Add various patches requested for 3.2

23 files changed, 1589 insertions, 0 deletions

diff --git a/queue-3.2/add-foxconn-hon-hai-ids-for-btusb-module.patch b/queue-3.2/add-foxconn-hon-hai-ids-for-btusb-module.patch
new file mode 100644
index 0000000..bd57007
--- /dev/null
+++ b/queue-3.2/add-foxconn-hon-hai-ids-for-btusb-module.patch
@@ -0,0 +1,67 @@
+From: Steven Harms <sjharms@gmail.com>
+Date: Fri, 13 Apr 2012 14:45:55 -0400
+Subject: Add Foxconn / Hon Hai IDs for btusb module
+
+commit 985140369be1e886754d8ac0375dd64e4f727311 upstream.
+
+This change adds 0x0489:0xe033 to the btusb module.
+
+This bluetooth usb device is integrated in the Acer TimelineX AS4830TG-6808 notebook.
+
+Output from /sys/kernel/debug/usb/devices:
+
+T:  Bus=01 Lev=02 Prnt=02 Port=05 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
+D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=0489 ProdID=e033 Rev= 2.29
+S:  Manufacturer=Broadcom Corp
+S:  Product=Acer Module
+S:  SerialNumber=60D819F74101
+C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=  0mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
+E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  32 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  32 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  64 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  64 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  64 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  64 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E:  Ad=84(I) Atr=02(Bulk) MxPS=  32 Ivl=0ms
+E:  Ad=04(O) Atr=02(Bulk) MxPS=  32 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
+
+Signed-off-by: Steven Harms <sjharms@gmail.com>
+Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/bluetooth/btusb.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 93cc828..9217121 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -108,6 +108,9 @@ static struct usb_device_id btusb_table[] = {
+ 	{ USB_DEVICE(0x0a5c, 0x21f3) },
+ 	{ USB_DEVICE(0x413c, 0x8197) },
+ 
++	/* Foxconn - Hon Hai */
++	{ USB_DEVICE(0x0489, 0xe033) },
++
+ 	{ }	/* Terminating entry */
+ };
+ 
diff --git a/queue-3.2/bluetooth-add-support-for-ar3012.patch b/queue-3.2/bluetooth-add-support-for-ar3012.patch
new file mode 100644
index 0000000..31cbf48
--- /dev/null
+++ b/queue-3.2/bluetooth-add-support-for-ar3012.patch
@@ -0,0 +1,61 @@
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Thu, 19 Apr 2012 14:53:45 +0800
+Subject: Bluetooth: Add support for AR3012 [0cf3:e004]
+
+commit ac71311e65e2c4c2dbac76db698fecbee755b016 upstream.
+
+Add another vendor specific ID for Atheros AR3012
+
+output of usb-devices:
+T:  Bus=02 Lev=02 Prnt=02 Port=04 Cnt=01 Dev#=  4 Spd=12  MxCh= 0
+D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=0cf3 ProdID=e004 Rev=00.02
+S:  Manufacturer=Atheros Communications
+S:  Product=Bluetooth USB Host Controller
+S:  SerialNumber=Alaska Day 2006
+C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
+I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+
+BugLink: https://bugs.launchpad.net/bugs/922715
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/bluetooth/ath3k.c |    2 ++
+ drivers/bluetooth/btusb.c |    1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 639a161..57fd867 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -76,6 +76,7 @@ static struct usb_device_id ath3k_table[] = {
+ 	{ USB_DEVICE(0x13d3, 0x3375) },
+ 	{ USB_DEVICE(0x04CA, 0x3005) },
+ 	{ USB_DEVICE(0x13d3, 0x3362) },
++	{ USB_DEVICE(0x0CF3, 0xE004) },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xE02C) },
+@@ -96,6 +97,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+ 
+ 	{ }	/* Terminating entry */
+ };
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index a497544..93cc828 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -135,6 +135,7 @@ static struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
diff --git a/queue-3.2/bluetooth-add-support-for-atheros.patch b/queue-3.2/bluetooth-add-support-for-atheros.patch
new file mode 100644
index 0000000..5b7810d
--- /dev/null
+++ b/queue-3.2/bluetooth-add-support-for-atheros.patch
@@ -0,0 +1,60 @@
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Fri, 13 Apr 2012 17:39:57 +0800
+Subject: Bluetooth: Add support for Atheros [13d3:3362]
+
+commit 87522a433ba6886b5ccbb497e0a7cb8097def64e upstream.
+
+Add another vendor specific ID for Atheros AR3012 device.
+This chip is wrapped by IMC Networks.
+
+output of usb-devices:
+T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  5 Spd=12  MxCh= 0
+D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=13d3 ProdID=3362 Rev=00.02
+S:  Manufacturer=Atheros Communications
+S:  Product=Bluetooth USB Host Controller
+S:  SerialNumber=Alaska Day 2006
+C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
+I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/bluetooth/ath3k.c |    2 ++
+ drivers/bluetooth/btusb.c |    1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index ae9edca..639a161 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -75,6 +75,7 @@ static struct usb_device_id ath3k_table[] = {
+ 	{ USB_DEVICE(0x0CF3, 0x311D) },
+ 	{ USB_DEVICE(0x13d3, 0x3375) },
+ 	{ USB_DEVICE(0x04CA, 0x3005) },
++	{ USB_DEVICE(0x13d3, 0x3362) },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xE02C) },
+@@ -94,6 +95,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ 	{ USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ 
+ 	{ }	/* Terminating entry */
+ };
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 9af450a..a497544 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -134,6 +134,7 @@ static struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
diff --git a/queue-3.2/bluetooth-add-support-for-foxconn-hon-hai-ar5bbu22-0489-e03c.patch b/queue-3.2/bluetooth-add-support-for-foxconn-hon-hai-ar5bbu22-0489-e03c.patch
new file mode 100644
index 0000000..cdf9f4c
--- /dev/null
+++ b/queue-3.2/bluetooth-add-support-for-foxconn-hon-hai-ar5bbu22-0489-e03c.patch
@@ -0,0 +1,89 @@
+From: Michael Gruetzner <mgruetzn@gmx.de>
+Date: Wed, 2 May 2012 22:33:40 +0200
+Subject: Bluetooth: Add support for Foxconn/Hon Hai AR5BBU22 0489:E03C
+
+commit 85d59726c5c66016a507f1f4a60db8e374dd284d upstream.
+
+Add Foxconn/Hon Hai AR5BBU22 Bluetooth Module( 0x489:0xE03C) to
+the blacklist of btusb module and add it to the ath3k module to properly
+load the firmware in Kernel 3.3.4
+The device is integrated in  e.g. some  Acer Aspire 7750G.
+
+Output from /sys/kernel/debug/usb/devices:
+
+T:  Bus=01 Lev=02 Prnt=02 Port=05 Cnt=02 Dev#=  6 Spd=12   MxCh= 0
+D:  Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=0489 ProdID=e03c Rev= 0.02
+S:  Manufacturer=Atheros Communications
+S:  Product=Bluetooth USB Host Controller
+S:  SerialNumber=Alaska Day 2006
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
+E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+
+Signed-off-by: Michael Gruetzner <mgruetzn@gmx.de>
+Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/bluetooth/ath3k.c |    6 ++++++
+ drivers/bluetooth/btusb.c |    3 +++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 57fd867..aba22b2 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -81,6 +81,9 @@ static struct usb_device_id ath3k_table[] = {
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xE02C) },
+ 
++	/* Atheros AR5BBU22 with sflash firmware */
++	{ USB_DEVICE(0x0489, 0xE03C) },
++
+ 	{ }	/* Terminating entry */
+ };
+ 
+@@ -99,6 +102,9 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+ 
++	/* Atheros AR5BBU22 with sflash firmware */
++	{ USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
++
+ 	{ }	/* Terminating entry */
+ };
+ 
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index de17121..cb480f1 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -143,6 +143,9 @@ static struct usb_device_id blacklist_table[] = {
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+ 
++	/* Atheros AR5BBU12 with sflash firmware */
++	{ USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
++
+ 	/* Broadcom BCM2035 */
+ 	{ USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
+ 	{ USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
diff --git a/queue-3.2/bluetooth-btusb-add-support-for-bcm20702a0.patch b/queue-3.2/bluetooth-btusb-add-support-for-bcm20702a0.patch
new file mode 100644
index 0000000..0da44e1
--- /dev/null
+++ b/queue-3.2/bluetooth-btusb-add-support-for-bcm20702a0.patch
@@ -0,0 +1,43 @@
+From: "James M. Leddy" <james.leddy@canonical.com>
+Date: Tue, 6 Mar 2012 02:41:33 +0200
+Subject: Bluetooth: btusb: add support for BCM20702A0 [0a5c:21e6]
+
+commit 0a4eaeeb993658a4d6cff054a863241f32d3d2fb upstream.
+
+Add another vendor specific ID for BCM20702A0.  This has been tested and
+works on hardware with this device.
+
+output of usb-devices:
+T: Bus=01 Lev=02 Prnt=02 Port=03 Cnt=04 Dev#= 6 Spd=12 MxCh= 0
+D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0a5c ProdID=21e6 Rev=01.12
+S: Manufacturer=Broadcom Corp
+S: Product=BCM20702A0
+S: SerialNumber=D0DF9AFB227B
+C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
+I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
+
+Signed-off-by: James M. Leddy <james.leddy@canonical.com>
+Acked-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/bluetooth/btusb.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index c5606ef..22f695e 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -102,6 +102,7 @@ static struct usb_device_id btusb_table[] = {
+ 
+ 	/* Broadcom BCM20702A0 */
+ 	{ USB_DEVICE(0x0a5c, 0x21e3) },
++	{ USB_DEVICE(0x0a5c, 0x21e6) },
+ 	{ USB_DEVICE(0x0a5c, 0x21f3) },
+ 	{ USB_DEVICE(0x413c, 0x8197) },
+ 
diff --git a/queue-3.2/bluetooth-btusb-add-usb-device-id-0a5c-21e8.patch b/queue-3.2/bluetooth-btusb-add-usb-device-id-0a5c-21e8.patch
new file mode 100644
index 0000000..030493c
--- /dev/null
+++ b/queue-3.2/bluetooth-btusb-add-usb-device-id-0a5c-21e8.patch
@@ -0,0 +1,43 @@
+From: =?UTF-8?q?Jo=C3=A3o=20Paulo=20Rechi=20Vita?= <jprvita@openbossa.org>
+Date: Wed, 14 Mar 2012 21:45:16 +0200
+Subject: Bluetooth: btusb: Add USB device ID "0a5c 21e8"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 6dfc326f0605fd87e4c10ccde10de0ce4280d72d upstream.
+
+One more vendor-specific ID for BCM20702A0.
+
+T:  Bus=01 Lev=03 Prnt=05 Port=02 Cnt=01 Dev#=  9 Spd=12  MxCh= 0
+D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=0a5c ProdID=21e8 Rev=01.12
+S:  Manufacturer=Broadcom Corp
+S:  Product=BCM20702A0
+S:  SerialNumber=00027221F4E2
+C:  #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
+I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+I:  If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
+
+Signed-off-by: João Paulo Rechi Vita <jprvita@openbossa.org>
+Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/bluetooth/btusb.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 480cad9..b633854 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -103,6 +103,7 @@ static struct usb_device_id btusb_table[] = {
+ 	/* Broadcom BCM20702A0 */
+ 	{ USB_DEVICE(0x0a5c, 0x21e3) },
+ 	{ USB_DEVICE(0x0a5c, 0x21e6) },
++	{ USB_DEVICE(0x0a5c, 0x21e8) },
+ 	{ USB_DEVICE(0x0a5c, 0x21f3) },
+ 	{ USB_DEVICE(0x413c, 0x8197) },
+ 
diff --git a/queue-3.2/bluetooth-btusb-add-vendor-specific-id-0489-e042-for-bcm20702a0.patch b/queue-3.2/bluetooth-btusb-add-vendor-specific-id-0489-e042-for-bcm20702a0.patch
new file mode 100644
index 0000000..519f951
--- /dev/null
+++ b/queue-3.2/bluetooth-btusb-add-vendor-specific-id-0489-e042-for-bcm20702a0.patch
@@ -0,0 +1,38 @@
+From: Manoj Iyer <manoj.iyer@canonical.com>
+Date: Mon, 9 Apr 2012 09:22:28 -0500
+Subject: Bluetooth: btusb: Add vendor specific ID (0489 e042) for BCM20702A0
+
+commit 79cd76022044f8177bb00e3fd590ec8d6b5f8c35 upstream.
+
+T: Bus=02 Lev=02 Prnt=02 Port=04 Cnt=01 Dev#= 3 Spd=12 MxCh= 0
+D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0489 ProdID=e042 Rev=01.12
+S: Manufacturer=Broadcom Corp
+S: Product=BCM20702A0
+S: SerialNumber=E4D53DCA61B5
+C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
+I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
+
+Reported-by: Dennis Chua <dennis.chua@canonical.com>
+Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/bluetooth/btusb.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 3311b81..9af450a 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -101,6 +101,7 @@ static struct usb_device_id btusb_table[] = {
+ 	{ USB_DEVICE(0x0c10, 0x0000) },
+ 
+ 	/* Broadcom BCM20702A0 */
++	{ USB_DEVICE(0x0489, 0xe042) },
+ 	{ USB_DEVICE(0x0a5c, 0x21e3) },
+ 	{ USB_DEVICE(0x0a5c, 0x21e6) },
+ 	{ USB_DEVICE(0x0a5c, 0x21e8) },
diff --git a/queue-3.2/bluetooth-btusb-add-vendor-specific-id-0a5c-21f3-for-bcm20702a0.patch b/queue-3.2/bluetooth-btusb-add-vendor-specific-id-0a5c-21f3-for-bcm20702a0.patch
new file mode 100644
index 0000000..1c9cef8
--- /dev/null
+++ b/queue-3.2/bluetooth-btusb-add-vendor-specific-id-0a5c-21f3-for-bcm20702a0.patch
@@ -0,0 +1,39 @@
+From: Manoj Iyer <manoj.iyer@canonical.com>
+Date: Thu, 2 Feb 2012 09:32:36 -0600
+Subject: Bluetooth: btusb: Add vendor specific ID (0a5c 21f3) for BCM20702A0
+
+commit 37305cf649689a4d2341dd6fd89b091c6007f9ba upstream.
+
+T: Bus=01 Lev=02 Prnt=02 Port=03 Cnt=03 Dev#= 5 Spd=12 MxCh= 0
+D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0a5c ProdID=21f3 Rev=01.12
+S: Manufacturer=Broadcom Corp
+S: Product=BCM20702A0
+S: SerialNumber=74DE2B344A7B
+C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
+I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
+
+Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
+Tested-by: Dennis Chua <dennis.chua@canonical.com>
+Acked-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/bluetooth/btusb.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index d7664ff..afcd281 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -102,6 +102,7 @@ static struct usb_device_id btusb_table[] = {
+ 
+ 	/* Broadcom BCM20702A0 */
+ 	{ USB_DEVICE(0x0a5c, 0x21e3) },
++	{ USB_DEVICE(0x0a5c, 0x21f3) },
+ 	{ USB_DEVICE(0x413c, 0x8197) },
+ 
+ 	{ }	/* Terminating entry */
diff --git a/queue-3.2/bluetooth-btusb-typo-in-broadcom-softsailing-id.patch b/queue-3.2/bluetooth-btusb-typo-in-broadcom-softsailing-id.patch
new file mode 100644
index 0000000..1233930
--- /dev/null
+++ b/queue-3.2/bluetooth-btusb-typo-in-broadcom-softsailing-id.patch
@@ -0,0 +1,62 @@
+From: Don Zickus <dzickus@redhat.com>
+Date: Wed, 28 Mar 2012 16:41:11 -0400
+Subject: Bluetooth: btusb: typo in Broadcom SoftSailing id
+
+commit 2e8b506310f6433d5558387fd568d4bfb1d6a799 upstream.
+
+I was trying to backport the following commit to RHEL-6
+
+    From 0cea73465cd22373c5cd43a3edd25fbd4bb532ef Mon Sep 17 00:00:00 2001
+    From: Oliver Neukum <oliver@neukum.org>
+    Date: Wed, 21 Sep 2011 11:37:15 +0200
+    Subject: [PATCH] btusb: add device entry for Broadcom SoftSailing
+
+and noticed it wasn't working on an HP Elitebook.  Looking into the patch I
+noticed a very subtle typo in the ids.  The patch has '0x05ac' instead of
+'0x0a5c'.  A snippet of the lsusb -v output also shows this:
+
+Bus 002 Device 003: ID 0a5c:21e1 Broadcom Corp.
+Device Descriptor:
+  bLength                18
+  bDescriptorType         1
+  bcdUSB               2.00
+  bDeviceClass          255 Vendor Specific Class
+  bDeviceSubClass         1
+  bDeviceProtocol         1
+  bMaxPacketSize0        64
+  idVendor           0x0a5c Broadcom Corp.
+  idProduct          0x21e1
+  bcdDevice            1.12
+  iManufacturer           1 Broadcom Corp
+  iProduct                2 BCM20702A0
+  iSerial                 3 60D819F0338C
+  bNumConfigurations      1
+
+Looking at other Broadcom ids, the fix matches them whereas the original patch
+matches Apple's ids.
+
+Tested on an HP Elitebook 8760w.  The btusb binds and the userspace stuff loads
+correctly.
+
+Cc: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Don Zickus <dzickus@redhat.com>
+Acked-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/bluetooth/btusb.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index ba89cd0..3311b81 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -61,7 +61,7 @@ static struct usb_device_id btusb_table[] = {
+ 	{ USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
+ 
+ 	/* Broadcom SoftSailing reporting vendor specific */
+-	{ USB_DEVICE(0x05ac, 0x21e1) },
++	{ USB_DEVICE(0x0a5c, 0x21e1) },
+ 
+ 	/* Apple MacBookPro 7,1 */
+ 	{ USB_DEVICE(0x05ac, 0x8213) },
diff --git a/queue-3.2/drm-i915-disable-fbc-on-sandybridge.patch b/queue-3.2/drm-i915-disable-fbc-on-sandybridge.patch
new file mode 100644
index 0000000..6da0d38
--- /dev/null
+++ b/queue-3.2/drm-i915-disable-fbc-on-sandybridge.patch
@@ -0,0 +1,30 @@
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 8 Nov 2011 23:17:34 +0000
+Subject: drm/i915:: Disable FBC on SandyBridge
+
+commit d56d8b28e9247e7e35e02fbb12b12239a2c33ad1 upstream.
+
+Enabling FBC is causing the BLT ring to run between 10-100x slower than
+normal and frequently lockup. The interim solution is disable FBC once
+more until we know why.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/gpu/drm/i915/intel_display.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index b3b51c4..19f35ec 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1872,7 +1872,7 @@ static void intel_update_fbc(struct drm_device *dev)
+ 	if (enable_fbc < 0) {
+ 		DRM_DEBUG_KMS("fbc set to per-chip default\n");
+ 		enable_fbc = 1;
+-		if (INTEL_INFO(dev)->gen <= 5)
++		if (INTEL_INFO(dev)->gen <= 6)
+ 			enable_fbc = 0;
+ 	}
+ 	if (!enable_fbc) {
diff --git a/queue-3.2/ipv4-do-not-use-dead-fib_info-entries.patch b/queue-3.2/ipv4-do-not-use-dead-fib_info-entries.patch
new file mode 100644
index 0000000..a71fefa
--- /dev/null
+++ b/queue-3.2/ipv4-do-not-use-dead-fib_info-entries.patch
@@ -0,0 +1,32 @@
+From: "David S. Miller" <davem@davemloft.net>
+Date: Thu, 10 May 2012 22:16:32 -0400
+Subject: ipv4: Do not use dead fib_info entries.
+
+[ Upstream commit dccd9ecc374462e5d6a5b8f8110415a86c2213d8 ]
+
+Due to RCU lookups and RCU based release, fib_info objects can
+be found during lookup which have fi->fib_dead set.
+
+We must ignore these entries, otherwise we risk dereferencing
+the parts of the entry which are being torn down.
+
+Reported-by: Yevgen Pronenko <yevgen.pronenko@sonymobile.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv4/fib_trie.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 3ce23f9..cd2d639 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1372,6 +1372,8 @@ static int check_leaf(struct fib_table *tb, struct trie *t, struct leaf *l,
+ 
+ 			if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos)
+ 				continue;
++			if (fi->fib_dead)
++				continue;
+ 			if (fa->fa_info->fib_scope < flp->flowi4_scope)
+ 				continue;
+ 			fib_alias_accessed(fa);
diff --git a/queue-3.2/ipv4-fix-the-rcu-race-between-free_fib_info-and-ip_route_output_slow.patch b/queue-3.2/ipv4-fix-the-rcu-race-between-free_fib_info-and-ip_route_output_slow.patch
new file mode 100644
index 0000000..6fc7d30
--- /dev/null
+++ b/queue-3.2/ipv4-fix-the-rcu-race-between-free_fib_info-and-ip_route_output_slow.patch
@@ -0,0 +1,87 @@
+From: Yanmin Zhang <yanmin_zhang@linux.intel.com>
+Date: Wed, 23 May 2012 15:39:45 +0000
+Subject: ipv4: fix the rcu race between free_fib_info and  ip_route_output_slow
+
+[ Upstream commit e49cc0da7283088c5e03d475ffe2fdcb24a6d5b1 ]
+
+We hit a kernel OOPS.
+
+<3>[23898.789643] BUG: sleeping function called from invalid context at
+/data/buildbot/workdir/ics/hardware/intel/linux-2.6/arch/x86/mm/fault.c:1103
+<3>[23898.862215] in_atomic(): 0, irqs_disabled(): 0, pid: 10526, name:
+Thread-6683
+<4>[23898.967805] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
+to suspend...
+<4>[23899.258526] Pid: 10526, comm: Thread-6683 Tainted: G        W
+3.0.8-137685-ge7742f9 #1
+<4>[23899.357404] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
+to suspend...
+<4>[23899.904225] Call Trace:
+<4>[23899.989209]  [<c1227f50>] ? pgtable_bad+0x130/0x130
+<4>[23900.000416]  [<c1238c2a>] __might_sleep+0x10a/0x110
+<4>[23900.007357]  [<c1228021>] do_page_fault+0xd1/0x3c0
+<4>[23900.013764]  [<c18e9ba9>] ? restore_all+0xf/0xf
+<4>[23900.024024]  [<c17c007b>] ? napi_complete+0x8b/0x690
+<4>[23900.029297]  [<c1227f50>] ? pgtable_bad+0x130/0x130
+<4>[23900.123739]  [<c1227f50>] ? pgtable_bad+0x130/0x130
+<4>[23900.128955]  [<c18ea0c3>] error_code+0x5f/0x64
+<4>[23900.133466]  [<c1227f50>] ? pgtable_bad+0x130/0x130
+<4>[23900.138450]  [<c17f6298>] ? __ip_route_output_key+0x698/0x7c0
+<4>[23900.144312]  [<c17f5f8d>] ? __ip_route_output_key+0x38d/0x7c0
+<4>[23900.150730]  [<c17f63df>] ip_route_output_flow+0x1f/0x60
+<4>[23900.156261]  [<c181de58>] ip4_datagram_connect+0x188/0x2b0
+<4>[23900.161960]  [<c18e981f>] ? _raw_spin_unlock_bh+0x1f/0x30
+<4>[23900.167834]  [<c18298d6>] inet_dgram_connect+0x36/0x80
+<4>[23900.173224]  [<c14f9e88>] ? _copy_from_user+0x48/0x140
+<4>[23900.178817]  [<c17ab9da>] sys_connect+0x9a/0xd0
+<4>[23900.183538]  [<c132e93c>] ? alloc_file+0xdc/0x240
+<4>[23900.189111]  [<c123925d>] ? sub_preempt_count+0x3d/0x50
+
+Function free_fib_info resets nexthop_nh->nh_dev to NULL before releasing
+fi. Other cpu might be accessing fi. Fixing it by delaying the releasing.
+
+With the patch, we ran MTBF testing on Android mobile for 12 hours
+and didn't trigger the issue.
+
+Thank Eric for very detailed review/checking the issue.
+
+Signed-off-by: Yanmin Zhang <yanmin_zhang@linux.intel.com>
+Signed-off-by: Kun Jiang <kunx.jiang@intel.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv4/fib_semantics.c |   12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index 80106d8..d01f9c6 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -146,6 +146,12 @@ static void free_fib_info_rcu(struct rcu_head *head)
+ {
+ 	struct fib_info *fi = container_of(head, struct fib_info, rcu);
+ 
++	change_nexthops(fi) {
++		if (nexthop_nh->nh_dev)
++			dev_put(nexthop_nh->nh_dev);
++	} endfor_nexthops(fi);
++
++	release_net(fi->fib_net);
+ 	if (fi->fib_metrics != (u32 *) dst_default_metrics)
+ 		kfree(fi->fib_metrics);
+ 	kfree(fi);
+@@ -157,13 +163,7 @@ void free_fib_info(struct fib_info *fi)
+ 		pr_warning("Freeing alive fib_info %p\n", fi);
+ 		return;
+ 	}
+-	change_nexthops(fi) {
+-		if (nexthop_nh->nh_dev)
+-			dev_put(nexthop_nh->nh_dev);
+-		nexthop_nh->nh_dev = NULL;
+-	} endfor_nexthops(fi);
+ 	fib_info_cnt--;
+-	release_net(fi->fib_net);
+ 	call_rcu(&fi->rcu, free_fib_info_rcu);
+ }
+ 
diff --git a/queue-3.2/ipv6-fix-incorrect-ipsec-fragment.patch b/queue-3.2/ipv6-fix-incorrect-ipsec-fragment.patch
new file mode 100644
index 0000000..aa460c9
--- /dev/null
+++ b/queue-3.2/ipv6-fix-incorrect-ipsec-fragment.patch
@@ -0,0 +1,177 @@
+From: Gao feng <gaofeng@cn.fujitsu.com>
+Date: Sat, 26 May 2012 01:30:53 +0000
+Subject: ipv6: fix incorrect ipsec fragment
+
+[ Upstream commit 0c1833797a5a6ec23ea9261d979aa18078720b74 ]
+
+Since commit ad0081e43a
+"ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed"
+the fragment of packets is incorrect.
+because tunnel mode needs IPsec headers and trailer for all fragments,
+while on transport mode it is sufficient to add the headers to the
+first fragment and the trailer to the last.
+
+so modify mtu and maxfraglen base on ipsec mode and if fragment is first
+or last.
+
+with my test,it work well(every fragment's size is the mtu)
+and does not trigger slow fragment path.
+
+Changes from v1:
+	though optimization, mtu_prev and maxfraglen_prev can be delete.
+	replace xfrm mode codes with dst_entry's new frag DST_XFRM_TUNNEL.
+	add fuction ip6_append_data_mtu to make codes clearer.
+
+Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ include/net/dst.h      |    1 +
+ net/ipv6/ip6_output.c  |   68 +++++++++++++++++++++++++++++++++++-------------
+ net/xfrm/xfrm_policy.c |    3 +++
+ 3 files changed, 54 insertions(+), 18 deletions(-)
+
+diff --git a/include/net/dst.h b/include/net/dst.h
+index 65bca65..16010d1 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -55,6 +55,7 @@ struct dst_entry {
+ #define DST_NOCOUNT		0x0020
+ #define DST_NOPEER		0x0040
+ #define DST_FAKE_RTABLE		0x0080
++#define DST_XFRM_TUNNEL		0x0100
+ 
+ 	short			error;
+ 	short			obsolete;
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index f7f07e2..ae98e09 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1178,6 +1178,29 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
+ 	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+ }
+ 
++static void ip6_append_data_mtu(int *mtu,
++				int *maxfraglen,
++				unsigned int fragheaderlen,
++				struct sk_buff *skb,
++				struct rt6_info *rt)
++{
++	if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
++		if (skb == NULL) {
++			/* first fragment, reserve header_len */
++			*mtu = *mtu - rt->dst.header_len;
++
++		} else {
++			/*
++			 * this fragment is not first, the headers
++			 * space is regarded as data space.
++			 */
++			*mtu = dst_mtu(rt->dst.path);
++		}
++		*maxfraglen = ((*mtu - fragheaderlen) & ~7)
++			      + fragheaderlen - sizeof(struct frag_hdr);
++	}
++}
++
+ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ 	int offset, int len, int odd, struct sk_buff *skb),
+ 	void *from, int length, int transhdrlen,
+@@ -1187,7 +1210,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ 	struct inet_sock *inet = inet_sk(sk);
+ 	struct ipv6_pinfo *np = inet6_sk(sk);
+ 	struct inet_cork *cork;
+-	struct sk_buff *skb;
++	struct sk_buff *skb, *skb_prev = NULL;
+ 	unsigned int maxfraglen, fragheaderlen;
+ 	int exthdrlen;
+ 	int dst_exthdrlen;
+@@ -1245,8 +1268,12 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ 		inet->cork.fl.u.ip6 = *fl6;
+ 		np->cork.hop_limit = hlimit;
+ 		np->cork.tclass = tclass;
+-		mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
+-		      rt->dst.dev->mtu : dst_mtu(&rt->dst);
++		if (rt->dst.flags & DST_XFRM_TUNNEL)
++			mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
++			      rt->dst.dev->mtu : dst_mtu(&rt->dst);
++		else
++			mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
++			      rt->dst.dev->mtu : dst_mtu(rt->dst.path);
+ 		if (np->frag_size < mtu) {
+ 			if (np->frag_size)
+ 				mtu = np->frag_size;
+@@ -1342,25 +1369,27 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ 			unsigned int fraglen;
+ 			unsigned int fraggap;
+ 			unsigned int alloclen;
+-			struct sk_buff *skb_prev;
+ alloc_new_skb:
+-			skb_prev = skb;
+-
+ 			/* There's no room in the current skb */
+-			if (skb_prev)
+-				fraggap = skb_prev->len - maxfraglen;
++			if (skb)
++				fraggap = skb->len - maxfraglen;
+ 			else
+ 				fraggap = 0;
++			/* update mtu and maxfraglen if necessary */
++			if (skb == NULL || skb_prev == NULL)
++				ip6_append_data_mtu(&mtu, &maxfraglen,
++						    fragheaderlen, skb, rt);
++
++			skb_prev = skb;
+ 
+ 			/*
+ 			 * If remaining data exceeds the mtu,
+ 			 * we know we need more fragment(s).
+ 			 */
+ 			datalen = length + fraggap;
+-			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
+-				datalen = maxfraglen - fragheaderlen;
+ 
+-			fraglen = datalen + fragheaderlen;
++			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
++				datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
+ 			if ((flags & MSG_MORE) &&
+ 			    !(rt->dst.dev->features&NETIF_F_SG))
+ 				alloclen = mtu;
+@@ -1369,13 +1398,16 @@ alloc_new_skb:
+ 
+ 			alloclen += dst_exthdrlen;
+ 
+-			/*
+-			 * The last fragment gets additional space at tail.
+-			 * Note: we overallocate on fragments with MSG_MODE
+-			 * because we have no idea if we're the last one.
+-			 */
+-			if (datalen == length + fraggap)
+-				alloclen += rt->dst.trailer_len;
++			if (datalen != length + fraggap) {
++				/*
++				 * this is not the last fragment, the trailer
++				 * space is regarded as data space.
++				 */
++				datalen += rt->dst.trailer_len;
++			}
++
++			alloclen += rt->dst.trailer_len;
++			fraglen = datalen + fragheaderlen;
+ 
+ 			/*
+ 			 * We just reserve space for fragment header.
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 9049a5c..0174034 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1919,6 +1919,9 @@ no_transform:
+ 	}
+ ok:
+ 	xfrm_pols_put(pols, drop_pols);
++	if (dst && dst->xfrm &&
++	    dst->xfrm->props.mode == XFRM_MODE_TUNNEL)
++		dst->flags |= DST_XFRM_TUNNEL;
+ 	return dst;
+ 
+ nopol:
diff --git a/queue-3.2/l2tp-fix-oops-in-l2tp-ip-sockets-for-connect-af_unspec-case.patch b/queue-3.2/l2tp-fix-oops-in-l2tp-ip-sockets-for-connect-af_unspec-case.patch
new file mode 100644
index 0000000..87b95a5
--- /dev/null
+++ b/queue-3.2/l2tp-fix-oops-in-l2tp-ip-sockets-for-connect-af_unspec-case.patch
@@ -0,0 +1,108 @@
+From: James Chapman <jchapman@katalix.com>
+Date: Tue, 29 May 2012 23:13:23 +0000
+Subject: l2tp: fix oops in L2TP IP sockets for connect()  AF_UNSPEC case
+
+[ Upstream commit c51ce49735c183ef2592db70f918ee698716276b ]
+
+An application may call connect() to disconnect a socket using an
+address with family AF_UNSPEC. The L2TP IP sockets were not handling
+this case when the socket is not bound and an attempt to connect()
+using AF_UNSPEC in such cases would result in an oops. This patch
+addresses the problem by protecting the sk_prot->disconnect() call
+against trying to unhash the socket before it is bound.
+
+The patch also adds more checks that the sockaddr supplied to bind()
+and connect() calls is valid.
+
+ RIP: 0010:[<ffffffff82e133b0>]  [<ffffffff82e133b0>] inet_unhash+0x50/0xd0
+ RSP: 0018:ffff88001989be28  EFLAGS: 00010293
+ Stack:
+  ffff8800407a8000 0000000000000000 ffff88001989be78 ffffffff82e3a249
+  ffffffff82e3a050 ffff88001989bec8 ffff88001989be88 ffff8800407a8000
+  0000000000000010 ffff88001989bec8 ffff88001989bea8 ffffffff82e42639
+ Call Trace:
+ [<ffffffff82e3a249>] udp_disconnect+0x1f9/0x290
+ [<ffffffff82e42639>] inet_dgram_connect+0x29/0x80
+ [<ffffffff82d012fc>] sys_connect+0x9c/0x100
+
+Reported-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: James Chapman <jchapman@katalix.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/l2tp/l2tp_ip.c |   30 ++++++++++++++++++++++++------
+ 1 file changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index 2a2a3e7..2fbbe1f 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -251,9 +251,16 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ {
+ 	struct inet_sock *inet = inet_sk(sk);
+ 	struct sockaddr_l2tpip *addr = (struct sockaddr_l2tpip *) uaddr;
+-	int ret = -EINVAL;
++	int ret;
+ 	int chk_addr_ret;
+ 
++	if (!sock_flag(sk, SOCK_ZAPPED))
++		return -EINVAL;
++	if (addr_len < sizeof(struct sockaddr_l2tpip))
++		return -EINVAL;
++	if (addr->l2tp_family != AF_INET)
++		return -EINVAL;
++
+ 	ret = -EADDRINUSE;
+ 	read_lock_bh(&l2tp_ip_lock);
+ 	if (__l2tp_ip_bind_lookup(&init_net, addr->l2tp_addr.s_addr, sk->sk_bound_dev_if, addr->l2tp_conn_id))
+@@ -283,6 +290,8 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ 	sk_del_node_init(sk);
+ 	write_unlock_bh(&l2tp_ip_lock);
+ 	ret = 0;
++	sock_reset_flag(sk, SOCK_ZAPPED);
++
+ out:
+ 	release_sock(sk);
+ 
+@@ -303,13 +312,14 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
+ 	__be32 saddr;
+ 	int oif, rc;
+ 
+-	rc = -EINVAL;
++	if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
++		return -EINVAL;
++
+ 	if (addr_len < sizeof(*lsa))
+-		goto out;
++		return -EINVAL;
+ 
+-	rc = -EAFNOSUPPORT;
+ 	if (lsa->l2tp_family != AF_INET)
+-		goto out;
++		return -EAFNOSUPPORT;
+ 
+ 	lock_sock(sk);
+ 
+@@ -363,6 +373,14 @@ out:
+ 	return rc;
+ }
+ 
++static int l2tp_ip_disconnect(struct sock *sk, int flags)
++{
++	if (sock_flag(sk, SOCK_ZAPPED))
++		return 0;
++
++	return udp_disconnect(sk, flags);
++}
++
+ static int l2tp_ip_getname(struct socket *sock, struct sockaddr *uaddr,
+ 			   int *uaddr_len, int peer)
+ {
+@@ -598,7 +616,7 @@ static struct proto l2tp_ip_prot = {
+ 	.close		   = l2tp_ip_close,
+ 	.bind		   = l2tp_ip_bind,
+ 	.connect	   = l2tp_ip_connect,
+-	.disconnect	   = udp_disconnect,
++	.disconnect	   = l2tp_ip_disconnect,
+ 	.ioctl		   = udp_ioctl,
+ 	.destroy	   = l2tp_ip_destroy_sock,
+ 	.setsockopt	   = ip_setsockopt,
diff --git a/queue-3.2/r8169-fix-early-queue-wake-up.patch b/queue-3.2/r8169-fix-early-queue-wake-up.patch
new file mode 100644
index 0000000..329efe4
--- /dev/null
+++ b/queue-3.2/r8169-fix-early-queue-wake-up.patch
@@ -0,0 +1,54 @@
+From: Francois Romieu <romieu@fr.zoreil.com>
+Date: Tue, 31 Jan 2012 00:00:19 +0100
+Subject: r8169: fix early queue wake-up.
+
+[ Upstream commit ae1f23fb433ac0aaff8aeaa5a7b14348e9aa8277 ]
+
+With infinite gratitude to Eric Dumazet for allowing me to identify
+the error.
+
+Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/realtek/r8169.c |   18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 5104d76..5f3fa32 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -5561,7 +5561,18 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
+ 	RTL_W8(TxPoll, NPQ);
+ 
+ 	if (TX_BUFFS_AVAIL(tp) < MAX_SKB_FRAGS) {
++		/* Avoid wrongly optimistic queue wake-up: rtl_tx thread must
++		 * not miss a ring update when it notices a stopped queue.
++		 */
++		smp_wmb();
+ 		netif_stop_queue(dev);
++		/* Sync with rtl_tx:
++		 * - publish queue status and cur_tx ring index (write barrier)
++		 * - refresh dirty_tx ring index (read barrier).
++		 * May the current thread have a pessimistic view of the ring
++		 * status and forget to wake up queue, a racing rtl_tx thread
++		 * can't.
++		 */
+ 		smp_mb();
+ 		if (TX_BUFFS_AVAIL(tp) >= MAX_SKB_FRAGS)
+ 			netif_wake_queue(dev);
+@@ -5663,6 +5674,13 @@ static void rtl8169_tx_interrupt(struct net_device *dev,
+ 
+ 	if (tp->dirty_tx != dirty_tx) {
+ 		tp->dirty_tx = dirty_tx;
++		/* Sync with rtl8169_start_xmit:
++		 * - publish dirty_tx ring index (write barrier)
++		 * - refresh cur_tx ring index and queue status (read barrier)
++		 * May the current thread miss the stopped queue condition,
++		 * a racing xmit thread can only have a right view of the
++		 * ring status.
++		 */
+ 		smp_mb();
+ 		if (netif_queue_stopped(dev) &&
+ 		    (TX_BUFFS_AVAIL(tp) >= MAX_SKB_FRAGS)) {
diff --git a/queue-3.2/r8169-fix-unsigned-int-wraparound-with-tso.patch b/queue-3.2/r8169-fix-unsigned-int-wraparound-with-tso.patch
new file mode 100644
index 0000000..5911926
--- /dev/null
+++ b/queue-3.2/r8169-fix-unsigned-int-wraparound-with-tso.patch
@@ -0,0 +1,78 @@
+From: Julien Ducourthial <jducourt@free.fr>
+Date: Wed, 9 May 2012 00:00:06 +0200
+Subject: r8169: fix unsigned int wraparound with TSO
+
+[ Upstream commit 477206a018f902895bfcd069dd820bfe94c187b1 ]
+
+The r8169 may get stuck or show bad behaviour after activating TSO :
+the net_device is not stopped when it has no more TX descriptors.
+This problem comes from TX_BUFS_AVAIL which may reach -1 when all
+transmit descriptors are in use. The patch simply tries to keep positive
+values.
+
+Tested with 8111d(onboard) on a D510MO, and with 8111e(onboard) on a
+Zotac 890GXITX.
+
+Signed-off-by: Julien Ducourthial <jducourt@free.fr>
+Acked-by: Francois Romieu <romieu@fr.zoreil.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/realtek/r8169.c |   16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 5f3fa32..cc2565c 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -62,8 +62,12 @@
+ #define R8169_MSG_DEFAULT \
+ 	(NETIF_MSG_DRV | NETIF_MSG_PROBE | NETIF_MSG_IFUP | NETIF_MSG_IFDOWN)
+ 
+-#define TX_BUFFS_AVAIL(tp) \
+-	(tp->dirty_tx + NUM_TX_DESC - tp->cur_tx - 1)
++#define TX_SLOTS_AVAIL(tp) \
++	(tp->dirty_tx + NUM_TX_DESC - tp->cur_tx)
++
++/* A skbuff with nr_frags needs nr_frags+1 entries in the tx queue */
++#define TX_FRAGS_READY_FOR(tp,nr_frags) \
++	(TX_SLOTS_AVAIL(tp) >= (nr_frags + 1))
+ 
+ /* Maximum number of multicast addresses to filter (vs. Rx-all-multicast).
+    The RTL chips use a 64 element hash table based on the Ethernet CRC. */
+@@ -5512,7 +5516,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
+ 	u32 opts[2];
+ 	int frags;
+ 
+-	if (unlikely(TX_BUFFS_AVAIL(tp) < skb_shinfo(skb)->nr_frags)) {
++	if (unlikely(!TX_FRAGS_READY_FOR(tp, skb_shinfo(skb)->nr_frags))) {
+ 		netif_err(tp, drv, dev, "BUG! Tx Ring full when queue awake!\n");
+ 		goto err_stop_0;
+ 	}
+@@ -5560,7 +5564,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
+ 
+ 	RTL_W8(TxPoll, NPQ);
+ 
+-	if (TX_BUFFS_AVAIL(tp) < MAX_SKB_FRAGS) {
++	if (!TX_FRAGS_READY_FOR(tp, MAX_SKB_FRAGS)) {
+ 		/* Avoid wrongly optimistic queue wake-up: rtl_tx thread must
+ 		 * not miss a ring update when it notices a stopped queue.
+ 		 */
+@@ -5574,7 +5578,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
+ 		 * can't.
+ 		 */
+ 		smp_mb();
+-		if (TX_BUFFS_AVAIL(tp) >= MAX_SKB_FRAGS)
++		if (TX_FRAGS_READY_FOR(tp, MAX_SKB_FRAGS))
+ 			netif_wake_queue(dev);
+ 	}
+ 
+@@ -5683,7 +5687,7 @@ static void rtl8169_tx_interrupt(struct net_device *dev,
+ 		 */
+ 		smp_mb();
+ 		if (netif_queue_stopped(dev) &&
+-		    (TX_BUFFS_AVAIL(tp) >= MAX_SKB_FRAGS)) {
++		    TX_FRAGS_READY_FOR(tp, MAX_SKB_FRAGS)) {
+ 			netif_wake_queue(dev);
+ 		}
+ 		/*
diff --git a/queue-3.2/r8169-missing-barriers.patch b/queue-3.2/r8169-missing-barriers.patch
new file mode 100644
index 0000000..3af188d
--- /dev/null
+++ b/queue-3.2/r8169-missing-barriers.patch
@@ -0,0 +1,43 @@
+From: Francois Romieu <romieu@fr.zoreil.com>
+Date: Fri, 27 Jan 2012 15:05:38 +0100
+Subject: r8169: missing barriers.
+
+[ Upstream commit 1e874e041fc7c222cbd85b20c4406070be1f687a ]
+
+Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
+Cc: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/realtek/r8169.c |    5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 697cae3..5104d76 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -5562,7 +5562,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
+ 
+ 	if (TX_BUFFS_AVAIL(tp) < MAX_SKB_FRAGS) {
+ 		netif_stop_queue(dev);
+-		smp_rmb();
++		smp_mb();
+ 		if (TX_BUFFS_AVAIL(tp) >= MAX_SKB_FRAGS)
+ 			netif_wake_queue(dev);
+ 	}
+@@ -5663,7 +5663,7 @@ static void rtl8169_tx_interrupt(struct net_device *dev,
+ 
+ 	if (tp->dirty_tx != dirty_tx) {
+ 		tp->dirty_tx = dirty_tx;
+-		smp_wmb();
++		smp_mb();
+ 		if (netif_queue_stopped(dev) &&
+ 		    (TX_BUFFS_AVAIL(tp) >= MAX_SKB_FRAGS)) {
+ 			netif_wake_queue(dev);
+@@ -5674,7 +5674,6 @@ static void rtl8169_tx_interrupt(struct net_device *dev,
+ 		 * of start_xmit activity is detected (if it is not detected,
+ 		 * it is slow enough). -- FR
+ 		 */
+-		smp_rmb();
+ 		if (tp->cur_tx != dirty_tx)
+ 			RTL_W8(TxPoll, NPQ);
+ 	}
diff --git a/queue-3.2/revert-net-maintain-namespace-isolation-between-vlan-and-real-device.patch b/queue-3.2/revert-net-maintain-namespace-isolation-between-vlan-and-real-device.patch
new file mode 100644
index 0000000..414283f
--- /dev/null
+++ b/queue-3.2/revert-net-maintain-namespace-isolation-between-vlan-and-real-device.patch
@@ -0,0 +1,133 @@
+From: "David S. Miller" <davem@davemloft.net>
+Date: Thu, 10 May 2012 23:03:34 -0400
+Subject: Revert "net: maintain namespace isolation between vlan  and real device"
+
+[ Upstream commit 59b9997baba5242997ddc7bd96b1391f5275a5a4 ]
+
+This reverts commit 8a83a00b0735190384a348156837918271034144.
+
+It causes regressions for S390 devices, because it does an
+unconditional DST drop on SKBs for vlans and the QETH device
+needs the neighbour entry hung off the DST for certain things
+on transmit.
+
+Arnd can't remember exactly why he even needed this change.
+
+Conflicts:
+
+	drivers/net/macvlan.c
+	net/8021q/vlan_dev.c
+	net/core/dev.c
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/macvlan.c     |    2 +-
+ include/linux/netdevice.h |    9 ---------
+ net/8021q/vlan_dev.c      |    2 +-
+ net/core/dev.c            |   36 +++++-------------------------------
+ 4 files changed, 7 insertions(+), 42 deletions(-)
+
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 959d448..97f342e 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -258,7 +258,7 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
+ 
+ xmit_world:
+ 	skb->ip_summed = ip_summed;
+-	skb_set_dev(skb, vlan->lowerdev);
++	skb->dev = vlan->lowerdev;
+ 	return dev_queue_xmit(skb);
+ }
+ 
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index cbeb586..cb52340 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1420,15 +1420,6 @@ static inline bool netdev_uses_dsa_tags(struct net_device *dev)
+ 	return 0;
+ }
+ 
+-#ifndef CONFIG_NET_NS
+-static inline void skb_set_dev(struct sk_buff *skb, struct net_device *dev)
+-{
+-	skb->dev = dev;
+-}
+-#else /* CONFIG_NET_NS */
+-void skb_set_dev(struct sk_buff *skb, struct net_device *dev);
+-#endif
+-
+ static inline bool netdev_uses_trailer_tags(struct net_device *dev)
+ {
+ #ifdef CONFIG_NET_DSA_TAG_TRAILER
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index bc25286..0cccca8 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -156,7 +156,7 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
+ 		skb = __vlan_hwaccel_put_tag(skb, vlan_tci);
+ 	}
+ 
+-	skb_set_dev(skb, vlan_dev_info(dev)->real_dev);
++	skb->dev = vlan_dev_info(dev)->real_dev;
+ 	len = skb->len;
+ 	ret = dev_queue_xmit(skb);
+ 
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 61a7baa..1cbddc9 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1607,10 +1607,14 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
+ 		kfree_skb(skb);
+ 		return NET_RX_DROP;
+ 	}
+-	skb_set_dev(skb, dev);
++	skb->dev = dev;
++	skb_dst_drop(skb);
+ 	skb->tstamp.tv64 = 0;
+ 	skb->pkt_type = PACKET_HOST;
+ 	skb->protocol = eth_type_trans(skb, dev);
++	skb->mark = 0;
++	secpath_reset(skb);
++	nf_reset(skb);
+ 	return netif_rx(skb);
+ }
+ EXPORT_SYMBOL_GPL(dev_forward_skb);
+@@ -1865,36 +1869,6 @@ void netif_device_attach(struct net_device *dev)
+ }
+ EXPORT_SYMBOL(netif_device_attach);
+ 
+-/**
+- * skb_dev_set -- assign a new device to a buffer
+- * @skb: buffer for the new device
+- * @dev: network device
+- *
+- * If an skb is owned by a device already, we have to reset
+- * all data private to the namespace a device belongs to
+- * before assigning it a new device.
+- */
+-#ifdef CONFIG_NET_NS
+-void skb_set_dev(struct sk_buff *skb, struct net_device *dev)
+-{
+-	skb_dst_drop(skb);
+-	if (skb->dev && !net_eq(dev_net(skb->dev), dev_net(dev))) {
+-		secpath_reset(skb);
+-		nf_reset(skb);
+-		skb_init_secmark(skb);
+-		skb->mark = 0;
+-		skb->priority = 0;
+-		skb->nf_trace = 0;
+-		skb->ipvs_property = 0;
+-#ifdef CONFIG_NET_SCHED
+-		skb->tc_index = 0;
+-#endif
+-	}
+-	skb->dev = dev;
+-}
+-EXPORT_SYMBOL(skb_set_dev);
+-#endif /* CONFIG_NET_NS */
+-
+ /*
+  * Invalidate hardware checksum when packet is to be mangled, and
+  * complete checksum manually on outgoing path.
diff --git a/queue-3.2/sctp-check-cached-dst-before-using-it.patch b/queue-3.2/sctp-check-cached-dst-before-using-it.patch
new file mode 100644
index 0000000..8984ab6
--- /dev/null
+++ b/queue-3.2/sctp-check-cached-dst-before-using-it.patch
@@ -0,0 +1,84 @@
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Date: Fri, 4 May 2012 05:24:54 +0000
+Subject: sctp: check cached dst before using it
+
+[ Upstream commit e0268868ba064980488fc8c194db3d8e9fb2959c ]
+
+dst_check() will take care of SA (and obsolete field), hence
+IPsec rekeying scenario is taken into account.
+
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Acked-by: Vlad Yaseivch <vyasevich@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ include/net/sctp/sctp.h |   13 +++++++++++++
+ net/sctp/output.c       |    4 +---
+ net/sctp/transport.c    |   17 -----------------
+ 3 files changed, 14 insertions(+), 20 deletions(-)
+
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index 6a72a58..ad03988 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -703,4 +703,17 @@ static inline void sctp_v4_map_v6(union sctp_addr *addr)
+ 	addr->v6.sin6_addr.s6_addr32[2] = htonl(0x0000ffff);
+ }
+ 
++/* The cookie is always 0 since this is how it's used in the
++ * pmtu code.
++ */
++static inline struct dst_entry *sctp_transport_dst_check(struct sctp_transport *t)
++{
++	if (t->dst && !dst_check(t->dst, 0)) {
++		dst_release(t->dst);
++		t->dst = NULL;
++	}
++
++	return t->dst;
++}
++
+ #endif /* __net_sctp_h__ */
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index 817174e..8fc4dcd 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -377,9 +377,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
+ 	 */
+ 	skb_set_owner_w(nskb, sk);
+ 
+-	/* The 'obsolete' field of dst is set to 2 when a dst is freed. */
+-	if (!dst || (dst->obsolete > 1)) {
+-		dst_release(dst);
++	if (!sctp_transport_dst_check(tp)) {
+ 		sctp_transport_route(tp, NULL, sctp_sk(sk));
+ 		if (asoc && (asoc->param_flags & SPP_PMTUD_ENABLE)) {
+ 			sctp_assoc_sync_pmtu(asoc);
+diff --git a/net/sctp/transport.c b/net/sctp/transport.c
+index 394c57c..8da4481 100644
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -226,23 +226,6 @@ void sctp_transport_pmtu(struct sctp_transport *transport, struct sock *sk)
+ 		transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
+ }
+ 
+-/* this is a complete rip-off from __sk_dst_check
+- * the cookie is always 0 since this is how it's used in the
+- * pmtu code
+- */
+-static struct dst_entry *sctp_transport_dst_check(struct sctp_transport *t)
+-{
+-	struct dst_entry *dst = t->dst;
+-
+-	if (dst && dst->obsolete && dst->ops->check(dst, 0) == NULL) {
+-		dst_release(t->dst);
+-		t->dst = NULL;
+-		return NULL;
+-	}
+-
+-	return dst;
+-}
+-
+ void sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
+ {
+ 	struct dst_entry *dst;
diff --git a/queue-3.2/series b/queue-3.2/series
index 39b4b1c..765146a 100644
--- a/queue-3.2/series
+++ b/queue-3.2/series
@@ -52,3 +52,25 @@ drm-ttm-fix-spinlock-imbalance.patch
 drm-vmwgfx-fix-nasty-write-past-alloced-memory-area.patch
 mtd-of_parts-fix-breakage-in-kconfig.patch
 fec_mpc52xx-fix-timestamp-filtering.patch
+bluetooth-btusb-add-vendor-specific-id-0a5c-21f3-for-bcm20702a0.patch
+bluetooth-btusb-add-support-for-bcm20702a0.patch
+bluetooth-btusb-add-usb-device-id-0a5c-21e8.patch
+bluetooth-btusb-typo-in-broadcom-softsailing-id.patch
+bluetooth-btusb-add-vendor-specific-id-0489-e042-for-bcm20702a0.patch
+bluetooth-add-support-for-atheros.patch
+bluetooth-add-support-for-ar3012.patch
+add-foxconn-hon-hai-ids-for-btusb-module.patch
+bluetooth-add-support-for-foxconn-hon-hai-ar5bbu22-0489-e03c.patch
+drm-i915-disable-fbc-on-sandybridge.patch
+ipv4-do-not-use-dead-fib_info-entries.patch
+ipv4-fix-the-rcu-race-between-free_fib_info-and-ip_route_output_slow.patch
+set-fake_rtable-s-dst-to-null-to-avoid-kernel-oops.patch
+ipv6-fix-incorrect-ipsec-fragment.patch
+l2tp-fix-oops-in-l2tp-ip-sockets-for-connect-af_unspec-case.patch
+r8169-missing-barriers.patch
+r8169-fix-early-queue-wake-up.patch
+r8169-fix-unsigned-int-wraparound-with-tso.patch
+revert-net-maintain-namespace-isolation-between-vlan-and-real-device.patch
+sctp-check-cached-dst-before-using-it.patch
+skb-avoid-unnecessary-reallocations-in-__skb_cow.patch
+xfrm-take-net-hdr-len-into-account-for-esp-payload-size-calculation.patch
diff --git a/queue-3.2/set-fake_rtable-s-dst-to-null-to-avoid-kernel-oops.patch b/queue-3.2/set-fake_rtable-s-dst-to-null-to-avoid-kernel-oops.patch
new file mode 100644
index 0000000..1f387fd
--- /dev/null
+++ b/queue-3.2/set-fake_rtable-s-dst-to-null-to-avoid-kernel-oops.patch
@@ -0,0 +1,106 @@
+From: "Peter Huang (Peng)" <peter.huangpeng@huawei.com>
+Date: Thu, 19 Apr 2012 20:12:51 +0000
+Subject: set fake_rtable's dst to NULL to avoid kernel Oops
+
+[ Upstream commit a881e963c7fe1f226e991ee9bbe8907acda93294 ]
+
+bridge: set fake_rtable's dst to NULL to avoid kernel Oops
+
+when bridge is deleted before tap/vif device's delete, kernel may
+encounter an oops because of NULL reference to fake_rtable's dst.
+Set fake_rtable's dst to NULL before sending packets out can solve
+this problem.
+
+v4 reformat, change br_drop_fake_rtable(skb) to {}
+
+v3 enrich commit header
+
+v2 introducing new flag DST_FAKE_RTABLE to dst_entry struct.
+
+[ Use "do { } while (0)" for nop br_drop_fake_rtable()
+  implementation -DaveM ]
+
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Peter Huang <peter.huangpeng@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ include/linux/netfilter_bridge.h |    9 +++++++++
+ include/net/dst.h                |    1 +
+ net/bridge/br_forward.c          |    1 +
+ net/bridge/br_netfilter.c        |    8 ++------
+ 4 files changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
+index 0ddd161..31d2844 100644
+--- a/include/linux/netfilter_bridge.h
++++ b/include/linux/netfilter_bridge.h
+@@ -104,9 +104,18 @@ struct bridge_skb_cb {
+ 	} daddr;
+ };
+ 
++static inline void br_drop_fake_rtable(struct sk_buff *skb)
++{
++	struct dst_entry *dst = skb_dst(skb);
++
++	if (dst && (dst->flags & DST_FAKE_RTABLE))
++		skb_dst_drop(skb);
++}
++
+ #else
+ #define nf_bridge_maybe_copy_header(skb)	(0)
+ #define nf_bridge_pad(skb)			(0)
++#define br_drop_fake_rtable(skb)	        do { } while (0)
+ #endif /* CONFIG_BRIDGE_NETFILTER */
+ 
+ #endif /* __KERNEL__ */
+diff --git a/include/net/dst.h b/include/net/dst.h
+index 75766b4..65bca65 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -54,6 +54,7 @@ struct dst_entry {
+ #define DST_NOCACHE		0x0010
+ #define DST_NOCOUNT		0x0020
+ #define DST_NOPEER		0x0040
++#define DST_FAKE_RTABLE		0x0080
+ 
+ 	short			error;
+ 	short			obsolete;
+diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
+index ee64287..e221f88 100644
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -47,6 +47,7 @@ int br_dev_queue_push_xmit(struct sk_buff *skb)
+ 		kfree_skb(skb);
+ 	} else {
+ 		skb_push(skb, ETH_HLEN);
++		br_drop_fake_rtable(skb);
+ 		dev_queue_xmit(skb);
+ 	}
+ 
+diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
+index fa8b8f7..577ea5d 100644
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -147,7 +147,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
+ 	rt->dst.dev = br->dev;
+ 	rt->dst.path = &rt->dst;
+ 	dst_init_metrics(&rt->dst, br_dst_default_metrics, true);
+-	rt->dst.flags	= DST_NOXFRM | DST_NOPEER;
++	rt->dst.flags	= DST_NOXFRM | DST_NOPEER | DST_FAKE_RTABLE;
+ 	rt->dst.ops = &fake_dst_ops;
+ }
+ 
+@@ -687,11 +687,7 @@ static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
+ 				   const struct net_device *out,
+ 				   int (*okfn)(struct sk_buff *))
+ {
+-	struct rtable *rt = skb_rtable(skb);
+-
+-	if (rt && rt == bridge_parent_rtable(in))
+-		skb_dst_drop(skb);
+-
++	br_drop_fake_rtable(skb);
+ 	return NF_ACCEPT;
+ }
+ 
diff --git a/queue-3.2/skb-avoid-unnecessary-reallocations-in-__skb_cow.patch b/queue-3.2/skb-avoid-unnecessary-reallocations-in-__skb_cow.patch
new file mode 100644
index 0000000..22f556f
--- /dev/null
+++ b/queue-3.2/skb-avoid-unnecessary-reallocations-in-__skb_cow.patch
@@ -0,0 +1,38 @@
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 29 May 2012 03:35:08 +0000
+Subject: skb: avoid unnecessary reallocations in __skb_cow
+
+[ Upstream commit 617c8c11236716dcbda877e764b7bf37c6fd8063 ]
+
+At the beginning of __skb_cow, headroom gets set to a minimum of
+NET_SKB_PAD. This causes unnecessary reallocations if the buffer was not
+cloned and the headroom is just below NET_SKB_PAD, but still more than the
+amount requested by the caller.
+This was showing up frequently in my tests on VLAN tx, where
+vlan_insert_tag calls skb_cow_head(skb, VLAN_HLEN).
+
+Locally generated packets should have enough headroom, and for forward
+paths, we already have NET_SKB_PAD bytes of headroom, so we don't need to
+add any extra space here.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ include/linux/skbuff.h |    2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index e689b47..bdb4590 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1866,8 +1866,6 @@ static inline int __skb_cow(struct sk_buff *skb, unsigned int headroom,
+ {
+ 	int delta = 0;
+ 
+-	if (headroom < NET_SKB_PAD)
+-		headroom = NET_SKB_PAD;
+ 	if (headroom > skb_headroom(skb))
+ 		delta = headroom - skb_headroom(skb);
+ 
diff --git a/queue-3.2/xfrm-take-net-hdr-len-into-account-for-esp-payload-size-calculation.patch b/queue-3.2/xfrm-take-net-hdr-len-into-account-for-esp-payload-size-calculation.patch
new file mode 100644
index 0000000..846d01d
--- /dev/null
+++ b/queue-3.2/xfrm-take-net-hdr-len-into-account-for-esp-payload-size-calculation.patch
@@ -0,0 +1,95 @@
+From: Benjamin Poirier <bpoirier@suse.de>
+Date: Thu, 24 May 2012 11:32:38 +0000
+Subject: xfrm: take net hdr len into account for esp payload  size calculation
+
+[ Upstream commit 91657eafb64b4cb53ec3a2fbc4afc3497f735788 ]
+
+Corrects the function that determines the esp payload size. The calculations
+done in esp{4,6}_get_mtu() lead to overlength frames in transport mode for
+certain mtu values and suboptimal frames for others.
+
+According to what is done, mainly in esp{,6}_output() and tcp_mtu_to_mss(),
+net_header_len must be taken into account before doing the alignment
+calculation.
+
+Signed-off-by: Benjamin Poirier <bpoirier@suse.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv4/esp4.c |   24 +++++++++---------------
+ net/ipv6/esp6.c |   18 +++++++-----------
+ 2 files changed, 16 insertions(+), 26 deletions(-)
+
+diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
+index a5b4134..530787b 100644
+--- a/net/ipv4/esp4.c
++++ b/net/ipv4/esp4.c
+@@ -457,28 +457,22 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu)
+ 	struct esp_data *esp = x->data;
+ 	u32 blksize = ALIGN(crypto_aead_blocksize(esp->aead), 4);
+ 	u32 align = max_t(u32, blksize, esp->padlen);
+-	u32 rem;
+-
+-	mtu -= x->props.header_len + crypto_aead_authsize(esp->aead);
+-	rem = mtu & (align - 1);
+-	mtu &= ~(align - 1);
++	unsigned int net_adj;
+ 
+ 	switch (x->props.mode) {
+-	case XFRM_MODE_TUNNEL:
+-		break;
+-	default:
+ 	case XFRM_MODE_TRANSPORT:
+-		/* The worst case */
+-		mtu -= blksize - 4;
+-		mtu += min_t(u32, blksize - 4, rem);
+-		break;
+ 	case XFRM_MODE_BEET:
+-		/* The worst case. */
+-		mtu += min_t(u32, IPV4_BEET_PHMAXLEN, rem);
++		net_adj = sizeof(struct iphdr);
+ 		break;
++	case XFRM_MODE_TUNNEL:
++		net_adj = 0;
++		break;
++	default:
++		BUG();
+ 	}
+ 
+-	return mtu - 2;
++	return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
++		 net_adj) & ~(align - 1)) + (net_adj - 2);
+ }
+ 
+ static void esp4_err(struct sk_buff *skb, u32 info)
+diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
+index 1ac7938..65dd543 100644
+--- a/net/ipv6/esp6.c
++++ b/net/ipv6/esp6.c
+@@ -411,19 +411,15 @@ static u32 esp6_get_mtu(struct xfrm_state *x, int mtu)
+ 	struct esp_data *esp = x->data;
+ 	u32 blksize = ALIGN(crypto_aead_blocksize(esp->aead), 4);
+ 	u32 align = max_t(u32, blksize, esp->padlen);
+-	u32 rem;
++	unsigned int net_adj;
+ 
+-	mtu -= x->props.header_len + crypto_aead_authsize(esp->aead);
+-	rem = mtu & (align - 1);
+-	mtu &= ~(align - 1);
+-
+-	if (x->props.mode != XFRM_MODE_TUNNEL) {
+-		u32 padsize = ((blksize - 1) & 7) + 1;
+-		mtu -= blksize - padsize;
+-		mtu += min_t(u32, blksize - padsize, rem);
+-	}
++	if (x->props.mode != XFRM_MODE_TUNNEL)
++		net_adj = sizeof(struct ipv6hdr);
++	else
++		net_adj = 0;
+ 
+-	return mtu - 2;
++	return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
++		 net_adj) & ~(align - 1)) + (net_adj - 2);
+ }
+ 
+ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,