56 files changed, 3516 insertions, 0 deletions

diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0001-regulator-Fix-the-logic-to-ensure-new-voltage-settin.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0001-regulator-Fix-the-logic-to-ensure-new-voltage-settin.patch
new file mode 100644
index 00000000..444cb567
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0001-regulator-Fix-the-logic-to-ensure-new-voltage-settin.patch
@@ -0,0 +1,35 @@
+From 94383ff64ebeaa09055462cb48260eb2831235ef Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@gmail.com>
+Date: Wed, 11 Apr 2012 20:53:58 +0800
+Subject: [PATCH 01/56] regulator: Fix the logic to ensure new voltage setting
+ in valid range
+
+commit f55205f4d4a8823a11bb8b37ef2ecbd78fb09463 upstream.
+
+I think this is a typo.
+To ensure new voltage setting won't greater than desc->max,
+the equation should be desc->min + desc->step * new_val <= desc->max.
+
+Signed-off-by: Axel Lin <axel.lin@gmail.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/regulator/max8997.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/regulator/max8997.c b/drivers/regulator/max8997.c
+index 6176129..8cba82d 100644
+--- a/drivers/regulator/max8997.c
++++ b/drivers/regulator/max8997.c
+@@ -689,7 +689,7 @@ static int max8997_set_voltage_buck(struct regulator_dev *rdev,
+                }
+ 
+                new_val++;
+-       } while (desc->min + desc->step + new_val <= desc->max);
++       } while (desc->min + desc->step * new_val <= desc->max);
+ 
+        new_idx = tmp_idx;
+        new_val = tmp_val;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0002-ARM-OMAP-Revert-ARM-OMAP-ctrl-Fix-CONTROL_DSIPHY-reg.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0002-ARM-OMAP-Revert-ARM-OMAP-ctrl-Fix-CONTROL_DSIPHY-reg.patch
new file mode 100644
index 00000000..eb9eb3c7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0002-ARM-OMAP-Revert-ARM-OMAP-ctrl-Fix-CONTROL_DSIPHY-reg.patch
@@ -0,0 +1,52 @@
+From c0d0663f26ba8ed987704a454a360b1a5997e1d7 Mon Sep 17 00:00:00 2001
+From: Archit Taneja <archit@ti.com>
+Date: Thu, 19 Apr 2012 17:39:16 +0530
+Subject: [PATCH 02/56] ARM: OMAP: Revert "ARM: OMAP: ctrl: Fix CONTROL_DSIPHY
+ register fields"
+
+commit 08ca7444f589bedf9ad5d82883e5d0754852d73b upstream.
+
+This reverts commit 46f8c3c7e95c0d30d95911e7975ddc4f93b3e237.
+
+The commit above swapped the DSI1_PPID and DSI2_PPID register fields in
+CONTROL_DSIPHY to be in sync with the newer public OMAP TRMs(after version V).
+
+With this commit, contention errors were reported on DSI lanes some OMAP4 SDPs.
+After probing the DSI lanes on OMAP4 SDP, it was seen that setting bits in the
+DSI2_PPID field was pulling up voltage on DSI1 lanes, and DSI1_PPID field was
+pulling up voltage on DSI2 lanes.
+
+This proves that the current version of OMAP4 TRM is incorrect, swap the
+position of register fields according to the older TRM versions as they were
+correct.
+
+Acked-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Archit Taneja <archit@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ .../include/mach/ctrl_module_pad_core_44xx.h       |    8 ++++----
+ 1 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h b/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h
+index 1e2d332..c88420d 100644
+--- a/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h
++++ b/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h
+@@ -941,10 +941,10 @@
+ #define OMAP4_DSI2_LANEENABLE_MASK                             (0x7 << 29)
+ #define OMAP4_DSI1_LANEENABLE_SHIFT                            24
+ #define OMAP4_DSI1_LANEENABLE_MASK                             (0x1f << 24)
+-#define OMAP4_DSI2_PIPD_SHIFT                                  19
+-#define OMAP4_DSI2_PIPD_MASK                                   (0x1f << 19)
+-#define OMAP4_DSI1_PIPD_SHIFT                                  14
+-#define OMAP4_DSI1_PIPD_MASK                                   (0x1f << 14)
++#define OMAP4_DSI1_PIPD_SHIFT                                  19
++#define OMAP4_DSI1_PIPD_MASK                                   (0x1f << 19)
++#define OMAP4_DSI2_PIPD_SHIFT                                  14
++#define OMAP4_DSI2_PIPD_MASK                                   (0x1f << 14)
+ 
+ /* CONTROL_MCBSPLP */
+ #define OMAP4_ALBCTRLRX_FSX_SHIFT                              31
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0003-ALSA-echoaudio-Remove-incorrect-part-of-assertion.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0003-ALSA-echoaudio-Remove-incorrect-part-of-assertion.patch
new file mode 100644
index 00000000..3e8bed3a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0003-ALSA-echoaudio-Remove-incorrect-part-of-assertion.patch
@@ -0,0 +1,46 @@
+From d88c1668a535d2abb3d201b8a521e46eff3f5e0e Mon Sep 17 00:00:00 2001
+From: Mark Hills <mark@pogo.org.uk>
+Date: Mon, 30 Apr 2012 19:39:22 +0100
+Subject: [PATCH 03/56] ALSA: echoaudio: Remove incorrect part of assertion
+
+commit c914f55f7cdfafe9d7d5b248751902c7ab57691e upstream.
+
+This assertion seems to imply that chip->dsp_code_to_load is a pointer.
+It's actually an integer handle on the actual firmware, and 0 has no
+special meaning.
+
+The assertion prevents initialisation of a Darla20 card, but would also
+affect other models. It seems it was introduced in commit dd7b254d.
+
+ALSA sound/pci/echoaudio/echoaudio.c:2061 Echoaudio driver starting...
+ALSA sound/pci/echoaudio/echoaudio.c:1969 chip=ebe4e000
+ALSA sound/pci/echoaudio/echoaudio.c:2007 pci=ed568000 irq=19 subdev=0010 Init hardware...
+ALSA sound/pci/echoaudio/darla20_dsp.c:36 init_hw() - Darla20
+------------[ cut here ]------------
+WARNING: at sound/pci/echoaudio/echoaudio_dsp.c:478 init_hw+0x1d1/0x86c [snd_darla20]()
+Hardware name: Dell DM051
+BUG? (!chip->dsp_code_to_load || !chip->comm_page)
+
+Signed-off-by: Mark Hills <mark@pogo.org.uk>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ sound/pci/echoaudio/echoaudio_dsp.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/sound/pci/echoaudio/echoaudio_dsp.c b/sound/pci/echoaudio/echoaudio_dsp.c
+index 64417a7..d8c670c 100644
+--- a/sound/pci/echoaudio/echoaudio_dsp.c
++++ b/sound/pci/echoaudio/echoaudio_dsp.c
+@@ -475,7 +475,7 @@ static int load_firmware(struct echoaudio *chip)
+        const struct firmware *fw;
+        int box_type, err;
+ 
+-       if (snd_BUG_ON(!chip->dsp_code_to_load || !chip->comm_page))
++       if (snd_BUG_ON(!chip->comm_page))
+                return -EPERM;
+ 
+        /* See if the ASIC is present and working - only if the DSP is already loaded */
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0004-ARM-orion5x-Fix-GPIO-enable-bits-for-MPP9.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0004-ARM-orion5x-Fix-GPIO-enable-bits-for-MPP9.patch
new file mode 100644
index 00000000..da89cfa8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0004-ARM-orion5x-Fix-GPIO-enable-bits-for-MPP9.patch
@@ -0,0 +1,41 @@
+From 900f27b9d47023edb709aad271b5d7516bb7c990 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Sun, 8 Apr 2012 05:18:53 +0100
+Subject: [PATCH 04/56] ARM: orion5x: Fix GPIO enable bits for MPP9
+
+commit 48d99f47a81a66bdd61a348c7fe8df5a7afdf5f3 upstream.
+
+Commit 554cdaefd1cf7bb54b209c4e68c7cec87ce442a9 ('ARM: orion5x: Refactor
+mpp code to use common orion platform mpp.') seems to have accidentally
+inverted the GPIO valid bits for MPP9 (only).  For the mv2120 platform
+which uses MPP9 as a GPIO LED device, this results in the error:
+
+[   12.711476] leds-gpio: probe of leds-gpio failed with error -22
+
+Reported-by: Henry von Tresckow <hvontres@gmail.com>
+References: http://bugs.debian.org/667446
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Tested-by: Hans Henry von Tresckow <hvontres@gmail.com>
+Signed-off-by: Jason Cooper <jason@lakedaemon.net>
+---
+ arch/arm/mach-orion5x/mpp.h |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-orion5x/mpp.h b/arch/arm/mach-orion5x/mpp.h
+index eac6897..db70e79 100644
+--- a/arch/arm/mach-orion5x/mpp.h
++++ b/arch/arm/mach-orion5x/mpp.h
+@@ -65,8 +65,8 @@
+ #define MPP8_GIGE               MPP(8,  0x1, 0, 0, 1,   1,   1)
+ 
+ #define MPP9_UNUSED            MPP(9,  0x0, 0, 0, 1,   1,   1)
+-#define MPP9_GPIO              MPP(9,  0x0, 0, 0, 1,   1,   1)
+-#define MPP9_GIGE               MPP(9,  0x1, 1, 1, 1,   1,   1)
++#define MPP9_GPIO              MPP(9,  0x0, 1, 1, 1,   1,   1)
++#define MPP9_GIGE               MPP(9,  0x1, 0, 0, 1,   1,   1)
+ 
+ #define MPP10_UNUSED           MPP(10, 0x0, 0, 0, 1,   1,   1)
+ #define MPP10_GPIO             MPP(10, 0x0, 1, 1, 1,   1,   1)
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0005-ALSA-HDA-Lessen-CPU-usage-when-waiting-for-chip-to-r.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0005-ALSA-HDA-Lessen-CPU-usage-when-waiting-for-chip-to-r.patch
new file mode 100644
index 00000000..9cdf2a77
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0005-ALSA-HDA-Lessen-CPU-usage-when-waiting-for-chip-to-r.patch
@@ -0,0 +1,56 @@
+From 3c3471703a78272a055d786ba1474384494bb7fc Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Fri, 4 May 2012 11:05:55 +0200
+Subject: [PATCH 05/56] ALSA: HDA: Lessen CPU usage when waiting for chip to
+ respond
+
+commit 32cf4023e689ad5b3a81a749d8cc99d7f184cb99 upstream.
+
+When an IRQ for some reason gets lost, we wait up to a second using
+udelay, which is CPU intensive. This patch improves the situation by
+waiting about 30 ms in the CPU intensive mode, then stepping down to
+using msleep(2) instead. In essence, we trade some granularity in
+exchange for less CPU consumption when the waiting time is a bit longer.
+
+As a result, PulseAudio should no longer be killed by the kernel
+for taking up to much RT-prio CPU time. At least not for *this* reason.
+
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Tested-by: Arun Raghavan <arun.raghavan@collabora.co.uk>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ sound/pci/hda/hda_intel.c |    6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 192e6c0..53345bc 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -769,11 +769,13 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
+ {
+        struct azx *chip = bus->private_data;
+        unsigned long timeout;
++       unsigned long loopcounter;
+        int do_poll = 0;
+ 
+  again:
+        timeout = jiffies + msecs_to_jiffies(1000);
+-       for (;;) {
++
++       for (loopcounter = 0;; loopcounter++) {
+                if (chip->polling_mode || do_poll) {
+                        spin_lock_irq(&chip->reg_lock);
+                        azx_update_rirb(chip);
+@@ -789,7 +791,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
+                }
+                if (time_after(jiffies, timeout))
+                        break;
+-               if (bus->needs_damn_long_delay)
++               if (bus->needs_damn_long_delay || loopcounter > 3000)
+                        msleep(2); /* temporary workaround */
+                else {
+                        udelay(10);
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0006-percpu-pcpu_embed_first_chunk-should-free-unused-par.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0006-percpu-pcpu_embed_first_chunk-should-free-unused-par.patch
new file mode 100644
index 00000000..26c5bd45
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0006-percpu-pcpu_embed_first_chunk-should-free-unused-par.patch
@@ -0,0 +1,57 @@
+From c49984f9b2cba3ae4eb6ac7056e45cde17629a20 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Fri, 27 Apr 2012 08:42:53 -0700
+Subject: [PATCH 06/56] percpu: pcpu_embed_first_chunk() should free unused
+ parts after all allocs are complete
+
+commit 42b64281453249dac52861f9b97d18552a7ec62b upstream.
+
+pcpu_embed_first_chunk() allocates memory for each node, copies percpu
+data and frees unused portions of it before proceeding to the next
+group.  This assumes that allocations for different nodes doesn't
+overlap; however, depending on memory topology, the bootmem allocator
+may end up allocating memory from a different node than the requested
+one which may overlap with the portion freed from one of the previous
+percpu areas.  This leads to percpu groups for different nodes
+overlapping which is a serious bug.
+
+This patch separates out copy & partial free from the allocation loop
+such that all allocations are complete before partial frees happen.
+
+This also fixes overlapping frees which could happen on allocation
+failure path - out_free_areas path frees whole groups but the groups
+could have portions freed at that point.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: "Pavel V. Panteleev" <pp_84@mail.ru>
+Tested-by: "Pavel V. Panteleev" <pp_84@mail.ru>
+LKML-Reference: <E1SNhwY-0007ui-V7.pp_84-mail-ru@f220.mail.ru>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ mm/percpu.c |   10 ++++++++++
+ 1 files changed, 10 insertions(+), 0 deletions(-)
+
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 716eb4a..5c29750 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1642,6 +1642,16 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
+                areas[group] = ptr;
+ 
+                base = min(ptr, base);
++       }
++
++       /*
++        * Copy data and free unused parts.  This should happen after all
++        * allocations are complete; otherwise, we may end up with
++        * overlapping groups.
++        */
++       for (group = 0; group < ai->nr_groups; group++) {
++               struct pcpu_group_info *gi = &ai->groups[group];
++               void *ptr = areas[group];
+ 
+                for (i = 0; i < gi->nr_units; i++, ptr += ai->unit_size) {
+                        if (gi->cpu_map[i] == NR_CPUS) {
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0007-hugetlb-prevent-BUG_ON-in-hugetlb_fault-hugetlb_cow.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0007-hugetlb-prevent-BUG_ON-in-hugetlb_fault-hugetlb_cow.patch
new file mode 100644
index 00000000..c7f28af9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0007-hugetlb-prevent-BUG_ON-in-hugetlb_fault-hugetlb_cow.patch
@@ -0,0 +1,46 @@
+From 264ef98284920c3c4b7139ce642f41f9b253bc24 Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Thu, 10 May 2012 13:01:44 -0700
+Subject: [PATCH 07/56] hugetlb: prevent BUG_ON in hugetlb_fault() ->
+ hugetlb_cow()
+
+commit 4998a6c0edce7fae9c0a5463f6ec3fa585258ee7 upstream.
+
+Commit 66aebce747eaf ("hugetlb: fix race condition in hugetlb_fault()")
+added code to avoid a race condition by elevating the page refcount in
+hugetlb_fault() while calling hugetlb_cow().
+
+However, one code path in hugetlb_cow() includes an assertion that the
+page count is 1, whereas it may now also have the value 2 in this path.
+
+The consensus is that this BUG_ON has served its purpose, so rather than
+extending it to cover both cases, we just remove it.
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Acked-by: Mel Gorman <mel@csn.ul.ie>
+Acked-by: Hillf Danton <dhillf@gmail.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Cc: Michal Hocko <mhocko@suse.cz>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ mm/hugetlb.c |    1 -
+ 1 files changed, 0 insertions(+), 1 deletions(-)
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index bd936ed..7120c2e 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2405,7 +2405,6 @@ retry_avoidcopy:
+                if (outside_reserve) {
+                        BUG_ON(huge_pte_none(pte));
+                        if (unmap_ref_private(mm, vma, old_page, address)) {
+-                               BUG_ON(page_count(old_page) != 1);
+                                BUG_ON(huge_pte_none(pte));
+                                spin_lock(&mm->page_table_lock);
+                                goto retry_avoidcopy;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0008-namespaces-pid_ns-fix-leakage-on-fork-failure.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0008-namespaces-pid_ns-fix-leakage-on-fork-failure.patch
new file mode 100644
index 00000000..6810b965
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0008-namespaces-pid_ns-fix-leakage-on-fork-failure.patch
@@ -0,0 +1,49 @@
+From 524ae74866597ebc0894b12ce456d8a53f80f533 Mon Sep 17 00:00:00 2001
+From: Mike Galbraith <efault@gmx.de>
+Date: Thu, 10 May 2012 13:01:45 -0700
+Subject: [PATCH 08/56] namespaces, pid_ns: fix leakage on fork() failure
+
+commit 5e2bf0142231194d36fdc9596b36a261ed2b9fe7 upstream.
+
+Fork() failure post namespace creation for a child cloned with
+CLONE_NEWPID leaks pid_namespace/mnt_cache due to proc being mounted
+during creation, but not unmounted during cleanup.  Call
+pid_ns_release_proc() during cleanup.
+
+Signed-off-by: Mike Galbraith <efault@gmx.de>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Cc: Pavel Emelyanov <xemul@parallels.com>
+Cc: Cyrill Gorcunov <gorcunov@openvz.org>
+Cc: Louis Rilling <louis.rilling@kerlabs.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ kernel/fork.c |    3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 0acf42c0..26f1ab0 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -47,6 +47,7 @@
+ #include <linux/audit.h>
+ #include <linux/memcontrol.h>
+ #include <linux/ftrace.h>
++#include <linux/proc_fs.h>
+ #include <linux/profile.h>
+ #include <linux/rmap.h>
+ #include <linux/ksm.h>
+@@ -1387,6 +1388,8 @@ bad_fork_cleanup_io:
+        if (p->io_context)
+                exit_io_context(p);
+ bad_fork_cleanup_namespaces:
++       if (unlikely(clone_flags & CLONE_NEWPID))
++               pid_ns_release_proc(p->nsproxy->pid_ns);
+        exit_task_namespaces(p);
+ bad_fork_cleanup_mm:
+        if (p->mm)
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0009-mm-nobootmem-fix-sign-extend-problem-in-__free_pages.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0009-mm-nobootmem-fix-sign-extend-problem-in-__free_pages.patch
new file mode 100644
index 00000000..c6208ebc
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0009-mm-nobootmem-fix-sign-extend-problem-in-__free_pages.patch
@@ -0,0 +1,49 @@
+From 06ae235e974156cc9304c169f89bba4d6ea4f6e4 Mon Sep 17 00:00:00 2001
+From: Russ Anderson <rja@sgi.com>
+Date: Thu, 10 May 2012 13:01:46 -0700
+Subject: [PATCH 09/56] mm: nobootmem: fix sign extend problem in
+ __free_pages_memory()
+
+commit 6bc2e853c6b46a6041980d58200ad9b0a73a60ff upstream.
+
+Systems with 8 TBytes of memory or greater can hit a problem where only
+the the first 8 TB of memory shows up.  This is due to "int i" being
+smaller than "unsigned long start_aligned", causing the high bits to be
+dropped.
+
+The fix is to change `i' to unsigned long to match start_aligned
+and end_aligned.
+
+Thanks to Jack Steiner for assistance tracking this down.
+
+Signed-off-by: Russ Anderson <rja@sgi.com>
+Cc: Jack Steiner <steiner@sgi.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Yinghai Lu <yinghai@kernel.org>
+Cc: Gavin Shan <shangw@linux.vnet.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ mm/nobootmem.c |    3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/mm/nobootmem.c b/mm/nobootmem.c
+index 7fa41b4..07c08c4 100644
+--- a/mm/nobootmem.c
++++ b/mm/nobootmem.c
+@@ -83,8 +83,7 @@ void __init free_bootmem_late(unsigned long addr, unsigned long size)
+ 
+ static void __init __free_pages_memory(unsigned long start, unsigned long end)
+ {
+-       int i;
+-       unsigned long start_aligned, end_aligned;
++       unsigned long i, start_aligned, end_aligned;
+        int order = ilog2(BITS_PER_LONG);
+ 
+        start_aligned = (start + (BITS_PER_LONG - 1)) & ~(BITS_PER_LONG - 1);
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0010-asix-Fix-tx-transfer-padding-for-full-speed-USB.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0010-asix-Fix-tx-transfer-padding-for-full-speed-USB.patch
new file mode 100644
index 00000000..c08dcb32
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0010-asix-Fix-tx-transfer-padding-for-full-speed-USB.patch
@@ -0,0 +1,45 @@
+From ccd532b836540eb1f0e1d9eee4a87b8403d729c1 Mon Sep 17 00:00:00 2001
+From: Ingo van Lil <inguin@gmx.de>
+Date: Mon, 23 Apr 2012 22:05:38 +0000
+Subject: [PATCH 10/56] asix: Fix tx transfer padding for full-speed USB
+
+[ Upstream commit 2a5809499e35b53a6044fd34e72b242688b7a862 ]
+
+The asix.c USB Ethernet driver avoids ending a tx transfer with a zero-
+length packet by appending a four-byte padding to transfers whose length
+is a multiple of maxpacket. However, the hard-coded 512 byte maxpacket
+length is valid for high-speed USB only; full-speed USB uses 64 byte
+packets.
+
+Signed-off-by: Ingo van Lil <inguin@gmx.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/usb/asix.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
+index fda4be2..a9abee8 100644
+--- a/drivers/net/usb/asix.c
++++ b/drivers/net/usb/asix.c
+@@ -403,7 +403,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+        u32 packet_len;
+        u32 padbytes = 0xffff0000;
+ 
+-       padlen = ((skb->len + 4) % 512) ? 0 : 4;
++       padlen = ((skb->len + 4) & (dev->maxpacket - 1)) ? 0 : 4;
+ 
+        if ((!skb_cloned(skb)) &&
+            ((headroom + tailroom) >= (4 + padlen))) {
+@@ -425,7 +425,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+        cpu_to_le32s(&packet_len);
+        skb_copy_to_linear_data(skb, &packet_len, sizeof(packet_len));
+ 
+-       if ((skb->len % 512) == 0) {
++       if (padlen) {
+                cpu_to_le32s(&padbytes);
+                memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
+                skb_put(skb, sizeof(padbytes));
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0011-netem-fix-possible-skb-leak.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0011-netem-fix-possible-skb-leak.patch
new file mode 100644
index 00000000..d57c44c9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0011-netem-fix-possible-skb-leak.patch
@@ -0,0 +1,39 @@
+From abb480a271308924f4174413f6d6969ecaaba892 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sun, 29 Apr 2012 09:08:22 +0000
+Subject: [PATCH 11/56] netem: fix possible skb leak
+
+[ Upstream commit 116a0fc31c6c9b8fc821be5a96e5bf0b43260131 ]
+
+skb_checksum_help(skb) can return an error, we must free skb in this
+case. qdisc_drop(skb, sch) can also be feeded with a NULL skb (if
+skb_unshare() failed), so lets use this generic helper.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Stephen Hemminger <shemminger@osdl.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/sched/sch_netem.c |    6 ++----
+ 1 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 7801b15..a489d8b 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -351,10 +351,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+        if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
+                if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
+                    (skb->ip_summed == CHECKSUM_PARTIAL &&
+-                    skb_checksum_help(skb))) {
+-                       sch->qstats.drops++;
+-                       return NET_XMIT_DROP;
+-               }
++                    skb_checksum_help(skb)))
++                       return qdisc_drop(skb, sch);
+ 
+                skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
+        }
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0012-net-In-unregister_netdevice_notifier-unregister-the-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0012-net-In-unregister_netdevice_notifier-unregister-the-.patch
new file mode 100644
index 00000000..0c1ea209
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0012-net-In-unregister_netdevice_notifier-unregister-the-.patch
@@ -0,0 +1,64 @@
+From d2b1ac073ca1e2caabafe219d0d1f04f4a2d1467 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Fri, 6 Apr 2012 15:33:35 +0000
+Subject: [PATCH 12/56] net: In unregister_netdevice_notifier unregister the
+ netdevices.
+
+[ Upstream commit 7d3d43dab4e978d8d9ad1acf8af15c9b1c4b0f0f ]
+
+We already synthesize events in register_netdevice_notifier and synthesizing
+events in unregister_netdevice_notifier allows to us remove the need for
+special case cleanup code.
+
+This change should be safe as it adds no new cases for existing callers
+of unregiser_netdevice_notifier to handle.
+
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/core/dev.c |   20 ++++++++++++++++++++
+ 1 files changed, 20 insertions(+), 0 deletions(-)
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index cd5050e..61a7baa 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1421,14 +1421,34 @@ EXPORT_SYMBOL(register_netdevice_notifier);
+  *     register_netdevice_notifier(). The notifier is unlinked into the
+  *     kernel structures and may then be reused. A negative errno code
+  *     is returned on a failure.
++ *
++ *     After unregistering unregister and down device events are synthesized
++ *     for all devices on the device list to the removed notifier to remove
++ *     the need for special case cleanup code.
+  */
+ 
+ int unregister_netdevice_notifier(struct notifier_block *nb)
+ {
++       struct net_device *dev;
++       struct net *net;
+        int err;
+ 
+        rtnl_lock();
+        err = raw_notifier_chain_unregister(&netdev_chain, nb);
++       if (err)
++               goto unlock;
++
++       for_each_net(net) {
++               for_each_netdev(net, dev) {
++                       if (dev->flags & IFF_UP) {
++                               nb->notifier_call(nb, NETDEV_GOING_DOWN, dev);
++                               nb->notifier_call(nb, NETDEV_DOWN, dev);
++                       }
++                       nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
++                       nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev);
++               }
++       }
++unlock:
+        rtnl_unlock();
+        return err;
+ }
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0013-net-l2tp-unlock-socket-lock-before-returning-from-l2.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0013-net-l2tp-unlock-socket-lock-before-returning-from-l2.patch
new file mode 100644
index 00000000..199864f5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0013-net-l2tp-unlock-socket-lock-before-returning-from-l2.patch
@@ -0,0 +1,47 @@
+From 1b3ded810906676f03b6eab986308b1cf5e6b135 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <levinsasha928@gmail.com>
+Date: Wed, 2 May 2012 03:58:43 +0000
+Subject: [PATCH 13/56] net: l2tp: unlock socket lock before returning from
+ l2tp_ip_sendmsg
+
+[ Upstream commit 84768edbb2721637620b2d84501bb0d5aed603f1 ]
+
+l2tp_ip_sendmsg could return without releasing socket lock, making it all the
+way to userspace, and generating the following warning:
+
+[  130.891594] ================================================
+[  130.894569] [ BUG: lock held when returning to user space! ]
+[  130.897257] 3.4.0-rc5-next-20120501-sasha #104 Tainted: G        W
+[  130.900336] ------------------------------------------------
+[  130.902996] trinity/8384 is leaving the kernel with locks still held!
+[  130.906106] 1 lock held by trinity/8384:
+[  130.907924]  #0:  (sk_lock-AF_INET){+.+.+.}, at: [<ffffffff82b9503f>] l2tp_ip_sendmsg+0x2f/0x550
+
+Introduced by commit 2f16270 ("l2tp: Fix locking in l2tp_ip.c").
+
+Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/l2tp/l2tp_ip.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index 55670ec..2a2a3e7 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -441,8 +441,9 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
+ 
+                daddr = lip->l2tp_addr.s_addr;
+        } else {
++               rc = -EDESTADDRREQ;
+                if (sk->sk_state != TCP_ESTABLISHED)
+-                       return -EDESTADDRREQ;
++                       goto out;
+ 
+                daddr = inet->inet_daddr;
+                connected = 1;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0014-sky2-propogate-rx-hash-when-packet-is-copied.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0014-sky2-propogate-rx-hash-when-packet-is-copied.patch
new file mode 100644
index 00000000..55d6ef9c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0014-sky2-propogate-rx-hash-when-packet-is-copied.patch
@@ -0,0 +1,38 @@
+From 040442d719f91dcb002eaa1efaffbebd2fd44328 Mon Sep 17 00:00:00 2001
+From: stephen hemminger <shemminger@vyatta.com>
+Date: Mon, 30 Apr 2012 05:49:45 +0000
+Subject: [PATCH 14/56] sky2: propogate rx hash when packet is copied
+
+[ Upstream commit 3f42941b5d1d13542b1a755a9e4f633aa72e4d3e ]
+
+When a small packet is received, the driver copies it to a new skb to allow
+reusing the full size Rx buffer. The copy was propogating the checksum offload
+but not the receive hash information. The bug is impact was mostly harmless
+and therefore not observed until reviewing this area of code.
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/marvell/sky2.c |    3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index 7eb8a00..e1f4b65 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -2475,8 +2475,11 @@ static struct sk_buff *receive_copy(struct sky2_port *sky2,
+                skb_copy_from_linear_data(re->skb, skb->data, length);
+                skb->ip_summed = re->skb->ip_summed;
+                skb->csum = re->skb->csum;
++               skb->rxhash = re->skb->rxhash;
++
+                pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr,
+                                               length, PCI_DMA_FROMDEVICE);
++               re->skb->rxhash = 0;
+                re->skb->ip_summed = CHECKSUM_NONE;
+                skb_put(skb, length);
+        }
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0015-sky2-fix-receive-length-error-in-mixed-non-VLAN-VLAN.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0015-sky2-fix-receive-length-error-in-mixed-non-VLAN-VLAN.patch
new file mode 100644
index 00000000..ba0888dc
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0015-sky2-fix-receive-length-error-in-mixed-non-VLAN-VLAN.patch
@@ -0,0 +1,136 @@
+From 27f7b26b133f97629f82ce156d481a32a881472b Mon Sep 17 00:00:00 2001
+From: stephen hemminger <shemminger@vyatta.com>
+Date: Mon, 30 Apr 2012 06:47:37 +0000
+Subject: [PATCH 15/56] sky2: fix receive length error in mixed non-VLAN/VLAN
+ traffic
+
+[ Upstream commit e072b3fad5f3915102c94628b4971f52ff99dd05 ]
+
+Bug: The VLAN bit of the MAC RX Status Word is unreliable in several older
+supported chips. Sometimes the VLAN bit is not set for valid VLAN packets
+and also sometimes the VLAN bit is set for non-VLAN packets that came after
+a VLAN packet. This results in a receive length error when VLAN hardware
+tagging is enabled.
+
+Fix: Variation on original fix proposed by Mirko.
+The VLAN information is decoded in the status loop, and can be
+applied to the received SKB there. This eliminates the need for the
+separate tag field in the interface data structure. The tag has to
+be copied and cleared if packet is copied. This version checked out
+with vlan and normal traffic.
+
+Note: vlan_tx_tag_present should be renamed vlan_tag_present, but that
+is outside scope of this.
+
+Reported-by: Mirko Lindner <mlindner@marvell.com>
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/marvell/sky2.c |   28 +++++++++++++++++-----------
+ drivers/net/ethernet/marvell/sky2.h |    1 -
+ 2 files changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index e1f4b65..65c51ff 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -2476,9 +2476,11 @@ static struct sk_buff *receive_copy(struct sky2_port *sky2,
+                skb->ip_summed = re->skb->ip_summed;
+                skb->csum = re->skb->csum;
+                skb->rxhash = re->skb->rxhash;
++               skb->vlan_tci = re->skb->vlan_tci;
+ 
+                pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr,
+                                               length, PCI_DMA_FROMDEVICE);
++               re->skb->vlan_tci = 0;
+                re->skb->rxhash = 0;
+                re->skb->ip_summed = CHECKSUM_NONE;
+                skb_put(skb, length);
+@@ -2564,9 +2566,6 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
+        struct sk_buff *skb = NULL;
+        u16 count = (status & GMR_FS_LEN) >> 16;
+ 
+-       if (status & GMR_FS_VLAN)
+-               count -= VLAN_HLEN;     /* Account for vlan tag */
+-
+        netif_printk(sky2, rx_status, KERN_DEBUG, dev,
+                     "rx slot %u status 0x%x len %d\n",
+                     sky2->rx_next, status, length);
+@@ -2574,6 +2573,9 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
+        sky2->rx_next = (sky2->rx_next + 1) % sky2->rx_pending;
+        prefetch(sky2->rx_ring + sky2->rx_next);
+ 
++       if (vlan_tx_tag_present(re->skb))
++               count -= VLAN_HLEN;     /* Account for vlan tag */
++
+        /* This chip has hardware problems that generates bogus status.
+         * So do only marginal checking and expect higher level protocols
+         * to handle crap frames.
+@@ -2631,11 +2633,8 @@ static inline void sky2_tx_done(struct net_device *dev, u16 last)
+ }
+ 
+ static inline void sky2_skb_rx(const struct sky2_port *sky2,
+-                              u32 status, struct sk_buff *skb)
++                              struct sk_buff *skb)
+ {
+-       if (status & GMR_FS_VLAN)
+-               __vlan_hwaccel_put_tag(skb, be16_to_cpu(sky2->rx_tag));
+-
+        if (skb->ip_summed == CHECKSUM_NONE)
+                netif_receive_skb(skb);
+        else
+@@ -2689,6 +2688,14 @@ static void sky2_rx_checksum(struct sky2_port *sky2, u32 status)
+        }
+ }
+ 
++static void sky2_rx_tag(struct sky2_port *sky2, u16 length)
++{
++       struct sk_buff *skb;
++
++       skb = sky2->rx_ring[sky2->rx_next].skb;
++       __vlan_hwaccel_put_tag(skb, be16_to_cpu(length));
++}
++
+ static void sky2_rx_hash(struct sky2_port *sky2, u32 status)
+ {
+        struct sk_buff *skb;
+@@ -2747,8 +2754,7 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
+                        }
+ 
+                        skb->protocol = eth_type_trans(skb, dev);
+-
+-                       sky2_skb_rx(sky2, status, skb);
++                       sky2_skb_rx(sky2, skb);
+ 
+                        /* Stop after net poll weight */
+                        if (++work_done >= to_do)
+@@ -2756,11 +2762,11 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
+                        break;
+ 
+                case OP_RXVLAN:
+-                       sky2->rx_tag = length;
++                       sky2_rx_tag(sky2, length);
+                        break;
+ 
+                case OP_RXCHKSVLAN:
+-                       sky2->rx_tag = length;
++                       sky2_rx_tag(sky2, length);
+                        /* fall through */
+                case OP_RXCHKS:
+                        if (likely(dev->features & NETIF_F_RXCSUM))
+diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
+index ff6f58b..3c896ce 100644
+--- a/drivers/net/ethernet/marvell/sky2.h
++++ b/drivers/net/ethernet/marvell/sky2.h
+@@ -2241,7 +2241,6 @@ struct sky2_port {
+        u16                  rx_pending;
+        u16                  rx_data_size;
+        u16                  rx_nfrags;
+-       u16                  rx_tag;
+ 
+        struct {
+                unsigned long last;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0016-sungem-Fix-WakeOnLan.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0016-sungem-Fix-WakeOnLan.patch
new file mode 100644
index 00000000..f750148b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0016-sungem-Fix-WakeOnLan.patch
@@ -0,0 +1,35 @@
+From 4fb3cd4329db7cba66335fe4d74f5234030cf1a9 Mon Sep 17 00:00:00 2001
+From: Gerard Lledo <gerard.lledo@gmail.com>
+Date: Sat, 28 Apr 2012 08:52:37 +0000
+Subject: [PATCH 16/56] sungem: Fix WakeOnLan
+
+[ Upstream commit 5a8887d39e1ba5ee2d4ccb94b14d6f2dce5ddfca ]
+
+WakeOnLan was broken in this driver because gp->asleep_wol is a 1-bit
+bitfield and it was being assigned WAKE_MAGIC, which is (1 << 5).
+gp->asleep_wol remains 0 and the machine never wakes up.  Fixed by casting
+gp->wake_on_lan to bool.  Tested on an iBook G4.
+
+Signed-off-by: Gerard Lledo <gerard.lledo@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/sun/sungem.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c
+index ceab215..c508d6a 100644
+--- a/drivers/net/ethernet/sun/sungem.c
++++ b/drivers/net/ethernet/sun/sungem.c
+@@ -2340,7 +2340,7 @@ static int gem_suspend(struct pci_dev *pdev, pm_message_t state)
+        netif_device_detach(dev);
+ 
+        /* Switch off chip, remember WOL setting */
+-       gp->asleep_wol = gp->wake_on_lan;
++       gp->asleep_wol = !!gp->wake_on_lan;
+        gem_do_stop(dev, gp->asleep_wol);
+ 
+        /* Unlock the network stack */
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0017-tg3-Avoid-panic-from-reserved-statblk-field-access.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0017-tg3-Avoid-panic-from-reserved-statblk-field-access.patch
new file mode 100644
index 00000000..1fbe741a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0017-tg3-Avoid-panic-from-reserved-statblk-field-access.patch
@@ -0,0 +1,67 @@
+From ec9a6575908fa9558b613ace25ec0a9f5e1795ec Mon Sep 17 00:00:00 2001
+From: Matt Carlson <mcarlson@broadcom.com>
+Date: Tue, 24 Apr 2012 13:37:01 +0000
+Subject: [PATCH 17/56] tg3: Avoid panic from reserved statblk field access
+
+[ Upstream commit f891ea1634ce41f5f47ae40d8594809f4cd2ca66 ]
+
+When RSS is enabled, interrupt vector 0 does not receive any rx traffic.
+The rx producer index fields for vector 0's status block should be
+considered reserved in this case.  This patch changes the code to
+respect these reserved fields, which avoids a kernel panic when these
+fields take on non-zero values.
+
+Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
+Signed-off-by: Michael Chan <mchan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/broadcom/tg3.c |   18 ++++++++++++++++--
+ 1 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 3d55883..2dcac28 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -879,8 +879,13 @@ static inline unsigned int tg3_has_work(struct tg3_napi *tnapi)
+                if (sblk->status & SD_STATUS_LINK_CHG)
+                        work_exists = 1;
+        }
+-       /* check for RX/TX work to do */
+-       if (sblk->idx[0].tx_consumer != tnapi->tx_cons ||
++
++       /* check for TX work to do */
++       if (sblk->idx[0].tx_consumer != tnapi->tx_cons)
++               work_exists = 1;
++
++       /* check for RX work to do */
++       if (tnapi->rx_rcb_prod_idx &&
+            *(tnapi->rx_rcb_prod_idx) != tnapi->rx_rcb_ptr)
+                work_exists = 1;
+ 
+@@ -5895,6 +5900,9 @@ static int tg3_poll_work(struct tg3_napi *tnapi, int work_done, int budget)
+                        return work_done;
+        }
+ 
++       if (!tnapi->rx_rcb_prod_idx)
++               return work_done;
++
+        /* run RX thread, within the bounds set by NAPI.
+         * All RX "locking" is done by ensuring outside
+         * code synchronizes with tg3->napi.poll()
+@@ -7448,6 +7456,12 @@ static int tg3_alloc_consistent(struct tg3 *tp)
+                 */
+                switch (i) {
+                default:
++                       if (tg3_flag(tp, ENABLE_RSS)) {
++                               tnapi->rx_rcb_prod_idx = NULL;
++                               break;
++                       }
++                       /* Fall through */
++               case 1:
+                        tnapi->rx_rcb_prod_idx = &sblk->idx[0].rx_producer;
+                        break;
+                case 2:
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0018-tcp-fix-infinite-cwnd-in-tcp_complete_cwr.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0018-tcp-fix-infinite-cwnd-in-tcp_complete_cwr.patch
new file mode 100644
index 00000000..7e2818da
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0018-tcp-fix-infinite-cwnd-in-tcp_complete_cwr.patch
@@ -0,0 +1,46 @@
+From 6b142c33b94fd1c35b6a19be0982ae408ce8d162 Mon Sep 17 00:00:00 2001
+From: Yuchung Cheng <ycheng@google.com>
+Date: Mon, 30 Apr 2012 06:00:18 +0000
+Subject: [PATCH 18/56] tcp: fix infinite cwnd in tcp_complete_cwr()
+
+[ Upstream commit 1cebce36d660c83bd1353e41f3e66abd4686f215 ]
+
+When the cwnd reduction is done, ssthresh may be infinite
+if TCP enters CWR via ECN or F-RTO. If cwnd is not undone, i.e.,
+undo_marker is set, tcp_complete_cwr() falsely set cwnd to the
+infinite ssthresh value. The correct operation is to keep cwnd
+intact because it has been updated in ECN or F-RTO.
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv4/tcp_input.c |    9 ++++++---
+ 1 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index daedc07..db07c9e 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2868,11 +2868,14 @@ static inline void tcp_complete_cwr(struct sock *sk)
+ 
+        /* Do not moderate cwnd if it's already undone in cwr or recovery. */
+        if (tp->undo_marker) {
+-               if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR)
++               if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR) {
+                        tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
+-               else /* PRR */
++                       tp->snd_cwnd_stamp = tcp_time_stamp;
++               } else if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH) {
++                       /* PRR algorithm. */
+                        tp->snd_cwnd = tp->snd_ssthresh;
+-               tp->snd_cwnd_stamp = tcp_time_stamp;
++                       tp->snd_cwnd_stamp = tcp_time_stamp;
++               }
+        }
+        tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
+ }
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0019-tcp-change-tcp_adv_win_scale-and-tcp_rmem-2.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0019-tcp-change-tcp_adv_win_scale-and-tcp_rmem-2.patch
new file mode 100644
index 00000000..e0e1dda9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0019-tcp-change-tcp_adv_win_scale-and-tcp_rmem-2.patch
@@ -0,0 +1,124 @@
+From 98d841428279a8060b46cf13a1463ebbeca65b4a Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 2 May 2012 02:28:41 +0000
+Subject: [PATCH 19/56] tcp: change tcp_adv_win_scale and tcp_rmem[2]
+
+[ Upstream commit b49960a05e32121d29316cfdf653894b88ac9190 ]
+
+tcp_adv_win_scale default value is 2, meaning we expect a good citizen
+skb to have skb->len / skb->truesize ratio of 75% (3/4)
+
+In 2.6 kernels we (mis)accounted for typical MSS=1460 frame :
+1536 + 64 + 256 = 1856 'estimated truesize', and 1856 * 3/4 = 1392.
+So these skbs were considered as not bloated.
+
+With recent truesize fixes, a typical MSS=1460 frame truesize is now the
+more precise :
+2048 + 256 = 2304. But 2304 * 3/4 = 1728.
+So these skb are not good citizen anymore, because 1460 < 1728
+
+(GRO can escape this problem because it build skbs with a too low
+truesize.)
+
+This also means tcp advertises a too optimistic window for a given
+allocated rcvspace : When receiving frames, sk_rmem_alloc can hit
+sk_rcvbuf limit and we call tcp_prune_queue()/tcp_collapse() too often,
+especially when application is slow to drain its receive queue or in
+case of losses (netperf is fast, scp is slow). This is a major latency
+source.
+
+We should adjust the len/truesize ratio to 50% instead of 75%
+
+This patch :
+
+1) changes tcp_adv_win_scale default to 1 instead of 2
+
+2) increase tcp_rmem[2] limit from 4MB to 6MB to take into account
+better truesize tracking and to allow autotuning tcp receive window to
+reach same value than before. Note that same amount of kernel memory is
+consumed compared to 2.6 kernels.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Neal Cardwell <ncardwell@google.com>
+Cc: Tom Herbert <therbert@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ Documentation/networking/ip-sysctl.txt |    4 ++--
+ net/ipv4/tcp.c                         |    9 +++++----
+ net/ipv4/tcp_input.c                   |    2 +-
+ 3 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index 589f2da..a4399f5 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -137,7 +137,7 @@ tcp_adv_win_scale - INTEGER
+        (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
+        if it is <= 0.
+        Possible values are [-31, 31], inclusive.
+-       Default: 2
++       Default: 1
+ 
+ tcp_allowed_congestion_control - STRING
+        Show/set the congestion control choices available to non-privileged
+@@ -397,7 +397,7 @@ tcp_rmem - vector of 3 INTEGERs: min, default, max
+        net.core.rmem_max.  Calling setsockopt() with SO_RCVBUF disables
+        automatic tuning of that socket's receive buffer size, in which
+        case this value is ignored.
+-       Default: between 87380B and 4MB, depending on RAM size.
++       Default: between 87380B and 6MB, depending on RAM size.
+ 
+ tcp_sack - BOOLEAN
+        Enable select acknowledgments (SACKS).
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 7904db4..8f826b1 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3216,7 +3216,7 @@ void __init tcp_init(void)
+ {
+        struct sk_buff *skb = NULL;
+        unsigned long limit;
+-       int i, max_share, cnt;
++       int i, max_rshare, max_wshare, cnt;
+        unsigned long jiffy = jiffies;
+ 
+        BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
+@@ -3280,15 +3280,16 @@ void __init tcp_init(void)
+ 
+        /* Set per-socket limits to no more than 1/128 the pressure threshold */
+        limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
+-       max_share = min(4UL*1024*1024, limit);
++       max_wshare = min(4UL*1024*1024, limit);
++       max_rshare = min(6UL*1024*1024, limit);
+ 
+        sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
+        sysctl_tcp_wmem[1] = 16*1024;
+-       sysctl_tcp_wmem[2] = max(64*1024, max_share);
++       sysctl_tcp_wmem[2] = max(64*1024, max_wshare);
+ 
+        sysctl_tcp_rmem[0] = SK_MEM_QUANTUM;
+        sysctl_tcp_rmem[1] = 87380;
+-       sysctl_tcp_rmem[2] = max(87380, max_share);
++       sysctl_tcp_rmem[2] = max(87380, max_rshare);
+ 
+        printk(KERN_INFO "TCP: Hash tables configured "
+               "(established %u bind %u)\n",
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index db07c9e..9726927 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -83,7 +83,7 @@ int sysctl_tcp_ecn __read_mostly = 2;
+ EXPORT_SYMBOL(sysctl_tcp_ecn);
+ int sysctl_tcp_dsack __read_mostly = 1;
+ int sysctl_tcp_app_win __read_mostly = 31;
+-int sysctl_tcp_adv_win_scale __read_mostly = 2;
++int sysctl_tcp_adv_win_scale __read_mostly = 1;
+ EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
+ 
+ int sysctl_tcp_stdurg __read_mostly;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0020-brcm80211-smac-pass-missing-argument-to-brcms_b_mute.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0020-brcm80211-smac-pass-missing-argument-to-brcms_b_mute.patch
new file mode 100644
index 00000000..92501a20
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0020-brcm80211-smac-pass-missing-argument-to-brcms_b_mute.patch
@@ -0,0 +1,43 @@
+From 9edfb7d2fb5250828aabc9ad47708b56184fa010 Mon Sep 17 00:00:00 2001
+From: Jonathan Nieder <jrnieder@gmail.com>
+Date: Fri, 11 May 2012 19:35:33 -0500
+Subject: [PATCH 20/56] brcm80211: smac: pass missing argument to
+ 'brcms_b_mute'
+
+[Not needed upstream --- this bug is specific to 3.2.y.]
+
+Commit c6c44893c864, which removes the flag argument from brcms_b_mute,
+is not part of 3.2.y, and we forgot to adjust a new call accordingly
+when applying commit badc4f07622f ("brcm80211: smac: resume transmit
+fifo upon receiving frames").
+
+ drivers/net/wireless/brcm80211/brcmsmac/main.c: In function 'brcms_c_recvctl':
+ drivers/net/wireless/brcm80211/brcmsmac/main.c:7882:4: error: too few arguments to function 'brcms_b_mute'
+ drivers/net/wireless/brcm80211/brcmsmac/main.c:2538:13: note: declared here
+
+Earlier build tests missed this because they didn't include this driver
+due to 'depends on BCMA=n'.
+
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wireless/brcm80211/brcmsmac/main.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+index f98becc..833cbef 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+@@ -7879,7 +7879,7 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
+        if (wlc->hw->suspended_fifos) {
+                hdr = (struct ieee80211_hdr *)p->data;
+                if (ieee80211_is_beacon(hdr->frame_control))
+-                       brcms_b_mute(wlc->hw, false);
++                       brcms_b_mute(wlc->hw, false, 0);
+        }
+ 
+        memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0021-phy-icplus-fix-Auto-Power-Saving-in-ip101a_config_in.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0021-phy-icplus-fix-Auto-Power-Saving-in-ip101a_config_in.patch
new file mode 100644
index 00000000..5b7769fb
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0021-phy-icplus-fix-Auto-Power-Saving-in-ip101a_config_in.patch
@@ -0,0 +1,43 @@
+From 78381ca9729f5c7508cc74701d29cc325f37c5b7 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@st.com>
+Date: Mon, 2 Apr 2012 00:02:09 +0000
+Subject: [PATCH 21/56] phy:icplus:fix Auto Power Saving in
+ ip101a_config_init.
+
+[ Upstream commit b3300146aa8efc5d3937fd33f3cfdc580a3843bc ]
+
+This patch fixes Auto Power Saving configuration in ip101a_config_init
+which was broken as there is no phy register write followed after
+setting IP101A_APS_ON flag.
+
+This patch also fixes the return value of ip101a_config_init.
+
+Without this patch ip101a_config_init returns 2 which is not an error
+accroding to IS_ERR and the mac driver will continue accessing 2 as
+valid pointer to phy_dev resulting in memory fault.
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@st.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/phy/icplus.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
+index c81f136..b142300 100644
+--- a/drivers/net/phy/icplus.c
++++ b/drivers/net/phy/icplus.c
+@@ -150,7 +150,8 @@ static int ip101a_config_init(struct phy_device *phydev)
+        /* Enable Auto Power Saving mode */
+        c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
+        c |= IP101A_APS_ON;
+-       return c;
++
++       return phy_write(phydev, IP10XX_SPEC_CTRL_STATUS, c);
+ }
+ 
+ static int ip175c_read_status(struct phy_device *phydev)
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0022-NFSv4-Revalidate-uid-gid-after-open.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0022-NFSv4-Revalidate-uid-gid-after-open.patch
new file mode 100644
index 00000000..edc0c916
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0022-NFSv4-Revalidate-uid-gid-after-open.patch
@@ -0,0 +1,74 @@
+From 28797e10f3879232042e0f636e6650a2b35912f6 Mon Sep 17 00:00:00 2001
+From: Jonathan Nieder <jrnieder@gmail.com>
+Date: Fri, 11 May 2012 04:20:20 -0500
+Subject: [PATCH 22/56] NFSv4: Revalidate uid/gid after open
+
+This is a shorter (and more appropriate for stable kernels) analog to
+the following upstream commit:
+
+commit 6926afd1925a54a13684ebe05987868890665e2b
+Author: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date:   Sat Jan 7 13:22:46 2012 -0500
+
+    NFSv4: Save the owner/group name string when doing open
+
+    ...so that we can do the uid/gid mapping outside the asynchronous RPC
+    context.
+    This fixes a bug in the current NFSv4 atomic open code where the client
+    isn't able to determine what the true uid/gid fields of the file are,
+    (because the asynchronous nature of the OPEN call denies it the ability
+    to do an upcall) and so fills them with default values, marking the
+    inode as needing revalidation.
+    Unfortunately, in some cases, the VFS will do some additional sanity
+    checks on the file, and may override the server's decision to allow
+    the open because it sees the wrong owner/group fields.
+
+    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+Without this patch, logging into two different machines with home
+directories mounted over NFS4 and then running "vim" and typing ":q"
+in each reliably produces the following error on the second machine:
+
+        E137: Viminfo file is not writable: /users/system/rtheys/.viminfo
+
+This regression was introduced by 80e52aced138 ("NFSv4: Don't do
+idmapper upcalls for asynchronous RPC calls", merged during the 2.6.32
+cycle) --- after the OPEN call, .viminfo has the default values for
+st_uid and st_gid (0xfffffffe) cached because we do not want to let
+rpciod wait for an idmapper upcall to fill them in.
+
+The fix used in mainline is to save the owner and group as strings and
+perform the upcall in _nfs4_proc_open outside the rpciod context,
+which takes about 600 lines.  For stable, we can do something similar
+with a one-liner: make open check for the stale fields and make a
+(synchronous) GETATTR call to fill them when needed.
+
+Trond dictated the patch, I typed it in, and Rik tested it.
+
+Addresses http://bugs.debian.org/659111 and
+          https://bugzilla.redhat.com/789298
+
+Reported-by: Rik Theys <Rik.Theys@esat.kuleuven.be>
+Explained-by: David Flyn <davidf@rd.bbc.co.uk>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Tested-by: Rik Theys <Rik.Theys@esat.kuleuven.be>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfs/nfs4proc.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 51f6a40..bab7c58 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1802,6 +1802,7 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, fmode_t fmode
+                        nfs_setattr_update_inode(state->inode, sattr);
+                nfs_post_op_update_inode(state->inode, opendata->o_res.f_attr);
+        }
++       nfs_revalidate_inode(server, state->inode);
+        nfs4_opendata_put(opendata);
+        nfs4_put_state_owner(sp);
+        *res = state;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0023-target-Drop-incorrect-se_lun_acl-release-for-dynamic.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0023-target-Drop-incorrect-se_lun_acl-release-for-dynamic.patch
new file mode 100644
index 00000000..66d06014
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0023-target-Drop-incorrect-se_lun_acl-release-for-dynamic.patch
@@ -0,0 +1,70 @@
+From ca92b5c1f22073e079dae19162698441a231e36f Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 10 May 2012 22:05:49 -0700
+Subject: [PATCH 23/56] target: Drop incorrect se_lun_acl release for dynamic
+ -> explict ACL conversion
+
+commit cfebf8f42f47327fa54cf05c19b98f4bd5236a26 upstream.
+
+This patch removes some potentially problematic legacy code within
+core_clear_initiator_node_from_tpg() that was originally intended to
+release left over se_lun_acl setup during dynamic NodeACL+MappedLUN
+generate when running with TPG demo-mode operation.
+
+Since we now only ever expect to allocate and release se_lun_acl from
+within target_core_fabric_configfs.c:target_fabric_make_mappedlun() and
+target_fabric_drop_mappedlun() context respectively, this code for
+demo-mode release is incorrect and needs to be removed.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Andy Grover <agrover@redhat.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/target/target_core_tpg.c |   22 ----------------------
+ 1 files changed, 0 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
+index 8ddd133..d91fe44 100644
+--- a/drivers/target/target_core_tpg.c
++++ b/drivers/target/target_core_tpg.c
+@@ -63,7 +63,6 @@ static void core_clear_initiator_node_from_tpg(
+        int i;
+        struct se_dev_entry *deve;
+        struct se_lun *lun;
+-       struct se_lun_acl *acl, *acl_tmp;
+ 
+        spin_lock_irq(&nacl->device_list_lock);
+        for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) {
+@@ -84,28 +83,7 @@ static void core_clear_initiator_node_from_tpg(
+                core_update_device_list_for_node(lun, NULL, deve->mapped_lun,
+                        TRANSPORT_LUNFLAGS_NO_ACCESS, nacl, tpg, 0);
+ 
+-               spin_lock(&lun->lun_acl_lock);
+-               list_for_each_entry_safe(acl, acl_tmp,
+-                                       &lun->lun_acl_list, lacl_list) {
+-                       if (!strcmp(acl->initiatorname, nacl->initiatorname) &&
+-                           (acl->mapped_lun == deve->mapped_lun))
+-                               break;
+-               }
+-
+-               if (!acl) {
+-                       pr_err("Unable to locate struct se_lun_acl for %s,"
+-                               " mapped_lun: %u\n", nacl->initiatorname,
+-                               deve->mapped_lun);
+-                       spin_unlock(&lun->lun_acl_lock);
+-                       spin_lock_irq(&nacl->device_list_lock);
+-                       continue;
+-               }
+-
+-               list_del(&acl->lacl_list);
+-               spin_unlock(&lun->lun_acl_lock);
+-
+                spin_lock_irq(&nacl->device_list_lock);
+-               kfree(acl);
+        }
+        spin_unlock_irq(&nacl->device_list_lock);
+ }
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0024-marvell-cam-fix-an-ARM-build-error.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0024-marvell-cam-fix-an-ARM-build-error.patch
new file mode 100644
index 00000000..09a02df7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0024-marvell-cam-fix-an-ARM-build-error.patch
@@ -0,0 +1,34 @@
+From 10b936ceae2bf61d07542014bf9140f302810892 Mon Sep 17 00:00:00 2001
+From: Jonathan Corbet <corbet@lwn.net>
+Date: Fri, 20 Apr 2012 12:22:50 -0300
+Subject: [PATCH 24/56] marvell-cam: fix an ARM build error
+
+commit 9967232f1be5bab10c7b7a8dcf51ff5c3c1a6d77 upstream.
+
+One of the OLPC changes lost a little in its translation to mainline,
+leading to build errors on the ARM architecture.  Remove the offending
+line, and all will be well.
+
+Reported-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/media/video/marvell-ccic/mmp-driver.c |    1 -
+ 1 files changed, 0 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/media/video/marvell-ccic/mmp-driver.c b/drivers/media/video/marvell-ccic/mmp-driver.c
+index fb0b124..a6b7657 100644
+--- a/drivers/media/video/marvell-ccic/mmp-driver.c
++++ b/drivers/media/video/marvell-ccic/mmp-driver.c
+@@ -175,7 +175,6 @@ static int mmpcam_probe(struct platform_device *pdev)
+        INIT_LIST_HEAD(&cam->devlist);
+ 
+        mcam = &cam->mcam;
+-       mcam->platform = MHP_Armada610;
+        mcam->plat_power_up = mmpcam_power_up;
+        mcam->plat_power_down = mmpcam_power_down;
+        mcam->dev = &pdev->dev;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0025-rc-Postpone-ISR-registration.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0025-rc-Postpone-ISR-registration.patch
new file mode 100644
index 00000000..501e7d8a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0025-rc-Postpone-ISR-registration.patch
@@ -0,0 +1,325 @@
+From 51e9e3cdf5aa99d1bda7d03d213cc4dc0766c7ed Mon Sep 17 00:00:00 2001
+From: Luis Henriques <luis.henriques@canonical.com>
+Date: Sat, 21 Apr 2012 12:25:21 -0300
+Subject: [PATCH 25/56] rc: Postpone ISR registration
+
+commit 9ef449c6b31bb6a8e6dedc24de475a3b8c79be20 upstream.
+
+An early registration of an ISR was causing a crash to several users (for
+example, with the ite-cir driver: http://bugs.launchpad.net/bugs/972723).
+The reason was that IRQs were being triggered before a driver
+initialisation was completed.
+
+This patch fixes this by moving the invocation to request_irq() and to
+request_region() to a later stage on the driver probe function.
+
+Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
+Acked-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/media/rc/ene_ir.c      |   32 ++++++++--------
+ drivers/media/rc/fintek-cir.c  |   20 +++++-----
+ drivers/media/rc/ite-cir.c     |   20 +++++-----
+ drivers/media/rc/nuvoton-cir.c |   36 +++++++++---------
+ drivers/media/rc/winbond-cir.c |   78 ++++++++++++++++++++--------------------
+ 5 files changed, 93 insertions(+), 93 deletions(-)
+
+diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
+index 860c112..bef5296 100644
+--- a/drivers/media/rc/ene_ir.c
++++ b/drivers/media/rc/ene_ir.c
+@@ -1018,22 +1018,6 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
+ 
+        spin_lock_init(&dev->hw_lock);
+ 
+-       /* claim the resources */
+-       error = -EBUSY;
+-       dev->hw_io = pnp_port_start(pnp_dev, 0);
+-       if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) {
+-               dev->hw_io = -1;
+-               dev->irq = -1;
+-               goto error;
+-       }
+-
+-       dev->irq = pnp_irq(pnp_dev, 0);
+-       if (request_irq(dev->irq, ene_isr,
+-                       IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) {
+-               dev->irq = -1;
+-               goto error;
+-       }
+-
+        pnp_set_drvdata(pnp_dev, dev);
+        dev->pnp_dev = pnp_dev;
+ 
+@@ -1086,6 +1070,22 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
+        device_set_wakeup_capable(&pnp_dev->dev, true);
+        device_set_wakeup_enable(&pnp_dev->dev, true);
+ 
++       /* claim the resources */
++       error = -EBUSY;
++       dev->hw_io = pnp_port_start(pnp_dev, 0);
++       if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) {
++               dev->hw_io = -1;
++               dev->irq = -1;
++               goto error;
++       }
++
++       dev->irq = pnp_irq(pnp_dev, 0);
++       if (request_irq(dev->irq, ene_isr,
++                       IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) {
++               dev->irq = -1;
++               goto error;
++       }
++
+        error = rc_register_device(rdev);
+        if (error < 0)
+                goto error;
+diff --git a/drivers/media/rc/fintek-cir.c b/drivers/media/rc/fintek-cir.c
+index 7f7079b..4218f73 100644
+--- a/drivers/media/rc/fintek-cir.c
++++ b/drivers/media/rc/fintek-cir.c
+@@ -504,16 +504,6 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
+ 
+        spin_lock_init(&fintek->fintek_lock);
+ 
+-       ret = -EBUSY;
+-       /* now claim resources */
+-       if (!request_region(fintek->cir_addr,
+-                           fintek->cir_port_len, FINTEK_DRIVER_NAME))
+-               goto failure;
+-
+-       if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
+-                       FINTEK_DRIVER_NAME, (void *)fintek))
+-               goto failure;
+-
+        pnp_set_drvdata(pdev, fintek);
+        fintek->pdev = pdev;
+ 
+@@ -548,6 +538,16 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
+        /* rx resolution is hardwired to 50us atm, 1, 25, 100 also possible */
+        rdev->rx_resolution = US_TO_NS(CIR_SAMPLE_PERIOD);
+ 
++       ret = -EBUSY;
++       /* now claim resources */
++       if (!request_region(fintek->cir_addr,
++                           fintek->cir_port_len, FINTEK_DRIVER_NAME))
++               goto failure;
++
++       if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
++                       FINTEK_DRIVER_NAME, (void *)fintek))
++               goto failure;
++
+        ret = rc_register_device(rdev);
+        if (ret)
+                goto failure;
+diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
+index 682009d..0e49c99 100644
+--- a/drivers/media/rc/ite-cir.c
++++ b/drivers/media/rc/ite-cir.c
+@@ -1515,16 +1515,6 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
+        /* initialize raw event */
+        init_ir_raw_event(&itdev->rawir);
+ 
+-       ret = -EBUSY;
+-       /* now claim resources */
+-       if (!request_region(itdev->cir_addr,
+-                               dev_desc->io_region_size, ITE_DRIVER_NAME))
+-               goto failure;
+-
+-       if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
+-                       ITE_DRIVER_NAME, (void *)itdev))
+-               goto failure;
+-
+        /* set driver data into the pnp device */
+        pnp_set_drvdata(pdev, itdev);
+        itdev->pdev = pdev;
+@@ -1600,6 +1590,16 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
+        rdev->driver_name = ITE_DRIVER_NAME;
+        rdev->map_name = RC_MAP_RC6_MCE;
+ 
++       ret = -EBUSY;
++       /* now claim resources */
++       if (!request_region(itdev->cir_addr,
++                               dev_desc->io_region_size, ITE_DRIVER_NAME))
++               goto failure;
++
++       if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
++                       ITE_DRIVER_NAME, (void *)itdev))
++               goto failure;
++
+        ret = rc_register_device(rdev);
+        if (ret)
+                goto failure;
+diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
+index 144f3f5..8b2c071 100644
+--- a/drivers/media/rc/nuvoton-cir.c
++++ b/drivers/media/rc/nuvoton-cir.c
+@@ -1021,24 +1021,6 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
+        spin_lock_init(&nvt->nvt_lock);
+        spin_lock_init(&nvt->tx.lock);
+ 
+-       ret = -EBUSY;
+-       /* now claim resources */
+-       if (!request_region(nvt->cir_addr,
+-                           CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
+-               goto failure;
+-
+-       if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
+-                       NVT_DRIVER_NAME, (void *)nvt))
+-               goto failure;
+-
+-       if (!request_region(nvt->cir_wake_addr,
+-                           CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
+-               goto failure;
+-
+-       if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
+-                       NVT_DRIVER_NAME, (void *)nvt))
+-               goto failure;
+-
+        pnp_set_drvdata(pdev, nvt);
+        nvt->pdev = pdev;
+ 
+@@ -1085,6 +1067,24 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
+        rdev->tx_resolution = XYZ;
+ #endif
+ 
++       ret = -EBUSY;
++       /* now claim resources */
++       if (!request_region(nvt->cir_addr,
++                           CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
++               goto failure;
++
++       if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
++                       NVT_DRIVER_NAME, (void *)nvt))
++               goto failure;
++
++       if (!request_region(nvt->cir_wake_addr,
++                           CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
++               goto failure;
++
++       if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
++                       NVT_DRIVER_NAME, (void *)nvt))
++               goto failure;
++
+        ret = rc_register_device(rdev);
+        if (ret)
+                goto failure;
+diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
+index a7e7d6f..4591770 100644
+--- a/drivers/media/rc/winbond-cir.c
++++ b/drivers/media/rc/winbond-cir.c
+@@ -991,39 +991,10 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
+                "(w: 0x%lX, e: 0x%lX, s: 0x%lX, i: %u)\n",
+                data->wbase, data->ebase, data->sbase, data->irq);
+ 
+-       if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
+-               dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+-                       data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1);
+-               err = -EBUSY;
+-               goto exit_free_data;
+-       }
+-
+-       if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) {
+-               dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+-                       data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1);
+-               err = -EBUSY;
+-               goto exit_release_wbase;
+-       }
+-
+-       if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) {
+-               dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+-                       data->sbase, data->sbase + SP_IOMEM_LEN - 1);
+-               err = -EBUSY;
+-               goto exit_release_ebase;
+-       }
+-
+-       err = request_irq(data->irq, wbcir_irq_handler,
+-                         IRQF_DISABLED, DRVNAME, device);
+-       if (err) {
+-               dev_err(dev, "Failed to claim IRQ %u\n", data->irq);
+-               err = -EBUSY;
+-               goto exit_release_sbase;
+-       }
+-
+        led_trigger_register_simple("cir-tx", &data->txtrigger);
+        if (!data->txtrigger) {
+                err = -ENOMEM;
+-               goto exit_free_irq;
++               goto exit_free_data;
+        }
+ 
+        led_trigger_register_simple("cir-rx", &data->rxtrigger);
+@@ -1062,9 +1033,38 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
+        data->dev->priv = data;
+        data->dev->dev.parent = &device->dev;
+ 
++       if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
++               dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
++                       data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1);
++               err = -EBUSY;
++               goto exit_free_rc;
++       }
++
++       if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) {
++               dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
++                       data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1);
++               err = -EBUSY;
++               goto exit_release_wbase;
++       }
++
++       if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) {
++               dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
++                       data->sbase, data->sbase + SP_IOMEM_LEN - 1);
++               err = -EBUSY;
++               goto exit_release_ebase;
++       }
++
++       err = request_irq(data->irq, wbcir_irq_handler,
++                         IRQF_DISABLED, DRVNAME, device);
++       if (err) {
++               dev_err(dev, "Failed to claim IRQ %u\n", data->irq);
++               err = -EBUSY;
++               goto exit_release_sbase;
++       }
++
+        err = rc_register_device(data->dev);
+        if (err)
+-               goto exit_free_rc;
++               goto exit_free_irq;
+ 
+        device_init_wakeup(&device->dev, 1);
+ 
+@@ -1072,14 +1072,6 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
+ 
+        return 0;
+ 
+-exit_free_rc:
+-       rc_free_device(data->dev);
+-exit_unregister_led:
+-       led_classdev_unregister(&data->led);
+-exit_unregister_rxtrigger:
+-       led_trigger_unregister_simple(data->rxtrigger);
+-exit_unregister_txtrigger:
+-       led_trigger_unregister_simple(data->txtrigger);
+ exit_free_irq:
+        free_irq(data->irq, device);
+ exit_release_sbase:
+@@ -1088,6 +1080,14 @@ exit_release_ebase:
+        release_region(data->ebase, EHFUNC_IOMEM_LEN);
+ exit_release_wbase:
+        release_region(data->wbase, WAKEUP_IOMEM_LEN);
++exit_free_rc:
++       rc_free_device(data->dev);
++exit_unregister_led:
++       led_classdev_unregister(&data->led);
++exit_unregister_rxtrigger:
++       led_trigger_unregister_simple(data->rxtrigger);
++exit_unregister_txtrigger:
++       led_trigger_unregister_simple(data->txtrigger);
+ exit_free_data:
+        kfree(data);
+        pnp_set_drvdata(device, NULL);
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0026-cdc_ether-Ignore-bogus-union-descriptor-for-RNDIS-de.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0026-cdc_ether-Ignore-bogus-union-descriptor-for-RNDIS-de.patch
new file mode 100644
index 00000000..718254ab
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0026-cdc_ether-Ignore-bogus-union-descriptor-for-RNDIS-de.patch
@@ -0,0 +1,75 @@
+From 701699958f6f1770bf758ebac587fd85e73e8c76 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Thu, 26 Apr 2012 02:35:10 +0000
+Subject: [PATCH 26/56] cdc_ether: Ignore bogus union descriptor for RNDIS
+ devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 6eddcb4c82883451aec3be1240f17793370fa62f upstream.
+
+Some RNDIS devices include a bogus CDC Union descriptor pointing
+to non-existing interfaces.  The RNDIS code is already prepared
+to handle devices without a CDC Union descriptor by hardwiring
+the driver to use interfaces 0 and 1, which is correct for the
+devices with the bogus descriptor as well. So we can reuse the
+existing workaround.
+
+Cc: Markus Kolb <linux-201011@tower-net.de>
+Cc: Iker Salmón San Millán <shaola@esdebian.org>
+Cc: Jonathan Nieder <jrnieder@gmail.com>
+Cc: Oliver Neukum <oliver@neukum.org>
+Cc: 655387@bugs.debian.org
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/usb/cdc_ether.c |   14 ++++++++++++--
+ 1 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index 4fd4144..eac4886 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -83,6 +83,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+        struct cdc_state                *info = (void *) &dev->data;
+        int                             status;
+        int                             rndis;
++       bool                            android_rndis_quirk = false;
+        struct usb_driver               *driver = driver_of(intf);
+        struct usb_cdc_mdlm_desc        *desc = NULL;
+        struct usb_cdc_mdlm_detail_desc *detail = NULL;
+@@ -195,6 +196,11 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+                                        info->control,
+                                        info->u->bSlaveInterface0,
+                                        info->data);
++                               /* fall back to hard-wiring for RNDIS */
++                               if (rndis) {
++                                       android_rndis_quirk = true;
++                                       goto next_desc;
++                               }
+                                goto bad_desc;
+                        }
+                        if (info->control != intf) {
+@@ -271,11 +277,15 @@ next_desc:
+        /* Microsoft ActiveSync based and some regular RNDIS devices lack the
+         * CDC descriptors, so we'll hard-wire the interfaces and not check
+         * for descriptors.
++        *
++        * Some Android RNDIS devices have a CDC Union descriptor pointing
++        * to non-existing interfaces.  Ignore that and attempt the same
++        * hard-wired 0 and 1 interfaces.
+         */
+-       if (rndis && !info->u) {
++       if (rndis && (!info->u || android_rndis_quirk)) {
+                info->control = usb_ifnum_to_if(dev->udev, 0);
+                info->data = usb_ifnum_to_if(dev->udev, 1);
+-               if (!info->control || !info->data) {
++               if (!info->control || !info->data || info->control != intf) {
+                        dev_dbg(&intf->dev,
+                                "rndis: master #0/%p slave #1/%p\n",
+                                info->control,
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0027-jffs2-Fix-lock-acquisition-order-bug-in-gc-path.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0027-jffs2-Fix-lock-acquisition-order-bug-in-gc-path.patch
new file mode 100644
index 00000000..4f321553
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0027-jffs2-Fix-lock-acquisition-order-bug-in-gc-path.patch
@@ -0,0 +1,103 @@
+From f1c7fc81d6b170d79df0dc657040e42ece3b1953 Mon Sep 17 00:00:00 2001
+From: Josh Cartwright <joshc@linux.com>
+Date: Thu, 29 Mar 2012 19:34:53 -0400
+Subject: [PATCH 27/56] jffs2: Fix lock acquisition order bug in gc path
+
+commit 226bb7df3d22bcf4a1c0fe8206c80cc427498eae upstream.
+
+The locking policy is such that the erase_complete_block spinlock is
+nested within the alloc_sem mutex.  This fixes a case in which the
+acquisition order was erroneously reversed.  This issue was caught by
+the following lockdep splat:
+
+   =======================================================
+   [ INFO: possible circular locking dependency detected ]
+   3.0.5 #1
+   -------------------------------------------------------
+   jffs2_gcd_mtd6/299 is trying to acquire lock:
+    (&c->alloc_sem){+.+.+.}, at: [<c01f7714>] jffs2_garbage_collect_pass+0x314/0x890
+
+   but task is already holding lock:
+    (&(&c->erase_completion_lock)->rlock){+.+...}, at: [<c01f7708>] jffs2_garbage_collect_pass+0x308/0x890
+
+   which lock already depends on the new lock.
+
+   the existing dependency chain (in reverse order) is:
+
+   -> #1 (&(&c->erase_completion_lock)->rlock){+.+...}:
+          [<c008bec4>] validate_chain+0xe6c/0x10bc
+          [<c008c660>] __lock_acquire+0x54c/0xba4
+          [<c008d240>] lock_acquire+0xa4/0x114
+          [<c046780c>] _raw_spin_lock+0x3c/0x4c
+          [<c01f744c>] jffs2_garbage_collect_pass+0x4c/0x890
+          [<c01f937c>] jffs2_garbage_collect_thread+0x1b4/0x1cc
+          [<c0071a68>] kthread+0x98/0xa0
+          [<c000f264>] kernel_thread_exit+0x0/0x8
+
+   -> #0 (&c->alloc_sem){+.+.+.}:
+          [<c008ad2c>] print_circular_bug+0x70/0x2c4
+          [<c008c08c>] validate_chain+0x1034/0x10bc
+          [<c008c660>] __lock_acquire+0x54c/0xba4
+          [<c008d240>] lock_acquire+0xa4/0x114
+          [<c0466628>] mutex_lock_nested+0x74/0x33c
+          [<c01f7714>] jffs2_garbage_collect_pass+0x314/0x890
+          [<c01f937c>] jffs2_garbage_collect_thread+0x1b4/0x1cc
+          [<c0071a68>] kthread+0x98/0xa0
+          [<c000f264>] kernel_thread_exit+0x0/0x8
+
+   other info that might help us debug this:
+
+    Possible unsafe locking scenario:
+
+          CPU0                    CPU1
+          ----                    ----
+     lock(&(&c->erase_completion_lock)->rlock);
+                                  lock(&c->alloc_sem);
+                                  lock(&(&c->erase_completion_lock)->rlock);
+     lock(&c->alloc_sem);
+
+    *** DEADLOCK ***
+
+   1 lock held by jffs2_gcd_mtd6/299:
+    #0:  (&(&c->erase_completion_lock)->rlock){+.+...}, at: [<c01f7708>] jffs2_garbage_collect_pass+0x308/0x890
+
+   stack backtrace:
+   [<c00155dc>] (unwind_backtrace+0x0/0x100) from [<c0463dc0>] (dump_stack+0x20/0x24)
+   [<c0463dc0>] (dump_stack+0x20/0x24) from [<c008ae84>] (print_circular_bug+0x1c8/0x2c4)
+   [<c008ae84>] (print_circular_bug+0x1c8/0x2c4) from [<c008c08c>] (validate_chain+0x1034/0x10bc)
+   [<c008c08c>] (validate_chain+0x1034/0x10bc) from [<c008c660>] (__lock_acquire+0x54c/0xba4)
+   [<c008c660>] (__lock_acquire+0x54c/0xba4) from [<c008d240>] (lock_acquire+0xa4/0x114)
+   [<c008d240>] (lock_acquire+0xa4/0x114) from [<c0466628>] (mutex_lock_nested+0x74/0x33c)
+   [<c0466628>] (mutex_lock_nested+0x74/0x33c) from [<c01f7714>] (jffs2_garbage_collect_pass+0x314/0x890)
+   [<c01f7714>] (jffs2_garbage_collect_pass+0x314/0x890) from [<c01f937c>] (jffs2_garbage_collect_thread+0x1b4/0x1cc)
+   [<c01f937c>] (jffs2_garbage_collect_thread+0x1b4/0x1cc) from [<c0071a68>] (kthread+0x98/0xa0)
+   [<c0071a68>] (kthread+0x98/0xa0) from [<c000f264>] (kernel_thread_exit+0x0/0x8)
+
+This was introduce in '81cfc9f jffs2: Fix serious write stall due to erase'.
+
+Signed-off-by: Josh Cartwright <joshc@linux.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/jffs2/gc.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c
+index 31dce61..4bbd521 100644
+--- a/fs/jffs2/gc.c
++++ b/fs/jffs2/gc.c
+@@ -225,8 +225,8 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
+                        return 0;
+ 
+                D1(printk(KERN_DEBUG "No progress from erasing blocks; doing GC anyway\n"));
+-               spin_lock(&c->erase_completion_lock);
+                mutex_lock(&c->alloc_sem);
++               spin_lock(&c->erase_completion_lock);
+        }
+ 
+        /* First, work out which block we're garbage-collecting */
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0028-s5p-fimc-Fix-locking-in-subdev-set_crop-op.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0028-s5p-fimc-Fix-locking-in-subdev-set_crop-op.patch
new file mode 100644
index 00000000..df322fd6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0028-s5p-fimc-Fix-locking-in-subdev-set_crop-op.patch
@@ -0,0 +1,35 @@
+From fdde7964742c3802205c7fa50677abfe7b462bfd Mon Sep 17 00:00:00 2001
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Date: Sat, 21 Apr 2012 18:46:30 -0300
+Subject: [PATCH 28/56] s5p-fimc: Fix locking in subdev set_crop op
+
+commit e985dbf7d93e2a3e114b4525413e50f83613e0cb upstream.
+
+When setting TRY crop on the sub-device the mutex was erroneously acquired
+rather than released on exit path. This bug is present in kernels starting
+from v3.2.
+
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/media/video/s5p-fimc/fimc-capture.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
+index 2cc3b91..327a81f 100644
+--- a/drivers/media/video/s5p-fimc/fimc-capture.c
++++ b/drivers/media/video/s5p-fimc/fimc-capture.c
+@@ -1304,7 +1304,7 @@ static int fimc_subdev_set_crop(struct v4l2_subdev *sd,
+        fimc_capture_try_crop(ctx, r, crop->pad);
+ 
+        if (crop->which == V4L2_SUBDEV_FORMAT_TRY) {
+-               mutex_lock(&fimc->lock);
++               mutex_unlock(&fimc->lock);
+                *v4l2_subdev_get_try_crop(fh, crop->pad) = *r;
+                return 0;
+        }
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0029-dm-mpath-check-if-scsi_dh-module-already-loaded-befo.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0029-dm-mpath-check-if-scsi_dh-module-already-loaded-befo.patch
new file mode 100644
index 00000000..cbbc4f14
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0029-dm-mpath-check-if-scsi_dh-module-already-loaded-befo.patch
@@ -0,0 +1,39 @@
+From 6cbf63344c48a119864df9c5873d0407a32d9872 Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Sat, 12 May 2012 01:43:21 +0100
+Subject: [PATCH 29/56] dm mpath: check if scsi_dh module already loaded
+ before trying to load
+
+commit 510193a2d3d2e03ae53b95c0ae4f33cdff02cbf8 upstream.
+
+If the requested scsi_dh module is already loaded then skip
+request_module().
+
+Multipath table loads can hang in an unnecessary __request_module.
+
+Reported-by: Ben Marzinski <bmarzins@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/md/dm-mpath.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 801d92d..a417f94 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -698,8 +698,8 @@ static int parse_hw_handler(struct dm_arg_set *as, struct multipath *m)
+                return 0;
+ 
+        m->hw_handler_name = kstrdup(dm_shift_arg(as), GFP_KERNEL);
+-       request_module("scsi_dh_%s", m->hw_handler_name);
+-       if (scsi_dh_handler_exist(m->hw_handler_name) == 0) {
++       if (!try_then_request_module(scsi_dh_handler_exist(m->hw_handler_name),
++                                    "scsi_dh_%s", m->hw_handler_name)) {
+                ti->error = "unknown hardware handler type";
+                ret = -EINVAL;
+                goto fail;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0030-sparc64-Do-not-clobber-g2-in-xcall_fetch_glob_regs.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0030-sparc64-Do-not-clobber-g2-in-xcall_fetch_glob_regs.patch
new file mode 100644
index 00000000..a684875a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0030-sparc64-Do-not-clobber-g2-in-xcall_fetch_glob_regs.patch
@@ -0,0 +1,58 @@
+From 03ddf7fce874ca8243c81666ca3cc742f195781b Mon Sep 17 00:00:00 2001
+From: "David S. Miller" <davem@davemloft.net>
+Date: Thu, 10 May 2012 11:00:46 -0700
+Subject: [PATCH 30/56] sparc64: Do not clobber %g2 in
+ xcall_fetch_glob_regs().
+
+[ Upstream commit a5a737e090e25981e99d69f01400e3a80356581c ]
+
+%g2 is meant to hold the CPUID number throughout this routine, since
+at the very beginning, and at the very end, we use %g2 to calculate
+indexes into per-cpu arrays.
+
+However we erroneously clobber it in order to hold the %cwp register
+value mid-stream.
+
+Fix this code to use %g3 for the %cwp read and related calulcations
+instead.
+
+Reported-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/sparc/kernel/central.c |    2 +-
+ arch/sparc/mm/ultra.S       |    6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/sparc/kernel/central.c b/arch/sparc/kernel/central.c
+index 38d48a5..9708851 100644
+--- a/arch/sparc/kernel/central.c
++++ b/arch/sparc/kernel/central.c
+@@ -269,4 +269,4 @@ static int __init sunfire_init(void)
+        return 0;
+ }
+ 
+-subsys_initcall(sunfire_init);
++fs_initcall(sunfire_init);
+diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
+index b57a594..874162a 100644
+--- a/arch/sparc/mm/ultra.S
++++ b/arch/sparc/mm/ultra.S
+@@ -495,11 +495,11 @@ xcall_fetch_glob_regs:
+        stx             %o7, [%g1 + GR_SNAP_O7]
+        stx             %i7, [%g1 + GR_SNAP_I7]
+        /* Don't try this at home kids... */
+-       rdpr            %cwp, %g2
+-       sub             %g2, 1, %g7
++       rdpr            %cwp, %g3
++       sub             %g3, 1, %g7
+        wrpr            %g7, %cwp
+        mov             %i7, %g7
+-       wrpr            %g2, %cwp
++       wrpr            %g3, %cwp
+        stx             %g7, [%g1 + GR_SNAP_RPC]
+        sethi           %hi(trap_block), %g7
+        or              %g7, %lo(trap_block), %g7
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0031-gpio-Add-missing-spin_lock_init-in-gpio-ml-ioh-drive.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0031-gpio-Add-missing-spin_lock_init-in-gpio-ml-ioh-drive.patch
new file mode 100644
index 00000000..bc85a028
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0031-gpio-Add-missing-spin_lock_init-in-gpio-ml-ioh-drive.patch
@@ -0,0 +1,33 @@
+From 37f2f887df9f3c8428bd1776a5c0ca1d302b3ea1 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@gmail.com>
+Date: Wed, 1 Feb 2012 10:50:05 +0800
+Subject: [PATCH 31/56] gpio: Add missing spin_lock_init in gpio-ml-ioh driver
+
+commit 7e3a70fb7bccada029c188c89bfbf3c0a63c1500 upstream.
+
+This bug was introduced by commit 54be5663
+"gpio-ml-ioh: Support interrupt function" which adds a spinlock to struct
+ioh_gpio but never init the spinlock.
+
+Signed-off-by: Axel Lin <axel.lin@gmail.com>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/gpio/gpio-ml-ioh.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c
+index 461958f..271fd49 100644
+--- a/drivers/gpio/gpio-ml-ioh.c
++++ b/drivers/gpio/gpio-ml-ioh.c
+@@ -448,6 +448,7 @@ static int __devinit ioh_gpio_probe(struct pci_dev *pdev,
+                chip->reg = chip->base;
+                chip->ch = i;
+                mutex_init(&chip->lock);
++               spin_lock_init(&chip->spinlock);
+                ioh_gpio_setup(chip, num_ports[i]);
+                ret = gpiochip_add(&chip->gpio);
+                if (ret) {
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0032-spi-topcliff-pch-Modify-pci-bus-number-dynamically-t.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0032-spi-topcliff-pch-Modify-pci-bus-number-dynamically-t.patch
new file mode 100644
index 00000000..e46fe625
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0032-spi-topcliff-pch-Modify-pci-bus-number-dynamically-t.patch
@@ -0,0 +1,32 @@
+From e985aa700788ca6b938d4505cbe1dbdd88a3dbfd Mon Sep 17 00:00:00 2001
+From: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Date: Fri, 9 Dec 2011 13:11:42 +0900
+Subject: [PATCH 32/56] spi-topcliff-pch: Modify pci-bus number dynamically to
+ get DMA device info
+
+commit ee2ece5261a639b89f194d141444b03b4c923179 upstream.
+
+Signed-off-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/spi/spi-topcliff-pch.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index 54b9d2e..3238ec8 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -924,7 +924,8 @@ static void pch_spi_request_dma(struct pch_spi_data *data, int bpw)
+        dma_cap_set(DMA_SLAVE, mask);
+ 
+        /* Get DMA's dev information */
+-       dma_dev = pci_get_bus_and_slot(2, PCI_DEVFN(12, 0));
++       dma_dev = pci_get_bus_and_slot(data->board_dat->pdev->bus->number,
++                                      PCI_DEVFN(12, 0));
+ 
+        /* Set Tx DMA */
+        param = &dma->param_tx;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0033-spi-topcliff-pch-Fix-issue-for-transmitting-over-4KB.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0033-spi-topcliff-pch-Fix-issue-for-transmitting-over-4KB.patch
new file mode 100644
index 00000000..f11f8c14
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0033-spi-topcliff-pch-Fix-issue-for-transmitting-over-4KB.patch
@@ -0,0 +1,187 @@
+From fcd3dfee85be4b4bdde47eecba12490ede6218d2 Mon Sep 17 00:00:00 2001
+From: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Date: Fri, 9 Dec 2011 13:13:27 +0900
+Subject: [PATCH 33/56] spi-topcliff-pch: Fix issue for transmitting over
+ 4KByte
+
+commit 7d05b3e868ee0f9231baf40cb77be3df5dd1f18c upstream.
+
+Currently, when spi-topcliff-pch receives transmit request over 4KByte,
+this driver can't process correctly. This driver needs to divide the data
+into 4Kbyte unit.
+This patch fixes the issue.
+
+Signed-off-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/spi/spi-topcliff-pch.c |   66 +++++++++++++++++++++++++++++++++-------
+ 1 files changed, 55 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index 3238ec8..1e60827 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -196,6 +196,7 @@ struct pch_spi_data {
+        struct pch_spi_dma_ctrl dma;
+        int use_dma;
+        u8 irq_reg_sts;
++       int save_total_len;
+ };
+ 
+ /**
+@@ -823,11 +824,13 @@ static void pch_spi_copy_rx_data_for_dma(struct pch_spi_data *data, int bpw)
+                rx_dma_buf = data->dma.rx_buf_virt;
+                for (j = 0; j < data->bpw_len; j++)
+                        *rx_buf++ = *rx_dma_buf++ & 0xFF;
++               data->cur_trans->rx_buf = rx_buf;
+        } else {
+                rx_sbuf = data->cur_trans->rx_buf;
+                rx_dma_sbuf = data->dma.rx_buf_virt;
+                for (j = 0; j < data->bpw_len; j++)
+                        *rx_sbuf++ = *rx_dma_sbuf++;
++               data->cur_trans->rx_buf = rx_sbuf;
+        }
+ }
+ 
+@@ -853,6 +856,9 @@ static int pch_spi_start_transfer(struct pch_spi_data *data)
+        rtn = wait_event_interruptible_timeout(data->wait,
+                                               data->transfer_complete,
+                                               msecs_to_jiffies(2 * HZ));
++       if (!rtn)
++               dev_err(&data->master->dev,
++                       "%s wait-event timeout\n", __func__);
+ 
+        dma_sync_sg_for_cpu(&data->master->dev, dma->sg_rx_p, dma->nent,
+                            DMA_FROM_DEVICE);
+@@ -989,6 +995,7 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+        int i;
+        int size;
+        int rem;
++       int head;
+        unsigned long flags;
+        struct pch_spi_dma_ctrl *dma;
+ 
+@@ -1017,6 +1024,11 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+        }
+        data->bpw_len = data->cur_trans->len / (*bpw / 8);
+ 
++       if (data->bpw_len > PCH_BUF_SIZE) {
++               data->bpw_len = PCH_BUF_SIZE;
++               data->cur_trans->len -= PCH_BUF_SIZE;
++       }
++
+        /* copy Tx Data */
+        if (data->cur_trans->tx_buf != NULL) {
+                if (*bpw == 8) {
+@@ -1031,10 +1043,17 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+                                *tx_dma_sbuf++ = *tx_sbuf++;
+                }
+        }
++
++       /* Calculate Rx parameter for DMA transmitting */
+        if (data->bpw_len > PCH_DMA_TRANS_SIZE) {
+-               num = data->bpw_len / PCH_DMA_TRANS_SIZE + 1;
++               if (data->bpw_len % PCH_DMA_TRANS_SIZE) {
++                       num = data->bpw_len / PCH_DMA_TRANS_SIZE + 1;
++                       rem = data->bpw_len % PCH_DMA_TRANS_SIZE;
++               } else {
++                       num = data->bpw_len / PCH_DMA_TRANS_SIZE;
++                       rem = PCH_DMA_TRANS_SIZE;
++               }
+                size = PCH_DMA_TRANS_SIZE;
+-               rem = data->bpw_len % PCH_DMA_TRANS_SIZE;
+        } else {
+                num = 1;
+                size = data->bpw_len;
+@@ -1094,15 +1113,23 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+        dma->nent = num;
+        dma->desc_rx = desc_rx;
+ 
+-       /* TX */
+-       if (data->bpw_len > PCH_DMA_TRANS_SIZE) {
+-               num = data->bpw_len / PCH_DMA_TRANS_SIZE;
++       /* Calculate Tx parameter for DMA transmitting */
++       if (data->bpw_len > PCH_MAX_FIFO_DEPTH) {
++               head = PCH_MAX_FIFO_DEPTH - PCH_DMA_TRANS_SIZE;
++               if (data->bpw_len % PCH_DMA_TRANS_SIZE > 4) {
++                       num = data->bpw_len / PCH_DMA_TRANS_SIZE + 1;
++                       rem = data->bpw_len % PCH_DMA_TRANS_SIZE - head;
++               } else {
++                       num = data->bpw_len / PCH_DMA_TRANS_SIZE;
++                       rem = data->bpw_len % PCH_DMA_TRANS_SIZE +
++                             PCH_DMA_TRANS_SIZE - head;
++               }
+                size = PCH_DMA_TRANS_SIZE;
+-               rem = 16;
+        } else {
+                num = 1;
+                size = data->bpw_len;
+                rem = data->bpw_len;
++               head = 0;
+        }
+ 
+        dma->sg_tx_p = kzalloc(sizeof(struct scatterlist)*num, GFP_ATOMIC);
+@@ -1112,11 +1139,17 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+        for (i = 0; i < num; i++, sg++) {
+                if (i == 0) {
+                        sg->offset = 0;
++                       sg_set_page(sg, virt_to_page(dma->tx_buf_virt), size + head,
++                                   sg->offset);
++                       sg_dma_len(sg) = size + head;
++               } else if (i == (num - 1)) {
++                       sg->offset = head + size * i;
++                       sg->offset = sg->offset * (*bpw / 8);
+                        sg_set_page(sg, virt_to_page(dma->tx_buf_virt), rem,
+                                    sg->offset);
+                        sg_dma_len(sg) = rem;
+                } else {
+-                       sg->offset = rem + size * (i - 1);
++                       sg->offset = head + size * i;
+                        sg->offset = sg->offset * (*bpw / 8);
+                        sg_set_page(sg, virt_to_page(dma->tx_buf_virt), size,
+                                    sg->offset);
+@@ -1204,6 +1237,7 @@ static void pch_spi_process_messages(struct work_struct *pwork)
+                                    data->current_msg->spi->bits_per_word);
+        pch_spi_writereg(data->master, PCH_SSNXCR, SSN_NO_CONTROL);
+        do {
++               int cnt;
+                /* If we are already processing a message get the next
+                transfer structure from the message otherwise retrieve
+                the 1st transfer request from the message. */
+@@ -1223,11 +1257,20 @@ static void pch_spi_process_messages(struct work_struct *pwork)
+                }
+                spin_unlock(&data->lock);
+ 
++               if (!data->cur_trans->len)
++                       goto out;
++               cnt = (data->cur_trans->len - 1) / PCH_BUF_SIZE + 1;
++               data->save_total_len = data->cur_trans->len;
+                if (data->use_dma) {
+-                       pch_spi_handle_dma(data, &bpw);
+-                       if (!pch_spi_start_transfer(data))
+-                               goto out;
+-                       pch_spi_copy_rx_data_for_dma(data, bpw);
++                       int i;
++                       char *save_rx_buf = data->cur_trans->rx_buf;
++                       for (i = 0; i < cnt; i ++) {
++                               pch_spi_handle_dma(data, &bpw);
++                               if (!pch_spi_start_transfer(data))
++                                       goto out;
++                               pch_spi_copy_rx_data_for_dma(data, bpw);
++                       }
++                       data->cur_trans->rx_buf = save_rx_buf;
+                } else {
+                        pch_spi_set_tx(data, &bpw);
+                        pch_spi_set_ir(data);
+@@ -1238,6 +1281,7 @@ static void pch_spi_process_messages(struct work_struct *pwork)
+                        data->pkt_tx_buff = NULL;
+                }
+                /* increment message count */
++               data->cur_trans->len = data->save_total_len;
+                data->current_msg->actual_length += data->cur_trans->len;
+ 
+                dev_dbg(&data->master->dev,
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0034-spi-topcliff-pch-supports-a-spi-mode-setup-and-bit-o.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0034-spi-topcliff-pch-supports-a-spi-mode-setup-and-bit-o.patch
new file mode 100644
index 00000000..c9d0ab75
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0034-spi-topcliff-pch-supports-a-spi-mode-setup-and-bit-o.patch
@@ -0,0 +1,34 @@
+From 3e43ac1c2f64e955c74f598621363028d87a93c2 Mon Sep 17 00:00:00 2001
+From: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Date: Fri, 9 Dec 2011 13:13:28 +0900
+Subject: [PATCH 34/56] spi-topcliff-pch: supports a spi mode setup and bit
+ order setup by IO control
+
+commit f258b44e22e07f5e98ac2260c70acff5784791b6 upstream.
+
+This patch supports a spi mode setup and bit order setup by IO control.
+    spi mode:     mode 0 to mode 3
+    bit order:    LSB first, MSB first
+
+Signed-off-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/spi/spi-topcliff-pch.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index 1e60827..0c4efed 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -1434,6 +1434,7 @@ static int __devinit pch_spi_pd_probe(struct platform_device *plat_dev)
+        master->num_chipselect = PCH_MAX_CS;
+        master->setup = pch_spi_setup;
+        master->transfer = pch_spi_transfer;
++       master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_LSB_FIRST;
+ 
+        data->board_dat = board_dat;
+        data->plat_dev = plat_dev;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0035-spi-topcliff-pch-add-recovery-processing-in-case-wai.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0035-spi-topcliff-pch-add-recovery-processing-in-case-wai.patch
new file mode 100644
index 00000000..5370de52
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0035-spi-topcliff-pch-add-recovery-processing-in-case-wai.patch
@@ -0,0 +1,43 @@
+From 0c6c9c1d69fbdd6a1f54668a2c9f8f306c702728 Mon Sep 17 00:00:00 2001
+From: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Date: Fri, 9 Dec 2011 13:13:29 +0900
+Subject: [PATCH 35/56] spi-topcliff-pch: add recovery processing in case
+ wait-event timeout
+
+commit 0f57e168aa109775430c76cc663fb64909813d84 upstream.
+
+Currently, pch_spi_start_transfer failure is not anticipated.
+This patch adds the processing.
+
+Signed-off-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/spi/spi-topcliff-pch.c |   10 +++++++++-
+ 1 files changed, 9 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index 0c4efed..1590dbd 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -1266,8 +1266,16 @@ static void pch_spi_process_messages(struct work_struct *pwork)
+                        char *save_rx_buf = data->cur_trans->rx_buf;
+                        for (i = 0; i < cnt; i ++) {
+                                pch_spi_handle_dma(data, &bpw);
+-                               if (!pch_spi_start_transfer(data))
++                               if (!pch_spi_start_transfer(data)) {
++                                       data->transfer_complete = true;
++                                       data->current_msg->status = -EIO;
++                                       data->current_msg->complete
++                                                  (data->current_msg->context);
++                                       data->bcurrent_msg_processing = false;
++                                       data->current_msg = NULL;
++                                       data->cur_trans = NULL;
+                                        goto out;
++                               }
+                                pch_spi_copy_rx_data_for_dma(data, bpw);
+                        }
+                        data->cur_trans->rx_buf = save_rx_buf;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0036-ext4-avoid-deadlock-on-sync-mounted-FS-w-o-journal.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0036-ext4-avoid-deadlock-on-sync-mounted-FS-w-o-journal.patch
new file mode 100644
index 00000000..ffdd9961
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0036-ext4-avoid-deadlock-on-sync-mounted-FS-w-o-journal.patch
@@ -0,0 +1,64 @@
+From ee9d8cc0c47d0095d5d27b81b7459fa534c56a67 Mon Sep 17 00:00:00 2001
+From: Eric Sandeen <sandeen@redhat.com>
+Date: Mon, 20 Feb 2012 23:06:18 -0500
+Subject: [PATCH 36/56] ext4: avoid deadlock on sync-mounted FS w/o journal
+
+commit c1bb05a657fb3d8c6179a4ef7980261fae4521d7 upstream.
+
+Processes hang forever on a sync-mounted ext2 file system that
+is mounted with the ext4 module (default in Fedora 16).
+
+I can reproduce this reliably by mounting an ext2 partition with
+"-o sync" and opening a new file an that partition with vim. vim
+will hang in "D" state forever.  The same happens on ext4 without
+a journal.
+
+I am attaching a small patch here that solves this issue for me.
+In the sync mounted case without a journal,
+ext4_handle_dirty_metadata() may call sync_dirty_buffer(), which
+can't be called with buffer lock held.
+
+Also move mb_cache_entry_release inside lock to avoid race
+fixed previously by 8a2bfdcb ext[34]: EA block reference count racing fix
+Note too that ext2 fixed this same problem in 2006 with
+b2f49033 [PATCH] fix deadlock in ext2
+
+Signed-off-by: Martin.Wilck@ts.fujitsu.com
+[sandeen@redhat.com: move mb_cache_entry_release before unlock, edit commit msg]
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ext4/xattr.c |    7 ++++---
+ 1 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 93a00d8..4410ae7 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -487,18 +487,19 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
+                ext4_free_blocks(handle, inode, bh, 0, 1,
+                                 EXT4_FREE_BLOCKS_METADATA |
+                                 EXT4_FREE_BLOCKS_FORGET);
++               unlock_buffer(bh);
+        } else {
+                le32_add_cpu(&BHDR(bh)->h_refcount, -1);
++               if (ce)
++                       mb_cache_entry_release(ce);
++               unlock_buffer(bh);
+                error = ext4_handle_dirty_metadata(handle, inode, bh);
+                if (IS_SYNC(inode))
+                        ext4_handle_sync(handle);
+                dquot_free_block(inode, 1);
+                ea_bdebug(bh, "refcount now=%d; releasing",
+                          le32_to_cpu(BHDR(bh)->h_refcount));
+-               if (ce)
+-                       mb_cache_entry_release(ce);
+        }
+-       unlock_buffer(bh);
+ out:
+        ext4_std_error(inode->i_sb, error);
+        return;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0037-ia64-Add-accept4-syscall.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0037-ia64-Add-accept4-syscall.patch
new file mode 100644
index 00000000..fa24f4d7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0037-ia64-Add-accept4-syscall.patch
@@ -0,0 +1,57 @@
+From 0ab7c7f97658245faa8a63b0e4870f5459f53e6e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=89meric=20Maschino?= <emeric.maschino@gmail.com>
+Date: Mon, 9 Jan 2012 12:55:10 -0800
+Subject: [PATCH 37/56] ia64: Add accept4() syscall
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 65cc21b4523e94d5640542a818748cd3be8cd6b4 upstream.
+
+While debugging udev > 170 failure on Debian Wheezy
+(http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648325), it appears
+that the issue was in fact due to missing accept4() in ia64.
+
+This patch simply adds accept4() to ia64.
+
+Signed-off-by: Émeric Maschino <emeric.maschino@gmail.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/ia64/include/asm/unistd.h |    3 ++-
+ arch/ia64/kernel/entry.S       |    1 +
+ 2 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h
+index 7617248..7a3bd25 100644
+--- a/arch/ia64/include/asm/unistd.h
++++ b/arch/ia64/include/asm/unistd.h
+@@ -323,11 +323,12 @@
+ #define __NR_sendmmsg                  1331
+ #define __NR_process_vm_readv          1332
+ #define __NR_process_vm_writev         1333
++#define __NR_accept4                   1334
+ 
+ #ifdef __KERNEL__
+ 
+ 
+-#define NR_syscalls                    310 /* length of syscall table */
++#define NR_syscalls                    311 /* length of syscall table */
+ 
+ /*
+  * The following defines stop scripts/checksyscalls.sh from complaining about
+diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
+index 5b31d46..1ccbe12 100644
+--- a/arch/ia64/kernel/entry.S
++++ b/arch/ia64/kernel/entry.S
+@@ -1779,6 +1779,7 @@ sys_call_table:
+        data8 sys_sendmmsg
+        data8 sys_process_vm_readv
+        data8 sys_process_vm_writev
++       data8 sys_accept4
+ 
+        .org sys_call_table + 8*NR_syscalls     // guard against failures to increase NR_syscalls
+ #endif /* __IA64_ASM_PARAVIRTUALIZED_NATIVE */
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0038-brcm80211-smac-fix-endless-retry-of-A-MPDU-transmiss.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0038-brcm80211-smac-fix-endless-retry-of-A-MPDU-transmiss.patch
new file mode 100644
index 00000000..09f5e5b0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0038-brcm80211-smac-fix-endless-retry-of-A-MPDU-transmiss.patch
@@ -0,0 +1,60 @@
+From 258bf060571803e3260270a579344d4a69eafe98 Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend@broadcom.com>
+Date: Thu, 9 Feb 2012 21:08:58 +0100
+Subject: [PATCH 38/56] brcm80211: smac: fix endless retry of A-MPDU
+ transmissions
+
+commit 5e379203c7788b7af01150bfadbc74d2797a2ef4 upstream.
+
+The A-MPDU code checked against a retry limit, but it was using
+the wrong variable to do so. This patch fixes this to assure
+proper retry mechanism.
+
+This problem had a side-effect causing the mac80211 flush callback
+to remain waiting forever as well. That side effect has been fixed
+by commit by Stanislaw Gruszka:
+
+commit f96b08a7e6f69c0f0a576554df3df5b1b519c479
+Date:   Tue Jan 17 12:38:50 2012 +0100
+
+    brcmsmac: fix tx queue flush infinite loop
+
+    Reference:
+    https://bugzilla.kernel.org/show_bug.cgi?id=42576
+
+Cc: Stanislaw Gruszka <sgruszka@redhat.com>
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Reviewed-by: Alwin Beukers <alwin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wireless/brcm80211/brcmsmac/ampdu.c |    6 +-----
+ 1 files changed, 1 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+index 7f27dbd..0515862 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+@@ -1053,17 +1053,13 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
+                }
+                /* either retransmit or send bar if ack not recd */
+                if (!ack_recd) {
+-                       struct ieee80211_tx_rate *txrate =
+-                           tx_info->status.rates;
+-                       if (retry && (txrate[0].count < (int)retry_limit)) {
++                       if (retry && (ini->txretry[index] < (int)retry_limit)) {
+                                ini->txretry[index]++;
+                                ini->tx_in_transit--;
+                                /*
+                                 * Use high prededence for retransmit to
+                                 * give some punch
+                                 */
+-                               /* brcms_c_txq_enq(wlc, scb, p,
+-                                * BRCMS_PRIO_TO_PREC(tid)); */
+                                brcms_c_txq_enq(wlc, scb, p,
+                                                BRCMS_PRIO_TO_HI_PREC(tid));
+                        } else {
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0039-ARM-7417-1-vfp-ensure-preemption-is-disabled-when-en.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0039-ARM-7417-1-vfp-ensure-preemption-is-disabled-when-en.patch
new file mode 100644
index 00000000..9c2fe73f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0039-ARM-7417-1-vfp-ensure-preemption-is-disabled-when-en.patch
@@ -0,0 +1,73 @@
+From 51fdc0c99703cfde72be81bef9c7e38ac5c023a0 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 11 May 2012 17:42:37 +0100
+Subject: [PATCH 39/56] ARM: 7417/1: vfp: ensure preemption is disabled when
+ enabling VFP access
+
+commit 998de4acb2ba188d20768d1065658377a2e7d29b upstream.
+
+The vfp_enable function enables access to the VFP co-processor register
+space (cp10 and cp11) on the current CPU and must be called with
+preemption disabled. Unfortunately, the vfp_init late initcall does not
+disable preemption and can lead to an oops during boot if thread
+migration occurs at the wrong time and we end up attempting to access
+the FPSID on a CPU with VFP access disabled.
+
+This patch fixes the initcall to call vfp_enable from a non-preemptible
+context on each CPU and adds a BUG_ON(preemptible) to ensure that any
+similar problems are easily spotted in the future.
+
+Reported-by: Hyungwoo Yang <hwoo.yang@gmail.com>
+Signed-off-by: Hyungwoo Yang <hyungwooy@nvidia.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/arm/vfp/vfpmodule.c |   10 ++++++----
+ 1 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
+index 8f3ccdd..8ea07e4 100644
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -11,6 +11,7 @@
+ #include <linux/types.h>
+ #include <linux/cpu.h>
+ #include <linux/cpu_pm.h>
++#include <linux/hardirq.h>
+ #include <linux/kernel.h>
+ #include <linux/notifier.h>
+ #include <linux/signal.h>
+@@ -428,7 +429,10 @@ void VFP_bounce(u32 trigger, u32 fpexc, struct pt_regs *regs)
+ 
+ static void vfp_enable(void *unused)
+ {
+-       u32 access = get_copro_access();
++       u32 access;
++
++       BUG_ON(preemptible());
++       access = get_copro_access();
+ 
+        /*
+         * Enable full access to VFP (cp10 and cp11)
+@@ -556,7 +560,7 @@ static int __init vfp_init(void)
+        unsigned int cpu_arch = cpu_architecture();
+ 
+        if (cpu_arch >= CPU_ARCH_ARMv6)
+-               vfp_enable(NULL);
++               on_each_cpu(vfp_enable, NULL, 1);
+ 
+        /*
+         * First check that there is a VFP that we can use.
+@@ -577,8 +581,6 @@ static int __init vfp_init(void)
+        } else {
+                hotcpu_notifier(vfp_hotplug, 0);
+ 
+-               smp_call_function(vfp_enable, NULL, 1);
+-
+                VFP_arch = (vfpsid & FPSID_ARCH_MASK) >> FPSID_ARCH_BIT;  /* Extract the architecture version */
+                printk("implementor %02x architecture %d part %02x variant %x rev %x\n",
+                        (vfpsid & FPSID_IMPLEMENTER_MASK) >> FPSID_IMPLEMENTER_BIT,
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0040-target-Fix-SPC-2-RELEASE-bug-for-multi-session-iSCSI.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0040-target-Fix-SPC-2-RELEASE-bug-for-multi-session-iSCSI.patch
new file mode 100644
index 00000000..cf2db916
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0040-target-Fix-SPC-2-RELEASE-bug-for-multi-session-iSCSI.patch
@@ -0,0 +1,42 @@
+From b081b9481296d51cdb05548b8f67888a240a675f Mon Sep 17 00:00:00 2001
+From: Bernhard Kohl <Riedel-und-Kohl@t-online.de>
+Date: Sun, 13 May 2012 23:39:37 +0200
+Subject: [PATCH 40/56] target: Fix SPC-2 RELEASE bug for multi-session iSCSI
+ client setups
+
+commit edc318d9fea6854df752ec8c645b960b0d5a1d23 upstream.
+
+This patch addresses a bug in a special case for target core SPC-2 RELEASE
+logic where the same physical client (eg: iSCSI InitiatorName) with
+differing iSCSI session identifiers (ISID) is allowed to incorrectly release
+the same client's SPC-2 reservation from the non reservation holding path.
+
+Note this bug is specific to iscsi-target w/ SPC-2 reservations, and
+with the default enforce_pr_isids=1 device attr setting in target-core
+controls if a InitiatorName + different ISID reservations are handled
+the same as a single iSCSI client entity.
+
+Signed-off-by: Bernhard Kohl <bernhard.kohl@gmx.net>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/target/target_core_pr.c |    3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index 6cf6ff4..b75bc92 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -223,6 +223,9 @@ int target_scsi2_reservation_release(struct se_task *task)
+        if (dev->dev_reserved_node_acl != sess->se_node_acl)
+                goto out_unlock;
+ 
++       if (dev->dev_res_bin_isid != sess->sess_bin_isid)
++               goto out_unlock;
++
+        dev->dev_reserved_node_acl = NULL;
+        dev->dev_flags &= ~DF_SPC2_RESERVATIONS;
+        if (dev->dev_flags & DF_SPC2_RESERVATIONS_WITH_ISID) {
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0041-crypto-mv_cesa-requires-on-CRYPTO_HASH-to-build.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0041-crypto-mv_cesa-requires-on-CRYPTO_HASH-to-build.patch
new file mode 100644
index 00000000..8176064f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0041-crypto-mv_cesa-requires-on-CRYPTO_HASH-to-build.patch
@@ -0,0 +1,51 @@
+From d5f0e3adeaf18edfac8b3c7d8f867fe92923a4ab Mon Sep 17 00:00:00 2001
+From: Alexander Clouter <alex@digriz.org.uk>
+Date: Sat, 12 May 2012 09:45:08 +0100
+Subject: [PATCH 41/56] crypto: mv_cesa requires on CRYPTO_HASH to build
+
+commit 1ebfefcf37a6e308266a8d786e8cfea0a454058c upstream.
+
+Without CRYPTO_HASH being selected, mv_cesa has a lot of hooks
+into undefined exports.
+----
+  MODPOST 81 modules
+  Kernel: arch/arm/boot/Image is ready
+  AS      arch/arm/boot/compressed/head.o
+  GZIP    arch/arm/boot/compressed/piggy.gzip
+  CC      arch/arm/boot/compressed/misc.o
+  CC      arch/arm/boot/compressed/decompress.o
+ERROR: "crypto_ahash_type" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_shash_final" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_register_ahash" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_unregister_ahash" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_shash_update" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_shash_digest" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_shash_setkey" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_alloc_shash" [drivers/crypto/mv_cesa.ko] undefined!
+make[1]: *** [__modpost] Error 1
+make: *** [modules] Error 2
+make: *** Waiting for unfinished jobs....
+----
+
+Signed-off-by: Alexander Clouter <alex@digriz.org.uk>
+Signed-off-by: Jason Cooper <jason@lakedaemon.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/crypto/Kconfig |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
+index 6d16b4b..7e3002b 100644
+--- a/drivers/crypto/Kconfig
++++ b/drivers/crypto/Kconfig
+@@ -173,6 +173,7 @@ config CRYPTO_DEV_MV_CESA
+        select CRYPTO_ALGAPI
+        select CRYPTO_AES
+        select CRYPTO_BLKCIPHER2
++       select CRYPTO_HASH
+        help
+          This driver allows you to utilize the Cryptographic Engines and
+          Security Accelerator (CESA) which can be found on the Marvell Orion
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0042-ALSA-hda-idt-Fix-power-map-for-speaker-pins-with-som.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0042-ALSA-hda-idt-Fix-power-map-for-speaker-pins-with-som.patch
new file mode 100644
index 00000000..21705fd4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0042-ALSA-hda-idt-Fix-power-map-for-speaker-pins-with-som.patch
@@ -0,0 +1,46 @@
+From e7a10d7bb94e2d5618757447f0ac108d8951b4a6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 15 May 2012 08:07:31 +0200
+Subject: [PATCH 42/56] ALSA: hda/idt - Fix power-map for speaker-pins with
+ some HP laptops
+
+commit b0791dda813c179e539b0fc1ecd3f5f30f2571e2 upstream.
+
+BIOS on some HP laptops don't set the speaker-pins as fixed but expose
+as jacks, and this confuses the driver as if these pins are
+jack-detectable.  As a result, the machine doesn't get sounds from
+speakers because the driver prepares the power-map update via jack
+unsol events which never come up in reality.  The bug was introduced
+in some time in 3.2 for enabling the power-mapping feature.
+
+This patch fixes the problem by replacing the check of the persistent
+power-map bits with a proper is_jack_detectable() call.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=43240
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ sound/pci/hda/patch_sigmatel.c |    6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index ed67698..7b7a516 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4484,9 +4484,9 @@ static int stac92xx_init(struct hda_codec *codec)
+                def_conf = get_defcfg_connect(def_conf);
+                /* skip any ports that don't have jacks since presence
+                 * detection is useless */
+-               if (def_conf != AC_JACK_PORT_COMPLEX) {
+-                       if (def_conf != AC_JACK_PORT_NONE)
+-                               stac_toggle_power_map(codec, nid, 1);
++               if (def_conf != AC_JACK_PORT_NONE &&
++                   !is_jack_detectable(codec, nid)) {
++                       stac_toggle_power_map(codec, nid, 1);
+                        continue;
+                }
+                if (enable_pin_detect(codec, nid, STAC_PWR_EVENT)) {
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0043-ASoC-wm8994-Fix-AIF2ADC-power-down.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0043-ASoC-wm8994-Fix-AIF2ADC-power-down.patch
new file mode 100644
index 00000000..505ca3f4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0043-ASoC-wm8994-Fix-AIF2ADC-power-down.patch
@@ -0,0 +1,29 @@
+From ffbe8f6bb9d1b143aa8d3e37c4c237219b71544d Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Tue, 15 May 2012 18:13:00 +0100
+Subject: [PATCH 43/56] ASoC: wm8994: Fix AIF2ADC power down
+
+commit c7f5f2389377b66028bc129890aa653deafe8d39 upstream.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ sound/soc/codecs/wm8994.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index 7806301..3e7aa22 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -1027,7 +1027,7 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+                                    WM8994_AIF2DACL_ENA |
+                                    WM8994_AIF2DACR_ENA, 0);
+-               snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++               snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
+                                    WM8994_AIF2ADCL_ENA |
+                                    WM8994_AIF2ADCR_ENA, 0);
+ 
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0044-usbnet-fix-skb-traversing-races-during-unlink-v2.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0044-usbnet-fix-skb-traversing-races-during-unlink-v2.patch
new file mode 100644
index 00000000..080b001e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0044-usbnet-fix-skb-traversing-races-during-unlink-v2.patch
@@ -0,0 +1,222 @@
+From 5dc6e8a33ae9998d96530b6e6778654685d02b86 Mon Sep 17 00:00:00 2001
+From: Ming Lei <tom.leiming@gmail.com>
+Date: Thu, 26 Apr 2012 11:33:46 +0800
+Subject: [PATCH 44/56] usbnet: fix skb traversing races during unlink(v2)
+
+commit 5b6e9bcdeb65634b4ad604eb4536404bbfc62cfa upstream.
+
+Commit 4231d47e6fe69f061f96c98c30eaf9fb4c14b96d(net/usbnet: avoid
+recursive locking in usbnet_stop()) fixes the recursive locking
+problem by releasing the skb queue lock before unlink, but may
+cause skb traversing races:
+        - after URB is unlinked and the queue lock is released,
+        the refered skb and skb->next may be moved to done queue,
+        even be released
+        - in skb_queue_walk_safe, the next skb is still obtained
+        by next pointer of the last skb
+        - so maybe trigger oops or other problems
+
+This patch extends the usage of entry->state to describe 'start_unlink'
+state, so always holding the queue(rx/tx) lock to change the state if
+the referd skb is in rx or tx queue because we need to know if the
+refered urb has been started unlinking in unlink_urbs.
+
+The other part of this patch is based on Huajun's patch:
+always traverse from head of the tx/rx queue to get skb which is
+to be unlinked but not been started unlinking.
+
+Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
+Signed-off-by: Ming Lei <tom.leiming@gmail.com>
+Cc: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/usb/usbnet.c   |   54 +++++++++++++++++++++++++++++++-------------
+ include/linux/usb/usbnet.h |    3 +-
+ 2 files changed, 40 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 750e330..b873b5d 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -281,17 +281,32 @@ int usbnet_change_mtu (struct net_device *net, int new_mtu)
+ }
+ EXPORT_SYMBOL_GPL(usbnet_change_mtu);
+ 
++/* The caller must hold list->lock */
++static void __usbnet_queue_skb(struct sk_buff_head *list,
++                       struct sk_buff *newsk, enum skb_state state)
++{
++       struct skb_data *entry = (struct skb_data *) newsk->cb;
++
++       __skb_queue_tail(list, newsk);
++       entry->state = state;
++}
++
+ /*-------------------------------------------------------------------------*/
+ 
+ /* some LK 2.4 HCDs oopsed if we freed or resubmitted urbs from
+  * completion callbacks.  2.5 should have fixed those bugs...
+  */
+ 
+-static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct sk_buff_head *list)
++static enum skb_state defer_bh(struct usbnet *dev, struct sk_buff *skb,
++               struct sk_buff_head *list, enum skb_state state)
+ {
+        unsigned long           flags;
++       enum skb_state          old_state;
++       struct skb_data *entry = (struct skb_data *) skb->cb;
+ 
+        spin_lock_irqsave(&list->lock, flags);
++       old_state = entry->state;
++       entry->state = state;
+        __skb_unlink(skb, list);
+        spin_unlock(&list->lock);
+        spin_lock(&dev->done.lock);
+@@ -299,6 +314,7 @@ static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct sk_buff_hea
+        if (dev->done.qlen == 1)
+                tasklet_schedule(&dev->bh);
+        spin_unlock_irqrestore(&dev->done.lock, flags);
++       return old_state;
+ }
+ 
+ /* some work can't be done in tasklets, so we use keventd
+@@ -339,7 +355,6 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
+        entry = (struct skb_data *) skb->cb;
+        entry->urb = urb;
+        entry->dev = dev;
+-       entry->state = rx_start;
+        entry->length = 0;
+ 
+        usb_fill_bulk_urb (urb, dev->udev, dev->in,
+@@ -371,7 +386,7 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
+                        tasklet_schedule (&dev->bh);
+                        break;
+                case 0:
+-                       __skb_queue_tail (&dev->rxq, skb);
++                       __usbnet_queue_skb(&dev->rxq, skb, rx_start);
+                }
+        } else {
+                netif_dbg(dev, ifdown, dev->net, "rx: stopped\n");
+@@ -422,16 +437,17 @@ static void rx_complete (struct urb *urb)
+        struct skb_data         *entry = (struct skb_data *) skb->cb;
+        struct usbnet           *dev = entry->dev;
+        int                     urb_status = urb->status;
++       enum skb_state          state;
+ 
+        skb_put (skb, urb->actual_length);
+-       entry->state = rx_done;
++       state = rx_done;
+        entry->urb = NULL;
+ 
+        switch (urb_status) {
+        /* success */
+        case 0:
+                if (skb->len < dev->net->hard_header_len) {
+-                       entry->state = rx_cleanup;
++                       state = rx_cleanup;
+                        dev->net->stats.rx_errors++;
+                        dev->net->stats.rx_length_errors++;
+                        netif_dbg(dev, rx_err, dev->net,
+@@ -470,7 +486,7 @@ static void rx_complete (struct urb *urb)
+                                  "rx throttle %d\n", urb_status);
+                }
+ block:
+-               entry->state = rx_cleanup;
++               state = rx_cleanup;
+                entry->urb = urb;
+                urb = NULL;
+                break;
+@@ -481,17 +497,18 @@ block:
+                // FALLTHROUGH
+ 
+        default:
+-               entry->state = rx_cleanup;
++               state = rx_cleanup;
+                dev->net->stats.rx_errors++;
+                netif_dbg(dev, rx_err, dev->net, "rx status %d\n", urb_status);
+                break;
+        }
+ 
+-       defer_bh(dev, skb, &dev->rxq);
++       state = defer_bh(dev, skb, &dev->rxq, state);
+ 
+        if (urb) {
+                if (netif_running (dev->net) &&
+-                   !test_bit (EVENT_RX_HALT, &dev->flags)) {
++                   !test_bit (EVENT_RX_HALT, &dev->flags) &&
++                   state != unlink_start) {
+                        rx_submit (dev, urb, GFP_ATOMIC);
+                        return;
+                }
+@@ -577,16 +594,23 @@ EXPORT_SYMBOL_GPL(usbnet_purge_paused_rxq);
+ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
+ {
+        unsigned long           flags;
+-       struct sk_buff          *skb, *skbnext;
++       struct sk_buff          *skb;
+        int                     count = 0;
+ 
+        spin_lock_irqsave (&q->lock, flags);
+-       skb_queue_walk_safe(q, skb, skbnext) {
++       while (!skb_queue_empty(q)) {
+                struct skb_data         *entry;
+                struct urb              *urb;
+                int                     retval;
+ 
+-               entry = (struct skb_data *) skb->cb;
++               skb_queue_walk(q, skb) {
++                       entry = (struct skb_data *) skb->cb;
++                       if (entry->state != unlink_start)
++                               goto found;
++               }
++               break;
++found:
++               entry->state = unlink_start;
+                urb = entry->urb;
+ 
+                /*
+@@ -1037,8 +1061,7 @@ static void tx_complete (struct urb *urb)
+        }
+ 
+        usb_autopm_put_interface_async(dev->intf);
+-       entry->state = tx_done;
+-       defer_bh(dev, skb, &dev->txq);
++       (void) defer_bh(dev, skb, &dev->txq, tx_done);
+ }
+ 
+ /*-------------------------------------------------------------------------*/
+@@ -1094,7 +1117,6 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
+        entry = (struct skb_data *) skb->cb;
+        entry->urb = urb;
+        entry->dev = dev;
+-       entry->state = tx_start;
+        entry->length = length;
+ 
+        usb_fill_bulk_urb (urb, dev->udev, dev->out,
+@@ -1153,7 +1175,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
+                break;
+        case 0:
+                net->trans_start = jiffies;
+-               __skb_queue_tail (&dev->txq, skb);
++               __usbnet_queue_skb(&dev->txq, skb, tx_start);
+                if (dev->txq.qlen >= TX_QLEN (dev))
+                        netif_stop_queue (net);
+        }
+diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
+index 605b0aa..76f4396 100644
+--- a/include/linux/usb/usbnet.h
++++ b/include/linux/usb/usbnet.h
+@@ -191,7 +191,8 @@ extern void usbnet_cdc_status(struct usbnet *, struct urb *);
+ enum skb_state {
+        illegal = 0,
+        tx_start, tx_done,
+-       rx_start, rx_done, rx_cleanup
++       rx_start, rx_done, rx_cleanup,
++       unlink_start
+ };
+ 
+ struct skb_data {      /* skb->cb is one of these */
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0045-cdc_ether-add-Novatel-USB551L-device-IDs-for-FLAG_WW.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0045-cdc_ether-add-Novatel-USB551L-device-IDs-for-FLAG_WW.patch
new file mode 100644
index 00000000..2310ee58
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0045-cdc_ether-add-Novatel-USB551L-device-IDs-for-FLAG_WW.patch
@@ -0,0 +1,58 @@
+From 3a586ee50e3f8a380125a8ce332de9f4c0ef727e Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Mon, 7 May 2012 04:24:51 +0000
+Subject: [PATCH 45/56] cdc_ether: add Novatel USB551L device IDs for
+ FLAG_WWAN
+
+commit 4e6304b8420aba5311ba21fd68dab2924ae4d91a upstream.
+
+Needs to be tagged with FLAG_WWAN, which since it has generic
+descriptors, won't happen if we don't override the generic
+driver info.
+
+Cc: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Acked-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/usb/cdc_ether.c |   16 ++++++++++++++++
+ 1 files changed, 16 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index eac4886..2ba40cf 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -482,6 +482,7 @@ static const struct driver_info wwan_info = {
+ /*-------------------------------------------------------------------------*/
+ 
+ #define HUAWEI_VENDOR_ID       0x12D1
++#define NOVATEL_VENDOR_ID      0x1410
+ 
+ static const struct usb_device_id      products [] = {
+ /*
+@@ -599,6 +600,21 @@ static const struct usb_device_id  products [] = {
+  * because of bugs/quirks in a given product (like Zaurus, above).
+  */
+ {
++       /* Novatel USB551L */
++       /* This match must come *before* the generic CDC-ETHER match so that
++        * we get FLAG_WWAN set on the device, since it's descriptors are
++        * generic CDC-ETHER.
++        */
++       .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
++                | USB_DEVICE_ID_MATCH_PRODUCT
++                | USB_DEVICE_ID_MATCH_INT_INFO,
++       .idVendor               = NOVATEL_VENDOR_ID,
++       .idProduct              = 0xB001,
++       .bInterfaceClass        = USB_CLASS_COMM,
++       .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
++       .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
++       .driver_info = (unsigned long)&wwan_info,
++}, {
+        USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
+                        USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &cdc_info,
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0046-ARM-prevent-VM_GROWSDOWN-mmaps-extending-below-FIRST.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0046-ARM-prevent-VM_GROWSDOWN-mmaps-extending-below-FIRST.patch
new file mode 100644
index 00000000..59cacc99
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0046-ARM-prevent-VM_GROWSDOWN-mmaps-extending-below-FIRST.patch
@@ -0,0 +1,33 @@
+From bb7f36d5a6a8621f37a79996cfbf0f0318862fcd Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Wed, 16 May 2012 15:19:20 +0100
+Subject: [PATCH 46/56] ARM: prevent VM_GROWSDOWN mmaps extending below
+ FIRST_USER_ADDRESS
+
+commit 9b61a4d1b2064dbd0c9e61754305ac852170509f upstream.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/arm/mm/fault.c |    4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
+index aa33949..4b0bc37 100644
+--- a/arch/arm/mm/fault.c
++++ b/arch/arm/mm/fault.c
+@@ -267,7 +267,9 @@ good_area:
+        return fault;
+ 
+ check_stack:
+-       if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
++       /* Don't allow expansion below FIRST_USER_ADDRESS */
++       if (vma->vm_flags & VM_GROWSDOWN &&
++           addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr))
+                goto good_area;
+ out:
+        return fault;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0047-arch-tile-apply-commit-74fca9da0-to-the-compat-signa.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0047-arch-tile-apply-commit-74fca9da0-to-the-compat-signa.patch
new file mode 100644
index 00000000..2b95a674
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0047-arch-tile-apply-commit-74fca9da0-to-the-compat-signa.patch
@@ -0,0 +1,49 @@
+From 4fb637e8e8bd6149d99d92389a104494bb234540 Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Wed, 16 May 2012 14:54:20 -0400
+Subject: [PATCH 47/56] arch/tile: apply commit 74fca9da0 to the compat signal
+ handling as well
+
+commit a134d228298c6aa9007205c6b81cae0cac0acb5d upstream.
+
+This passes siginfo and mcontext to tilegx32 signal handlers that
+don't have SA_SIGINFO set just as we have been doing for tilegx64.
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/tile/kernel/compat_signal.c |   12 +++++-------
+ 1 files changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/arch/tile/kernel/compat_signal.c b/arch/tile/kernel/compat_signal.c
+index a7869ad..41459d8 100644
+--- a/arch/tile/kernel/compat_signal.c
++++ b/arch/tile/kernel/compat_signal.c
+@@ -406,19 +406,17 @@ int compat_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
+         * Set up registers for signal handler.
+         * Registers that we don't modify keep the value they had from
+         * user-space at the time we took the signal.
++        * We always pass siginfo and mcontext, regardless of SA_SIGINFO,
++        * since some things rely on this (e.g. glibc's debug/segfault.c).
+         */
+        regs->pc = ptr_to_compat_reg(ka->sa.sa_handler);
+        regs->ex1 = PL_ICS_EX1(USER_PL, 1); /* set crit sec in handler */
+        regs->sp = ptr_to_compat_reg(frame);
+        regs->lr = restorer;
+        regs->regs[0] = (unsigned long) usig;
+-
+-       if (ka->sa.sa_flags & SA_SIGINFO) {
+-               /* Need extra arguments, so mark to restore caller-saves. */
+-               regs->regs[1] = ptr_to_compat_reg(&frame->info);
+-               regs->regs[2] = ptr_to_compat_reg(&frame->uc);
+-               regs->flags |= PT_FLAGS_CALLER_SAVES;
+-       }
++       regs->regs[1] = ptr_to_compat_reg(&frame->info);
++       regs->regs[2] = ptr_to_compat_reg(&frame->uc);
++       regs->flags |= PT_FLAGS_CALLER_SAVES;
+ 
+        /*
+         * Notify any tracer that was single-stepping it.
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0048-MD-Add-del_timer_sync-to-mddev_suspend-fix-nasty-pan.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0048-MD-Add-del_timer_sync-to-mddev_suspend-fix-nasty-pan.patch
new file mode 100644
index 00000000..8daf07a9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0048-MD-Add-del_timer_sync-to-mddev_suspend-fix-nasty-pan.patch
@@ -0,0 +1,38 @@
+From efbb3ae65b6bd81ebb5b7487fdfc4d65812b0825 Mon Sep 17 00:00:00 2001
+From: Jonathan Brassow <jbrassow@redhat.com>
+Date: Wed, 16 May 2012 04:06:14 -0500
+Subject: [PATCH 48/56] MD: Add del_timer_sync to mddev_suspend (fix nasty
+ panic)
+
+commit 0d9f4f135eb6dea06bdcb7065b1e4ff78274a5e9 upstream.
+
+Use del_timer_sync to remove timer before mddev_suspend finishes.
+
+We don't want a timer going off after an mddev_suspend is called.  This is
+especially true with device-mapper, since it can call the destructor function
+immediately following a suspend.  This results in the removal (kfree) of the
+structures upon which the timer depends - resulting in a very ugly panic.
+Therefore, we add a del_timer_sync to mddev_suspend to prevent this.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/md/md.c |    2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 065ab4f..adcd850 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -392,6 +392,8 @@ void mddev_suspend(struct mddev *mddev)
+        synchronize_rcu();
+        wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0);
+        mddev->pers->quiesce(mddev, 1);
++
++       del_timer_sync(&mddev->safemode_timer);
+ }
+ EXPORT_SYMBOL_GPL(mddev_suspend);
+ 
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0049-target-Fix-bug-in-handling-of-FILEIO-block_device-re.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0049-target-Fix-bug-in-handling-of-FILEIO-block_device-re.patch
new file mode 100644
index 00000000..9422e65f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0049-target-Fix-bug-in-handling-of-FILEIO-block_device-re.patch
@@ -0,0 +1,78 @@
+From 08671b3fdc83c369484ee2b4e9bfab6b0a6ee48d Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Wed, 16 May 2012 16:05:26 -0700
+Subject: [PATCH 49/56] target: Fix bug in handling of FILEIO + block_device
+ resize ops
+
+commit cd9323fd68aee3c1c6b5b21e5746c9d1b586fb58 upstream.
+
+This patch fixes a bug in the handling of FILEIO w/ underlying block_device
+resize operations where the original fd_dev->fd_dev_size was incorrectly being
+used in fd_get_blocks() for READ_CAPACITY response payloads.
+
+This patch avoids using fd_dev->fd_dev_size for FILEIO devices with
+an underlying block_device, and instead changes fd_get_blocks() to
+get the sector count directly from i_size_read() as recommended by hch.
+
+Reported-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/target/target_core_file.c |   22 ++++++++++++++++------
+ 1 files changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
+index b4864fb..cad8b92 100644
+--- a/drivers/target/target_core_file.c
++++ b/drivers/target/target_core_file.c
+@@ -170,6 +170,7 @@ static struct se_device *fd_create_virtdevice(
+        inode = file->f_mapping->host;
+        if (S_ISBLK(inode->i_mode)) {
+                struct request_queue *q;
++               unsigned long long dev_size;
+                /*
+                 * Setup the local scope queue_limits from struct request_queue->limits
+                 * to pass into transport_add_device_to_core_hba() as struct se_dev_limits.
+@@ -184,13 +185,12 @@ static struct se_device *fd_create_virtdevice(
+                 * one (1) logical sector from underlying struct block_device
+                 */
+                fd_dev->fd_block_size = bdev_logical_block_size(inode->i_bdev);
+-               fd_dev->fd_dev_size = (i_size_read(file->f_mapping->host) -
++               dev_size = (i_size_read(file->f_mapping->host) -
+                                       fd_dev->fd_block_size);
+ 
+                pr_debug("FILEIO: Using size: %llu bytes from struct"
+                        " block_device blocks: %llu logical_block_size: %d\n",
+-                       fd_dev->fd_dev_size,
+-                       div_u64(fd_dev->fd_dev_size, fd_dev->fd_block_size),
++                       dev_size, div_u64(dev_size, fd_dev->fd_block_size),
+                        fd_dev->fd_block_size);
+        } else {
+                if (!(fd_dev->fbd_flags & FBDF_HAS_SIZE)) {
+@@ -606,10 +606,20 @@ static u32 fd_get_device_type(struct se_device *dev)
+ static sector_t fd_get_blocks(struct se_device *dev)
+ {
+        struct fd_dev *fd_dev = dev->dev_ptr;
+-       unsigned long long blocks_long = div_u64(fd_dev->fd_dev_size,
+-                       dev->se_sub_dev->se_dev_attrib.block_size);
++       struct file *f = fd_dev->fd_file;
++       struct inode *i = f->f_mapping->host;
++       unsigned long long dev_size;
++       /*
++        * When using a file that references an underlying struct block_device,
++        * ensure dev_size is always based on the current inode size in order
++        * to handle underlying block_device resize operations.
++        */
++       if (S_ISBLK(i->i_mode))
++               dev_size = (i_size_read(i) - fd_dev->fd_block_size);
++       else
++               dev_size = fd_dev->fd_dev_size;
+ 
+-       return blocks_long;
++       return div_u64(dev_size, dev->se_sub_dev->se_dev_attrib.block_size);
+ }
+ 
+ static struct se_subsystem_api fileio_template = {
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0050-tcp-do_tcp_sendpages-must-try-to-push-data-out-on-oo.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0050-tcp-do_tcp_sendpages-must-try-to-push-data-out-on-oo.patch
new file mode 100644
index 00000000..1e3a68b3
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0050-tcp-do_tcp_sendpages-must-try-to-push-data-out-on-oo.patch
@@ -0,0 +1,57 @@
+From 8c6c5b3fb938b8af747c79cfe8c5cb39db72202a Mon Sep 17 00:00:00 2001
+From: Willy Tarreau <w@1wt.eu>
+Date: Thu, 17 May 2012 11:14:14 +0000
+Subject: [PATCH 50/56] tcp: do_tcp_sendpages() must try to push data out on
+ oom conditions
+
+commit bad115cfe5b509043b684d3a007ab54b80090aa1 upstream.
+
+Since recent changes on TCP splicing (starting with commits 2f533844
+"tcp: allow splice() to build full TSO packets" and 35f9c09f "tcp:
+tcp_sendpages() should call tcp_push() once"), I started seeing
+massive stalls when forwarding traffic between two sockets using
+splice() when pipe buffers were larger than socket buffers.
+
+Latest changes (net: netdev_alloc_skb() use build_skb()) made the
+problem even more apparent.
+
+The reason seems to be that if do_tcp_sendpages() fails on out of memory
+condition without being able to send at least one byte, tcp_push() is not
+called and the buffers cannot be flushed.
+
+After applying the attached patch, I cannot reproduce the stalls at all
+and the data rate it perfectly stable and steady under any condition
+which previously caused the problem to be permanent.
+
+The issue seems to have been there since before the kernel migrated to
+git, which makes me think that the stalls I occasionally experienced
+with tux during stress-tests years ago were probably related to the
+same issue.
+
+This issue was first encountered on 3.0.31 and 3.2.17, so please backport
+to -stable.
+
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv4/tcp.c |    3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 8f826b1..11ba922 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -851,8 +851,7 @@ new_segment:
+ wait_for_sndbuf:
+                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+ wait_for_memory:
+-               if (copied)
+-                       tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
++               tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+ 
+                if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
+                        goto do_error;
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0051-e1000-Prevent-reset-task-killing-itself.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0051-e1000-Prevent-reset-task-killing-itself.patch
new file mode 100644
index 00000000..1a3cdf4a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0051-e1000-Prevent-reset-task-killing-itself.patch
@@ -0,0 +1,40 @@
+From 4cad7c8fe708e7795f298240e246cec993a7e74b Mon Sep 17 00:00:00 2001
+From: Tushar Dave <tushar.n.dave@intel.com>
+Date: Thu, 17 May 2012 01:04:50 +0000
+Subject: [PATCH 51/56] e1000: Prevent reset task killing itself.
+
+commit 8ce6909f77ba1b7bcdea65cc2388fd1742b6d669 upstream.
+
+Killing reset task while adapter is resetting causes deadlock.
+Only kill reset task if adapter is not resetting.
+Ref bug #43132 on bugzilla.kernel.org
+
+Signed-off-by: Tushar Dave <tushar.n.dave@intel.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/intel/e1000/e1000_main.c |    6 +++++-
+ 1 files changed, 5 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index cf480b5..de00805 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -494,7 +494,11 @@ out:
+ static void e1000_down_and_stop(struct e1000_adapter *adapter)
+ {
+        set_bit(__E1000_DOWN, &adapter->flags);
+-       cancel_work_sync(&adapter->reset_task);
++
++       /* Only kill reset task if adapter is not resetting */
++       if (!test_bit(__E1000_RESETTING, &adapter->flags))
++               cancel_work_sync(&adapter->reset_task);
++
+        cancel_delayed_work_sync(&adapter->watchdog_task);
+        cancel_delayed_work_sync(&adapter->phy_info_task);
+        cancel_delayed_work_sync(&adapter->fifo_stall_task);
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0052-mtd-map.h-fix-arm-cross-build-failure.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0052-mtd-map.h-fix-arm-cross-build-failure.patch
new file mode 100644
index 00000000..297eb07e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0052-mtd-map.h-fix-arm-cross-build-failure.patch
@@ -0,0 +1,37 @@
+From e3478e0a8885a446eed02cd159394c0ea74ecfd0 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Fri, 30 Dec 2011 18:28:01 +0200
+Subject: [PATCH 52/56] mtd: map.h: fix arm cross-build failure
+
+commit 4a42243886b87cd28a39b192161767c2af851a55 upstream.
+
+This patch fixes the following build failure:
+In file included from include/linux/mtd/qinfo.h:4:0,
+                 from include/linux/mtd/pfow.h:7,
+                 from drivers/mtd/lpddr/lpddr_cmds.c:27:
+include/linux/mtd/map.h: In function 'inline_map_read':
+include/linux/mtd/map.h:409:3: error: implicit declaration of function 'BUILD_BUG_ON' [-Werror=implicit-function-declaration]
+
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ include/linux/mtd/map.h |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h
+index a9e6ba4..daad4e6 100644
+--- a/include/linux/mtd/map.h
++++ b/include/linux/mtd/map.h
+@@ -26,7 +26,7 @@
+ #include <linux/list.h>
+ #include <linux/string.h>
+ #include <linux/bug.h>
+-
++#include <linux/kernel.h>
+ 
+ #include <asm/unaligned.h>
+ #include <asm/system.h>
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0053-stmmac-Fix-compilation-error-in-mmc_core.c.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0053-stmmac-Fix-compilation-error-in-mmc_core.c.patch
new file mode 100644
index 00000000..5a0b0d70
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0053-stmmac-Fix-compilation-error-in-mmc_core.c.patch
@@ -0,0 +1,38 @@
+From 19ccd03475be60d00e4ac87f05020c31201ae29d Mon Sep 17 00:00:00 2001
+From: Stefan Roese <sr@denx.de>
+Date: Tue, 10 Jan 2012 01:47:40 +0000
+Subject: [PATCH 53/56] stmmac: Fix compilation error in mmc_core.c
+
+commit 1dd8117e3320fb42ec40ef2ace982871572d34ed upstream.
+
+Fix this error:
+
+  CC      drivers/net/ethernet/stmicro/stmmac/mmc_core.o
+drivers/net/ethernet/stmicro/stmmac/mmc_core.c: In function 'dwmac_mmc_ctrl':
+drivers/net/ethernet/stmicro/stmmac/mmc_core.c:143:2: error: implicit
+  declaration of function 'pr_debug' [-Werror=implicit-function-declaration]
+
+Signed-off-by: Stefan Roese <sr@denx.de>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Acked-by: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/stmicro/stmmac/mmc_core.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
+index 41e6b33..c07cfe9 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
+@@ -22,6 +22,7 @@
+   Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+ *******************************************************************************/
+ 
++#include <linux/kernel.h>
+ #include <linux/io.h>
+ #include "mmc.h"
+ 
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0054-pktgen-fix-crash-at-module-unload.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0054-pktgen-fix-crash-at-module-unload.patch
new file mode 100644
index 00000000..3d38f55f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0054-pktgen-fix-crash-at-module-unload.patch
@@ -0,0 +1,72 @@
+From 0db05d78c77595936a7494aa049850169c49b861 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Wed, 9 May 2012 13:29:51 +0000
+Subject: [PATCH 54/56] pktgen: fix crash at module unload
+
+commit c57b54684060c8aced64a5b78ff69ff289af97b9 upstream.
+
+commit 7d3d43dab4e9 (net: In unregister_netdevice_notifier unregister
+the netdevices.) makes pktgen crashing at module unload.
+
+[  296.820578] BUG: spinlock bad magic on CPU#6, rmmod/3267
+[  296.820719]  lock: ffff880310c38000, .magic: ffff8803, .owner: <none>/-1, .owner_cpu: -1
+[  296.820943] Pid: 3267, comm: rmmod Not tainted 3.4.0-rc5+ #254
+[  296.821079] Call Trace:
+[  296.821211]  [<ffffffff8168a715>] spin_dump+0x8a/0x8f
+[  296.821345]  [<ffffffff8168a73b>] spin_bug+0x21/0x26
+[  296.821507]  [<ffffffff812b4741>] do_raw_spin_lock+0x131/0x140
+[  296.821648]  [<ffffffff8169188e>] _raw_spin_lock+0x1e/0x20
+[  296.821786]  [<ffffffffa00cc0fd>] __pktgen_NN_threads+0x4d/0x140 [pktgen]
+[  296.821928]  [<ffffffffa00ccf8d>] pktgen_device_event+0x10d/0x1e0 [pktgen]
+[  296.822073]  [<ffffffff8154ed4f>] unregister_netdevice_notifier+0x7f/0x100
+[  296.822216]  [<ffffffffa00d2a0b>] pg_cleanup+0x48/0x73 [pktgen]
+[  296.822357]  [<ffffffff8109528e>] sys_delete_module+0x17e/0x2a0
+[  296.822502]  [<ffffffff81699652>] system_call_fastpath+0x16/0x1b
+
+Hold the pktgen_thread_lock while splicing pktgen_threads, and test
+pktgen_exiting in pktgen_device_event() to make unload faster.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/core/pktgen.c |   10 ++++++++--
+ 1 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index 0001c24..657e5f9 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -1932,7 +1932,7 @@ static int pktgen_device_event(struct notifier_block *unused,
+ {
+        struct net_device *dev = ptr;
+ 
+-       if (!net_eq(dev_net(dev), &init_net))
++       if (!net_eq(dev_net(dev), &init_net) || pktgen_exiting)
+                return NOTIFY_DONE;
+ 
+        /* It is OK that we do not hold the group lock right now,
+@@ -3758,12 +3758,18 @@ static void __exit pg_cleanup(void)
+ {
+        struct pktgen_thread *t;
+        struct list_head *q, *n;
++       struct list_head list;
+ 
+        /* Stop all interfaces & threads */
+        pktgen_exiting = true;
+ 
+-       list_for_each_safe(q, n, &pktgen_threads) {
++       mutex_lock(&pktgen_thread_lock);
++       list_splice(&list, &pktgen_threads);
++       mutex_unlock(&pktgen_thread_lock);
++
++       list_for_each_safe(q, n, &list) {
+                t = list_entry(q, struct pktgen_thread, th_list);
++               list_del(&t->th_list);
+                kthread_stop(t->tsk);
+                kfree(t);
+        }
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0055-pktgen-fix-module-unload-for-good.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0055-pktgen-fix-module-unload-for-good.patch
new file mode 100644
index 00000000..1f86f355
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0055-pktgen-fix-module-unload-for-good.patch
@@ -0,0 +1,48 @@
+From 20b87e11f8ebb8b1fa74b668770c7f2b301b40b4 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 17 May 2012 23:52:26 +0000
+Subject: [PATCH 55/56] pktgen: fix module unload for good
+
+commit d4b1133558e0d417342d5d2c49e4c35b428ff20d upstream.
+
+commit c57b5468406 (pktgen: fix crash at module unload) did a very poor
+job with list primitives.
+
+1) list_splice() arguments were in the wrong order
+
+2) list_splice(list, head) has undefined behavior if head is not
+initialized.
+
+3) We should use the list_splice_init() variant to clear pktgen_threads
+list.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/core/pktgen.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index 657e5f9..df878de 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -3758,13 +3758,13 @@ static void __exit pg_cleanup(void)
+ {
+        struct pktgen_thread *t;
+        struct list_head *q, *n;
+-       struct list_head list;
++       LIST_HEAD(list);
+ 
+        /* Stop all interfaces & threads */
+        pktgen_exiting = true;
+ 
+        mutex_lock(&pktgen_thread_lock);
+-       list_splice(&list, &pktgen_threads);
++       list_splice_init(&pktgen_threads, &list);
+        mutex_unlock(&pktgen_thread_lock);
+ 
+        list_for_each_safe(q, n, &list) {
+-- 
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0056-Linux-3.2.18.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0056-Linux-3.2.18.patch
new file mode 100644
index 00000000..a8809ed1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.18/0056-Linux-3.2.18.patch
@@ -0,0 +1,24 @@
+From c04a2fde6b61eb063267b611c43371e61d0cabc3 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Sun, 20 May 2012 22:56:54 +0100
+Subject: [PATCH 56/56] Linux 3.2.18
+
+---
+ Makefile |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 4c4efa3..add68f1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 17
++SUBLEVEL = 18
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+-- 
+1.7.7.6
+