diff -druNp --no-dereference linux-libre-3.0.99-gnu1/arch/powerpc/kernel/iommu.c linux-libre-3.0.100-gnu1/arch/powerpc/kernel/iommu.c
--- linux-libre-3.0.99-gnu1/arch/powerpc/kernel/iommu.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/arch/powerpc/kernel/iommu.c	2013-10-13 18:07:28.000000000 -0400
@@ -495,7 +495,7 @@ struct iommu_table *iommu_init_table(str
 	/* number of bytes needed for the bitmap */
 	sz = (tbl->it_size + 7) >> 3;
 
-	page = alloc_pages_node(nid, GFP_ATOMIC, get_order(sz));
+	page = alloc_pages_node(nid, GFP_KERNEL, get_order(sz));
 	if (!page)
 		panic("iommu_init_table: Can't allocate %ld bytes\n", sz);
 	tbl->it_map = page_address(page);
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/arch/powerpc/kernel/vio.c linux-libre-3.0.100-gnu1/arch/powerpc/kernel/vio.c
--- linux-libre-3.0.99-gnu1/arch/powerpc/kernel/vio.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/arch/powerpc/kernel/vio.c	2013-10-13 18:07:28.000000000 -0400
@@ -1345,11 +1345,15 @@ static ssize_t modalias_show(struct devi
 	const char *cp;
 
 	dn = dev->of_node;
-	if (!dn)
-		return -ENODEV;
+	if (!dn) {
+		strcat(buf, "\n");
+		return strlen(buf);
+	}
 	cp = of_get_property(dn, "compatible", NULL);
-	if (!cp)
-		return -ENODEV;
+	if (!cp) {
+		strcat(buf, "\n");
+		return strlen(buf);
+	}
 
 	return sprintf(buf, "vio:T%sS%s\n", vio_dev->type, cp);
 }
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/arch/powerpc/lib/checksum_64.S linux-libre-3.0.100-gnu1/arch/powerpc/lib/checksum_64.S
--- linux-libre-3.0.99-gnu1/arch/powerpc/lib/checksum_64.S	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/arch/powerpc/lib/checksum_64.S	2013-10-13 18:07:28.000000000 -0400
@@ -272,8 +272,8 @@ _GLOBAL(csum_partial_copy_generic)
 	rldicl. r6,r3,64-1,64-2		/* r6 = (r3 & 0x3) >> 1 */
 	beq	.Lcopy_aligned
 
-	li	r7,4
-	sub	r6,r7,r6
+	li	r9,4
+	sub	r6,r9,r6
 	mtctr	r6
 
 1:
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/arch/sparc/kernel/entry.S linux-libre-3.0.100-gnu1/arch/sparc/kernel/entry.S
--- linux-libre-3.0.99-gnu1/arch/sparc/kernel/entry.S	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/arch/sparc/kernel/entry.S	2013-10-13 18:07:28.000000000 -0400
@@ -1177,7 +1177,7 @@ sys_sigreturn:
 	 nop
 
 	call	syscall_trace
-	 nop
+	 mov	1, %o1
 
 1:
 	/* We don't want to muck with user registers like a
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/arch/sparc/kernel/ktlb.S linux-libre-3.0.100-gnu1/arch/sparc/kernel/ktlb.S
--- linux-libre-3.0.99-gnu1/arch/sparc/kernel/ktlb.S	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/arch/sparc/kernel/ktlb.S	2013-10-13 18:07:28.000000000 -0400
@@ -25,11 +25,10 @@ kvmap_itlb:
 	 */
 kvmap_itlb_4v:
 
-kvmap_itlb_nonlinear:
 	/* Catch kernel NULL pointer calls.  */
 	sethi		%hi(PAGE_SIZE), %g5
 	cmp		%g4, %g5
-	bleu,pn		%xcc, kvmap_dtlb_longpath
+	blu,pn		%xcc, kvmap_itlb_longpath
 	 nop
 
 	KERN_TSB_LOOKUP_TL1(%g4, %g6, %g5, %g1, %g2, %g3, kvmap_itlb_load)
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/arch/sparc/kernel/syscalls.S linux-libre-3.0.100-gnu1/arch/sparc/kernel/syscalls.S
--- linux-libre-3.0.99-gnu1/arch/sparc/kernel/syscalls.S	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/arch/sparc/kernel/syscalls.S	2013-10-13 18:07:28.000000000 -0400
@@ -147,7 +147,7 @@ linux_syscall_trace32:
 	srl	%i4, 0, %o4
 	srl	%i1, 0, %o1
 	srl	%i2, 0, %o2
-	ba,pt	%xcc, 2f
+	ba,pt	%xcc, 5f
 	 srl	%i3, 0, %o3
 
 linux_syscall_trace:
@@ -177,13 +177,13 @@ linux_sparc_syscall32:
 	srl	%i1, 0, %o1				! IEU0	Group
 	ldx	[%g6 + TI_FLAGS], %l0		! Load
 
-	srl	%i5, 0, %o5				! IEU1
+	srl	%i3, 0, %o3				! IEU0
 	srl	%i2, 0, %o2				! IEU0	Group
 	andcc	%l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %g0
 	bne,pn	%icc, linux_syscall_trace32		! CTI
 	 mov	%i0, %l5				! IEU1
-	call	%l7					! CTI	Group brk forced
-	 srl	%i3, 0, %o3				! IEU0
+5:	call	%l7					! CTI	Group brk forced
+	 srl	%i5, 0, %o5				! IEU1
 	ba,a,pt	%xcc, 3f
 
 	/* Linux native system calls enter here... */
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/arch/sparc/kernel/trampoline_64.S linux-libre-3.0.100-gnu1/arch/sparc/kernel/trampoline_64.S
--- linux-libre-3.0.99-gnu1/arch/sparc/kernel/trampoline_64.S	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/arch/sparc/kernel/trampoline_64.S	2013-10-13 18:07:28.000000000 -0400
@@ -131,7 +131,6 @@ startup_continue:
 	clr		%l5
 	sethi		%hi(num_kernel_image_mappings), %l6
 	lduw		[%l6 + %lo(num_kernel_image_mappings)], %l6
-	add		%l6, 1, %l6
 
 	mov		15, %l7
 	BRANCH_IF_ANY_CHEETAH(g1,g5,2f)
@@ -224,7 +223,6 @@ niagara_lock_tlb:
 	clr		%l5
 	sethi		%hi(num_kernel_image_mappings), %l6
 	lduw		[%l6 + %lo(num_kernel_image_mappings)], %l6
-	add		%l6, 1, %l6
 
 1:
 	mov		HV_FAST_MMU_MAP_PERM_ADDR, %o5
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/arch/sparc/lib/ksyms.c linux-libre-3.0.100-gnu1/arch/sparc/lib/ksyms.c
--- linux-libre-3.0.99-gnu1/arch/sparc/lib/ksyms.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/arch/sparc/lib/ksyms.c	2013-10-13 18:07:28.000000000 -0400
@@ -131,15 +131,6 @@ EXPORT_SYMBOL(___copy_from_user);
 EXPORT_SYMBOL(___copy_in_user);
 EXPORT_SYMBOL(__clear_user);
 
-/* RW semaphores */
-EXPORT_SYMBOL(__down_read);
-EXPORT_SYMBOL(__down_read_trylock);
-EXPORT_SYMBOL(__down_write);
-EXPORT_SYMBOL(__down_write_trylock);
-EXPORT_SYMBOL(__up_read);
-EXPORT_SYMBOL(__up_write);
-EXPORT_SYMBOL(__downgrade_write);
-
 /* Atomic counter implementation. */
 EXPORT_SYMBOL(atomic_add);
 EXPORT_SYMBOL(atomic_add_ret);
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/arch/tile/include/asm/percpu.h linux-libre-3.0.100-gnu1/arch/tile/include/asm/percpu.h
--- linux-libre-3.0.99-gnu1/arch/tile/include/asm/percpu.h	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/arch/tile/include/asm/percpu.h	2013-10-13 18:07:28.000000000 -0400
@@ -15,9 +15,37 @@
 #ifndef _ASM_TILE_PERCPU_H
 #define _ASM_TILE_PERCPU_H
 
-register unsigned long __my_cpu_offset __asm__("tp");
-#define __my_cpu_offset __my_cpu_offset
-#define set_my_cpu_offset(tp) (__my_cpu_offset = (tp))
+register unsigned long my_cpu_offset_reg asm("tp");
+
+#ifdef CONFIG_PREEMPT
+/*
+ * For full preemption, we can't just use the register variable
+ * directly, since we need barrier() to hazard against it, causing the
+ * compiler to reload anything computed from a previous "tp" value.
+ * But we also don't want to use volatile asm, since we'd like the
+ * compiler to be able to cache the value across multiple percpu reads.
+ * So we use a fake stack read as a hazard against barrier().
+ * The 'U' constraint is like 'm' but disallows postincrement.
+ */
+static inline unsigned long __my_cpu_offset(void)
+{
+	unsigned long tp;
+	register unsigned long *sp asm("sp");
+	asm("move %0, tp" : "=r" (tp) : "U" (*sp));
+	return tp;
+}
+#define __my_cpu_offset __my_cpu_offset()
+#else
+/*
+ * We don't need to hazard against barrier() since "tp" doesn't ever
+ * change with PREEMPT_NONE, and with PREEMPT_VOLUNTARY it only
+ * changes at function call points, at which we are already re-reading
+ * the value of "tp" due to "my_cpu_offset_reg" being a global variable.
+ */
+#define __my_cpu_offset my_cpu_offset_reg
+#endif
+
+#define set_my_cpu_offset(tp) (my_cpu_offset_reg = (tp))
 
 #include <asm-generic/percpu.h>
 
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/acpi/acpi_ipmi.c linux-libre-3.0.100-gnu1/drivers/acpi/acpi_ipmi.c
--- linux-libre-3.0.99-gnu1/drivers/acpi/acpi_ipmi.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/acpi/acpi_ipmi.c	2013-10-13 18:07:28.000000000 -0400
@@ -39,6 +39,7 @@
 #include <linux/ipmi.h>
 #include <linux/device.h>
 #include <linux/pnp.h>
+#include <linux/spinlock.h>
 
 MODULE_AUTHOR("Zhao Yakui");
 MODULE_DESCRIPTION("ACPI IPMI Opregion driver");
@@ -57,7 +58,7 @@ struct acpi_ipmi_device {
 	struct list_head head;
 	/* the IPMI request message list */
 	struct list_head tx_msg_list;
-	struct mutex	tx_msg_lock;
+	spinlock_t	tx_msg_lock;
 	acpi_handle handle;
 	struct pnp_dev *pnp_dev;
 	ipmi_user_t	user_interface;
@@ -147,6 +148,7 @@ static void acpi_format_ipmi_msg(struct
 	struct kernel_ipmi_msg *msg;
 	struct acpi_ipmi_buffer *buffer;
 	struct acpi_ipmi_device *device;
+	unsigned long flags;
 
 	msg = &tx_msg->tx_message;
 	/*
@@ -177,10 +179,10 @@ static void acpi_format_ipmi_msg(struct
 
 	/* Get the msgid */
 	device = tx_msg->device;
-	mutex_lock(&device->tx_msg_lock);
+	spin_lock_irqsave(&device->tx_msg_lock, flags);
 	device->curr_msgid++;
 	tx_msg->tx_msgid = device->curr_msgid;
-	mutex_unlock(&device->tx_msg_lock);
+	spin_unlock_irqrestore(&device->tx_msg_lock, flags);
 }
 
 static void acpi_format_ipmi_response(struct acpi_ipmi_msg *msg,
@@ -242,6 +244,7 @@ static void ipmi_msg_handler(struct ipmi
 	int msg_found = 0;
 	struct acpi_ipmi_msg *tx_msg;
 	struct pnp_dev *pnp_dev = ipmi_device->pnp_dev;
+	unsigned long flags;
 
 	if (msg->user != ipmi_device->user_interface) {
 		dev_warn(&pnp_dev->dev, "Unexpected response is returned. "
@@ -250,7 +253,7 @@ static void ipmi_msg_handler(struct ipmi
 		ipmi_free_recv_msg(msg);
 		return;
 	}
-	mutex_lock(&ipmi_device->tx_msg_lock);
+	spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
 	list_for_each_entry(tx_msg, &ipmi_device->tx_msg_list, head) {
 		if (msg->msgid == tx_msg->tx_msgid) {
 			msg_found = 1;
@@ -258,7 +261,7 @@ static void ipmi_msg_handler(struct ipmi
 		}
 	}
 
-	mutex_unlock(&ipmi_device->tx_msg_lock);
+	spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
 	if (!msg_found) {
 		dev_warn(&pnp_dev->dev, "Unexpected response (msg id %ld) is "
 			"returned.\n", msg->msgid);
@@ -378,6 +381,7 @@ acpi_ipmi_space_handler(u32 function, ac
 	struct acpi_ipmi_device *ipmi_device = handler_context;
 	int err, rem_time;
 	acpi_status status;
+	unsigned long flags;
 	/*
 	 * IPMI opregion message.
 	 * IPMI message is firstly written to the BMC and system software
@@ -395,9 +399,9 @@ acpi_ipmi_space_handler(u32 function, ac
 		return AE_NO_MEMORY;
 
 	acpi_format_ipmi_msg(tx_msg, address, value);
-	mutex_lock(&ipmi_device->tx_msg_lock);
+	spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
 	list_add_tail(&tx_msg->head, &ipmi_device->tx_msg_list);
-	mutex_unlock(&ipmi_device->tx_msg_lock);
+	spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
 	err = ipmi_request_settime(ipmi_device->user_interface,
 					&tx_msg->addr,
 					tx_msg->tx_msgid,
@@ -413,9 +417,9 @@ acpi_ipmi_space_handler(u32 function, ac
 	status = AE_OK;
 
 end_label:
-	mutex_lock(&ipmi_device->tx_msg_lock);
+	spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
 	list_del(&tx_msg->head);
-	mutex_unlock(&ipmi_device->tx_msg_lock);
+	spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
 	kfree(tx_msg);
 	return status;
 }
@@ -457,7 +461,7 @@ static void acpi_add_ipmi_device(struct
 
 	INIT_LIST_HEAD(&ipmi_device->head);
 
-	mutex_init(&ipmi_device->tx_msg_lock);
+	spin_lock_init(&ipmi_device->tx_msg_lock);
 	INIT_LIST_HEAD(&ipmi_device->tx_msg_list);
 	ipmi_install_space_handler(ipmi_device);
 
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/block/cciss.c linux-libre-3.0.100-gnu1/drivers/block/cciss.c
--- linux-libre-3.0.99-gnu1/drivers/block/cciss.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/block/cciss.c	2013-10-13 18:07:28.000000000 -0400
@@ -1179,6 +1179,7 @@ static int cciss_ioctl32_passthru(struct
 	int err;
 	u32 cp;
 
+	memset(&arg64, 0, sizeof(arg64));
 	err = 0;
 	err |=
 	    copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/block/cpqarray.c linux-libre-3.0.100-gnu1/drivers/block/cpqarray.c
--- linux-libre-3.0.99-gnu1/drivers/block/cpqarray.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/block/cpqarray.c	2013-10-13 18:07:28.000000000 -0400
@@ -1195,6 +1195,7 @@ out_passthru:
 		ida_pci_info_struct pciinfo;
 
 		if (!arg) return -EINVAL;
+		memset(&pciinfo, 0, sizeof(pciinfo));
 		pciinfo.bus = host->pci_dev->bus->number;
 		pciinfo.dev_fn = host->pci_dev->devfn;
 		pciinfo.board_id = host->board_id;
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/net/bonding/bond_main.c linux-libre-3.0.100-gnu1/drivers/net/bonding/bond_main.c
--- linux-libre-3.0.99-gnu1/drivers/net/bonding/bond_main.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/net/bonding/bond_main.c	2013-10-13 18:07:28.000000000 -0400
@@ -1994,6 +1994,7 @@ int bond_release(struct net_device *bond
 	struct bonding *bond = netdev_priv(bond_dev);
 	struct slave *slave, *oldcurrent;
 	struct sockaddr addr;
+	int old_flags = bond_dev->flags;
 	u32 old_features = bond_dev->features;
 
 	/* slave is not a slave or master is not master of this slave */
@@ -2124,12 +2125,18 @@ int bond_release(struct net_device *bond
 	 * already taken care of above when we detached the slave
 	 */
 	if (!USES_PRIMARY(bond->params.mode)) {
-		/* unset promiscuity level from slave */
-		if (bond_dev->flags & IFF_PROMISC)
+		/* unset promiscuity level from slave
+		 * NOTE: The NETDEV_CHANGEADDR call above may change the value
+		 * of the IFF_PROMISC flag in the bond_dev, but we need the
+		 * value of that flag before that change, as that was the value
+		 * when this slave was attached, so we cache at the start of the
+		 * function and use it here. Same goes for ALLMULTI below
+		 */
+		if (old_flags & IFF_PROMISC)
 			dev_set_promiscuity(slave_dev, -1);
 
 		/* unset allmulti level from slave */
-		if (bond_dev->flags & IFF_ALLMULTI)
+		if (old_flags & IFF_ALLMULTI)
 			dev_set_allmulti(slave_dev, -1);
 
 		/* flush master's mc_list from slave */
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/net/ll_temac_main.c linux-libre-3.0.100-gnu1/drivers/net/ll_temac_main.c
--- linux-libre-3.0.99-gnu1/drivers/net/ll_temac_main.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/net/ll_temac_main.c	2013-10-13 18:07:28.000000000 -0400
@@ -302,6 +302,12 @@ static int temac_dma_bd_init(struct net_
 		       lp->rx_bd_p + (sizeof(*lp->rx_bd_v) * (RX_BD_NUM - 1)));
 	lp->dma_out(lp, TX_CURDESC_PTR, lp->tx_bd_p);
 
+	/* Init descriptor indexes */
+	lp->tx_bd_ci = 0;
+	lp->tx_bd_next = 0;
+	lp->tx_bd_tail = 0;
+	lp->rx_bd_ci = 0;
+
 	return 0;
 
 out:
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/net/pptp.c linux-libre-3.0.100-gnu1/drivers/net/pptp.c
--- linux-libre-3.0.99-gnu1/drivers/net/pptp.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/net/pptp.c	2013-10-13 18:07:28.000000000 -0400
@@ -282,7 +282,7 @@ static int pptp_xmit(struct ppp_channel
 	nf_reset(skb);
 
 	skb->ip_summed = CHECKSUM_NONE;
-	ip_select_ident(iph, &rt->dst, NULL);
+	ip_select_ident(skb, &rt->dst, NULL);
 	ip_send_check(iph);
 
 	ip_local_out(skb);
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/net/tg3.c linux-libre-3.0.100-gnu1/drivers/net/tg3.c
--- linux-libre-3.0.99-gnu1/drivers/net/tg3.c	2013-10-06 00:34:53.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/net/tg3.c	2013-10-14 07:39:35.000000000 -0400
@@ -13058,8 +13058,11 @@ static void __devinit tg3_read_vpd(struc
 		if (j + len > block_end)
 			goto partno;
 
-		memcpy(tp->fw_ver, &vpd_data[j], len);
-		strncat(tp->fw_ver, " bc ", TG3_NVM_VPD_LEN - len - 1);
+		if (len >= sizeof(tp->fw_ver))
+			len = sizeof(tp->fw_ver) - 1;
+		memset(tp->fw_ver, 0, sizeof(tp->fw_ver));
+		snprintf(tp->fw_ver, sizeof(tp->fw_ver), "%.*s bc ", len,
+			 &vpd_data[j]);
 	}
 
 partno:
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/net/usb/dm9601.c linux-libre-3.0.100-gnu1/drivers/net/usb/dm9601.c
--- linux-libre-3.0.99-gnu1/drivers/net/usb/dm9601.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/net/usb/dm9601.c	2013-10-13 18:07:28.000000000 -0400
@@ -384,7 +384,7 @@ static void dm9601_set_multicast(struct
 		rx_ctl |= 0x02;
 	} else if (net->flags & IFF_ALLMULTI ||
 		   netdev_mc_count(net) > DM_MAX_MCAST) {
-		rx_ctl |= 0x04;
+		rx_ctl |= 0x08;
 	} else if (!netdev_mc_empty(net)) {
 		struct netdev_hw_addr *ha;
 
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/net/via-rhine.c linux-libre-3.0.100-gnu1/drivers/net/via-rhine.c
--- linux-libre-3.0.99-gnu1/drivers/net/via-rhine.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/net/via-rhine.c	2013-10-13 18:07:28.000000000 -0400
@@ -32,7 +32,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #define DRV_NAME	"via-rhine"
-#define DRV_VERSION	"1.5.0"
+#define DRV_VERSION	"1.5.1"
 #define DRV_RELDATE	"2010-10-09"
 
 
@@ -1518,7 +1518,12 @@ static netdev_tx_t rhine_start_tx(struct
 		cpu_to_le32(TXDESC | (skb->len >= ETH_ZLEN ? skb->len : ETH_ZLEN));
 
 	if (unlikely(vlan_tx_tag_present(skb))) {
-		rp->tx_ring[entry].tx_status = cpu_to_le32((vlan_tx_tag_get(skb)) << 16);
+		u16 vid_pcp = vlan_tx_tag_get(skb);
+
+		/* drop CFI/DEI bit, register needs VID and PCP */
+		vid_pcp = (vid_pcp & VLAN_VID_MASK) |
+			  ((vid_pcp & VLAN_PRIO_MASK) >> 1);
+		rp->tx_ring[entry].tx_status = cpu_to_le32((vid_pcp) << 16);
 		/* request tagging */
 		rp->tx_ring[entry].desc_length |= cpu_to_le32(0x020000);
 	}
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/net/wireless/p54/p54usb.c linux-libre-3.0.100-gnu1/drivers/net/wireless/p54/p54usb.c
--- linux-libre-3.0.99-gnu1/drivers/net/wireless/p54/p54usb.c	2013-10-06 00:37:06.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/net/wireless/p54/p54usb.c	2013-10-14 07:42:04.000000000 -0400
@@ -81,6 +81,7 @@ static struct usb_device_id p54u_table[]
 	{USB_DEVICE(0x06a9, 0x000e)},	/* Westell 802.11g USB (A90-211WG-01) */
 	{USB_DEVICE(0x06b9, 0x0121)},	/* Thomson SpeedTouch 121g */
 	{USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
+	{USB_DEVICE(0x07aa, 0x0020)},	/* Corega WLUSB2GTST USB */
 	{USB_DEVICE(0x0803, 0x4310)},	/* Zoom 4410a */
 	{USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
 	{USB_DEVICE(0x083a, 0x4531)},	/* T-Com Sinus 154 data II */
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/net/wireless/rtlwifi/wifi.h linux-libre-3.0.100-gnu1/drivers/net/wireless/rtlwifi/wifi.h
--- linux-libre-3.0.99-gnu1/drivers/net/wireless/rtlwifi/wifi.h	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/net/wireless/rtlwifi/wifi.h	2013-10-13 18:07:28.000000000 -0400
@@ -1587,7 +1587,7 @@ struct rtl_priv {
 	   that it points to the data allocated
 	   beyond  this structure like:
 	   rtl_pci_priv or rtl_usb_priv */
-	u8 priv[0];
+	u8 priv[0] __aligned(sizeof(void *));
 };
 
 #define rtl_priv(hw)		(((struct rtl_priv *)(hw)->priv))
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/pci/intel-iommu.c linux-libre-3.0.100-gnu1/drivers/pci/intel-iommu.c
--- linux-libre-3.0.99-gnu1/drivers/pci/intel-iommu.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/pci/intel-iommu.c	2013-10-13 18:07:28.000000000 -0400
@@ -853,56 +853,54 @@ static int dma_pte_clear_range(struct dm
 	return order;
 }
 
+static void dma_pte_free_level(struct dmar_domain *domain, int level,
+			       struct dma_pte *pte, unsigned long pfn,
+			       unsigned long start_pfn, unsigned long last_pfn)
+{
+	pfn = max(start_pfn, pfn);
+	pte = &pte[pfn_level_offset(pfn, level)];
+
+	do {
+		unsigned long level_pfn;
+		struct dma_pte *level_pte;
+
+		if (!dma_pte_present(pte) || dma_pte_superpage(pte))
+			goto next;
+
+		level_pfn = pfn & level_mask(level - 1);
+		level_pte = phys_to_virt(dma_pte_addr(pte));
+
+		if (level > 2)
+			dma_pte_free_level(domain, level - 1, level_pte,
+					   level_pfn, start_pfn, last_pfn);
+
+		/* If range covers entire pagetable, free it */
+		if (!(start_pfn > level_pfn ||
+		      last_pfn < level_pfn + level_size(level))) {
+			dma_clear_pte(pte);
+			domain_flush_cache(domain, pte, sizeof(*pte));
+			free_pgtable_page(level_pte);
+		}
+next:
+		pfn += level_size(level);
+	} while (!first_pte_in_page(++pte) && pfn <= last_pfn);
+}
+
 /* free page table pages. last level pte should already be cleared */
 static void dma_pte_free_pagetable(struct dmar_domain *domain,
 				   unsigned long start_pfn,
 				   unsigned long last_pfn)
 {
 	int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
-	struct dma_pte *first_pte, *pte;
-	int total = agaw_to_level(domain->agaw);
-	int level;
-	unsigned long tmp;
-	int large_page = 2;
 
 	BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
 	BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
 	BUG_ON(start_pfn > last_pfn);
 
 	/* We don't need lock here; nobody else touches the iova range */
-	level = 2;
-	while (level <= total) {
-		tmp = align_to_level(start_pfn, level);
-
-		/* If we can't even clear one PTE at this level, we're done */
-		if (tmp + level_size(level) - 1 > last_pfn)
-			return;
-
-		do {
-			large_page = level;
-			first_pte = pte = dma_pfn_level_pte(domain, tmp, level, &large_page);
-			if (large_page > level)
-				level = large_page + 1;
-			if (!pte) {
-				tmp = align_to_level(tmp + 1, level + 1);
-				continue;
-			}
-			do {
-				if (dma_pte_present(pte)) {
-					free_pgtable_page(phys_to_virt(dma_pte_addr(pte)));
-					dma_clear_pte(pte);
-				}
-				pte++;
-				tmp += level_size(level);
-			} while (!first_pte_in_page(pte) &&
-				 tmp + level_size(level) - 1 <= last_pfn);
+	dma_pte_free_level(domain, agaw_to_level(domain->agaw),
+			   domain->pgd, 0, start_pfn, last_pfn);
 
-			domain_flush_cache(domain, first_pte,
-					   (void *)pte - (void *)first_pte);
-			
-		} while (tmp && tmp + level_size(level) - 1 <= last_pfn);
-		level++;
-	}
 	/* free pgd */
 	if (start_pfn == 0 && last_pfn == DOMAIN_MAX_PFN(domain->gaw)) {
 		free_pgtable_page(domain->pgd);
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/scsi/esp_scsi.c linux-libre-3.0.100-gnu1/drivers/scsi/esp_scsi.c
--- linux-libre-3.0.99-gnu1/drivers/scsi/esp_scsi.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/scsi/esp_scsi.c	2013-10-13 18:07:28.000000000 -0400
@@ -530,7 +530,7 @@ static int esp_need_to_nego_sync(struct
 static int esp_alloc_lun_tag(struct esp_cmd_entry *ent,
 			     struct esp_lun_data *lp)
 {
-	if (!ent->tag[0]) {
+	if (!ent->orig_tag[0]) {
 		/* Non-tagged, slot already taken?  */
 		if (lp->non_tagged_cmd)
 			return -EBUSY;
@@ -564,9 +564,9 @@ static int esp_alloc_lun_tag(struct esp_
 			return -EBUSY;
 	}
 
-	BUG_ON(lp->tagged_cmds[ent->tag[1]]);
+	BUG_ON(lp->tagged_cmds[ent->orig_tag[1]]);
 
-	lp->tagged_cmds[ent->tag[1]] = ent;
+	lp->tagged_cmds[ent->orig_tag[1]] = ent;
 	lp->num_tagged++;
 
 	return 0;
@@ -575,9 +575,9 @@ static int esp_alloc_lun_tag(struct esp_
 static void esp_free_lun_tag(struct esp_cmd_entry *ent,
 			     struct esp_lun_data *lp)
 {
-	if (ent->tag[0]) {
-		BUG_ON(lp->tagged_cmds[ent->tag[1]] != ent);
-		lp->tagged_cmds[ent->tag[1]] = NULL;
+	if (ent->orig_tag[0]) {
+		BUG_ON(lp->tagged_cmds[ent->orig_tag[1]] != ent);
+		lp->tagged_cmds[ent->orig_tag[1]] = NULL;
 		lp->num_tagged--;
 	} else {
 		BUG_ON(lp->non_tagged_cmd != ent);
@@ -667,6 +667,8 @@ static struct esp_cmd_entry *find_and_pr
 			ent->tag[0] = 0;
 			ent->tag[1] = 0;
 		}
+		ent->orig_tag[0] = ent->tag[0];
+		ent->orig_tag[1] = ent->tag[1];
 
 		if (esp_alloc_lun_tag(ent, lp) < 0)
 			continue;
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/scsi/esp_scsi.h linux-libre-3.0.100-gnu1/drivers/scsi/esp_scsi.h
--- linux-libre-3.0.99-gnu1/drivers/scsi/esp_scsi.h	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/scsi/esp_scsi.h	2013-10-13 18:07:28.000000000 -0400
@@ -271,6 +271,7 @@ struct esp_cmd_entry {
 #define ESP_CMD_FLAG_AUTOSENSE	0x04 /* Doing automatic REQUEST_SENSE */
 
 	u8			tag[2];
+	u8			orig_tag[2];
 
 	u8			status;
 	u8			message;
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/staging/comedi/drivers/ni_65xx.c linux-libre-3.0.100-gnu1/drivers/staging/comedi/drivers/ni_65xx.c
--- linux-libre-3.0.99-gnu1/drivers/staging/comedi/drivers/ni_65xx.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/staging/comedi/drivers/ni_65xx.c	2013-10-13 18:07:28.000000000 -0400
@@ -411,29 +411,25 @@ static int ni_65xx_dio_insn_bits(struct
 				 struct comedi_subdevice *s,
 				 struct comedi_insn *insn, unsigned int *data)
 {
-	unsigned base_bitfield_channel;
-	const unsigned max_ports_per_bitfield = 5;
+	int base_bitfield_channel;
 	unsigned read_bits = 0;
-	unsigned j;
+	int last_port_offset = ni_65xx_port_by_channel(s->n_chan - 1);
+	int port_offset;
+
 	if (insn->n != 2)
 		return -EINVAL;
 	base_bitfield_channel = CR_CHAN(insn->chanspec);
-	for (j = 0; j < max_ports_per_bitfield; ++j) {
-		const unsigned port_offset =
-			ni_65xx_port_by_channel(base_bitfield_channel) + j;
-		const unsigned port =
-			sprivate(s)->base_port + port_offset;
-		unsigned base_port_channel;
+	for (port_offset = ni_65xx_port_by_channel(base_bitfield_channel);
+	     port_offset <= last_port_offset; port_offset++) {
+		unsigned port = sprivate(s)->base_port + port_offset;
+		int base_port_channel = port_offset * ni_65xx_channels_per_port;
 		unsigned port_mask, port_data, port_read_bits;
-		int bitshift;
-		if (port >= ni_65xx_total_num_ports(board(dev)))
+		int bitshift = base_port_channel - base_bitfield_channel;
+
+		if (bitshift >= 32)
 			break;
-		base_port_channel = port_offset * ni_65xx_channels_per_port;
 		port_mask = data[0];
 		port_data = data[1];
-		bitshift = base_port_channel - base_bitfield_channel;
-		if (bitshift >= 32 || bitshift <= -32)
-			break;
 		if (bitshift > 0) {
 			port_mask >>= bitshift;
 			port_data >>= bitshift;
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/staging/hv/tools/hv_kvp_daemon.c linux-libre-3.0.100-gnu1/drivers/staging/hv/tools/hv_kvp_daemon.c
--- linux-libre-3.0.99-gnu1/drivers/staging/hv/tools/hv_kvp_daemon.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/staging/hv/tools/hv_kvp_daemon.c	2013-10-13 18:07:28.000000000 -0400
@@ -378,14 +378,18 @@ int main(void)
 	pfd.fd = fd;
 
 	while (1) {
+		struct sockaddr *addr_p = (struct sockaddr *) &addr;
+		socklen_t addr_l = sizeof(addr);
 		pfd.events = POLLIN;
 		pfd.revents = 0;
 		poll(&pfd, 1, -1);
 
-		len = recv(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0);
+		len = recvfrom(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0,
+				addr_p, &addr_l);
 
-		if (len < 0) {
-			syslog(LOG_ERR, "recv failed; error:%d", len);
+		if (len < 0 || addr.nl_pid) {
+			syslog(LOG_ERR, "recvfrom failed; pid:%u error:%d %s",
+					addr.nl_pid, errno, strerror(errno));
 			close(fd);
 			return -1;
 		}
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/drivers/usb/serial/option.c linux-libre-3.0.100-gnu1/drivers/usb/serial/option.c
--- linux-libre-3.0.99-gnu1/drivers/usb/serial/option.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/drivers/usb/serial/option.c	2013-10-13 18:07:28.000000000 -0400
@@ -81,6 +81,7 @@ static void option_instat_callback(struc
 
 #define HUAWEI_VENDOR_ID			0x12D1
 #define HUAWEI_PRODUCT_E173			0x140C
+#define HUAWEI_PRODUCT_E1750			0x1406
 #define HUAWEI_PRODUCT_K4505			0x1464
 #define HUAWEI_PRODUCT_K3765			0x1465
 #define HUAWEI_PRODUCT_K4605			0x14C6
@@ -581,6 +582,8 @@ static const struct usb_device_id option
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff),
 		.driver_info = (kernel_ulong_t) &net_intf1_blacklist },
+	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1750, 0xff, 0xff, 0xff),
+		.driver_info = (kernel_ulong_t) &net_intf2_blacklist },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1442, USB_CLASS_COMM, 0x02, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff),
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/fs/btrfs/relocation.c linux-libre-3.0.100-gnu1/fs/btrfs/relocation.c
--- linux-libre-3.0.99-gnu1/fs/btrfs/relocation.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/fs/btrfs/relocation.c	2013-10-13 18:07:28.000000000 -0400
@@ -670,6 +670,7 @@ struct backref_node *build_backref_tree(
 	int cowonly;
 	int ret;
 	int err = 0;
+	bool need_check = true;
 
 	path1 = btrfs_alloc_path();
 	path2 = btrfs_alloc_path();
@@ -892,6 +893,7 @@ again:
 			cur->bytenr);
 
 		lower = cur;
+		need_check = true;
 		for (; level < BTRFS_MAX_LEVEL; level++) {
 			if (!path2->nodes[level]) {
 				BUG_ON(btrfs_root_bytenr(&root->root_item) !=
@@ -935,14 +937,12 @@ again:
 
 				/*
 				 * add the block to pending list if we
-				 * need check its backrefs. only block
-				 * at 'cur->level + 1' is added to the
-				 * tail of pending list. this guarantees
-				 * we check backrefs from lower level
-				 * blocks to upper level blocks.
+				 * need check its backrefs, we only do this once
+				 * while walking up a tree as we will catch
+				 * anything else later on.
 				 */
-				if (!upper->checked &&
-				    level == cur->level + 1) {
+				if (!upper->checked && need_check) {
+					need_check = false;
 					list_add_tail(&edge->list[UPPER],
 						      &list);
 				} else
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/fs/ext4/namei.c linux-libre-3.0.100-gnu1/fs/ext4/namei.c
--- linux-libre-3.0.99-gnu1/fs/ext4/namei.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/fs/ext4/namei.c	2013-10-13 18:07:28.000000000 -0400
@@ -2059,7 +2059,8 @@ int ext4_orphan_del(handle_t *handle, st
 	int err = 0;
 
 	/* ext4_handle_valid() assumes a valid handle_t pointer */
-	if (handle && !ext4_handle_valid(handle))
+	if (handle && !ext4_handle_valid(handle) &&
+	    !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS))
 		return 0;
 
 	mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/include/net/ip.h linux-libre-3.0.100-gnu1/include/net/ip.h
--- linux-libre-3.0.99-gnu1/include/net/ip.h	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/include/net/ip.h	2013-10-13 18:07:28.000000000 -0400
@@ -262,9 +262,11 @@ int ip_dont_fragment(struct sock *sk, st
 
 extern void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more);
 
-static inline void ip_select_ident(struct iphdr *iph, struct dst_entry *dst, struct sock *sk)
+static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk)
 {
-	if (iph->frag_off & htons(IP_DF)) {
+	struct iphdr *iph = ip_hdr(skb);
+
+	if ((iph->frag_off & htons(IP_DF)) && !skb->local_df) {
 		/* This is only to work around buggy Windows95/2000
 		 * VJ compression implementations.  If the ID field
 		 * does not change, they drop every other packet in
@@ -276,9 +278,11 @@ static inline void ip_select_ident(struc
 		__ip_select_ident(iph, dst, 0);
 }
 
-static inline void ip_select_ident_more(struct iphdr *iph, struct dst_entry *dst, struct sock *sk, int more)
+static inline void ip_select_ident_more(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk, int more)
 {
-	if (iph->frag_off & htons(IP_DF)) {
+	struct iphdr *iph = ip_hdr(skb);
+
+	if ((iph->frag_off & htons(IP_DF)) && !skb->local_df) {
 		if (sk && inet_sk(sk)->inet_daddr) {
 			iph->id = htons(inet_sk(sk)->inet_id);
 			inet_sk(sk)->inet_id += 1 + more;
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/include/net/ipip.h linux-libre-3.0.100-gnu1/include/net/ipip.h
--- linux-libre-3.0.99-gnu1/include/net/ipip.h	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/include/net/ipip.h	2013-10-13 18:07:28.000000000 -0400
@@ -50,7 +50,7 @@ struct ip_tunnel_prl_entry {
 	int pkt_len = skb->len - skb_transport_offset(skb);		\
 									\
 	skb->ip_summed = CHECKSUM_NONE;					\
-	ip_select_ident(iph, &rt->dst, NULL);				\
+	ip_select_ident(skb, &rt->dst, NULL);				\
 									\
 	err = ip_local_out(skb);					\
 	if (likely(net_xmit_eval(err) == 0)) {				\
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/Makefile linux-libre-3.0.100-gnu1/Makefile
--- linux-libre-3.0.99-gnu1/Makefile	2013-10-06 00:29:42.000000000 -0400
+++ linux-libre-3.0.100-gnu1/Makefile	2013-10-14 07:33:56.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 0
-SUBLEVEL = 99
+SUBLEVEL = 100
 EXTRAVERSION =-gnu1
 NAME = Sneaky Weasel
 
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/bridge/br_private.h linux-libre-3.0.100-gnu1/net/bridge/br_private.h
--- linux-libre-3.0.99-gnu1/net/bridge/br_private.h	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/bridge/br_private.h	2013-10-13 18:07:28.000000000 -0400
@@ -492,6 +492,7 @@ extern struct net_bridge_port *br_get_po
 extern void br_init_port(struct net_bridge_port *p);
 extern void br_become_designated_port(struct net_bridge_port *p);
 
+extern void __br_set_forward_delay(struct net_bridge *br, unsigned long t);
 extern int br_set_forward_delay(struct net_bridge *br, unsigned long x);
 extern int br_set_hello_time(struct net_bridge *br, unsigned long x);
 extern int br_set_max_age(struct net_bridge *br, unsigned long x);
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/bridge/br_stp.c linux-libre-3.0.100-gnu1/net/bridge/br_stp.c
--- linux-libre-3.0.99-gnu1/net/bridge/br_stp.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/bridge/br_stp.c	2013-10-13 18:07:28.000000000 -0400
@@ -191,7 +191,7 @@ static inline void br_record_config_info
 	p->designated_age = jiffies + bpdu->message_age;
 
 	mod_timer(&p->message_age_timer, jiffies
-		  + (p->br->max_age - bpdu->message_age));
+		  + (bpdu->max_age - bpdu->message_age));
 }
 
 /* called under bridge lock */
@@ -517,18 +517,27 @@ int br_set_max_age(struct net_bridge *br
 
 }
 
+void __br_set_forward_delay(struct net_bridge *br, unsigned long t)
+{
+	br->bridge_forward_delay = t;
+	if (br_is_root_bridge(br))
+		br->forward_delay = br->bridge_forward_delay;
+}
+
 int br_set_forward_delay(struct net_bridge *br, unsigned long val)
 {
 	unsigned long t = clock_t_to_jiffies(val);
+	int err = -ERANGE;
 
+	spin_lock_bh(&br->lock);
 	if (br->stp_enabled != BR_NO_STP &&
 	    (t < BR_MIN_FORWARD_DELAY || t > BR_MAX_FORWARD_DELAY))
-		return -ERANGE;
+		goto unlock;
 
-	spin_lock_bh(&br->lock);
-	br->bridge_forward_delay = t;
-	if (br_is_root_bridge(br))
-		br->forward_delay = br->bridge_forward_delay;
+	__br_set_forward_delay(br, t);
+	err = 0;
+
+unlock:
 	spin_unlock_bh(&br->lock);
-	return 0;
+	return err;
 }
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/bridge/br_stp_if.c linux-libre-3.0.100-gnu1/net/bridge/br_stp_if.c
--- linux-libre-3.0.99-gnu1/net/bridge/br_stp_if.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/bridge/br_stp_if.c	2013-10-13 18:07:28.000000000 -0400
@@ -126,6 +126,14 @@ static void br_stp_start(struct net_brid
 	char *envp[] = { NULL };
 
 	r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
+
+	spin_lock_bh(&br->lock);
+
+	if (br->bridge_forward_delay < BR_MIN_FORWARD_DELAY)
+		__br_set_forward_delay(br, BR_MIN_FORWARD_DELAY);
+	else if (br->bridge_forward_delay < BR_MAX_FORWARD_DELAY)
+		__br_set_forward_delay(br, BR_MAX_FORWARD_DELAY);
+
 	if (r == 0) {
 		br->stp_enabled = BR_USER_STP;
 		br_debug(br, "userspace STP started\n");
@@ -134,10 +142,10 @@ static void br_stp_start(struct net_brid
 		br_debug(br, "using kernel STP\n");
 
 		/* To start timers on any ports left in blocking */
-		spin_lock_bh(&br->lock);
 		br_port_state_selection(br);
-		spin_unlock_bh(&br->lock);
 	}
+
+	spin_unlock_bh(&br->lock);
 }
 
 static void br_stp_stop(struct net_bridge *br)
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/caif/cfctrl.c linux-libre-3.0.100-gnu1/net/caif/cfctrl.c
--- linux-libre-3.0.99-gnu1/net/caif/cfctrl.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/caif/cfctrl.c	2013-10-13 18:07:28.000000000 -0400
@@ -297,9 +297,10 @@ int cfctrl_linkup_request(struct cflayer
 
 		count = cfctrl_cancel_req(&cfctrl->serv.layer,
 						user_layer);
-		if (count != 1)
+		if (count != 1) {
 			pr_err("Could not remove request (%d)", count);
 			return -ENODEV;
+		}
 	}
 	return 0;
 }
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/core/netpoll.c linux-libre-3.0.100-gnu1/net/core/netpoll.c
--- linux-libre-3.0.99-gnu1/net/core/netpoll.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/core/netpoll.c	2013-10-13 18:07:28.000000000 -0400
@@ -927,15 +927,14 @@ EXPORT_SYMBOL_GPL(__netpoll_cleanup);
 
 void netpoll_cleanup(struct netpoll *np)
 {
-	if (!np->dev)
-		return;
-
 	rtnl_lock();
+	if (!np->dev)
+		goto out;
 	__netpoll_cleanup(np);
-	rtnl_unlock();
-
 	dev_put(np->dev);
 	np->dev = NULL;
+out:
+	rtnl_unlock();
 }
 EXPORT_SYMBOL(netpoll_cleanup);
 
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/ipv4/igmp.c linux-libre-3.0.100-gnu1/net/ipv4/igmp.c
--- linux-libre-3.0.99-gnu1/net/ipv4/igmp.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/ipv4/igmp.c	2013-10-13 18:07:28.000000000 -0400
@@ -342,7 +342,7 @@ static struct sk_buff *igmpv3_newpack(st
 	pip->saddr    = fl4.saddr;
 	pip->protocol = IPPROTO_IGMP;
 	pip->tot_len  = 0;	/* filled in later */
-	ip_select_ident(pip, &rt->dst, NULL);
+	ip_select_ident(skb, &rt->dst, NULL);
 	((u8*)&pip[1])[0] = IPOPT_RA;
 	((u8*)&pip[1])[1] = 4;
 	((u8*)&pip[1])[2] = 0;
@@ -683,7 +683,7 @@ static int igmp_send_report(struct in_de
 	iph->daddr    = dst;
 	iph->saddr    = fl4.saddr;
 	iph->protocol = IPPROTO_IGMP;
-	ip_select_ident(iph, &rt->dst, NULL);
+	ip_select_ident(skb, &rt->dst, NULL);
 	((u8*)&iph[1])[0] = IPOPT_RA;
 	((u8*)&iph[1])[1] = 4;
 	((u8*)&iph[1])[2] = 0;
@@ -705,7 +705,7 @@ static void igmp_gq_timer_expire(unsigne
 
 	in_dev->mr_gq_running = 0;
 	igmpv3_send_report(in_dev, NULL);
-	__in_dev_put(in_dev);
+	in_dev_put(in_dev);
 }
 
 static void igmp_ifc_timer_expire(unsigned long data)
@@ -717,7 +717,7 @@ static void igmp_ifc_timer_expire(unsign
 		in_dev->mr_ifc_count--;
 		igmp_ifc_start_timer(in_dev, IGMP_Unsolicited_Report_Interval);
 	}
-	__in_dev_put(in_dev);
+	in_dev_put(in_dev);
 }
 
 static void igmp_ifc_event(struct in_device *in_dev)
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/ipv4/inetpeer.c linux-libre-3.0.100-gnu1/net/ipv4/inetpeer.c
--- linux-libre-3.0.99-gnu1/net/ipv4/inetpeer.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/ipv4/inetpeer.c	2013-10-13 18:07:28.000000000 -0400
@@ -31,8 +31,8 @@
  *  At the moment of writing this notes identifier of IP packets is generated
  *  to be unpredictable using this code only for packets subjected
  *  (actually or potentially) to defragmentation.  I.e. DF packets less than
- *  PMTU in size uses a constant ID and do not use this code (see
- *  ip_select_ident() in include/net/ip.h).
+ *  PMTU in size when local fragmentation is disabled use a constant ID and do
+ *  not use this code (see ip_select_ident() in include/net/ip.h).
  *
  *  Route cache entries hold references to our nodes.
  *  New cache entries get references via lookup by destination IP address in
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/ipv4/ipmr.c linux-libre-3.0.100-gnu1/net/ipv4/ipmr.c
--- linux-libre-3.0.99-gnu1/net/ipv4/ipmr.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/ipv4/ipmr.c	2013-10-13 18:07:28.000000000 -0400
@@ -1575,7 +1575,7 @@ static void ip_encap(struct sk_buff *skb
 	iph->protocol	=	IPPROTO_IPIP;
 	iph->ihl	=	5;
 	iph->tot_len	=	htons(skb->len);
-	ip_select_ident(iph, skb_dst(skb), NULL);
+	ip_select_ident(skb, skb_dst(skb), NULL);
 	ip_send_check(iph);
 
 	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/ipv4/ip_output.c linux-libre-3.0.100-gnu1/net/ipv4/ip_output.c
--- linux-libre-3.0.99-gnu1/net/ipv4/ip_output.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/ipv4/ip_output.c	2013-10-13 18:07:28.000000000 -0400
@@ -161,7 +161,7 @@ int ip_build_and_send_pkt(struct sk_buff
 	iph->daddr    = (opt && opt->opt.srr ? opt->opt.faddr : daddr);
 	iph->saddr    = saddr;
 	iph->protocol = sk->sk_protocol;
-	ip_select_ident(iph, &rt->dst, sk);
+	ip_select_ident(skb, &rt->dst, sk);
 
 	if (opt && opt->opt.optlen) {
 		iph->ihl += opt->opt.optlen>>2;
@@ -397,7 +397,7 @@ packet_routed:
 		ip_options_build(skb, &inet_opt->opt, inet->inet_daddr, rt, 0);
 	}
 
-	ip_select_ident_more(iph, &rt->dst, sk,
+	ip_select_ident_more(skb, &rt->dst, sk,
 			     (skb_shinfo(skb)->gso_segs ?: 1) - 1);
 
 	skb->priority = sk->sk_priority;
@@ -1340,7 +1340,7 @@ struct sk_buff *__ip_make_skb(struct soc
 	iph->ihl = 5;
 	iph->tos = inet->tos;
 	iph->frag_off = df;
-	ip_select_ident(iph, &rt->dst, sk);
+	ip_select_ident(skb, &rt->dst, sk);
 	iph->ttl = ttl;
 	iph->protocol = sk->sk_protocol;
 	iph->saddr = fl4->saddr;
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/ipv4/raw.c linux-libre-3.0.100-gnu1/net/ipv4/raw.c
--- linux-libre-3.0.99-gnu1/net/ipv4/raw.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/ipv4/raw.c	2013-10-13 18:07:28.000000000 -0400
@@ -379,7 +379,7 @@ static int raw_send_hdrinc(struct sock *
 		iph->check   = 0;
 		iph->tot_len = htons(length);
 		if (!iph->id)
-			ip_select_ident(iph, &rt->dst, NULL);
+			ip_select_ident(skb, &rt->dst, NULL);
 
 		iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
 	}
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/ipv4/xfrm4_mode_tunnel.c linux-libre-3.0.100-gnu1/net/ipv4/xfrm4_mode_tunnel.c
--- linux-libre-3.0.99-gnu1/net/ipv4/xfrm4_mode_tunnel.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/ipv4/xfrm4_mode_tunnel.c	2013-10-13 18:07:28.000000000 -0400
@@ -54,7 +54,7 @@ static int xfrm4_mode_tunnel_output(stru
 
 	top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
 		0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
-	ip_select_ident(top_iph, dst->child, NULL);
+	ip_select_ident(skb, dst->child, NULL);
 
 	top_iph->ttl = ip4_dst_hoplimit(dst->child);
 
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/ipv6/ip6_output.c linux-libre-3.0.100-gnu1/net/ipv6/ip6_output.c
--- linux-libre-3.0.99-gnu1/net/ipv6/ip6_output.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/ipv6/ip6_output.c	2013-10-13 18:07:28.000000000 -0400
@@ -1141,6 +1141,8 @@ static inline int ip6_ufo_append_data(st
 	 * udp datagram
 	 */
 	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
+		struct frag_hdr fhdr;
+
 		skb = sock_alloc_send_skb(sk,
 			hh_len + fragheaderlen + transhdrlen + 20,
 			(flags & MSG_DONTWAIT), &err);
@@ -1161,12 +1163,6 @@ static inline int ip6_ufo_append_data(st
 
 		skb->ip_summed = CHECKSUM_PARTIAL;
 		skb->csum = 0;
-	}
-
-	err = skb_append_datato_frags(sk,skb, getfrag, from,
-				      (length - transhdrlen));
-	if (!err) {
-		struct frag_hdr fhdr;
 
 		/* Specify the length of each IPv6 datagram fragment.
 		 * It has to be a multiple of 8.
@@ -1177,15 +1173,10 @@ static inline int ip6_ufo_append_data(st
 		ipv6_select_ident(&fhdr, &rt->rt6i_dst.addr);
 		skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
 		__skb_queue_tail(&sk->sk_write_queue, skb);
-
-		return 0;
 	}
-	/* There is not enough support do UPD LSO,
-	 * so follow normal path
-	 */
-	kfree_skb(skb);
 
-	return err;
+	return skb_append_datato_frags(sk, skb, getfrag, from,
+				       (length - transhdrlen));
 }
 
 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
@@ -1354,27 +1345,27 @@ int ip6_append_data(struct sock *sk, int
 	 * --yoshfuji
 	 */
 
-	cork->length += length;
-	if (length > mtu) {
-		int proto = sk->sk_protocol;
-		if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
-			ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
-			return -EMSGSIZE;
-		}
-
-		if (proto == IPPROTO_UDP &&
-		    (rt->dst.dev->features & NETIF_F_UFO)) {
+	if ((length > mtu) && dontfrag && (sk->sk_protocol == IPPROTO_UDP ||
+					   sk->sk_protocol == IPPROTO_RAW)) {
+		ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
+		return -EMSGSIZE;
+	}
 
-			err = ip6_ufo_append_data(sk, getfrag, from, length,
-						  hh_len, fragheaderlen,
-						  transhdrlen, mtu, flags, rt);
-			if (err)
-				goto error;
-			return 0;
-		}
+	skb = skb_peek_tail(&sk->sk_write_queue);
+	cork->length += length;
+	if (((length > mtu) ||
+	     (skb && skb_is_gso(skb))) &&
+	    (sk->sk_protocol == IPPROTO_UDP) &&
+	    (rt->dst.dev->features & NETIF_F_UFO)) {
+		err = ip6_ufo_append_data(sk, getfrag, from, length,
+					  hh_len, fragheaderlen,
+					  transhdrlen, mtu, flags, rt);
+		if (err)
+			goto error;
+		return 0;
 	}
 
-	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
+	if (!skb)
 		goto alloc_new_skb;
 
 	while (length > 0) {
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/ipv6/mcast.c linux-libre-3.0.100-gnu1/net/ipv6/mcast.c
--- linux-libre-3.0.99-gnu1/net/ipv6/mcast.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/ipv6/mcast.c	2013-10-13 18:07:28.000000000 -0400
@@ -2159,7 +2159,7 @@ static void mld_gq_timer_expire(unsigned
 
 	idev->mc_gq_running = 0;
 	mld_send_report(idev, NULL);
-	__in6_dev_put(idev);
+	in6_dev_put(idev);
 }
 
 static void mld_ifc_timer_expire(unsigned long data)
@@ -2172,7 +2172,7 @@ static void mld_ifc_timer_expire(unsigne
 		if (idev->mc_ifc_count)
 			mld_ifc_start_timer(idev, idev->mc_maxdelay);
 	}
-	__in6_dev_put(idev);
+	in6_dev_put(idev);
 }
 
 static void mld_ifc_event(struct inet6_dev *idev)
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/netfilter/ipvs/ip_vs_xmit.c linux-libre-3.0.100-gnu1/net/netfilter/ipvs/ip_vs_xmit.c
--- linux-libre-3.0.99-gnu1/net/netfilter/ipvs/ip_vs_xmit.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/netfilter/ipvs/ip_vs_xmit.c	2013-10-13 18:07:28.000000000 -0400
@@ -853,7 +853,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, s
 	iph->daddr		=	cp->daddr.ip;
 	iph->saddr		=	saddr;
 	iph->ttl		=	old_iph->ttl;
-	ip_select_ident(iph, &rt->dst, NULL);
+	ip_select_ident(skb, &rt->dst, NULL);
 
 	/* Another hack: avoid icmp_send in ip_fragment */
 	skb->local_df = 1;
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/net/sctp/ipv6.c linux-libre-3.0.100-gnu1/net/sctp/ipv6.c
--- linux-libre-3.0.99-gnu1/net/sctp/ipv6.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/net/sctp/ipv6.c	2013-10-13 18:07:28.000000000 -0400
@@ -203,45 +203,22 @@ out:
 		in6_dev_put(idev);
 }
 
-/* Based on tcp_v6_xmit() in tcp_ipv6.c. */
 static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
 {
 	struct sock *sk = skb->sk;
 	struct ipv6_pinfo *np = inet6_sk(sk);
-	struct flowi6 fl6;
-
-	memset(&fl6, 0, sizeof(fl6));
-
-	fl6.flowi6_proto = sk->sk_protocol;
-
-	/* Fill in the dest address from the route entry passed with the skb
-	 * and the source address from the transport.
-	 */
-	ipv6_addr_copy(&fl6.daddr, &transport->ipaddr.v6.sin6_addr);
-	ipv6_addr_copy(&fl6.saddr, &transport->saddr.v6.sin6_addr);
-
-	fl6.flowlabel = np->flow_label;
-	IP6_ECN_flow_xmit(sk, fl6.flowlabel);
-	if (ipv6_addr_type(&fl6.saddr) & IPV6_ADDR_LINKLOCAL)
-		fl6.flowi6_oif = transport->saddr.v6.sin6_scope_id;
-	else
-		fl6.flowi6_oif = sk->sk_bound_dev_if;
-
-	if (np->opt && np->opt->srcrt) {
-		struct rt0_hdr *rt0 = (struct rt0_hdr *) np->opt->srcrt;
-		ipv6_addr_copy(&fl6.daddr, rt0->addr);
-	}
+	struct flowi6 *fl6 = &transport->fl.u.ip6;
 
 	SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, src:%pI6 dst:%pI6\n",
 			  __func__, skb, skb->len,
-			  &fl6.saddr, &fl6.daddr);
-
-	SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
+			  &fl6->saddr, &fl6->daddr);
 
 	if (!(transport->param_flags & SPP_PMTUD_ENABLE))
 		skb->local_df = 1;
 
-	return ip6_xmit(sk, skb, &fl6, np->opt);
+	SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
+
+	return ip6_xmit(sk, skb, fl6, np->opt);
 }
 
 /* Returns the dst cache entry for the given source and destination ip
@@ -254,10 +231,12 @@ static void sctp_v6_get_dst(struct sctp_
 	struct dst_entry *dst = NULL;
 	struct flowi6 *fl6 = &fl->u.ip6;
 	struct sctp_bind_addr *bp;
+	struct ipv6_pinfo *np = inet6_sk(sk);
 	struct sctp_sockaddr_entry *laddr;
 	union sctp_addr *baddr = NULL;
 	union sctp_addr *daddr = &t->ipaddr;
 	union sctp_addr dst_saddr;
+	struct in6_addr *final_p, final;
 	__u8 matchlen = 0;
 	__u8 bmatchlen;
 	sctp_scope_t scope;
@@ -280,7 +259,8 @@ static void sctp_v6_get_dst(struct sctp_
 		SCTP_DEBUG_PRINTK("SRC=%pI6 - ", &fl6->saddr);
 	}
 
-	dst = ip6_dst_lookup_flow(sk, fl6, NULL, false);
+	final_p = fl6_update_dst(fl6, np->opt, &final);
+	dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
 	if (!asoc || saddr)
 		goto out;
 
@@ -331,10 +311,12 @@ static void sctp_v6_get_dst(struct sctp_
 		}
 	}
 	rcu_read_unlock();
+
 	if (baddr) {
 		ipv6_addr_copy(&fl6->saddr, &baddr->v6.sin6_addr);
 		fl6->fl6_sport = baddr->v6.sin6_port;
-		dst = ip6_dst_lookup_flow(sk, fl6, NULL, false);
+		final_p = fl6_update_dst(fl6, np->opt, &final);
+		dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
 	}
 
 out:
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/sound/soc/codecs/88pm860x-codec.c linux-libre-3.0.100-gnu1/sound/soc/codecs/88pm860x-codec.c
--- linux-libre-3.0.99-gnu1/sound/soc/codecs/88pm860x-codec.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/sound/soc/codecs/88pm860x-codec.c	2013-10-13 18:07:28.000000000 -0400
@@ -350,6 +350,9 @@ static int snd_soc_put_volsw_2r_st(struc
 	val = ucontrol->value.integer.value[0];
 	val2 = ucontrol->value.integer.value[1];
 
+	if (val >= ARRAY_SIZE(st_table) || val2 >= ARRAY_SIZE(st_table))
+		return -EINVAL;
+
 	err = snd_soc_update_bits(codec, reg, 0x3f, st_table[val].m);
 	if (err < 0)
 		return err;
diff -druNp --no-dereference linux-libre-3.0.99-gnu1/sound/soc/codecs/max98095.c linux-libre-3.0.100-gnu1/sound/soc/codecs/max98095.c
--- linux-libre-3.0.99-gnu1/sound/soc/codecs/max98095.c	2013-10-05 10:00:59.000000000 -0400
+++ linux-libre-3.0.100-gnu1/sound/soc/codecs/max98095.c	2013-10-13 18:07:28.000000000 -0400
@@ -1865,7 +1865,7 @@ static int max98095_put_eq_enum(struct s
 	struct max98095_pdata *pdata = max98095->pdata;
 	int channel = max98095_get_eq_channel(kcontrol->id.name);
 	struct max98095_cdata *cdata;
-	int sel = ucontrol->value.integer.value[0];
+	unsigned int sel = ucontrol->value.integer.value[0];
 	struct max98095_eq_cfg *coef_set;
 	int fs, best, best_val, i;
 	int regmask, regsave;
@@ -2011,7 +2011,7 @@ static int max98095_put_bq_enum(struct s
 	struct max98095_pdata *pdata = max98095->pdata;
 	int channel = max98095_get_bq_channel(kcontrol->id.name);
 	struct max98095_cdata *cdata;
-	int sel = ucontrol->value.integer.value[0];
+	unsigned int sel = ucontrol->value.integer.value[0];
 	struct max98095_biquad_cfg *coef_set;
 	int fs, best, best_val, i;
 	int regmask, regsave;
