3.0 patches

27 files changed, 1965 insertions, 0 deletions

diff --git a/queue-3.0/alsa-snd-usb-accept-uac2-format_type-descriptors-with.patch b/queue-3.0/alsa-snd-usb-accept-uac2-format_type-descriptors-with.patch
new file mode 100644
index 0000000000..84f04dab29
--- /dev/null
+++ b/queue-3.0/alsa-snd-usb-accept-uac2-format_type-descriptors-with.patch
@@ -0,0 +1,34 @@
+From 824818b148db42173446707df4cbd61cd7133272 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Thu, 4 Aug 2011 16:17:42 +0200
+Subject: ALSA: snd-usb: Accept UAC2 FORMAT_TYPE descriptors with
+ bLength > 6
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 824818b148db42173446707df4cbd61cd7133272 upstream.
+
+The Focusrite Scarlett 18i6 USB has them that way, which is probably a
+bug. Anyway, the driver should simply ignore this fact.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-by: Nicolai Krakowiak <nicolai.krakowiak@gmail.com>
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/endpoint.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -352,7 +352,7 @@ int snd_usb_parse_audio_endpoints(struct
+ 			continue;
+ 		}
+ 		if (((protocol == UAC_VERSION_1) && (fmt->bLength < 8)) ||
+-		    ((protocol == UAC_VERSION_2) && (fmt->bLength != 6))) {
++		    ((protocol == UAC_VERSION_2) && (fmt->bLength < 6))) {
+ 			snd_printk(KERN_ERR "%d:%u:%d : invalid UAC_FORMAT_TYPE desc\n",
+ 				   dev->devnum, iface_no, altno);
+ 			continue;
diff --git a/queue-3.0/alsa-snd-usb-avoid-dividing-by-zero-on-invalid-input.patch b/queue-3.0/alsa-snd-usb-avoid-dividing-by-zero-on-invalid-input.patch
new file mode 100644
index 0000000000..7388600780
--- /dev/null
+++ b/queue-3.0/alsa-snd-usb-avoid-dividing-by-zero-on-invalid-input.patch
@@ -0,0 +1,33 @@
+From 60c961a9e1ed879a4d151df6076bf1203f595f73 Mon Sep 17 00:00:00 2001
+From: Nicolai Krakowiak <nicolai.krakowiak@gmail.com>
+Date: Thu, 4 Aug 2011 15:56:27 +0200
+Subject: ALSA: snd-usb: avoid dividing by zero on invalid input
+
+From: Nicolai Krakowiak <nicolai.krakowiak@gmail.com>
+
+commit 60c961a9e1ed879a4d151df6076bf1203f595f73 upstream.
+
+Signed-off-by: Nicolai Krakowiak <nicolai.krakowiak@gmail.com>
+Acked-by: Daniel Mack <zonque@gmail.com>
+Acked-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/mixer.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1191,6 +1191,11 @@ static int parse_audio_feature_unit(stru
+ 
+ 	if (state->mixer->protocol == UAC_VERSION_1) {
+ 		csize = hdr->bControlSize;
++		if (!csize) {
++			snd_printdd(KERN_ERR "usbaudio: unit %u: "
++				    "invalid bControlSize == 0\n", unitid);
++			return -EINVAL;
++		}
+ 		channels = (hdr->bLength - 7) / csize - 1;
+ 		bmaControls = hdr->bmaControls;
+ 	} else {
diff --git a/queue-3.0/alsa-snd-usb-caiaq-fix-keymap-for-rigkontrol3.patch b/queue-3.0/alsa-snd-usb-caiaq-fix-keymap-for-rigkontrol3.patch
new file mode 100644
index 0000000000..c1fd65de5a
--- /dev/null
+++ b/queue-3.0/alsa-snd-usb-caiaq-fix-keymap-for-rigkontrol3.patch
@@ -0,0 +1,29 @@
+From f4389489b5cbe60b3441869c68bb4afe760969c4 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Sat, 6 Aug 2011 09:13:08 +0200
+Subject: ALSA: snd-usb-caiaq: Fix keymap for RigKontrol3
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit f4389489b5cbe60b3441869c68bb4afe760969c4 upstream.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-by: Renato <naretobh@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/caiaq/input.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/caiaq/input.c
++++ b/sound/usb/caiaq/input.c
+@@ -30,7 +30,7 @@ static unsigned short keycode_ak1[] =  {
+ static unsigned short keycode_rk2[] =  { KEY_1, KEY_2, KEY_3, KEY_4,
+ 					 KEY_5, KEY_6, KEY_7 };
+ static unsigned short keycode_rk3[] =  { KEY_1, KEY_2, KEY_3, KEY_4,
+-					 KEY_5, KEY_6, KEY_7, KEY_5, KEY_6 };
++					 KEY_5, KEY_6, KEY_7, KEY_8, KEY_9 };
+ 
+ static unsigned short keycode_kore[] = {
+ 	KEY_FN_F1,      /* "menu"               */
diff --git a/queue-3.0/alsa-snd-usb-operate-on-given-mixer-interface-only.patch b/queue-3.0/alsa-snd-usb-operate-on-given-mixer-interface-only.patch
new file mode 100644
index 0000000000..718543fa47
--- /dev/null
+++ b/queue-3.0/alsa-snd-usb-operate-on-given-mixer-interface-only.patch
@@ -0,0 +1,105 @@
+From 1faa5d07a93fc5b0a4a5254fc940a79e20b55540 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Thu, 4 Aug 2011 15:56:28 +0200
+Subject: ALSA: snd-usb: operate on given mixer interface only
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit 1faa5d07a93fc5b0a4a5254fc940a79e20b55540 upstream.
+
+When creating the mixers for an USB audio device, the current code looks
+at the host interface stored in mixer->chip->ctrl_if. Change this and
+rather keep a local pointer to the interface that was given when
+snd_usb_create_mixer() was called.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-by: Nicolai Krakowiak <nicolai.krakowiak@gmail.com>
+Reported-by: Lean-Yves LENHOF <jean-yves@lenhof.eu.org>
+Acked-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/mixer.c |   20 ++++++++------------
+ sound/usb/mixer.h |    1 +
+ 2 files changed, 9 insertions(+), 12 deletions(-)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1939,15 +1939,13 @@ static int snd_usb_mixer_controls(struct
+ 	struct mixer_build state;
+ 	int err;
+ 	const struct usbmix_ctl_map *map;
+-	struct usb_host_interface *hostif;
+ 	void *p;
+ 
+-	hostif = mixer->chip->ctrl_intf;
+ 	memset(&state, 0, sizeof(state));
+ 	state.chip = mixer->chip;
+ 	state.mixer = mixer;
+-	state.buffer = hostif->extra;
+-	state.buflen = hostif->extralen;
++	state.buffer = mixer->hostif->extra;
++	state.buflen = mixer->hostif->extralen;
+ 
+ 	/* check the mapping table */
+ 	for (map = usbmix_ctl_maps; map->id; map++) {
+@@ -1960,7 +1958,8 @@ static int snd_usb_mixer_controls(struct
+ 	}
+ 
+ 	p = NULL;
+-	while ((p = snd_usb_find_csint_desc(hostif->extra, hostif->extralen, p, UAC_OUTPUT_TERMINAL)) != NULL) {
++	while ((p = snd_usb_find_csint_desc(mixer->hostif->extra, mixer->hostif->extralen,
++					    p, UAC_OUTPUT_TERMINAL)) != NULL) {
+ 		if (mixer->protocol == UAC_VERSION_1) {
+ 			struct uac1_output_terminal_descriptor *desc = p;
+ 
+@@ -2167,17 +2166,15 @@ int snd_usb_mixer_activate(struct usb_mi
+ /* create the handler for the optional status interrupt endpoint */
+ static int snd_usb_mixer_status_create(struct usb_mixer_interface *mixer)
+ {
+-	struct usb_host_interface *hostif;
+ 	struct usb_endpoint_descriptor *ep;
+ 	void *transfer_buffer;
+ 	int buffer_length;
+ 	unsigned int epnum;
+ 
+-	hostif = mixer->chip->ctrl_intf;
+ 	/* we need one interrupt input endpoint */
+-	if (get_iface_desc(hostif)->bNumEndpoints < 1)
++	if (get_iface_desc(mixer->hostif)->bNumEndpoints < 1)
+ 		return 0;
+-	ep = get_endpoint(hostif, 0);
++	ep = get_endpoint(mixer->hostif, 0);
+ 	if (!usb_endpoint_dir_in(ep) || !usb_endpoint_xfer_int(ep))
+ 		return 0;
+ 
+@@ -2207,7 +2204,6 @@ int snd_usb_create_mixer(struct snd_usb_
+ 	};
+ 	struct usb_mixer_interface *mixer;
+ 	struct snd_info_entry *entry;
+-	struct usb_host_interface *host_iface;
+ 	int err;
+ 
+ 	strcpy(chip->card->mixername, "USB Mixer");
+@@ -2224,8 +2220,8 @@ int snd_usb_create_mixer(struct snd_usb_
+ 		return -ENOMEM;
+ 	}
+ 
+-	host_iface = &usb_ifnum_to_if(chip->dev, ctrlif)->altsetting[0];
+-	switch (get_iface_desc(host_iface)->bInterfaceProtocol) {
++	mixer->hostif = &usb_ifnum_to_if(chip->dev, ctrlif)->altsetting[0];
++	switch (get_iface_desc(mixer->hostif)->bInterfaceProtocol) {
+ 	case UAC_VERSION_1:
+ 	default:
+ 		mixer->protocol = UAC_VERSION_1;
+--- a/sound/usb/mixer.h
++++ b/sound/usb/mixer.h
+@@ -3,6 +3,7 @@
+ 
+ struct usb_mixer_interface {
+ 	struct snd_usb_audio *chip;
++	struct usb_host_interface *hostif;
+ 	struct list_head list;
+ 	unsigned int ignore_ctl_error;
+ 	struct urb *urb;
diff --git a/queue-3.0/alsa-timer-fix-oops-at-closing-slave-timer.patch b/queue-3.0/alsa-timer-fix-oops-at-closing-slave-timer.patch
new file mode 100644
index 0000000000..1001cd0a9a
--- /dev/null
+++ b/queue-3.0/alsa-timer-fix-oops-at-closing-slave-timer.patch
@@ -0,0 +1,33 @@
+From 0584ffa548b6e59aceb027112f23a55f0133400e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 8 Aug 2011 12:24:46 +0200
+Subject: ALSA: timer - Fix Oops at closing slave timer
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0584ffa548b6e59aceb027112f23a55f0133400e upstream.
+
+A slave-timer instance has no timer reference, and this results in
+NULL-dereference at stopping the timer, typically called at closing
+the device.
+
+Reference: https://bugzilla.kernel.org/show_bug.cgi?id=40682
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/timer.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -531,6 +531,8 @@ int snd_timer_stop(struct snd_timer_inst
+ 	if (err < 0)
+ 		return err;
+ 	timer = timeri->timer;
++	if (!timer)
++		return -EINVAL;
+ 	spin_lock_irqsave(&timer->lock, flags);
+ 	timeri->cticks = timeri->ticks;
+ 	timeri->pticks = 0;
diff --git a/queue-3.0/asoc-sgtl5000-fix-cache-handling.patch b/queue-3.0/asoc-sgtl5000-fix-cache-handling.patch
new file mode 100644
index 0000000000..4636b336a5
--- /dev/null
+++ b/queue-3.0/asoc-sgtl5000-fix-cache-handling.patch
@@ -0,0 +1,217 @@
+From 151798f872d6b386d82cd1707ad703e981fef8f2 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <w.sang@pengutronix.de>
+Date: Tue, 2 Aug 2011 19:42:19 +0200
+Subject: ASoC: sgtl5000: fix cache handling
+
+From: Wolfram Sang <w.sang@pengutronix.de>
+
+commit 151798f872d6b386d82cd1707ad703e981fef8f2 upstream.
+
+Cache handling in this driver is broken. The chip has 16-bit registers, yet the
+register numbers also increase by 2 per register, i.e.  there are only
+even-numbered registers. The cache in this driver, though, simply increments
+register numbers, so it does need some mapping as seen in
+sgtl5000_restore_regs(), note the '>> 1':
+
+	snd_soc_write(codec, SGTL5000_CHIP_LINREG_CTRL,
+                        cache[SGTL5000_CHIP_LINREG_CTRL >> 1]);
+
+That, of course, won't work with snd_soc_update_bits(). (Thus, we won't even
+notice the missing register 0x1c in the default regs which shifted all follwing
+registers to wrong values.) Noticed on the MX28EVK where enabling the regulators
+simply locked up the chip.
+
+Refactor the routines and use a properly sized default_regs array which matches
+the register layout of the underlying chip, i.e. create a truly flat cache.
+This also saves some code which should make up for the bigger array a little.
+When soc-core will somewhen have another cache type which handles a step size,
+this conversion will also ease the transition.
+
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Tested-by: Dong Aisheng <b29396@freescale.com>
+Tested-by: Shawn Guo <shawn.guo@linaro.org>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/sgtl5000.c |  128 ++++++++++++--------------------------------
+ 1 file changed, 35 insertions(+), 93 deletions(-)
+
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -33,73 +33,31 @@
+ #define SGTL5000_DAP_REG_OFFSET	0x0100
+ #define SGTL5000_MAX_REG_OFFSET	0x013A
+ 
+-/* default value of sgtl5000 registers except DAP */
+-static const u16 sgtl5000_regs[SGTL5000_MAX_REG_OFFSET >> 1] =  {
+-	0xa011, /* 0x0000, CHIP_ID. 11 stand for revison 17 */
+-	0x0000, /* 0x0002, CHIP_DIG_POWER. */
+-	0x0008, /* 0x0004, CHIP_CKL_CTRL */
+-	0x0010, /* 0x0006, CHIP_I2S_CTRL */
+-	0x0000, /* 0x0008, reserved */
+-	0x0008, /* 0x000A, CHIP_SSS_CTRL */
+-	0x0000, /* 0x000C, reserved */
+-	0x020c, /* 0x000E, CHIP_ADCDAC_CTRL */
+-	0x3c3c, /* 0x0010, CHIP_DAC_VOL */
+-	0x0000, /* 0x0012, reserved */
+-	0x015f, /* 0x0014, CHIP_PAD_STRENGTH */
+-	0x0000, /* 0x0016, reserved */
+-	0x0000, /* 0x0018, reserved */
+-	0x0000, /* 0x001A, reserved */
+-	0x0000, /* 0x001E, reserved */
+-	0x0000, /* 0x0020, CHIP_ANA_ADC_CTRL */
+-	0x1818, /* 0x0022, CHIP_ANA_HP_CTRL */
+-	0x0111, /* 0x0024, CHIP_ANN_CTRL */
+-	0x0000, /* 0x0026, CHIP_LINREG_CTRL */
+-	0x0000, /* 0x0028, CHIP_REF_CTRL */
+-	0x0000, /* 0x002A, CHIP_MIC_CTRL */
+-	0x0000, /* 0x002C, CHIP_LINE_OUT_CTRL */
+-	0x0404, /* 0x002E, CHIP_LINE_OUT_VOL */
+-	0x7060, /* 0x0030, CHIP_ANA_POWER */
+-	0x5000, /* 0x0032, CHIP_PLL_CTRL */
+-	0x0000, /* 0x0034, CHIP_CLK_TOP_CTRL */
+-	0x0000, /* 0x0036, CHIP_ANA_STATUS */
+-	0x0000, /* 0x0038, reserved */
+-	0x0000, /* 0x003A, CHIP_ANA_TEST2 */
+-	0x0000, /* 0x003C, CHIP_SHORT_CTRL */
+-	0x0000, /* reserved */
+-};
+-
+-/* default value of dap registers */
+-static const u16 sgtl5000_dap_regs[] = {
+-	0x0000, /* 0x0100, DAP_CONTROL */
+-	0x0000, /* 0x0102, DAP_PEQ */
+-	0x0040, /* 0x0104, DAP_BASS_ENHANCE */
+-	0x051f, /* 0x0106, DAP_BASS_ENHANCE_CTRL */
+-	0x0000, /* 0x0108, DAP_AUDIO_EQ */
+-	0x0040, /* 0x010A, DAP_SGTL_SURROUND */
+-	0x0000, /* 0x010C, DAP_FILTER_COEF_ACCESS */
+-	0x0000, /* 0x010E, DAP_COEF_WR_B0_MSB */
+-	0x0000, /* 0x0110, DAP_COEF_WR_B0_LSB */
+-	0x0000, /* 0x0112, reserved */
+-	0x0000, /* 0x0114, reserved */
+-	0x002f, /* 0x0116, DAP_AUDIO_EQ_BASS_BAND0 */
+-	0x002f, /* 0x0118, DAP_AUDIO_EQ_BAND0 */
+-	0x002f, /* 0x011A, DAP_AUDIO_EQ_BAND2 */
+-	0x002f, /* 0x011C, DAP_AUDIO_EQ_BAND3 */
+-	0x002f, /* 0x011E, DAP_AUDIO_EQ_TREBLE_BAND4 */
+-	0x8000, /* 0x0120, DAP_MAIN_CHAN */
+-	0x0000, /* 0x0122, DAP_MIX_CHAN */
+-	0x0510, /* 0x0124, DAP_AVC_CTRL */
+-	0x1473, /* 0x0126, DAP_AVC_THRESHOLD */
+-	0x0028, /* 0x0128, DAP_AVC_ATTACK */
+-	0x0050, /* 0x012A, DAP_AVC_DECAY */
+-	0x0000, /* 0x012C, DAP_COEF_WR_B1_MSB */
+-	0x0000, /* 0x012E, DAP_COEF_WR_B1_LSB */
+-	0x0000, /* 0x0130, DAP_COEF_WR_B2_MSB */
+-	0x0000, /* 0x0132, DAP_COEF_WR_B2_LSB */
+-	0x0000, /* 0x0134, DAP_COEF_WR_A1_MSB */
+-	0x0000, /* 0x0136, DAP_COEF_WR_A1_LSB */
+-	0x0000, /* 0x0138, DAP_COEF_WR_A2_MSB */
+-	0x0000, /* 0x013A, DAP_COEF_WR_A2_LSB */
++/* default value of sgtl5000 registers */
++static const u16 sgtl5000_regs[SGTL5000_MAX_REG_OFFSET] =  {
++	[SGTL5000_CHIP_CLK_CTRL] = 0x0008,
++	[SGTL5000_CHIP_I2S_CTRL] = 0x0010,
++	[SGTL5000_CHIP_SSS_CTRL] = 0x0008,
++	[SGTL5000_CHIP_DAC_VOL] = 0x3c3c,
++	[SGTL5000_CHIP_PAD_STRENGTH] = 0x015f,
++	[SGTL5000_CHIP_ANA_HP_CTRL] = 0x1818,
++	[SGTL5000_CHIP_ANA_CTRL] = 0x0111,
++	[SGTL5000_CHIP_LINE_OUT_VOL] = 0x0404,
++	[SGTL5000_CHIP_ANA_POWER] = 0x7060,
++	[SGTL5000_CHIP_PLL_CTRL] = 0x5000,
++	[SGTL5000_DAP_BASS_ENHANCE] = 0x0040,
++	[SGTL5000_DAP_BASS_ENHANCE_CTRL] = 0x051f,
++	[SGTL5000_DAP_SURROUND] = 0x0040,
++	[SGTL5000_DAP_EQ_BASS_BAND0] = 0x002f,
++	[SGTL5000_DAP_EQ_BASS_BAND1] = 0x002f,
++	[SGTL5000_DAP_EQ_BASS_BAND2] = 0x002f,
++	[SGTL5000_DAP_EQ_BASS_BAND3] = 0x002f,
++	[SGTL5000_DAP_EQ_BASS_BAND4] = 0x002f,
++	[SGTL5000_DAP_MAIN_CHAN] = 0x8000,
++	[SGTL5000_DAP_AVC_CTRL] = 0x0510,
++	[SGTL5000_DAP_AVC_THRESHOLD] = 0x1473,
++	[SGTL5000_DAP_AVC_ATTACK] = 0x0028,
++	[SGTL5000_DAP_AVC_DECAY] = 0x0050,
+ };
+ 
+ /* regulator supplies for sgtl5000, VDDD is an optional external supply */
+@@ -1022,12 +980,10 @@ static int sgtl5000_suspend(struct snd_s
+ static int sgtl5000_restore_regs(struct snd_soc_codec *codec)
+ {
+ 	u16 *cache = codec->reg_cache;
+-	int i;
+-	int regular_regs = SGTL5000_CHIP_SHORT_CTRL >> 1;
++	u16 reg;
+ 
+ 	/* restore regular registers */
+-	for (i = 0; i < regular_regs; i++) {
+-		int reg = i << 1;
++	for (reg = 0; reg <= SGTL5000_CHIP_SHORT_CTRL; reg += 2) {
+ 
+ 		/* this regs depends on the others */
+ 		if (reg == SGTL5000_CHIP_ANA_POWER ||
+@@ -1037,35 +993,31 @@ static int sgtl5000_restore_regs(struct
+ 			reg == SGTL5000_CHIP_CLK_CTRL)
+ 			continue;
+ 
+-		snd_soc_write(codec, reg, cache[i]);
++		snd_soc_write(codec, reg, cache[reg]);
+ 	}
+ 
+ 	/* restore dap registers */
+-	for (i = SGTL5000_DAP_REG_OFFSET >> 1;
+-			i < SGTL5000_MAX_REG_OFFSET >> 1; i++) {
+-		int reg = i << 1;
+-
+-		snd_soc_write(codec, reg, cache[i]);
+-	}
++	for (reg = SGTL5000_DAP_REG_OFFSET; reg < SGTL5000_MAX_REG_OFFSET; reg += 2)
++		snd_soc_write(codec, reg, cache[reg]);
+ 
+ 	/*
+ 	 * restore power and other regs according
+ 	 * to set_power() and set_clock()
+ 	 */
+ 	snd_soc_write(codec, SGTL5000_CHIP_LINREG_CTRL,
+-			cache[SGTL5000_CHIP_LINREG_CTRL >> 1]);
++			cache[SGTL5000_CHIP_LINREG_CTRL]);
+ 
+ 	snd_soc_write(codec, SGTL5000_CHIP_ANA_POWER,
+-			cache[SGTL5000_CHIP_ANA_POWER >> 1]);
++			cache[SGTL5000_CHIP_ANA_POWER]);
+ 
+ 	snd_soc_write(codec, SGTL5000_CHIP_CLK_CTRL,
+-			cache[SGTL5000_CHIP_CLK_CTRL >> 1]);
++			cache[SGTL5000_CHIP_CLK_CTRL]);
+ 
+ 	snd_soc_write(codec, SGTL5000_CHIP_REF_CTRL,
+-			cache[SGTL5000_CHIP_REF_CTRL >> 1]);
++			cache[SGTL5000_CHIP_REF_CTRL]);
+ 
+ 	snd_soc_write(codec, SGTL5000_CHIP_LINE_OUT_CTRL,
+-			cache[SGTL5000_CHIP_LINE_OUT_CTRL >> 1]);
++			cache[SGTL5000_CHIP_LINE_OUT_CTRL]);
+ 	return 0;
+ }
+ 
+@@ -1460,16 +1412,6 @@ static __devinit int sgtl5000_i2c_probe(
+ 	if (!sgtl5000)
+ 		return -ENOMEM;
+ 
+-	/*
+-	 * copy DAP default values to default value array.
+-	 * sgtl5000 register space has a big hole, merge it
+-	 * at init phase makes life easy.
+-	 * FIXME: should we drop 'const' of sgtl5000_regs?
+-	 */
+-	memcpy((void *)(&sgtl5000_regs[0] + (SGTL5000_DAP_REG_OFFSET >> 1)),
+-			sgtl5000_dap_regs,
+-			SGTL5000_MAX_REG_OFFSET - SGTL5000_DAP_REG_OFFSET);
+-
+ 	i2c_set_clientdata(client, sgtl5000);
+ 
+ 	ret = snd_soc_register_codec(&client->dev,
diff --git a/queue-3.0/bonding-fix-string-comparison-errors.patch b/queue-3.0/bonding-fix-string-comparison-errors.patch
new file mode 100644
index 0000000000..2e43f9e09c
--- /dev/null
+++ b/queue-3.0/bonding-fix-string-comparison-errors.patch
@@ -0,0 +1,214 @@
+From 536a63b9c920404eb6a5b22fed00a8a61d409523 Mon Sep 17 00:00:00 2001
+From: Andy Gospodarek <andy@greyhouse.net>
+Date: Tue, 26 Jul 2011 11:12:27 +0000
+Subject: bonding: fix string comparison errors
+
+
+From: Andy Gospodarek <andy@greyhouse.net>
+
+[ Upstream commit f4bb2e9c4fa9e5fdddf90589703613fd1a9c519f ]
+
+When a bond contains a device where one name is the subset of another
+(eth1 and eth10, for example), one cannot properly set the primary
+device or the currently active device.
+
+This was reported and based on work by Takuma Umeya.  I also verified
+the problem and tested that this fix resolves it.
+
+V2: A few did not like the the current code or my changes, so I
+refactored bonding_store_primary and bonding_store_active_slave to be a
+bit cleaner, dropped the use of strnicmp since we did not really need
+the comparison to be case insensitive, and formatted the input string
+from sysfs so a comparison to IFNAMSIZ could be used.
+
+I also discovered an error in bonding_store_active_slave that would
+modify bond->primary_slave rather than bond->curr_active_slave before
+forcing the bonding driver to choose a new active slave.
+
+V3: Actually sending the proper patch....
+
+Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
+Reported-by: Takuma Umeya <tumeya@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/bonding/bond_sysfs.c |  133 ++++++++++++++++++++-------------------
+ 1 file changed, 71 insertions(+), 62 deletions(-)
+
+--- a/drivers/net/bonding/bond_sysfs.c
++++ b/drivers/net/bonding/bond_sysfs.c
+@@ -992,6 +992,7 @@ static ssize_t bonding_store_primary(str
+ 	int i;
+ 	struct slave *slave;
+ 	struct bonding *bond = to_bond(d);
++	char ifname[IFNAMSIZ];
+ 
+ 	if (!rtnl_trylock())
+ 		return restart_syscall();
+@@ -1002,32 +1003,33 @@ static ssize_t bonding_store_primary(str
+ 	if (!USES_PRIMARY(bond->params.mode)) {
+ 		pr_info("%s: Unable to set primary slave; %s is in mode %d\n",
+ 			bond->dev->name, bond->dev->name, bond->params.mode);
+-	} else {
+-		bond_for_each_slave(bond, slave, i) {
+-			if (strnicmp
+-			    (slave->dev->name, buf,
+-			     strlen(slave->dev->name)) == 0) {
+-				pr_info("%s: Setting %s as primary slave.\n",
+-					bond->dev->name, slave->dev->name);
+-				bond->primary_slave = slave;
+-				strcpy(bond->params.primary, slave->dev->name);
+-				bond_select_active_slave(bond);
+-				goto out;
+-			}
+-		}
++		goto out;
++	}
+ 
+-		/* if we got here, then we didn't match the name of any slave */
++	sscanf(buf, "%16s", ifname); /* IFNAMSIZ */
+ 
+-		if (strlen(buf) == 0 || buf[0] == '\n') {
+-			pr_info("%s: Setting primary slave to None.\n",
+-				bond->dev->name);
+-			bond->primary_slave = NULL;
+-				bond_select_active_slave(bond);
+-		} else {
+-			pr_info("%s: Unable to set %.*s as primary slave as it is not a slave.\n",
+-				bond->dev->name, (int)strlen(buf) - 1, buf);
++	/* check to see if we are clearing primary */
++	if (!strlen(ifname) || buf[0] == '\n') {
++		pr_info("%s: Setting primary slave to None.\n",
++			bond->dev->name);
++		bond->primary_slave = NULL;
++		bond_select_active_slave(bond);
++		goto out;
++	}
++
++	bond_for_each_slave(bond, slave, i) {
++		if (strncmp(slave->dev->name, ifname, IFNAMSIZ) == 0) {
++			pr_info("%s: Setting %s as primary slave.\n",
++				bond->dev->name, slave->dev->name);
++			bond->primary_slave = slave;
++			strcpy(bond->params.primary, slave->dev->name);
++			bond_select_active_slave(bond);
++			goto out;
+ 		}
+ 	}
++
++	pr_info("%s: Unable to set %.*s as primary slave.\n",
++		bond->dev->name, (int)strlen(buf) - 1, buf);
+ out:
+ 	write_unlock_bh(&bond->curr_slave_lock);
+ 	read_unlock(&bond->lock);
+@@ -1162,6 +1164,7 @@ static ssize_t bonding_store_active_slav
+ 	struct slave *old_active = NULL;
+ 	struct slave *new_active = NULL;
+ 	struct bonding *bond = to_bond(d);
++	char ifname[IFNAMSIZ];
+ 
+ 	if (!rtnl_trylock())
+ 		return restart_syscall();
+@@ -1170,56 +1173,62 @@ static ssize_t bonding_store_active_slav
+ 	read_lock(&bond->lock);
+ 	write_lock_bh(&bond->curr_slave_lock);
+ 
+-	if (!USES_PRIMARY(bond->params.mode))
++	if (!USES_PRIMARY(bond->params.mode)) {
+ 		pr_info("%s: Unable to change active slave; %s is in mode %d\n",
+ 			bond->dev->name, bond->dev->name, bond->params.mode);
+-	else {
+-		bond_for_each_slave(bond, slave, i) {
+-			if (strnicmp
+-			    (slave->dev->name, buf,
+-			     strlen(slave->dev->name)) == 0) {
+-        			old_active = bond->curr_active_slave;
+-        			new_active = slave;
+-        			if (new_active == old_active) {
+-					/* do nothing */
+-					pr_info("%s: %s is already the current active slave.\n",
++		goto out;
++	}
++
++	sscanf(buf, "%16s", ifname); /* IFNAMSIZ */
++
++	/* check to see if we are clearing active */
++	if (!strlen(ifname) || buf[0] == '\n') {
++		pr_info("%s: Clearing current active slave.\n",
++			bond->dev->name);
++		bond->curr_active_slave = NULL;
++		bond_select_active_slave(bond);
++		goto out;
++	}
++
++	bond_for_each_slave(bond, slave, i) {
++		if (strncmp(slave->dev->name, ifname, IFNAMSIZ) == 0) {
++			old_active = bond->curr_active_slave;
++			new_active = slave;
++			if (new_active == old_active) {
++				/* do nothing */
++				pr_info("%s: %s is already the current"
++					" active slave.\n",
++					bond->dev->name,
++					slave->dev->name);
++				goto out;
++			}
++			else {
++				if ((new_active) &&
++				    (old_active) &&
++				    (new_active->link == BOND_LINK_UP) &&
++				    IS_UP(new_active->dev)) {
++					pr_info("%s: Setting %s as active"
++						" slave.\n",
+ 						bond->dev->name,
+ 						slave->dev->name);
+-					goto out;
++					bond_change_active_slave(bond,
++								 new_active);
+ 				}
+ 				else {
+-        				if ((new_active) &&
+-            				    (old_active) &&
+-				            (new_active->link == BOND_LINK_UP) &&
+-				            IS_UP(new_active->dev)) {
+-						pr_info("%s: Setting %s as active slave.\n",
+-							bond->dev->name,
+-							slave->dev->name);
+-							bond_change_active_slave(bond, new_active);
+-        				}
+-					else {
+-						pr_info("%s: Could not set %s as active slave; either %s is down or the link is down.\n",
+-							bond->dev->name,
+-							slave->dev->name,
+-							slave->dev->name);
+-					}
+-					goto out;
++					pr_info("%s: Could not set %s as"
++						" active slave; either %s is"
++						" down or the link is down.\n",
++						bond->dev->name,
++						slave->dev->name,
++						slave->dev->name);
+ 				}
++				goto out;
+ 			}
+ 		}
+-
+-		/* if we got here, then we didn't match the name of any slave */
+-
+-		if (strlen(buf) == 0 || buf[0] == '\n') {
+-			pr_info("%s: Setting active slave to None.\n",
+-				bond->dev->name);
+-			bond->primary_slave = NULL;
+-			bond_select_active_slave(bond);
+-		} else {
+-			pr_info("%s: Unable to set %.*s as active slave as it is not a slave.\n",
+-				bond->dev->name, (int)strlen(buf) - 1, buf);
+-		}
+ 	}
++
++	pr_info("%s: Unable to set %.*s as active slave.\n",
++		bond->dev->name, (int)strlen(buf) - 1, buf);
+  out:
+ 	write_unlock_bh(&bond->curr_slave_lock);
+ 	read_unlock(&bond->lock);
diff --git a/queue-3.0/drivers-net-niu.c-adjust-array-index.patch b/queue-3.0/drivers-net-niu.c-adjust-array-index.patch
new file mode 100644
index 0000000000..a81f1af629
--- /dev/null
+++ b/queue-3.0/drivers-net-niu.c-adjust-array-index.patch
@@ -0,0 +1,55 @@
+From 88782afb511c8b96184855b252b11a14f2e82702 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Thu, 28 Jul 2011 02:46:03 +0000
+Subject: drivers/net/niu.c: adjust array index
+
+
+From: Julia Lawall <julia@diku.dk>
+
+[ Upstream commit 956837f7c954443f426a82ba6f17b33488cf9a0c ]
+
+Convert array index from the loop bound to the loop index.
+
+A simplified version of the semantic patch that fixes this problem is as
+follows: (http://coccinelle.lip6.fr/)
+
+// <smpl>
+@@
+expression e1,e2,ar;
+@@
+
+for(e1 = 0; e1 < e2; e1++) { <...
+  ar[
+- e2
++ e1
+  ]
+  ...> }
+// </smpl>
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/niu.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/niu.c
++++ b/drivers/net/niu.c
+@@ -9196,7 +9196,7 @@ static int __devinit niu_ldg_init(struct
+ 
+ 	first_chan = 0;
+ 	for (i = 0; i < port; i++)
+-		first_chan += parent->rxchan_per_port[port];
++		first_chan += parent->rxchan_per_port[i];
+ 	num_chan = parent->rxchan_per_port[port];
+ 
+ 	for (i = first_chan; i < (first_chan + num_chan); i++) {
+@@ -9212,7 +9212,7 @@ static int __devinit niu_ldg_init(struct
+ 
+ 	first_chan = 0;
+ 	for (i = 0; i < port; i++)
+-		first_chan += parent->txchan_per_port[port];
++		first_chan += parent->txchan_per_port[i];
+ 	num_chan = parent->txchan_per_port[port];
+ 	for (i = first_chan; i < (first_chan + num_chan); i++) {
+ 		err = niu_ldg_assign_ldn(np, parent,
diff --git a/queue-3.0/fix-cdc-phonet-build.patch b/queue-3.0/fix-cdc-phonet-build.patch
new file mode 100644
index 0000000000..f2950d60d1
--- /dev/null
+++ b/queue-3.0/fix-cdc-phonet-build.patch
@@ -0,0 +1,39 @@
+From af999891230336f7ffbe750d6b8262749693a52e Mon Sep 17 00:00:00 2001
+From: Chris Clayton <chris2553@googlemail.com>
+Date: Tue, 26 Jul 2011 12:20:22 +0000
+Subject: Fix cdc-phonet build
+
+
+From: Chris Clayton <chris2553@googlemail.com>
+
+[ Upstream commit a0295a3b6775ab88f5883684e14bbda8d287822d ]
+
+Try to send to correct address this time!
+
+----------  Forwarded Message  ----------
+
+Subject: [PATCH] Fix cdc-phonet build
+Date: Saturday 23 Jul 2011
+From: Chris Clayton <chris2553@googlemail.com>
+To: linux-net@vger.kernel.org
+
+cdc-phonet does not presently build on linux-3.0 because there is no entry for it in
+drivers/net/Makefile. This patch adds that entry.
+
+Signed-off-by: Chris Clayton <chris2553@googlemail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/Makefile |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -283,6 +283,7 @@ obj-$(CONFIG_USB_HSO)		+= usb/
+ obj-$(CONFIG_USB_USBNET)        += usb/
+ obj-$(CONFIG_USB_ZD1201)        += usb/
+ obj-$(CONFIG_USB_IPHETH)        += usb/
++obj-$(CONFIG_USB_CDC_PHONET)   += usb/
+ 
+ obj-$(CONFIG_WLAN) += wireless/
+ obj-$(CONFIG_NET_TULIP) += tulip/
diff --git a/queue-3.0/gre-fix-improper-error-handling.patch b/queue-3.0/gre-fix-improper-error-handling.patch
new file mode 100644
index 0000000000..9a0c7d0ebc
--- /dev/null
+++ b/queue-3.0/gre-fix-improper-error-handling.patch
@@ -0,0 +1,64 @@
+From b2be55e21dd28aecd96e8476fc9e9a0e18e33c52 Mon Sep 17 00:00:00 2001
+From: "xeb@mail.ru" <xeb@mail.ru>
+Date: Fri, 22 Jul 2011 20:49:40 +0000
+Subject: gre: fix improper error handling
+
+
+From: "xeb@mail.ru" <xeb@mail.ru>
+
+[ Upstream commit 559fafb94ad9e4cd8774f39241917c57396f9fc5 ]
+
+Fix improper protocol err_handler, current implementation is fully
+unapplicable and may cause kernel crash due to double kfree_skb.
+
+Signed-off-by: Dmitry Kozlov <xeb@mail.ru>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/gre.c |   21 ++++++---------------
+ 1 file changed, 6 insertions(+), 15 deletions(-)
+
+--- a/net/ipv4/gre.c
++++ b/net/ipv4/gre.c
+@@ -15,6 +15,7 @@
+ #include <linux/kmod.h>
+ #include <linux/skbuff.h>
+ #include <linux/in.h>
++#include <linux/ip.h>
+ #include <linux/netdevice.h>
+ #include <linux/version.h>
+ #include <linux/spinlock.h>
+@@ -97,27 +98,17 @@ drop:
+ static void gre_err(struct sk_buff *skb, u32 info)
+ {
+ 	const struct gre_protocol *proto;
+-	u8 ver;
+-
+-	if (!pskb_may_pull(skb, 12))
+-		goto drop;
++	const struct iphdr *iph = (const struct iphdr *)skb->data;
++	u8 ver = skb->data[(iph->ihl<<2) + 1]&0x7f;
+ 
+-	ver = skb->data[1]&0x7f;
+ 	if (ver >= GREPROTO_MAX)
+-		goto drop;
++		return;
+ 
+ 	rcu_read_lock();
+ 	proto = rcu_dereference(gre_proto[ver]);
+-	if (!proto || !proto->err_handler)
+-		goto drop_unlock;
+-	proto->err_handler(skb, info);
+-	rcu_read_unlock();
+-	return;
+-
+-drop_unlock:
++	if (proto && proto->err_handler)
++		proto->err_handler(skb, info);
+ 	rcu_read_unlock();
+-drop:
+-	kfree_skb(skb);
+ }
+ 
+ static const struct net_protocol net_gre_protocol = {
diff --git a/queue-3.0/icmp-fix-regression-in-nexthop-resolution-during-replies.patch b/queue-3.0/icmp-fix-regression-in-nexthop-resolution-during-replies.patch
new file mode 100644
index 0000000000..9b202c1a4b
--- /dev/null
+++ b/queue-3.0/icmp-fix-regression-in-nexthop-resolution-during-replies.patch
@@ -0,0 +1,79 @@
+From c867a9d829b436ca130d08c04d7c1e549e263366 Mon Sep 17 00:00:00 2001
+From: "David S. Miller" <davem@davemloft.net>
+Date: Fri, 22 Jul 2011 06:22:10 -0700
+Subject: icmp: Fix regression in nexthop resolution during replies.
+
+
+From: "David S. Miller" <davem@davemloft.net>
+
+[ Upstream commit 415b3334a21aa67806c52d1acf4e72e14f7f402f ]
+
+icmp_route_lookup() uses the wrong flow parameters if the reverse
+session route lookup isn't used.
+
+So do not commit to the re-decoded flow until we actually make a
+final decision to use a real route saved in 'rt2'.
+
+Reported-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/icmp.c |   14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -380,6 +380,7 @@ static struct rtable *icmp_route_lookup(
+ 					struct icmp_bxm *param)
+ {
+ 	struct rtable *rt, *rt2;
++	struct flowi4 fl4_dec;
+ 	int err;
+ 
+ 	memset(fl4, 0, sizeof(*fl4));
+@@ -408,19 +409,19 @@ static struct rtable *icmp_route_lookup(
+ 	} else
+ 		return rt;
+ 
+-	err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(fl4), AF_INET);
++	err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(&fl4_dec), AF_INET);
+ 	if (err)
+ 		goto relookup_failed;
+ 
+-	if (inet_addr_type(net, fl4->saddr) == RTN_LOCAL) {
+-		rt2 = __ip_route_output_key(net, fl4);
++	if (inet_addr_type(net, fl4_dec.saddr) == RTN_LOCAL) {
++		rt2 = __ip_route_output_key(net, &fl4_dec);
+ 		if (IS_ERR(rt2))
+ 			err = PTR_ERR(rt2);
+ 	} else {
+ 		struct flowi4 fl4_2 = {};
+ 		unsigned long orefdst;
+ 
+-		fl4_2.daddr = fl4->saddr;
++		fl4_2.daddr = fl4_dec.saddr;
+ 		rt2 = ip_route_output_key(net, &fl4_2);
+ 		if (IS_ERR(rt2)) {
+ 			err = PTR_ERR(rt2);
+@@ -428,7 +429,7 @@ static struct rtable *icmp_route_lookup(
+ 		}
+ 		/* Ugh! */
+ 		orefdst = skb_in->_skb_refdst; /* save old refdst */
+-		err = ip_route_input(skb_in, fl4->daddr, fl4->saddr,
++		err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
+ 				     RT_TOS(tos), rt2->dst.dev);
+ 
+ 		dst_release(&rt2->dst);
+@@ -440,10 +441,11 @@ static struct rtable *icmp_route_lookup(
+ 		goto relookup_failed;
+ 
+ 	rt2 = (struct rtable *) xfrm_lookup(net, &rt2->dst,
+-					    flowi4_to_flowi(fl4), NULL,
++					    flowi4_to_flowi(&fl4_dec), NULL,
+ 					    XFRM_LOOKUP_ICMP);
+ 	if (!IS_ERR(rt2)) {
+ 		dst_release(&rt->dst);
++		memcpy(fl4, &fl4_dec, sizeof(*fl4));
+ 		rt = rt2;
+ 	} else if (PTR_ERR(rt2) == -EPERM) {
+ 		if (rt)
diff --git a/queue-3.0/ipv4-constrain-ufo-fragment-sizes-to-multiples-of-8-bytes.patch b/queue-3.0/ipv4-constrain-ufo-fragment-sizes-to-multiples-of-8-bytes.patch
new file mode 100644
index 0000000000..d06d8866d3
--- /dev/null
+++ b/queue-3.0/ipv4-constrain-ufo-fragment-sizes-to-multiples-of-8-bytes.patch
@@ -0,0 +1,53 @@
+From b08c1401e8fbcce60be44a623bcf9d04af3ce2e9 Mon Sep 17 00:00:00 2001
+From: Bill Sommerfeld <wsommerfeld@google.com>
+Date: Tue, 19 Jul 2011 15:22:33 +0000
+Subject: ipv4: Constrain UFO fragment sizes to multiples of 8 bytes
+
+
+From: Bill Sommerfeld <wsommerfeld@google.com>
+
+[ Upstream commit d9be4f7a6f5a8da3133b832eca41c3591420b1ca ]
+
+Because the ip fragment offset field counts 8-byte chunks, ip
+fragments other than the last must contain a multiple of 8 bytes of
+payload.  ip_ufo_append_data wasn't respecting this constraint and,
+depending on the MTU and ip option sizes, could create malformed
+non-final fragments.
+
+Google-Bug-Id: 5009328
+Signed-off-by: Bill Sommerfeld <wsommerfeld@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/ip_output.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -734,7 +734,7 @@ static inline int ip_ufo_append_data(str
+ 			int getfrag(void *from, char *to, int offset, int len,
+ 			       int odd, struct sk_buff *skb),
+ 			void *from, int length, int hh_len, int fragheaderlen,
+-			int transhdrlen, int mtu, unsigned int flags)
++			int transhdrlen, int maxfraglen, unsigned int flags)
+ {
+ 	struct sk_buff *skb;
+ 	int err;
+@@ -767,7 +767,7 @@ static inline int ip_ufo_append_data(str
+ 		skb->csum = 0;
+ 
+ 		/* specify the length of each IP datagram fragment */
+-		skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
++		skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen;
+ 		skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+ 		__skb_queue_tail(queue, skb);
+ 	}
+@@ -831,7 +831,7 @@ static int __ip_append_data(struct sock
+ 	    (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
+ 		err = ip_ufo_append_data(sk, queue, getfrag, from, length,
+ 					 hh_len, fragheaderlen, transhdrlen,
+-					 mtu, flags);
++					 maxfraglen, flags);
+ 		if (err)
+ 			goto error;
+ 		return 0;
diff --git a/queue-3.0/ipv4-fix-the-reusing-of-routing-cache-entries.patch b/queue-3.0/ipv4-fix-the-reusing-of-routing-cache-entries.patch
new file mode 100644
index 0000000000..a12874dcfc
--- /dev/null
+++ b/queue-3.0/ipv4-fix-the-reusing-of-routing-cache-entries.patch
@@ -0,0 +1,52 @@
+From d3ba761a87bad091b5d4d0f6d6c3f5bbcc574c40 Mon Sep 17 00:00:00 2001
+From: Julian Anastasov <ja@ssi.bg>
+Date: Sun, 7 Aug 2011 22:20:20 -0700
+Subject: ipv4: fix the reusing of routing cache entries
+
+
+From: Julian Anastasov <ja@ssi.bg>
+
+[ Upstream commit d547f727df86059104af2234804fdd538e112015 ]
+
+	compare_keys and ip_route_input_common rely on
+rt_oif for distinguishing of input and output routes
+with same keys values. But sometimes the input route has
+also same hash chain (keyed by iif != 0) with the output
+routes (keyed by orig_oif=0). Problem visible if running
+with small number of rhash_entries.
+
+	Fix them to use rt_route_iif instead. By this way
+input route can not be returned to users that request
+output route.
+
+	The patch fixes the ip_rt_bug errors that were
+reported in ip_local_out context, mostly for 255.255.255.255
+destinations.
+
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/route.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -726,6 +726,7 @@ static inline int compare_keys(struct rt
+ 		((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
+ 		(rt1->rt_mark ^ rt2->rt_mark) |
+ 		(rt1->rt_key_tos ^ rt2->rt_key_tos) |
++		(rt1->rt_route_iif ^ rt2->rt_route_iif) |
+ 		(rt1->rt_oif ^ rt2->rt_oif) |
+ 		(rt1->rt_iif ^ rt2->rt_iif)) == 0;
+ }
+@@ -2282,8 +2283,8 @@ int ip_route_input_common(struct sk_buff
+ 		if ((((__force u32)rth->rt_key_dst ^ (__force u32)daddr) |
+ 		     ((__force u32)rth->rt_key_src ^ (__force u32)saddr) |
+ 		     (rth->rt_iif ^ iif) |
+-		     rth->rt_oif |
+ 		     (rth->rt_key_tos ^ tos)) == 0 &&
++		    rt_is_input_route(rth) &&
+ 		    rth->rt_mark == skb->mark &&
+ 		    net_eq(dev_net(rth->dst.dev), net) &&
+ 		    !rt_is_expired(rth)) {
diff --git a/queue-3.0/ipv4-send-gratuitous-arp-for-secondary-ip-addresses-also.patch b/queue-3.0/ipv4-send-gratuitous-arp-for-secondary-ip-addresses-also.patch
new file mode 100644
index 0000000000..9ef97731e7
--- /dev/null
+++ b/queue-3.0/ipv4-send-gratuitous-arp-for-secondary-ip-addresses-also.patch
@@ -0,0 +1,47 @@
+From 4e1b1e9f8de331f87c4ea9dfe97861edf2026207 Mon Sep 17 00:00:00 2001
+From: Zoltan Kiss <schaman@sch.bme.hu>
+Date: Sun, 24 Jul 2011 13:09:30 +0000
+Subject: IPv4: Send gratuitous ARP for secondary IP addresses also
+
+
+From: Zoltan Kiss <schaman@sch.bme.hu>
+
+[ Upstream commit b76d0789c92a816a5539dc14232a700b8d62a53a ]
+
+If a device event generates gratuitous ARP messages, only primary
+address is used for sending. This patch iterates through the whole
+list. Tested with 2 IP addresses configuration on bonding interface.
+
+Signed-off-by: Zoltan Kiss <schaman@sch.bme.hu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/devinet.c |   16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -1134,15 +1134,15 @@ static void inetdev_send_gratuitous_arp(
+ 					struct in_device *in_dev)
+ 
+ {
+-	struct in_ifaddr *ifa = in_dev->ifa_list;
++	struct in_ifaddr *ifa;
+ 
+-	if (!ifa)
+-		return;
+-
+-	arp_send(ARPOP_REQUEST, ETH_P_ARP,
+-		 ifa->ifa_local, dev,
+-		 ifa->ifa_local, NULL,
+-		 dev->dev_addr, NULL);
++	for (ifa = in_dev->ifa_list; ifa;
++	     ifa = ifa->ifa_next) {
++		arp_send(ARPOP_REQUEST, ETH_P_ARP,
++			 ifa->ifa_local, dev,
++			 ifa->ifa_local, NULL,
++			 dev->dev_addr, NULL);
++	}
+ }
+ 
+ /* Called only under RTNL semaphore */
diff --git a/queue-3.0/ipv4-use-rt_tos-after-some-rt_tos-conversions.patch b/queue-3.0/ipv4-use-rt_tos-after-some-rt_tos-conversions.patch
new file mode 100644
index 0000000000..cb6af3bb6f
--- /dev/null
+++ b/queue-3.0/ipv4-use-rt_tos-after-some-rt_tos-conversions.patch
@@ -0,0 +1,42 @@
+From 47a3bfdef3c4ba58f04d978c9480b057bedd4624 Mon Sep 17 00:00:00 2001
+From: Julian Anastasov <ja@ssi.bg>
+Date: Sat, 23 Jul 2011 02:00:41 +0000
+Subject: ipv4: use RT_TOS after some rt_tos conversions
+
+
+From: Julian Anastasov <ja@ssi.bg>
+
+[ Upstream commit b0fe4a31849063fcac0bdc93716ca92615e93f57 ]
+
+rt_tos was changed to iph->tos but it must be filtered by RT_TOS
+
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/ipmr.c  |    2 +-
+ net/ipv4/route.c |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1796,7 +1796,7 @@ static struct mr_table *ipmr_rt_fib_look
+ 	struct flowi4 fl4 = {
+ 		.daddr = iph->daddr,
+ 		.saddr = iph->saddr,
+-		.flowi4_tos = iph->tos,
++		.flowi4_tos = RT_TOS(iph->tos),
+ 		.flowi4_oif = rt->rt_oif,
+ 		.flowi4_iif = rt->rt_iif,
+ 		.flowi4_mark = rt->rt_mark,
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1705,7 +1705,7 @@ void ip_rt_get_source(u8 *addr, struct s
+ 		memset(&fl4, 0, sizeof(fl4));
+ 		fl4.daddr = iph->daddr;
+ 		fl4.saddr = iph->saddr;
+-		fl4.flowi4_tos = iph->tos;
++		fl4.flowi4_tos = RT_TOS(iph->tos);
+ 		fl4.flowi4_oif = rt->dst.dev->ifindex;
+ 		fl4.flowi4_iif = skb->dev->ifindex;
+ 		fl4.flowi4_mark = skb->mark;
diff --git a/queue-3.0/ipv6-make-fragment-identifications-less-predictable.patch b/queue-3.0/ipv6-make-fragment-identifications-less-predictable.patch
new file mode 100644
index 0000000000..e03358be0b
--- /dev/null
+++ b/queue-3.0/ipv6-make-fragment-identifications-less-predictable.patch
@@ -0,0 +1,172 @@
+From d8d972876c51f7344367414bef3682bcf97e4e87 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Mon, 8 Aug 2011 23:44:00 -0700
+Subject: ipv6: make fragment identifications less predictable
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Backport of upstream commit 87c48fa3b4630905f98268dde838ee43626a060c ]
+
+Fernando Gont reported current IPv6 fragment identification generation
+was not secure, because using a very predictable system-wide generator,
+allowing various attacks.
+
+IPv4 uses inetpeer cache to address this problem and to get good
+performance. We'll use this mechanism when IPv6 inetpeer is stable
+enough in linux-3.1
+
+For the time being, we use jhash on destination address to provide less
+predictable identifications. Also remove a spinlock and use cmpxchg() to
+get better SMP performance.
+
+Reported-by: Fernando Gont <fernando@gont.com.ar>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/net/ipv6.h      |   12 +-----------
+ include/net/transp_v6.h |    2 ++
+ net/ipv6/af_inet6.c     |    2 ++
+ net/ipv6/ip6_output.c   |   40 +++++++++++++++++++++++++++++++++++-----
+ net/ipv6/udp.c          |    2 +-
+ 5 files changed, 41 insertions(+), 17 deletions(-)
+
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -463,17 +463,7 @@ static inline int ipv6_addr_diff(const s
+ 	return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
+ }
+ 
+-static __inline__ void ipv6_select_ident(struct frag_hdr *fhdr)
+-{
+-	static u32 ipv6_fragmentation_id = 1;
+-	static DEFINE_SPINLOCK(ip6_id_lock);
+-
+-	spin_lock_bh(&ip6_id_lock);
+-	fhdr->identification = htonl(ipv6_fragmentation_id);
+-	if (++ipv6_fragmentation_id == 0)
+-		ipv6_fragmentation_id = 1;
+-	spin_unlock_bh(&ip6_id_lock);
+-}
++extern void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
+ 
+ /*
+  *	Prototypes exported by ipv6
+--- a/include/net/transp_v6.h
++++ b/include/net/transp_v6.h
+@@ -14,6 +14,8 @@ extern struct proto tcpv6_prot;
+ 
+ struct flowi6;
+ 
++extern void initialize_hashidentrnd(void);
++
+ /* extension headers */
+ extern int				ipv6_exthdrs_init(void);
+ extern void				ipv6_exthdrs_exit(void);
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -1078,6 +1078,8 @@ static int __init inet6_init(void)
+ 		goto out;
+ 	}
+ 
++	initialize_hashidentrnd();
++
+ 	err = proto_register(&tcpv6_prot, 1);
+ 	if (err)
+ 		goto out;
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -596,6 +596,35 @@ int ip6_find_1stfragopt(struct sk_buff *
+ 	return offset;
+ }
+ 
++static u32 hashidentrnd __read_mostly;
++#define FID_HASH_SZ 16
++static u32 ipv6_fragmentation_id[FID_HASH_SZ];
++
++void __init initialize_hashidentrnd(void)
++{
++	get_random_bytes(&hashidentrnd, sizeof(hashidentrnd));
++}
++
++static u32 __ipv6_select_ident(const struct in6_addr *addr)
++{
++	u32 newid, oldid, hash = jhash2((u32 *)addr, 4, hashidentrnd);
++	u32 *pid = &ipv6_fragmentation_id[hash % FID_HASH_SZ];
++
++	do {
++		oldid = *pid;
++		newid = oldid + 1;
++		if (!(hash + newid))
++			newid++;
++	} while (cmpxchg(pid, oldid, newid) != oldid);
++
++	return hash + newid;
++}
++
++void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
++{
++	fhdr->identification = htonl(__ipv6_select_ident(&rt->rt6i_dst.addr));
++}
++
+ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+ {
+ 	struct sk_buff *frag;
+@@ -680,7 +709,7 @@ int ip6_fragment(struct sk_buff *skb, in
+ 		skb_reset_network_header(skb);
+ 		memcpy(skb_network_header(skb), tmp_hdr, hlen);
+ 
+-		ipv6_select_ident(fh);
++		ipv6_select_ident(fh, rt);
+ 		fh->nexthdr = nexthdr;
+ 		fh->reserved = 0;
+ 		fh->frag_off = htons(IP6_MF);
+@@ -826,7 +855,7 @@ slow_path:
+ 		fh->nexthdr = nexthdr;
+ 		fh->reserved = 0;
+ 		if (!frag_id) {
+-			ipv6_select_ident(fh);
++			ipv6_select_ident(fh, rt);
+ 			frag_id = fh->identification;
+ 		} else
+ 			fh->identification = frag_id;
+@@ -1072,7 +1101,8 @@ static inline int ip6_ufo_append_data(st
+ 			int getfrag(void *from, char *to, int offset, int len,
+ 			int odd, struct sk_buff *skb),
+ 			void *from, int length, int hh_len, int fragheaderlen,
+-			int transhdrlen, int mtu,unsigned int flags)
++			int transhdrlen, int mtu,unsigned int flags,
++			struct rt6_info *rt)
+ 
+ {
+ 	struct sk_buff *skb;
+@@ -1116,7 +1146,7 @@ static inline int ip6_ufo_append_data(st
+ 		skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
+ 					     sizeof(struct frag_hdr)) & ~7;
+ 		skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+-		ipv6_select_ident(&fhdr);
++		ipv6_select_ident(&fhdr, rt);
+ 		skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
+ 		__skb_queue_tail(&sk->sk_write_queue, skb);
+ 
+@@ -1282,7 +1312,7 @@ int ip6_append_data(struct sock *sk, int
+ 
+ 			err = ip6_ufo_append_data(sk, getfrag, from, length,
+ 						  hh_len, fragheaderlen,
+-						  transhdrlen, mtu, flags);
++						  transhdrlen, mtu, flags, rt);
+ 			if (err)
+ 				goto error;
+ 			return 0;
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1359,7 +1359,7 @@ static struct sk_buff *udp6_ufo_fragment
+ 	fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
+ 	fptr->nexthdr = nexthdr;
+ 	fptr->reserved = 0;
+-	ipv6_select_ident(fptr);
++	ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
+ 
+ 	/* Fragment the skb. ipv6 header and the remaining fields of the
+ 	 * fragment header are updated in ipv6_gso_segment()
diff --git a/queue-3.0/ipvs-free-resources-on-module-removal.patch b/queue-3.0/ipvs-free-resources-on-module-removal.patch
new file mode 100644
index 0000000000..eaaafefc1c
--- /dev/null
+++ b/queue-3.0/ipvs-free-resources-on-module-removal.patch
@@ -0,0 +1,31 @@
+From 84ea121d5ffa4706af3c36da25401c87c27d6841 Mon Sep 17 00:00:00 2001
+From: Simon Horman <horms@verge.net.au>
+Date: Thu, 19 May 2011 21:32:57 +0900
+Subject: IPVS: Free resources on module removal
+
+
+From: Simon Horman <horms@verge.net.au>
+
+[ Upstream commit 7676e345824f162191b1fe2058ad948a6cf91c20 ]
+
+This resolves a panic on module removal.
+
+Reported-by: Dave Jones <davej@redhat.com>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Hans Schillstrom <hans.schillstrom@ericsson.com>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/netfilter/ipvs/ip_vs_ctl.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -3771,6 +3771,7 @@ err_sock:
+ void ip_vs_control_cleanup(void)
+ {
+ 	EnterFunction(2);
++	unregister_netdevice_notifier(&ip_vs_dst_notifier);
+ 	ip_vs_genl_unregister();
+ 	nf_unregister_sockopt(&ip_vs_sockopts);
+ 	LeaveFunction(2);
diff --git a/queue-3.0/iwlagn-5000-do-not-support-idle-mode.patch b/queue-3.0/iwlagn-5000-do-not-support-idle-mode.patch
new file mode 100644
index 0000000000..ac739dd755
--- /dev/null
+++ b/queue-3.0/iwlagn-5000-do-not-support-idle-mode.patch
@@ -0,0 +1,77 @@
+From djpohly@gmail.com  Tue Aug  9 09:40:10 2011
+From: "Devin J. Pohly" <djpohly@gmail.com>
+Date: Mon,  8 Aug 2011 20:53:58 -0600
+Subject: iwlagn: 5000 do not support idle mode
+To: gregkh@suse.de
+Cc: stable@kernel.org, "Devin J. Pohly" <djpohly+iwl@gmail.com>, Wey-Yi Guy <wey-yi.w.guy@intel.com>, "John W. Linville" <linville@tuxdriver.com>
+Message-ID: <1312858438-5080-1-git-send-email-djpohly@gmail.com>
+
+
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+
+commit f35291082294ca6737953bbe4e9491ede04ab822 upstream.
+
+5000 series has issue supporting power save idle mode:
+commit	9dc2153315650eae220898668b6aa56a25c130be
+
+iwlwifi: always support idle mode for agn devices
+
+For agn devices, always support idle mode which help power
+consumption in idle unassociated state.
+
+the above changes cause 5000 become not stable when power management is "on"
+
+http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2312
+
+Reported-by: Devin J. Pohly <djpohly+iwl@gmail.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Devin J. Pohly <djpohly+iwl@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-5000.c  |    1 +
+ drivers/net/wireless/iwlwifi/iwl-core.h  |    2 ++
+ drivers/net/wireless/iwlwifi/iwl-power.c |    3 ++-
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -421,6 +421,7 @@ static struct iwl_base_params iwl5000_ba
+ 	.chain_noise_scale = 1000,
+ 	.wd_timeout = IWL_LONG_WD_TIMEOUT,
+ 	.max_event_log_size = 512,
++	.no_idle_support = true,
+ };
+ static struct iwl_ht_params iwl5000_ht_params = {
+ 	.ht_greenfield_support = true,
+--- a/drivers/net/wireless/iwlwifi/iwl-core.h
++++ b/drivers/net/wireless/iwlwifi/iwl-core.h
+@@ -195,6 +195,7 @@ struct iwl_mod_params {
+  * @temperature_kelvin: temperature report by uCode in kelvin
+  * @max_event_log_size: size of event log buffer size for ucode event logging
+  * @shadow_reg_enable: HW shadhow register bit
++ * @no_idle_support: do not support idle mode
+  */
+ struct iwl_base_params {
+ 	int eeprom_size;
+@@ -216,6 +217,7 @@ struct iwl_base_params {
+ 	bool temperature_kelvin;
+ 	u32 max_event_log_size;
+ 	const bool shadow_reg_enable;
++	const bool no_idle_support;
+ };
+ /*
+  * @advanced_bt_coexist: support advanced bt coexist
+--- a/drivers/net/wireless/iwlwifi/iwl-power.c
++++ b/drivers/net/wireless/iwlwifi/iwl-power.c
+@@ -355,7 +355,8 @@ static void iwl_power_build_cmd(struct i
+ 
+ 	dtimper = priv->hw->conf.ps_dtim_period ?: 1;
+ 
+-	if (priv->hw->conf.flags & IEEE80211_CONF_IDLE)
++	if (!priv->cfg->base_params->no_idle_support &&
++		 priv->hw->conf.flags & IEEE80211_CONF_IDLE)
+ 		iwl_static_sleep_cmd(priv, cmd, IWL_POWER_INDEX_5, 20);
+ 	else if (iwl_tt_is_low_power_state(priv)) {
+ 		/* in thermal throttling low power state */
diff --git a/queue-3.0/net-add-iff_skb_tx_shared-flag-to-priv_flags.patch b/queue-3.0/net-add-iff_skb_tx_shared-flag-to-priv_flags.patch
new file mode 100644
index 0000000000..004be589e1
--- /dev/null
+++ b/queue-3.0/net-add-iff_skb_tx_shared-flag-to-priv_flags.patch
@@ -0,0 +1,91 @@
+From 4c113d38b468faf67ae1558600328154f4ed885e Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Tue, 26 Jul 2011 06:05:37 +0000
+Subject: net: add IFF_SKB_TX_SHARED flag to priv_flags
+
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+[ Upstream commit d8873315065f1f527c7c380402cf59b1e1d0ae36 ]
+
+Pktgen attempts to transmit shared skbs to net devices, which can't be used by
+some drivers as they keep state information in skbs.  This patch adds a flag
+marking drivers as being able to handle shared skbs in their tx path.  Drivers
+are defaulted to being unable to do so, but calling ether_setup enables this
+flag, as 90% of the drivers calling ether_setup touch real hardware and can
+handle shared skbs.  A subsequent patch will audit drivers to ensure that the
+flag is set properly
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+Reported-by: Jiri Pirko <jpirko@redhat.com>
+CC: Robert Olsson <robert.olsson@its.uu.se>
+CC: Eric Dumazet <eric.dumazet@gmail.com>
+CC: Alexey Dobriyan <adobriyan@gmail.com>
+CC: David S. Miller <davem@davemloft.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/linux/if.h |    2 ++
+ net/core/pktgen.c  |    8 +++++---
+ net/ethernet/eth.c |    1 +
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+--- a/include/linux/if.h
++++ b/include/linux/if.h
+@@ -76,6 +76,8 @@
+ #define IFF_BRIDGE_PORT	0x4000		/* device used as bridge port */
+ #define IFF_OVS_DATAPATH	0x8000	/* device used as Open vSwitch
+ 					 * datapath port */
++#define IFF_TX_SKB_SHARING	0x10000	/* The interface supports sharing
++					 * skbs on transmit */
+ 
+ #define IF_GET_IFACE	0x0001		/* for querying only */
+ #define IF_GET_PROTO	0x0002
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -1070,7 +1070,9 @@ static ssize_t pktgen_if_write(struct fi
+ 		len = num_arg(&user_buffer[i], 10, &value);
+ 		if (len < 0)
+ 			return len;
+-
++		if ((value > 0) &&
++		    (!(pkt_dev->odev->priv_flags & IFF_TX_SKB_SHARING)))
++			return -ENOTSUPP;
+ 		i += len;
+ 		pkt_dev->clone_skb = value;
+ 
+@@ -3555,7 +3557,6 @@ static int pktgen_add_device(struct pktg
+ 	pkt_dev->min_pkt_size = ETH_ZLEN;
+ 	pkt_dev->max_pkt_size = ETH_ZLEN;
+ 	pkt_dev->nfrags = 0;
+-	pkt_dev->clone_skb = pg_clone_skb_d;
+ 	pkt_dev->delay = pg_delay_d;
+ 	pkt_dev->count = pg_count_d;
+ 	pkt_dev->sofar = 0;
+@@ -3563,7 +3564,6 @@ static int pktgen_add_device(struct pktg
+ 	pkt_dev->udp_src_max = 9;
+ 	pkt_dev->udp_dst_min = 9;
+ 	pkt_dev->udp_dst_max = 9;
+-
+ 	pkt_dev->vlan_p = 0;
+ 	pkt_dev->vlan_cfi = 0;
+ 	pkt_dev->vlan_id = 0xffff;
+@@ -3575,6 +3575,8 @@ static int pktgen_add_device(struct pktg
+ 	err = pktgen_setup_dev(pkt_dev, ifname);
+ 	if (err)
+ 		goto out1;
++	if (pkt_dev->odev->priv_flags & IFF_TX_SKB_SHARING)
++		pkt_dev->clone_skb = pg_clone_skb_d;
+ 
+ 	pkt_dev->entry = proc_create_data(ifname, 0600, pg_proc_dir,
+ 					  &pktgen_if_fops, pkt_dev);
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -340,6 +340,7 @@ void ether_setup(struct net_device *dev)
+ 	dev->addr_len		= ETH_ALEN;
+ 	dev->tx_queue_len	= 1000;	/* Ethernet wants good queues */
+ 	dev->flags		= IFF_BROADCAST|IFF_MULTICAST;
++	dev->priv_flags		= IFF_TX_SKB_SHARING;
+ 
+ 	memset(dev->broadcast, 0xFF, ETH_ALEN);
+ 
diff --git a/queue-3.0/net-adjust-array-index.patch b/queue-3.0/net-adjust-array-index.patch
new file mode 100644
index 0000000000..009dd544a3
--- /dev/null
+++ b/queue-3.0/net-adjust-array-index.patch
@@ -0,0 +1,46 @@
+From 04e29aa354a1cf4eee37d0ce32ed3d3399188230 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Thu, 28 Jul 2011 02:46:01 +0000
+Subject: net: adjust array index
+
+
+From: Julia Lawall <julia@diku.dk>
+
+[ Upstream commit a1889c0d2039a53ae04abb9f20c62500bd312bf3 ]
+
+Convert array index from the loop bound to the loop index.
+
+A simplified version of the semantic patch that fixes this problem is as
+follows: (http://coccinelle.lip6.fr/)
+
+// <smpl>
+@@
+expression e1,e2,ar;
+@@
+
+for(e1 = 0; e1 < e2; e1++) { <...
+  ar[
+- e2
++ e1
+  ]
+  ...> }
+// </smpl>
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/igmp.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -1718,7 +1718,7 @@ static int ip_mc_add_src(struct in_devic
+ 
+ 		pmc->sfcount[sfmode]--;
+ 		for (j=0; j<i; j++)
+-			(void) ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
++			(void) ip_mc_del1_src(pmc, sfmode, &psfsrc[j]);
+ 	} else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
+ #ifdef CONFIG_IP_MULTICAST
+ 		struct ip_sf_list *psf;
diff --git a/queue-3.0/net-allow-netif_carrier-to-be-called-safely-from-irq.patch b/queue-3.0/net-allow-netif_carrier-to-be-called-safely-from-irq.patch
new file mode 100644
index 0000000000..7f97d78087
--- /dev/null
+++ b/queue-3.0/net-allow-netif_carrier-to-be-called-safely-from-irq.patch
@@ -0,0 +1,43 @@
+From 38be383d73917e4ea2d5676104037742e50c1e64 Mon Sep 17 00:00:00 2001
+From: stephen hemminger <shemminger@vyatta.com>
+Date: Fri, 22 Jul 2011 12:53:56 +0000
+Subject: net: allow netif_carrier to be called safely from IRQ
+
+
+From: stephen hemminger <shemminger@vyatta.com>
+
+[ Upstream commit 1821f7cd65ad9ea56580b830ac79bf4c4fef59cb ]
+
+As reported by Ben Greer and Froncois Romieu. The code path in
+the netif_carrier code leads it to try and disable
+a late workqueue to reenable it immediately
+netif_carrier_on
+-> linkwatch_fire_event
+   -> linkwatch_schedule_work
+      -> cancel_delayed_work
+         -> del_timer_sync
+
+If __cancel_delayed_work is used instead then there is no
+problem of waiting for running linkwatch_event.
+
+There is a race between linkwatch_event running re-scheduling
+but it is harmless to schedule an extra scan of the linkwatch queue.
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/core/link_watch.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/core/link_watch.c
++++ b/net/core/link_watch.c
+@@ -126,7 +126,7 @@ static void linkwatch_schedule_work(int
+ 		return;
+ 
+ 	/* It's already running which is good enough. */
+-	if (!cancel_delayed_work(&linkwatch_work))
++	if (!__cancel_delayed_work(&linkwatch_work))
+ 		return;
+ 
+ 	/* Otherwise we reschedule it again for immediate execution. */
diff --git a/queue-3.0/net-audit-drivers-to-identify-those-needing-iff_tx_skb_sharing-cleared.patch b/queue-3.0/net-audit-drivers-to-identify-those-needing-iff_tx_skb_sharing-cleared.patch
new file mode 100644
index 0000000000..7c7d276f9c
--- /dev/null
+++ b/queue-3.0/net-audit-drivers-to-identify-those-needing-iff_tx_skb_sharing-cleared.patch
@@ -0,0 +1,213 @@
+From 6d256e78725e139eec48a4ec5286516b4458fd19 Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Tue, 26 Jul 2011 06:05:38 +0000
+Subject: net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared
+
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+[ Upstream commit 550fd08c2cebad61c548def135f67aba284c6162 ]
+
+After the last patch, We are left in a state in which only drivers calling
+ether_setup have IFF_TX_SKB_SHARING set (we assume that drivers touching real
+hardware call ether_setup for their net_devices and don't hold any state in
+their skbs.  There are a handful of drivers that violate this assumption of
+course, and need to be fixed up.  This patch identifies those drivers, and marks
+them as not being able to support the safe transmission of skbs by clearning the
+IFF_TX_SKB_SHARING flag in priv_flags
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+CC: Karsten Keil <isdn@linux-pingi.de>
+CC: "David S. Miller" <davem@davemloft.net>
+CC: Jay Vosburgh <fubar@us.ibm.com>
+CC: Andy Gospodarek <andy@greyhouse.net>
+CC: Patrick McHardy <kaber@trash.net>
+CC: Krzysztof Halasa <khc@pm.waw.pl>
+CC: "John W. Linville" <linville@tuxdriver.com>
+CC: Greg Kroah-Hartman <gregkh@suse.de>
+CC: Marcel Holtmann <marcel@holtmann.org>
+CC: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/isdn/i4l/isdn_net.c                  |    3 +++
+ drivers/net/bonding/bond_main.c              |    6 ++++--
+ drivers/net/ifb.c                            |    2 +-
+ drivers/net/macvlan.c                        |    2 +-
+ drivers/net/tun.c                            |    1 +
+ drivers/net/veth.c                           |    2 ++
+ drivers/net/wan/hdlc_fr.c                    |    5 +++--
+ drivers/net/wireless/airo.c                  |    1 +
+ drivers/net/wireless/hostap/hostap_main.c    |    1 +
+ drivers/staging/ath6kl/os/linux/ar6000_drv.c |    1 +
+ net/8021q/vlan_dev.c                         |    2 +-
+ net/bluetooth/bnep/netdev.c                  |    1 +
+ net/l2tp/l2tp_eth.c                          |    2 +-
+ net/mac80211/iface.c                         |    1 +
+ 14 files changed, 22 insertions(+), 8 deletions(-)
+
+--- a/drivers/isdn/i4l/isdn_net.c
++++ b/drivers/isdn/i4l/isdn_net.c
+@@ -2531,6 +2531,9 @@ static void _isdn_setup(struct net_devic
+ 
+ 	/* Setup the generic properties */
+ 	dev->flags = IFF_NOARP|IFF_POINTOPOINT;
++
++	/* isdn prepends a header in the tx path, can't share skbs */
++	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ 	dev->header_ops = NULL;
+ 	dev->netdev_ops = &isdn_netdev_ops;
+ 
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1625,8 +1625,10 @@ int bond_enslave(struct net_device *bond
+ 
+ 			if (slave_dev->type != ARPHRD_ETHER)
+ 				bond_setup_by_slave(bond_dev, slave_dev);
+-			else
++			else {
+ 				ether_setup(bond_dev);
++				bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING;
++			}
+ 
+ 			netdev_bonding_change(bond_dev,
+ 					      NETDEV_POST_TYPE_CHANGE);
+@@ -4398,7 +4400,7 @@ static void bond_setup(struct net_device
+ 	bond_dev->tx_queue_len = 0;
+ 	bond_dev->flags |= IFF_MASTER|IFF_MULTICAST;
+ 	bond_dev->priv_flags |= IFF_BONDING;
+-	bond_dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
++	bond_dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
+ 
+ 	/* At first, we block adding VLANs. That's the only way to
+ 	 * prevent problems that occur when adding VLANs over an
+--- a/drivers/net/ifb.c
++++ b/drivers/net/ifb.c
+@@ -145,7 +145,7 @@ static void ifb_setup(struct net_device
+ 
+ 	dev->flags |= IFF_NOARP;
+ 	dev->flags &= ~IFF_MULTICAST;
+-	dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
++	dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
+ 	random_ether_addr(dev->dev_addr);
+ }
+ 
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -547,7 +547,7 @@ void macvlan_common_setup(struct net_dev
+ {
+ 	ether_setup(dev);
+ 
+-	dev->priv_flags	       &= ~IFF_XMIT_DST_RELEASE;
++	dev->priv_flags	       &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
+ 	dev->netdev_ops		= &macvlan_netdev_ops;
+ 	dev->destructor		= free_netdev;
+ 	dev->header_ops		= &macvlan_hard_header_ops,
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -528,6 +528,7 @@ static void tun_net_init(struct net_devi
+ 		dev->netdev_ops = &tap_netdev_ops;
+ 		/* Ethernet TAP Device */
+ 		ether_setup(dev);
++		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ 
+ 		random_ether_addr(dev->dev_addr);
+ 
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -262,6 +262,8 @@ static void veth_setup(struct net_device
+ {
+ 	ether_setup(dev);
+ 
++	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
++
+ 	dev->netdev_ops = &veth_netdev_ops;
+ 	dev->ethtool_ops = &veth_ethtool_ops;
+ 	dev->features |= NETIF_F_LLTX;
+--- a/drivers/net/wan/hdlc_fr.c
++++ b/drivers/net/wan/hdlc_fr.c
+@@ -1083,9 +1083,10 @@ static int fr_add_pvc(struct net_device
+ 
+ 	used = pvc_is_used(pvc);
+ 
+-	if (type == ARPHRD_ETHER)
++	if (type == ARPHRD_ETHER) {
+ 		dev = alloc_netdev(0, "pvceth%d", ether_setup);
+-	else
++		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
++	} else
+ 		dev = alloc_netdev(0, "pvc%d", pvc_setup);
+ 
+ 	if (!dev) {
+--- a/drivers/net/wireless/airo.c
++++ b/drivers/net/wireless/airo.c
+@@ -2823,6 +2823,7 @@ static struct net_device *_init_airo_car
+ 	dev->wireless_data = &ai->wireless_data;
+ 	dev->irq = irq;
+ 	dev->base_addr = port;
++	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ 
+ 	SET_NETDEV_DEV(dev, dmdev);
+ 
+--- a/drivers/net/wireless/hostap/hostap_main.c
++++ b/drivers/net/wireless/hostap/hostap_main.c
+@@ -855,6 +855,7 @@ void hostap_setup_dev(struct net_device
+ 
+ 	iface = netdev_priv(dev);
+ 	ether_setup(dev);
++	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ 
+ 	/* kernel callbacks */
+ 	if (iface) {
+--- a/drivers/staging/ath6kl/os/linux/ar6000_drv.c
++++ b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
+@@ -6198,6 +6198,7 @@ int ar6000_create_ap_interface(struct ar
+     
+     ether_setup(dev);
+     init_netdev(dev, ap_ifname);
++    dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ 
+     if (register_netdev(dev)) {
+         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_create_ap_interface: register_netdev failed\n"));
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -694,7 +694,7 @@ void vlan_setup(struct net_device *dev)
+ 	ether_setup(dev);
+ 
+ 	dev->priv_flags		|= IFF_802_1Q_VLAN;
+-	dev->priv_flags		&= ~IFF_XMIT_DST_RELEASE;
++	dev->priv_flags		&= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
+ 	dev->tx_queue_len	= 0;
+ 
+ 	dev->netdev_ops		= &vlan_netdev_ops;
+--- a/net/bluetooth/bnep/netdev.c
++++ b/net/bluetooth/bnep/netdev.c
+@@ -231,6 +231,7 @@ void bnep_net_setup(struct net_device *d
+ 	dev->addr_len = ETH_ALEN;
+ 
+ 	ether_setup(dev);
++	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ 	dev->netdev_ops = &bnep_netdev_ops;
+ 
+ 	dev->watchdog_timeo  = HZ * 2;
+--- a/net/l2tp/l2tp_eth.c
++++ b/net/l2tp/l2tp_eth.c
+@@ -103,7 +103,7 @@ static struct net_device_ops l2tp_eth_ne
+ static void l2tp_eth_dev_setup(struct net_device *dev)
+ {
+ 	ether_setup(dev);
+-
++	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ 	dev->netdev_ops		= &l2tp_eth_netdev_ops;
+ 	dev->destructor		= free_netdev;
+ }
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -699,6 +699,7 @@ static const struct net_device_ops ieee8
+ static void ieee80211_if_setup(struct net_device *dev)
+ {
+ 	ether_setup(dev);
++	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ 	dev->netdev_ops = &ieee80211_dataif_ops;
+ 	dev->destructor = free_netdev;
+ }
diff --git a/queue-3.0/r8169-add-support-for-d-link-530t-rev-c1-kernel-bug-38862.patch b/queue-3.0/r8169-add-support-for-d-link-530t-rev-c1-kernel-bug-38862.patch
new file mode 100644
index 0000000000..f3d6031d7f
--- /dev/null
+++ b/queue-3.0/r8169-add-support-for-d-link-530t-rev-c1-kernel-bug-38862.patch
@@ -0,0 +1,38 @@
+From 57dabb02e0e44392886740d7e22cfb2854adf183 Mon Sep 17 00:00:00 2001
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+Date: Thu, 28 Jul 2011 13:18:11 +0000
+Subject: r8169: Add support for D-Link 530T rev C1 (Kernel Bug 38862)
+
+
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+
+[ Upstream commit 93a3aa25933461d76141179fc94aa32d5f9d954a ]
+
+The D-Link DGE-530T rev C1 is a re-badged Realtek 8169 named DLG10028C,
+unlike the previous revisions which were skge based.  It is probably
+the same as the discontinued DGE-528T (0x4300) other than the PCI ID.
+
+The PCI ID is 0x1186:0x4302.
+
+Adding it to r8169.c where 0x1186:0x4300 is already found makes the card
+be detected and work.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=38862
+
+Signed-off-by: Len Sorensen <lsorense@csclub.uwaterloo.ca>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/r8169.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -236,6 +236,7 @@ static DEFINE_PCI_DEVICE_TABLE(rtl8169_p
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8168), 0, 0, RTL_CFG_1 },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8169), 0, 0, RTL_CFG_0 },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_DLINK,	0x4300), 0, 0, RTL_CFG_0 },
++	{ PCI_DEVICE(PCI_VENDOR_ID_DLINK,	0x4302), 0, 0, RTL_CFG_0 },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AT,		0xc107), 0, 0, RTL_CFG_0 },
+ 	{ PCI_DEVICE(0x16ec,			0x0116), 0, 0, RTL_CFG_0 },
+ 	{ PCI_VENDOR_ID_LINKSYS,		0x1032,
diff --git a/queue-3.0/sch_sfq-fix-sfq_enqueue.patch b/queue-3.0/sch_sfq-fix-sfq_enqueue.patch
new file mode 100644
index 0000000000..9fc6138751
--- /dev/null
+++ b/queue-3.0/sch_sfq-fix-sfq_enqueue.patch
@@ -0,0 +1,46 @@
+From 97f750bd33b693c4a4a2ab4bdc2de4ee675d8372 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Fri, 29 Jul 2011 19:22:42 +0000
+Subject: sch_sfq: fix sfq_enqueue()
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit e1738bd9cecc5c867b0e2996470c1ff20f66ba79 ]
+
+commit 8efa88540635 (sch_sfq: avoid giving spurious NET_XMIT_CN signals)
+forgot to call qdisc_tree_decrease_qlen() to signal upper levels that a
+packet (from another flow) was dropped, leading to various problems.
+
+With help from Michal Soltys and Michal Pokrywka, who did a bisection.
+
+Bugzilla ref: https://bugzilla.kernel.org/show_bug.cgi?id=39372
+Debian ref: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631945
+
+Reported-by: Lucas Bocchi <lucas.bocchi@gmail.com>
+Reported-and-bisected-by: Michal Pokrywka <wolfmoon@o2.pl>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+CC: Michal Soltys <soltys@ziu.info>
+Acked-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/sched/sch_sfq.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -410,7 +410,12 @@ sfq_enqueue(struct sk_buff *skb, struct
+ 	/* Return Congestion Notification only if we dropped a packet
+ 	 * from this flow.
+ 	 */
+-	return (qlen != slot->qlen) ? NET_XMIT_CN : NET_XMIT_SUCCESS;
++	if (qlen != slot->qlen)
++		return NET_XMIT_CN;
++
++	/* As we dropped a packet, better let upper stack know this */
++	qdisc_tree_decrease_qlen(sch, 1);
++	return NET_XMIT_SUCCESS;
+ }
+ 
+ static struct sk_buff *
diff --git a/queue-3.0/series b/queue-3.0/series
index db17ca545a..a8aa60c4f6 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -33,3 +33,29 @@ asus-wmi-return-proper-value-in-store_cpufv.patch
 cifs-fix-missing-a-decrement-of-inflight-value.patch
 cifs-cope-with-negative-dentries-in-cifs_get_root.patch
 cifs-convert-prefixpath-delimiters-in.patch
+asoc-sgtl5000-fix-cache-handling.patch
+alsa-timer-fix-oops-at-closing-slave-timer.patch
+alsa-snd-usb-caiaq-fix-keymap-for-rigkontrol3.patch
+alsa-snd-usb-avoid-dividing-by-zero-on-invalid-input.patch
+alsa-snd-usb-operate-on-given-mixer-interface-only.patch
+alsa-snd-usb-accept-uac2-format_type-descriptors-with.patch
+ipv6-make-fragment-identifications-less-predictable.patch
+icmp-fix-regression-in-nexthop-resolution-during-replies.patch
+ipv4-constrain-ufo-fragment-sizes-to-multiples-of-8-bytes.patch
+ipv4-fix-the-reusing-of-routing-cache-entries.patch
+ipvs-free-resources-on-module-removal.patch
+net-adjust-array-index.patch
+drivers-net-niu.c-adjust-array-index.patch
+sch_sfq-fix-sfq_enqueue.patch
+ipv4-send-gratuitous-arp-for-secondary-ip-addresses-also.patch
+net-add-iff_skb_tx_shared-flag-to-priv_flags.patch
+net-audit-drivers-to-identify-those-needing-iff_tx_skb_sharing-cleared.patch
+bonding-fix-string-comparison-errors.patch
+fix-cdc-phonet-build.patch
+xfrm-fix-key-lengths-for-rfc3686-ctr-aes.patch
+sis190-rx-filter-init-is-needed-for-mac-address-change.patch
+r8169-add-support-for-d-link-530t-rev-c1-kernel-bug-38862.patch
+net-allow-netif_carrier-to-be-called-safely-from-irq.patch
+ipv4-use-rt_tos-after-some-rt_tos-conversions.patch
+gre-fix-improper-error-handling.patch
+iwlagn-5000-do-not-support-idle-mode.patch
diff --git a/queue-3.0/sis190-rx-filter-init-is-needed-for-mac-address-change.patch b/queue-3.0/sis190-rx-filter-init-is-needed-for-mac-address-change.patch
new file mode 100644
index 0000000000..ea21ad820f
--- /dev/null
+++ b/queue-3.0/sis190-rx-filter-init-is-needed-for-mac-address-change.patch
@@ -0,0 +1,48 @@
+From aa5c8edc9934c5f0e225ad1d0b2b4cbc383a3ab8 Mon Sep 17 00:00:00 2001
+From: Klement Fish <klement2@azet.sk>
+Date: Thu, 28 Jul 2011 06:03:22 +0000
+Subject: sis190: Rx filter init is needed for MAC address change.
+
+
+From: Klement Fish <klement2@azet.sk>
+
+[ Upstream commit fe66101f14813b77d84f6450d51772a2af2b81a1 ]
+
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=34552
+
+Signed-off-by: Klement Fish <klement2@azet.sk>
+Acked-by: Francois Romieu <romieu@fr.zoreil.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/sis190.c |   12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/sis190.c
++++ b/drivers/net/sis190.c
+@@ -1824,6 +1824,16 @@ static int sis190_ioctl(struct net_devic
+ 		generic_mii_ioctl(&tp->mii_if, if_mii(ifr), cmd, NULL);
+ }
+ 
++static int sis190_mac_addr(struct net_device  *dev, void *p)
++{
++	int rc;
++
++	rc = eth_mac_addr(dev, p);
++	if (!rc)
++		sis190_init_rxfilter(dev);
++	return rc;
++}
++
+ static const struct net_device_ops sis190_netdev_ops = {
+ 	.ndo_open		= sis190_open,
+ 	.ndo_stop		= sis190_close,
+@@ -1832,7 +1842,7 @@ static const struct net_device_ops sis19
+ 	.ndo_tx_timeout		= sis190_tx_timeout,
+ 	.ndo_set_multicast_list = sis190_set_rx_mode,
+ 	.ndo_change_mtu		= eth_change_mtu,
+-	.ndo_set_mac_address 	= eth_mac_addr,
++	.ndo_set_mac_address	= sis190_mac_addr,
+ 	.ndo_validate_addr	= eth_validate_addr,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ 	.ndo_poll_controller	 = sis190_netpoll,
diff --git a/queue-3.0/xfrm-fix-key-lengths-for-rfc3686-ctr-aes.patch b/queue-3.0/xfrm-fix-key-lengths-for-rfc3686-ctr-aes.patch
new file mode 100644
index 0000000000..5470958ac1
--- /dev/null
+++ b/queue-3.0/xfrm-fix-key-lengths-for-rfc3686-ctr-aes.patch
@@ -0,0 +1,38 @@
+From 4422af785032a970c79bdbe423a374c9be0ec957 Mon Sep 17 00:00:00 2001
+From: Tushar Gohad <tgohad@mvista.com>
+Date: Thu, 28 Jul 2011 10:36:20 +0000
+Subject: xfrm: Fix key lengths for rfc3686(ctr(aes))
+
+
+From: Tushar Gohad <tgohad@mvista.com>
+
+[ Upstream commit 4203223a1aed862b4445fdcd260d6139603a51d9 ]
+
+Fix the min and max bit lengths for AES-CTR (RFC3686) keys.
+The number of bits in key spec is the key length (128/256)
+plus 32 bits of nonce.
+
+This change takes care of the "Invalid key length" errors
+reported by setkey when specifying 288 bit keys for aes-ctr.
+
+Signed-off-by: Tushar Gohad <tgohad@mvista.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/xfrm/xfrm_algo.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/xfrm/xfrm_algo.c
++++ b/net/xfrm/xfrm_algo.c
+@@ -462,8 +462,8 @@ static struct xfrm_algo_desc ealg_list[]
+ 	.desc = {
+ 		.sadb_alg_id = SADB_X_EALG_AESCTR,
+ 		.sadb_alg_ivlen	= 8,
+-		.sadb_alg_minbits = 128,
+-		.sadb_alg_maxbits = 256
++		.sadb_alg_minbits = 160,
++		.sadb_alg_maxbits = 288
+ 	}
+ },
+ };