're good.
++		 */
+ 		kfree(limits);
+ 		return 0;
+  cont: