[meta-ti] [Beagleboard.org][PATCH v2 02/10] linux-ti33x-psp 3.2: update to 3.2.5
Koen Kooi
koen at dominion.thruhere.net
Tue Feb 21 02:30:16 PST 2012
Runtime tested on a beaglebone A3
Signed-off-by: Koen Kooi <koen at dominion.thruhere.net>
---
conf/machine/include/ti33x.inc | 2 +-
.../0001-MAINTAINERS-stable-Update-address.patch | 31 +
.../0002-Documentation-Update-stable-address.patch | 56 ++
...x-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch | 81 +++
.../0004-rt2800usb-Move-ID-out-of-unknown.patch | 43 ++
...ix-setting-of-the-pseudo-palette-for-8bpp.patch | 92 +++
...ix-bug-in-calculating-requested-vram-size.patch | 32 +
...07-libertas-clean-up-scan-thread-handling.patch | 86 +++
.../0008-bcma-support-for-suspend-and-resume.patch | 120 ++++
...x-Validate-FEM-index-from-ini-file-and-FW.patch | 75 +++
...eck-buffer-bound-when-processing-nvs-data.patch | 68 ++
.../3.2.1/0011-wl12xx-Restore-testmode-ABI.patch | 32 +
...werpc-time-Handle-wrapping-of-decrementer.patch | 93 +++
...-unpaired-probe_hcall_entry-and-probe_hca.patch | 85 +++
...a-possible-data-corruption-when-receiving.patch | 78 +++
.../0015-IB-uverbs-Protect-QP-multicast-list.patch | 96 +++
.../3.2.1/0016-iwlagn-fix-TID-use-bug.patch | 50 ++
.../0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch | 180 +++++
...Fix-parsing-of-__print_flags-in-TP_printk.patch | 37 +
...0019-ore-Fix-crash-in-case-of-an-IO-error.patch | 41 ++
...0-ore-fix-BUG_ON-too-few-sgs-when-reading.patch | 56 ++
...021-ore-Must-support-none-PAGE-aligned-IO.patch | 163 +++++
...breakage-when-MISC_FILESYSTEMS-is-not-set.patch | 89 +++
...3-reiserfs-Fix-quota-mount-option-parsing.patch | 34 +
...rce-inode-evictions-before-umount-to-avoi.patch | 70 ++
...warn-from-writepage-when-readonly-inode-i.patch | 73 ++
...-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch | 70 ++
...s-hv-Fix-a-bug-in-vmbus_driver_unregister.patch | 40 ++
.../0028-USB-update-documentation-for-usbmon.patch | 54 ++
...oops-related-to-user-namespace-conversion.patch | 125 ++++
..._serial-fix-spinlock-lockup-in-RS485-code.patch | 47 ++
...fix-to-allow-mounting-a-hierarchy-by-name.patch | 50 ++
...dlock-when-converting-file-from-in-ICB-on.patch | 130 ++++
...sb-class-cdc-acm.c-clear-dangling-pointer.patch | 45 ++
...ight-fix-kernel-bug-when-loading-firmware.patch | 47 ++
...rage-doesn-t-support-dynamic-id-currently.patch | 121 ++++
.../0036-USB-pxa168-Fix-compilation-error.patch | 42 ++
.../0037-USB-add-quirk-for-another-camera.patch | 37 +
.../3.2.1/0038-USB-omninet-fix-write_room.patch | 34 +
...usb-option-add-ZD-Incorporated-HSPA-modem.patch | 53 ++
...-ID-for-Multiplex-RC-serial-adapter-to-cp.patch | 36 +
...1-usb-fix-number-of-mapped-SG-DMA-entries.patch | 155 +++++
...0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch | 62 ++
.../0043-usb-ch9-fix-up-MaxStreams-helper.patch | 81 +++
...zero-delay-when-receiving-odd-mixture-of-.patch | 37 +
.../0045-asix-fix-infinite-loop-in-rx_fixup.patch | 38 ++
...ng-fix-error-handling-if-slave-is-busy-v2.patch | 68 ++
...-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch | 54 ++
...acl-count-validation-in-xfs_acl_from_disk.patch | 34 +
.../3.2.1/0049-Linux-3.2.1.patch | 24 +
...mtdoops-fix-the-oops_page_used-array-size.patch | 39 ++
...mtdoops-skip-reading-initially-bad-blocks.patch | 36 +
...devs-don-t-increase-open-count-on-error-p.patch | 85 +++
...tresstest-bail-out-if-device-has-not-enou.patch | 60 ++
...-interface.c-fix-alarm-rollover-when-day-.patch | 53 ++
...dd-missing-ext4_resize_end-on-error-paths.patch | 109 +++
...undefined-behavior-in-ext4_fill_flex_info.patch | 74 ++
...sb-us122l-Delete-calls-to-preempt_disable.patch | 54 ++
...-Fix-master-control-for-Cirrus-Logic-421X.patch | 57 ++
...SA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch | 48 ++
...e1724-Check-for-ac97-to-avoid-kernel-oops.patch | 38 ++
...dio-Avoid-flood-of-frame-active-debug-mes.patch | 46 ++
...e-auto-parser-for-HP-laptops-with-cx20459.patch | 37 +
...turn-the-error-from-get_wcaps_type-for-in.patch | 58 ++
...x-the-detection-of-Loopback-Mixing-contro.patch | 42 ++
...x-the-lost-power-setup-of-seconary-pins-a.patch | 92 +++
...kms-workaround-invalid-AVI-infoframe-chec.patch | 43 ++
...n-kms-disable-writeback-on-pre-R300-asics.patch | 40 ++
...disabling-PCI-bus-mastering-on-big-endian.patch | 70 ++
...FS-errors-are-communicated-on-iodata-pnfs.patch | 50 ++
...1-pnfs-obj-Must-return-layout-on-IO-error.patch | 92 +++
.../3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch | 94 +++
...4.1-fix-backchannel-slotid-off-by-one-bug.patch | 30 +
...fix-recent-breakage-to-NFS-error-handling.patch | 60 ++
...FSv4-include-bitmap-in-nfsv4-get-acl-data.patch | 313 +++++++++
...ression-in-handling-of-context-option-in-.patch | 147 ++++
...ximum-global-item-tag-report-size-to-96-b.patch | 35 +
.../0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch | 33 +
...ix-missing-scrub-when-there-is-a-bit-flip.patch | 81 +++
...0030-UBI-fix-use-after-free-on-error-path.patch | 52 ++
.../0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch | 32 +
...able-msi-interrupts-when-we-initialize-a-.patch | 53 ++
...ore-CPU-non-addressable-_CRS-reserved-mem.patch | 65 ++
...x86-PCI-amd-factor-out-MMCONFIG-discovery.patch | 160 +++++
...build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch | 37 +
...s-Release-spinlock-for-the-raid-device-li.patch | 56 ++
...s-Fix-for-memory-allocation-error-for-lar.patch | 177 +++++
...Reject-replies-with-payload-XENSTORE_PAYL.patch | 78 +++
...rform-bad-block-tests-for-WriteMostly-dev.patch | 56 ++
...040-ima-free-duplicate-measurement-memory.patch | 52 ++
.../0041-ima-fix-invalid-memory-reference.patch | 68 ++
...ub-fix-a-possible-memleak-in-__slab_alloc.patch | 47 ++
...ound-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch | 101 +++
...tting-custom-MAC-address-on-Asix-88178-de.patch | 45 ++
...tting-custom-MAC-address-on-Asix-88772-de.patch | 53 ++
...46-include-linux-crash_dump.h-needs-elf.h.patch | 54 ++
...ix-BUG-caused-by-failure-to-check-skb-all.patch | 44 ++
...x-rx-key-NULL-pointer-dereference-in-prom.patch | 52 ++
...egression-in-channelwidth-switch-at-the-s.patch | 68 ++
...em_cgroup_replace_page_cache-to-fix-LRU-i.patch | 179 +++++
.../0051-x86-Fix-mmap-random-address-range.patch | 47 ++
.../0052-UBI-fix-nameless-volumes-handling.patch | 37 +
.../3.2.2/0053-UBI-fix-debugging-messages.patch | 42 ++
.../3.2.2/0054-UBI-make-vid_hdr-non-static.patch | 36 +
.../3.2.2/0055-UBIFS-fix-debugging-messages.patch | 41 ++
...UBIFS-make-debugging-messages-light-again.patch | 57 ++
...ror-value-returned-by-several-bus-drivers.patch | 197 ++++++
...8-mmc-core-Fix-voltage-select-in-DDR-mode.patch | 39 ++
...ix-tuning-timer-incorrect-setting-when-su.patch | 39 ++
.../0060-mmc-sd-Fix-SDR12-timing-regression.patch | 38 ++
...2-ioctl-integer-overflow-in-video_usercop.patch | 54 ++
...s-in-a-batch-should-not-be-accounted-as-a.patch | 71 ++
...race-Fix-unregister-ftrace_ops-accounting.patch | 227 +++++++
...eamline-config.pl-Simplify-backslash-line.patch | 68 ++
...eamline-config.pl-Fix-parsing-Makefile-wi.patch | 98 +++
...double-free-on-shutdown-of-nfsd-after-cha.patch | 60 ++
...svcrpc-destroy-server-sockets-all-at-once.patch | 85 +++
...-avoid-memory-corruption-on-pool-shutdown.patch | 156 +++++
.../3.2.2/0069-nfsd4-fix-lockowner-matching.patch | 59 ++
...d-Fix-oops-when-parsing-a-0-length-export.patch | 82 +++
...notify-don-t-BUG-in-fsnotify_destroy_mark.patch | 61 ++
...Update-Boot-messages-for-SGI-UV2-platform.patch | 44 ++
...t-Fix-handling-of-elf64-big-endian-object.patch | 46 ++
...ix-integer-overflow-in-uvc_ioctl_ctrl_map.patch | 62 ++
...cache-use-a-dispose-list-in-select_parent.patch | 172 +++++
.../0076-fix-shrink_dcache_parent-livelock.patch | 130 ++++
...fsblock-acquire-im_lock-in-_preload_range.patch | 64 ++
...ock-don-t-spinlock-when-freeing-block_dev.patch | 46 ++
.../0079-pnfsblock-limit-bio-page-count.patch | 51 ++
...0211-revert-on-channel-work-optimisations.patch | 635 ++++++++++++++++++
...-HID-hid-multitouch-add-another-eGalax-id.patch | 60 ++
...touch-cleanup-with-eGalax-PID-definitions.patch | 112 ++++
...itouch-Add-egalax-ID-for-Acer-Iconia-W500.patch | 62 ++
...ouch-add-support-for-the-MSI-Windpad-110W.patch | 49 ++
...titouch-add-support-for-new-Hanvon-panels.patch | 63 ++
...uch-add-support-of-Atmel-multitouch-panel.patch | 63 ++
...0087-HID-multitouch-add-support-for-3M-32.patch | 45 ++
...ltitouch-add-support-9-new-Xiroku-devices.patch | 117 ++++
...-fix-cputime-overflow-in-uptime_proc_show.patch | 49 ++
...0090-block-add-and-use-scsi_blk_cmd_ioctl.patch | 166 +++++
...SCSI-passthrough-ioctls-on-partition-devi.patch | 166 +++++
...orward-ioctls-from-logical-volumes-to-the.patch | 90 +++
...oc-clean-up-and-fix-proc-pid-mem-handling.patch | 271 ++++++++
...Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch | 35 +
...oso-Xonar-DS-fix-polarity-of-front-output.patch | 37 +
...x-internal-microphone-on-Dell-Studio-16-X.patch | 36 +
...97-TOMOYO-Accept-000-as-a-valid-character.patch | 43 ++
...8-intel-idle-Make-idle-driver-more-robust.patch | 53 ++
.../3.2.2/0099-intel_idle-fix-API-misuse.patch | 56 ++
.../0100-ACPI-Store-SRAT-table-revision.patch | 66 ++
...e-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch | 50 ++
...se-SRAT-table-rev-to-use-8bit-or-16-32bit.patch | 66 ++
...back-the-call-to-acpi_os_validate_address.patch | 59 ++
...essor-fix-acpi_get_cpuid-for-UP-processor.patch | 75 +++
...ix-NULL-pointer-dereference-in-slave_dest.patch | 37 +
...t-Set-response-format-in-INQUIRY-response.patch | 44 ++
...additional-sense-length-field-in-sense-da.patch | 177 +++++
...idate-the-mapped-core-over-suspend-resume.patch | 44 ++
...-cx23885-dvb-check-if-dvb_attach-succeded.patch | 36 +
...ix-don-t-duplicate-xc4000-entry-for-radio.patch | 95 +++
...umberspace-conflict-between-xc4000-and-pt.patch | 42 ++
...-module-Fix-disabling-tracepoints-with-ta.patch | 50 ++
...AP-correct-SYSC-register-offset-for-OMAP4.patch | 34 +
...-new-UV2-hardware-by-using-native-UV2-bro.patch | 350 ++++++++++
...ix-BAU-destination-timeout-initialization.patch | 66 ++
.../3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch | 570 ++++++++++++++++
...fix-interpretation-of-the-rx-KeyMiss-flag.patch | 61 ++
...800pci-fix-spurious-interrupts-generation.patch | 86 +++
...x-endian-conversion-issue-in-discard-code.patch | 45 ++
...20t-modified-the-setting-of-transfer-rate.patch | 33 +
...e-fix-off-by-one-index-into-syscall-table.patch | 46 ++
...default-wsize-when-unix-extensions-are-no.patch | 67 ++
...3-kprobes-initialize-before-using-a-hlist.patch | 49 ++
...oc-clear_refs-do-not-clear-reserved-pages.patch | 64 ++
...-ptr-dereference-in-__count_immobile_page.patch | 91 +++
.../3.2.2/0126-iwlagn-check-for-SMPS-mode.patch | 50 ++
...945-fix-hw-passive-scan-on-radar-channels.patch | 60 ++
...SHM_UNLOCK-fix-long-unpreemptible-section.patch | 186 ++++++
...fix-Unevictable-pages-stranded-after-swap.patch | 342 ++++++++++
.../3.2.2/0130-Linux-3.2.2.patch | 24 +
...x-buffer-alignment-regression-with-Nvidia.patch | 62 ++
...x-silent-outputs-from-docking-station-jac.patch | 64 ++
...tfs-Sanitize-write-counts-of-dev-ecryptfs.patch | 103 +++
...tfs-Improve-metadata-read-failure-logging.patch | 58 ++
...0005-eCryptfs-Make-truncate-path-killable.patch | 71 ++
...6-eCryptfs-Check-inode-changes-in-setattr.patch | 122 ++++
...x-oops-when-printing-debug-info-in-extent.patch | 103 +++
...adeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch | 38 ++
...kms-move-panel-mode-setup-into-encoder-mo.patch | 130 ++++
...kms-rework-modeset-sequence-for-DCE41-and.patch | 87 +++
.../0011-drm-Fix-authentication-kernel-crash.patch | 91 +++
...sing-xfs_iunlock-on-error-recovery-path-i.patch | 38 ++
...M5100-register-map-cache-only-when-going-.patch | 32 +
...e-register-synchronisation-for-low-freque.patch | 66 ++
...go-through-cache-when-applying-WM5100-rev.patch | 41 ++
...-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch | 33 +
...brcmsmac-fix-tx-queue-flush-infinite-loop.patch | 53 ++
...c80211-fix-work-removal-on-deauth-request.patch | 111 +++
...jbd-Issue-cache-flush-after-checkpointing.patch | 118 ++++
...12-make-it-work-undo-percpu-message-sched.patch | 78 +++
...-sha512-reduce-stack-usage-to-safe-number.patch | 129 ++++
...-tpm_tis-add-delay-after-aborting-command.patch | 37 +
.../0023-x86-uv-Fix-uninitialized-spinlocks.patch | 58 ++
...4-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch | 41 ++
...de_amd-Add-support-for-CPU-family-specifi.patch | 75 +++
...sembler-constraint-to-prevent-overeager-g.patch | 172 +++++
...t-mute-led-polarity-for-laptops-with-bugg.patch | 43 ++
...8-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch | 55 ++
...hda-Fix-silent-output-on-Haier-W18-laptop.patch | 34 +
...per-over-missed-irq-issues-with-force-wak.patch | 126 ++++
...15-sdvo-always-set-positive-sync-polarity.patch | 52 ++
...-enable-gen7-RC6-and-GPU-turbo-after-resu.patch | 43 ++
...-at91-fix-at91rm9200-soc-subtype-handling.patch | 46 ++
.../0034-mach-ux500-enable-ARM-errata-764369.patch | 31 +
...proc-v7.S-remove-HARVARD_CACHE-preprocess.patch | 53 ++
...ain-bitterly-about-attempts-to-remove-fil.patch | 68 ++
...e-struct-xen_spinlock-to-always-fit-in-ar.patch | 103 +++
...oved-redundant-calling-of-_scsih_probe_de.patch | 96 +++
.../0039-USB-option-Add-LG-docomo-L-02C.patch | 41 ++
...di_sio-fix-TIOCSSERIAL-baud_base-handling.patch | 41 ++
.../0041-USB-ftdi_sio-fix-initial-baud-rate.patch | 49 ++
...sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch | 50 ++
.../0043-USB-serial-ftdi-additional-IDs.patch | 49 ++
.../0044-USB-ftdi_sio-Add-more-identifiers.patch | 48 ++
...-updating-desc-length-must-be-protected-b.patch | 37 +
...-use-two-mutexes-to-allow-simultaneous-re.patch | 178 +++++
...-add-more-Pantech-UML190-and-UML290-ports.patch | 43 ++
...dwc3-ep0-tidy-up-Pending-Request-handling.patch | 54 ++
...ake-edge_remove_sysfs_attrs-the-port_remo.patch | 60 ++
...0050-TTY-fix-UV-serial-console-regression.patch | 72 ++
...-pl011-lock-console-writes-against-interr.patch | 67 ++
.../3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch | 53 ++
...053-iwlwifi-fix-PCI-E-transport-inta-race.patch | 53 ++
...assignment-in-vmw_framebuffer_create_hand.patch | 34 +
...tek-cr-fix-autopm-scheduling-while-atomic.patch | 36 +
.../3.2.3/0056-USB-usbsevseg-fix-max-length.patch | 34 +
...t-langwell-don-t-call-gadget-s-disconnect.patch | 94 +++
.../3.2.3/0058-usb-gadget-storage-endian-fix.patch | 43 ++
...s-usb-host-ehci-fsl.c-add-missing-iounmap.patch | 54 ++
...xhci-Fix-USB-3.0-device-restart-on-resume.patch | 51 ++
...p-isoc-transfer-ring-when-TD-length-misma.patch | 40 ++
.../0062-usb-musb-davinci-fix-build-breakage.patch | 41 ++
...71805f-Fix-clamping-of-temperature-limits.patch | 43 ++
...7ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch | 46 ++
.../0065-hwmon-sht15-fix-bad-error-code.patch | 40 ++
...-call-wake_up_all-to-allow-driver-to-shut.patch | 45 ++
...-better-allocate-a-buffer-that-is-at-leas.patch | 38 ++
...-Avoid-hanging-on-interface-with-no-USB_C.patch | 53 ++
.../3.2.3/0069-netns-fix-net_alloc_generic.patch | 120 ++++
...conspicously-if-someone-uses-net_generic-.patch | 42 ++
...f-Register-properly-as-a-pernet-subsystem.patch | 117 ++++
...fix-EPOLLET-regression-for-stream-sockets.patch | 96 +++
...-fix-enslaving-in-alb-mode-when-link-down.patch | 116 ++++
...tp_ip-fix-possible-oops-on-packet-receive.patch | 73 ++
...075-macvlan-fix-a-possible-use-after-free.patch | 34 +
...76-net-bpf_jit-fix-divide-by-0-generation.patch | 129 ++++
...ntroduce-missing-rcu_assign_pointer-calls.patch | 703 ++++++++++++++++++++
...ake-rds_sock_lock-BH-rather-than-IRQ-safe.patch | 119 ++++
..._trim_head-to-adjust-segment-count-with-s.patch | 61 ++
...ng-remote-adress-for-md5-lookup-in-rst-pa.patch | 49 ++
...CP210x-Added-USB-ID-for-the-Link-Instrume.patch | 32 +
...USB-cp210x-call-generic-open-last-in-open.patch | 47 ++
...0083-USB-cp210x-fix-CP2104-baudrate-usage.patch | 78 +++
...84-USB-cp210x-do-not-map-baud-rates-to-B0.patch | 34 +
...5-USB-cp210x-fix-up-set_termios-variables.patch | 44 ++
...clean-up-refactor-and-document-speed-hand.patch | 121 ++++
...7-USB-cp210x-initialise-baud-rate-at-open.patch | 35 +
...cp210x-allow-more-baud-rates-above-1Mbaud.patch | 48 ++
...ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch | 34 +
.../3.2.3/0090-Linux-3.2.3.patch | 24 +
...-Mark-WM5100-register-map-cache-only-when.patch | 32 +
...-Don-t-go-through-cache-when-applying-WM5.patch | 39 ++
.../3.2.4/0003-Linux-3.2.4.patch | 24 +
.../3.2.5/0001-PCI-Rework-ASPM-disable-code.patch | 236 +++++++
.../3.2.5/0002-Linux-3.2.5.patch | 24 +
recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt | 295 ++++++++
recipes-kernel/linux/linux-ti33x-psp_3.2.bb | 276 ++++++++-
277 files changed, 21802 insertions(+), 2 deletions(-)
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0001-MAINTAINERS-stable-Update-address.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0002-Documentation-Update-stable-address.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0007-libertas-clean-up-scan-thread-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0008-bcma-support-for-suspend-and-resume.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0011-wl12xx-Restore-testmode-ABI.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0016-iwlagn-fix-TID-use-bug.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0028-USB-update-documentation-for-usbmon.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0036-USB-pxa168-Fix-compilation-error.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0037-USB-add-quirk-for-another-camera.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0038-USB-omninet-fix-write_room.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0049-Linux-3.2.1.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0040-ima-free-duplicate-measurement-memory.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0041-ima-fix-invalid-memory-reference.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0051-x86-Fix-mmap-random-address-range.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0052-UBI-fix-nameless-volumes-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0053-UBI-fix-debugging-messages.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0054-UBI-make-vid_hdr-non-static.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0055-UBIFS-fix-debugging-messages.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0069-nfsd4-fix-lockowner-matching.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0076-fix-shrink_dcache_parent-livelock.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0079-pnfsblock-limit-bio-page-count.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0099-intel_idle-fix-API-misuse.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0100-ACPI-Store-SRAT-table-revision.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0126-iwlagn-check-for-SMPS-mode.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0130-Linux-3.2.2.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0011-drm-Fix-authentication-kernel-crash.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0043-USB-serial-ftdi-additional-IDs.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0050-TTY-fix-UV-serial-console-regression.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0056-USB-usbsevseg-fix-max-length.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0058-usb-gadget-storage-endian-fix.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0069-netns-fix-net_alloc_generic.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0090-Linux-3.2.3.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0003-Linux-3.2.4.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0001-PCI-Rework-ASPM-disable-code.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0002-Linux-3.2.5.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt
diff --git a/conf/machine/include/ti33x.inc b/conf/machine/include/ti33x.inc
index 3807fbb..fc670d0 100644
--- a/conf/machine/include/ti33x.inc
+++ b/conf/machine/include/ti33x.inc
@@ -3,7 +3,7 @@ SOC_FAMILY = "ti33x"
require conf/machine/include/tune-cortexa8.inc
PREFERRED_PROVIDER_virtual/kernel = "linux-ti33x-psp"
# Increase this everytime you change something in the kernel
-MACHINE_KERNEL_PR = "r2"
+MACHINE_KERNEL_PR = "r3"
KERNEL_IMAGETYPE = "uImage"
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0001-MAINTAINERS-stable-Update-address.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0001-MAINTAINERS-stable-Update-address.patch
new file mode 100644
index 0000000..fe2b0d6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0001-MAINTAINERS-stable-Update-address.patch
@@ -0,0 +1,31 @@
+From d1fe421bb81064477843db98b4804fec79eae30e Mon Sep 17 00:00:00 2001
+From: Joe Perches <joe at perches.com>
+Date: Fri, 9 Dec 2011 13:54:34 -0800
+Subject: [PATCH 01/49] MAINTAINERS: stable: Update address
+
+commit bc7a2f3abc636d7cab84258a48e77b08fb5fd3d6 upstream.
+
+The old address hasn't worked since the great intrusion of August 2011.
+
+Signed-off-by: Joe Perches <joe at perches.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ MAINTAINERS | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 62f1cd3..f986e7d 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -6258,7 +6258,7 @@ F: arch/alpha/kernel/srm_env.c
+
+ STABLE BRANCH
+ M: Greg Kroah-Hartman <greg at kroah.com>
+-L: stable at kernel.org
++L: stable at vger.kernel.org
+ S: Maintained
+
+ STAGING SUBSYSTEM
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0002-Documentation-Update-stable-address.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0002-Documentation-Update-stable-address.patch
new file mode 100644
index 0000000..10b9e32
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0002-Documentation-Update-stable-address.patch
@@ -0,0 +1,56 @@
+From 3dc851fe5a59ee0eb306b3a29819ee040ba69a24 Mon Sep 17 00:00:00 2001
+From: Joe Perches <joe at perches.com>
+Date: Fri, 9 Dec 2011 14:12:00 -0800
+Subject: [PATCH 02/49] Documentation: Update stable address
+
+commit 2eb7f204db51969ea558802a6601d79c2fb273b9 upstream.
+
+The Japanese/Korean/Chinese versions still need updating.
+
+Also, the stable kernel 2.6.x.y descriptions are out of date
+and should be updated as well.
+
+Signed-off-by: Joe Perches <joe at perches.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ Documentation/HOWTO | 4 ++--
+ Documentation/development-process/5.Posting | 8 ++++----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/Documentation/HOWTO b/Documentation/HOWTO
+index 81bc1a9..f7ade3b 100644
+--- a/Documentation/HOWTO
++++ b/Documentation/HOWTO
+@@ -275,8 +275,8 @@ versions.
+ If no 2.6.x.y kernel is available, then the highest numbered 2.6.x
+ kernel is the current stable kernel.
+
+-2.6.x.y are maintained by the "stable" team <stable at kernel.org>, and are
+-released as needs dictate. The normal release period is approximately
++2.6.x.y are maintained by the "stable" team <stable at vger.kernel.org>, and
++are released as needs dictate. The normal release period is approximately
+ two weeks, but it can be longer if there are no pressing problems. A
+ security-related problem, instead, can cause a release to happen almost
+ instantly.
+diff --git a/Documentation/development-process/5.Posting b/Documentation/development-process/5.Posting
+index 903a254..8a48c9b 100644
+--- a/Documentation/development-process/5.Posting
++++ b/Documentation/development-process/5.Posting
+@@ -271,10 +271,10 @@ copies should go to:
+ the linux-kernel list.
+
+ - If you are fixing a bug, think about whether the fix should go into the
+- next stable update. If so, stable at kernel.org should get a copy of the
+- patch. Also add a "Cc: stable at kernel.org" to the tags within the patch
+- itself; that will cause the stable team to get a notification when your
+- fix goes into the mainline.
++ next stable update. If so, stable at vger.kernel.org should get a copy of
++ the patch. Also add a "Cc: stable at vger.kernel.org" to the tags within
++ the patch itself; that will cause the stable team to get a notification
++ when your fix goes into the mainline.
+
+ When selecting recipients for a patch, it is good to have an idea of who
+ you think will eventually accept the patch and get it merged. While it
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch
new file mode 100644
index 0000000..146af6d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch
@@ -0,0 +1,81 @@
+From 9fa97016831ab21d14565a478dc462f35dfb7d2b Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman at tuxdriver.com>
+Date: Mon, 2 Jan 2012 15:31:23 -0500
+Subject: [PATCH 03/49] firmware: Fix an oops on reading fw_priv->fw in sysfs
+ loading file
+
+commit eea915bb0d1358755f151eaefb8208a2d5f3e10c upstream.
+
+This oops was reported recently:
+firmware_loading_store+0xf9/0x17b
+dev_attr_store+0x20/0x22
+sysfs_write_file+0x101/0x134
+vfs_write+0xac/0xf3
+sys_write+0x4a/0x6e
+system_call_fastpath+0x16/0x1b
+
+The complete backtrace was unfortunately not captured, but details can be found
+here:
+https://bugzilla.redhat.com/show_bug.cgi?id=769920
+
+The cause is fairly clear.
+
+Its caused by the fact that firmware_loading_store has a case 0 in its
+switch statement that reads and writes the fw_priv->fw poniter without the
+protection of the fw_lock mutex. since there is a window between the time that
+_request_firmware sets fw_priv->fw to NULL and the time the corresponding sysfs
+file is unregistered, its possible for a user space application to race in, and
+write a zero to the loading file, causing a NULL dereference in
+firmware_loading_store. Fix it by extending the protection of the fw_lock mutex
+to cover all of the firware_loading_store function.
+
+Signed-off-by: Neil Horman <nhorman at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/base/firmware_class.c | 14 +++++++-------
+ 1 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
+index 06ed6b4..3719c94 100644
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -226,13 +226,13 @@ static ssize_t firmware_loading_store(struct device *dev,
+ int loading = simple_strtol(buf, NULL, 10);
+ int i;
+
++ mutex_lock(&fw_lock);
++
++ if (!fw_priv->fw)
++ goto out;
++
+ switch (loading) {
+ case 1:
+- mutex_lock(&fw_lock);
+- if (!fw_priv->fw) {
+- mutex_unlock(&fw_lock);
+- break;
+- }
+ firmware_free_data(fw_priv->fw);
+ memset(fw_priv->fw, 0, sizeof(struct firmware));
+ /* If the pages are not owned by 'struct firmware' */
+@@ -243,7 +243,6 @@ static ssize_t firmware_loading_store(struct device *dev,
+ fw_priv->page_array_size = 0;
+ fw_priv->nr_pages = 0;
+ set_bit(FW_STATUS_LOADING, &fw_priv->status);
+- mutex_unlock(&fw_lock);
+ break;
+ case 0:
+ if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {
+@@ -274,7 +273,8 @@ static ssize_t firmware_loading_store(struct device *dev,
+ fw_load_abort(fw_priv);
+ break;
+ }
+-
++out:
++ mutex_unlock(&fw_lock);
+ return count;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch
new file mode 100644
index 0000000..6923c7e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch
@@ -0,0 +1,43 @@
+From c64f87400ad7f27c043d969e695b3b2384e8a246 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger at lwfinger.net>
+Date: Tue, 27 Dec 2011 12:22:51 -0600
+Subject: [PATCH 04/49] rt2800usb: Move ID out of unknown
+
+commit 3f81f8f1524ccca24df1029b0cf825ecef5e5cdc upstream.
+
+Testing on the openSUSE wireless forum has shown that a Linksys
+WUSB54GC v3 with USB ID 1737:0077 works with rt2800usb when the ID is
+written to /sys/.../new_id. This ID can therefore be moved out of UNKNOWN.
+
+Signed-off-by: Larry Finger <Larry.Finger at lwfinger.net>
+Acked-by: Gertjan van Wingerde <gwingerde at gmail.com>
+Acked-by: Ivo van Doorn <IvDoorn at gmail.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/rt2x00/rt2800usb.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index 3778763..3265b34 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -976,6 +976,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x13b1, 0x0031) },
+ { USB_DEVICE(0x1737, 0x0070) },
+ { USB_DEVICE(0x1737, 0x0071) },
++ { USB_DEVICE(0x1737, 0x0077) },
+ /* Logitec */
+ { USB_DEVICE(0x0789, 0x0162) },
+ { USB_DEVICE(0x0789, 0x0163) },
+@@ -1171,7 +1172,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x1740, 0x0605) },
+ { USB_DEVICE(0x1740, 0x0615) },
+ /* Linksys */
+- { USB_DEVICE(0x1737, 0x0077) },
+ { USB_DEVICE(0x1737, 0x0078) },
+ /* Logitec */
+ { USB_DEVICE(0x0789, 0x0168) },
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch
new file mode 100644
index 0000000..e019802
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch
@@ -0,0 +1,92 @@
+From 698d2012f8540d1cedc1f49013ba320e382cd1d9 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh at kernel.crashing.org>
+Date: Wed, 28 Dec 2011 00:10:16 +0000
+Subject: [PATCH 05/49] offb: Fix setting of the pseudo-palette for >8bpp
+
+commit 1bb0b7d21584b3f878e2bc880db62351ddee5185 upstream.
+
+When using a >8bpp framebuffer, offb advertises truecolor, not directcolor,
+and doesn't touch the color map even if it has a corresponding access method
+for the real hardware.
+
+Thus it needs to set the pseudo-palette with all 3 components of the color,
+like other truecolor framebuffers, not with copies of the color index like
+a directcolor framebuffer would do.
+
+This went unnoticed for a long time because it's pretty hard to get offb
+to kick in with anything but 8bpp (old BootX under MacOS will do that and
+qemu does it).
+
+Signed-off-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/video/offb.c | 50 +++++++++++++++++++++++---------------------------
+ 1 files changed, 23 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/video/offb.c b/drivers/video/offb.c
+index cb163a5..24e1fc6 100644
+--- a/drivers/video/offb.c
++++ b/drivers/video/offb.c
+@@ -100,36 +100,32 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
+ u_int transp, struct fb_info *info)
+ {
+ struct offb_par *par = (struct offb_par *) info->par;
+- int i, depth;
+- u32 *pal = info->pseudo_palette;
+-
+- depth = info->var.bits_per_pixel;
+- if (depth == 16)
+- depth = (info->var.green.length == 5) ? 15 : 16;
+-
+- if (regno > 255 ||
+- (depth == 16 && regno > 63) ||
+- (depth == 15 && regno > 31))
+- return 1;
+-
+- if (regno < 16) {
+- switch (depth) {
+- case 15:
+- pal[regno] = (regno << 10) | (regno << 5) | regno;
+- break;
+- case 16:
+- pal[regno] = (regno << 11) | (regno << 5) | regno;
+- break;
+- case 24:
+- pal[regno] = (regno << 16) | (regno << 8) | regno;
+- break;
+- case 32:
+- i = (regno << 8) | regno;
+- pal[regno] = (i << 16) | i;
+- break;
++
++ if (info->fix.visual == FB_VISUAL_TRUECOLOR) {
++ u32 *pal = info->pseudo_palette;
++ u32 cr = red >> (16 - info->var.red.length);
++ u32 cg = green >> (16 - info->var.green.length);
++ u32 cb = blue >> (16 - info->var.blue.length);
++ u32 value;
++
++ if (regno >= 16)
++ return -EINVAL;
++
++ value = (cr << info->var.red.offset) |
++ (cg << info->var.green.offset) |
++ (cb << info->var.blue.offset);
++ if (info->var.transp.length > 0) {
++ u32 mask = (1 << info->var.transp.length) - 1;
++ mask <<= info->var.transp.offset;
++ value |= mask;
+ }
++ pal[regno] = value;
++ return 0;
+ }
+
++ if (regno > 255)
++ return -EINVAL;
++
+ red >>= 8;
+ green >>= 8;
+ blue >>= 8;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch
new file mode 100644
index 0000000..19c6d42
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch
@@ -0,0 +1,32 @@
+From 37c7c45ec59ce80eaedb2b8edc4b797e4ad0ef03 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh at kernel.crashing.org>
+Date: Tue, 3 Jan 2012 12:09:15 +1100
+Subject: [PATCH 06/49] offb: Fix bug in calculating requested vram size
+
+commit c055fe0797b7bd8f6f21a13598a55a16d5c13ae7 upstream.
+
+We used to try to request 8 times more vram than needed, which would
+fail if the card has a too small BAR (observed with qemu & kvm).
+
+Signed-off-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/video/offb.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/video/offb.c b/drivers/video/offb.c
+index 24e1fc6..3251a02 100644
+--- a/drivers/video/offb.c
++++ b/drivers/video/offb.c
+@@ -377,7 +377,7 @@ static void __init offb_init_fb(const char *name, const char *full_name,
+ int pitch, unsigned long address,
+ int foreign_endian, struct device_node *dp)
+ {
+- unsigned long res_size = pitch * height * (depth + 7) / 8;
++ unsigned long res_size = pitch * height;
+ struct offb_par *par = &default_par;
+ unsigned long res_start = address;
+ struct fb_fix_screeninfo *fix;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0007-libertas-clean-up-scan-thread-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0007-libertas-clean-up-scan-thread-handling.patch
new file mode 100644
index 0000000..38fbce3
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0007-libertas-clean-up-scan-thread-handling.patch
@@ -0,0 +1,86 @@
+From 3184baa0e69e6ad327808b91e0d915090c59b99b Mon Sep 17 00:00:00 2001
+From: Andres Salomon <dilinger at queued.net>
+Date: Mon, 19 Dec 2011 12:22:58 -0800
+Subject: [PATCH 07/49] libertas: clean up scan thread handling
+
+commit afbca95f95f2bf7283a72670c24c1f6de00b1cb5 upstream.
+
+The libertas scan thread expects priv->scan_req to be non-NULL. In theory,
+it should always be set. In practice, we've seen the following oops:
+
+[ 8363.067444] Unable to handle kernel NULL pointer dereference at virtual address 00000004
+[ 8363.067490] pgd = c0004000
+[ 8363.078393] [00000004] *pgd=00000000
+[ 8363.086711] Internal error: Oops: 17 [#1] PREEMPT
+[ 8363.091375] Modules linked in: fuse libertas_sdio libertas psmouse mousedev ov7670 mmp_camera joydev videobuf2_core videobuf2_dma_sg videobuf2_memops [last unloaded: scsi_wait_scan]
+[ 8363.107490] CPU: 0 Not tainted (3.0.0-gf7ccc69 #671)
+[ 8363.112799] PC is at lbs_scan_worker+0x108/0x5a4 [libertas]
+[ 8363.118326] LR is at 0x0
+[ 8363.120836] pc : [<bf03a854>] lr : [<00000000>] psr: 60000113
+[ 8363.120845] sp : ee66bf48 ip : 00000000 fp : 00000000
+[ 8363.120845] r10: ee2c2088 r9 : c04e2efc r8 : eef97005
+[ 8363.132231] r7 : eee0716f r6 : ee2c02c0 r5 : ee2c2088 r4 : eee07160
+[ 8363.137419] r3 : 00000000 r2 : a0000113 r1 : 00000001 r0 : eee07160
+[ 8363.143896] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
+[ 8363.157630] Control: 10c5387d Table: 2e754019 DAC: 00000015
+[ 8363.163334] Process kworker/u:1 (pid: 25, stack limit = 0xee66a2f8)
+
+While I've not found a smoking gun, there are two places that raised red flags
+for me. The first is in _internal_start_scan, when we queue up a scan; we
+first queue the worker, and then set priv->scan_req. There's theoretically
+a 50mS delay which should be plenty, but doing things that way just seems
+racy (and not in the good way).
+
+The second is in the scan worker thread itself. Depending on the state of
+priv->scan_channel, we cancel pending scan runs and then requeue a run in
+300mS. We then send the scan command down to the hardware, sleep, and if
+we get scan results for all the desired channels, we set priv->scan_req to
+NULL. However, it that's happened in less than 300mS, what happens with
+the pending scan run?
+
+This patch addresses both of those concerns. With the patch applied, we
+have not seen the oops in the past two weeks.
+
+Signed-off-by: Andres Salomon <dilinger at queued.net>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/libertas/cfg.c | 10 ++++++----
+ 1 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
+index a7f1ab2..db64ef1 100644
+--- a/drivers/net/wireless/libertas/cfg.c
++++ b/drivers/net/wireless/libertas/cfg.c
+@@ -728,9 +728,11 @@ static void lbs_scan_worker(struct work_struct *work)
+ le16_to_cpu(scan_cmd->hdr.size),
+ lbs_ret_scan, 0);
+
+- if (priv->scan_channel >= priv->scan_req->n_channels)
++ if (priv->scan_channel >= priv->scan_req->n_channels) {
+ /* Mark scan done */
++ cancel_delayed_work(&priv->scan_work);
+ lbs_scan_done(priv);
++ }
+
+ /* Restart network */
+ if (carrier)
+@@ -759,12 +761,12 @@ static void _internal_start_scan(struct lbs_private *priv, bool internal,
+ request->n_ssids, request->n_channels, request->ie_len);
+
+ priv->scan_channel = 0;
+- queue_delayed_work(priv->work_thread, &priv->scan_work,
+- msecs_to_jiffies(50));
+-
+ priv->scan_req = request;
+ priv->internal_scan = internal;
+
++ queue_delayed_work(priv->work_thread, &priv->scan_work,
++ msecs_to_jiffies(50));
++
+ lbs_deb_leave(LBS_DEB_CFG80211);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0008-bcma-support-for-suspend-and-resume.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0008-bcma-support-for-suspend-and-resume.patch
new file mode 100644
index 0000000..fa51849
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0008-bcma-support-for-suspend-and-resume.patch
@@ -0,0 +1,120 @@
+From 84c0b10f18c54e0f669f9ac81872db6aff1e59b4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5 at gmail.com>
+Date: Fri, 9 Dec 2011 22:16:07 +0100
+Subject: [PATCH 08/49] bcma: support for suspend and resume
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 775ab52142b02237a54184238e922251c59a2b5c upstream.
+
+bcma used to lock up machine without enabling PCI or initializing CC.
+
+Signed-off-by: Rafał Miłecki <zajec5 at gmail.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/bcma/bcma_private.h | 3 +++
+ drivers/bcma/host_pci.c | 37 +++++++++++++++++++++++++++++++++++++
+ drivers/bcma/main.c | 16 ++++++++++++++++
+ 3 files changed, 56 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
+index 30a3085..fda56bd 100644
+--- a/drivers/bcma/bcma_private.h
++++ b/drivers/bcma/bcma_private.h
+@@ -18,6 +18,9 @@ void bcma_bus_unregister(struct bcma_bus *bus);
+ int __init bcma_bus_early_register(struct bcma_bus *bus,
+ struct bcma_device *core_cc,
+ struct bcma_device *core_mips);
++#ifdef CONFIG_PM
++int bcma_bus_resume(struct bcma_bus *bus);
++#endif
+
+ /* scan.c */
+ int bcma_bus_scan(struct bcma_bus *bus);
+diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
+index 1b51d8b..990f5a8 100644
+--- a/drivers/bcma/host_pci.c
++++ b/drivers/bcma/host_pci.c
+@@ -224,6 +224,41 @@ static void bcma_host_pci_remove(struct pci_dev *dev)
+ pci_set_drvdata(dev, NULL);
+ }
+
++#ifdef CONFIG_PM
++static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
++{
++ /* Host specific */
++ pci_save_state(dev);
++ pci_disable_device(dev);
++ pci_set_power_state(dev, pci_choose_state(dev, state));
++
++ return 0;
++}
++
++static int bcma_host_pci_resume(struct pci_dev *dev)
++{
++ struct bcma_bus *bus = pci_get_drvdata(dev);
++ int err;
++
++ /* Host specific */
++ pci_set_power_state(dev, 0);
++ err = pci_enable_device(dev);
++ if (err)
++ return err;
++ pci_restore_state(dev);
++
++ /* Bus specific */
++ err = bcma_bus_resume(bus);
++ if (err)
++ return err;
++
++ return 0;
++}
++#else /* CONFIG_PM */
++# define bcma_host_pci_suspend NULL
++# define bcma_host_pci_resume NULL
++#endif /* CONFIG_PM */
++
+ static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
+ { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
+ { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
+@@ -239,6 +274,8 @@ static struct pci_driver bcma_pci_bridge_driver = {
+ .id_table = bcma_pci_bridge_tbl,
+ .probe = bcma_host_pci_probe,
+ .remove = bcma_host_pci_remove,
++ .suspend = bcma_host_pci_suspend,
++ .resume = bcma_host_pci_resume,
+ };
+
+ int __init bcma_host_pci_init(void)
+diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
+index 70c84b9..10f92b3 100644
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -240,6 +240,22 @@ int __init bcma_bus_early_register(struct bcma_bus *bus,
+ return 0;
+ }
+
++#ifdef CONFIG_PM
++int bcma_bus_resume(struct bcma_bus *bus)
++{
++ struct bcma_device *core;
++
++ /* Init CC core */
++ core = bcma_find_core(bus, BCMA_CORE_CHIPCOMMON);
++ if (core) {
++ bus->drv_cc.setup_done = false;
++ bcma_core_chipcommon_init(&bus->drv_cc);
++ }
++
++ return 0;
++}
++#endif
++
+ int __bcma_driver_register(struct bcma_driver *drv, struct module *owner)
+ {
+ drv->drv.name = drv->name;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch
new file mode 100644
index 0000000..3380e52
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch
@@ -0,0 +1,75 @@
+From aa9c7fd565d04120156ef720235e9a759638606a Mon Sep 17 00:00:00 2001
+From: Pontus Fuchs <pontus.fuchs at gmail.com>
+Date: Tue, 18 Oct 2011 09:23:41 +0200
+Subject: [PATCH 09/49] wl12xx: Validate FEM index from ini file and FW
+
+commit 2131d3c2f99b081806fdae7662c92fe6acda52af upstream.
+
+Check for out of bound FEM index to prevent reading beyond ini
+memory end.
+
+Signed-off-by: Pontus Fuchs <pontus.fuchs at gmail.com>
+Reviewed-by: Luciano Coelho <coelho at ti.com>
+Signed-off-by: Luciano Coelho <coelho at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/wl12xx/cmd.c | 22 ++++++++++++++++++++++
+ 1 files changed, 22 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/wl12xx/cmd.c b/drivers/net/wireless/wl12xx/cmd.c
+index a52299e..54a0d66 100644
+--- a/drivers/net/wireless/wl12xx/cmd.c
++++ b/drivers/net/wireless/wl12xx/cmd.c
+@@ -120,6 +120,11 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
+ if (!wl->nvs)
+ return -ENODEV;
+
++ if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
++ wl1271_warning("FEM index from INI out of bounds");
++ return -EINVAL;
++ }
++
+ gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
+ if (!gen_parms)
+ return -ENOMEM;
+@@ -143,6 +148,12 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
+ gp->tx_bip_fem_manufacturer =
+ gen_parms->general_params.tx_bip_fem_manufacturer;
+
++ if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
++ wl1271_warning("FEM index from FW out of bounds");
++ ret = -EINVAL;
++ goto out;
++ }
++
+ wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
+ answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
+
+@@ -162,6 +173,11 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
+ if (!wl->nvs)
+ return -ENODEV;
+
++ if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
++ wl1271_warning("FEM index from ini out of bounds");
++ return -EINVAL;
++ }
++
+ gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
+ if (!gen_parms)
+ return -ENOMEM;
+@@ -186,6 +202,12 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
+ gp->tx_bip_fem_manufacturer =
+ gen_parms->general_params.tx_bip_fem_manufacturer;
+
++ if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
++ wl1271_warning("FEM index from FW out of bounds");
++ ret = -EINVAL;
++ goto out;
++ }
++
+ wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
+ answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch
new file mode 100644
index 0000000..d462ef6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch
@@ -0,0 +1,68 @@
+From bcd7880977c293b60ae6dbae4264d6c47be08fb9 Mon Sep 17 00:00:00 2001
+From: Pontus Fuchs <pontus.fuchs at gmail.com>
+Date: Tue, 18 Oct 2011 09:23:42 +0200
+Subject: [PATCH 10/49] wl12xx: Check buffer bound when processing nvs data
+
+commit f6efe96edd9c41c624c8f4ddbc4930c1a2d8f1e1 upstream.
+
+An nvs with malformed contents could cause the processing of the
+calibration data to read beyond the end of the buffer. Prevent this
+from happening by adding bound checking.
+
+Signed-off-by: Pontus Fuchs <pontus.fuchs at gmail.com>
+Reviewed-by: Luciano Coelho <coelho at ti.com>
+Signed-off-by: Luciano Coelho <coelho at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/wl12xx/boot.c | 14 ++++++++++++++
+ 1 files changed, 14 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c
+index 6813379..a7b327d 100644
+--- a/drivers/net/wireless/wl12xx/boot.c
++++ b/drivers/net/wireless/wl12xx/boot.c
+@@ -347,6 +347,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+ nvs_ptr += 3;
+
+ for (i = 0; i < burst_len; i++) {
++ if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
++ goto out_badnvs;
++
+ val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
+ | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
+
+@@ -358,6 +361,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+ nvs_ptr += 4;
+ dest_addr += 4;
+ }
++
++ if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
++ goto out_badnvs;
+ }
+
+ /*
+@@ -369,6 +375,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+ */
+ nvs_ptr = (u8 *)wl->nvs +
+ ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
++
++ if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
++ goto out_badnvs;
++
+ nvs_len -= nvs_ptr - (u8 *)wl->nvs;
+
+ /* Now we must set the partition correctly */
+@@ -384,6 +394,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+
+ kfree(nvs_aligned);
+ return 0;
++
++out_badnvs:
++ wl1271_error("nvs data is malformed");
++ return -EILSEQ;
+ }
+
+ static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0011-wl12xx-Restore-testmode-ABI.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0011-wl12xx-Restore-testmode-ABI.patch
new file mode 100644
index 0000000..7c619d4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0011-wl12xx-Restore-testmode-ABI.patch
@@ -0,0 +1,32 @@
+From 78848b4805314cdbf6c342b8315cdf7db2a1d09e Mon Sep 17 00:00:00 2001
+From: Pontus Fuchs <pontus.fuchs at gmail.com>
+Date: Thu, 1 Dec 2011 12:13:44 +0100
+Subject: [PATCH 11/49] wl12xx: Restore testmode ABI
+
+commit 3f1764945eaac532c20ab1f23afa352a40f797b2 upstream.
+
+Commit 80900d0140a7648587982c8f299830e900e49165 accidently broke
+the ABI for testmode commands. Restore the ABI again.
+
+Signed-off-by: Pontus Fuchs <pontus.fuchs at gmail.com>
+Signed-off-by: Luciano Coelho <coelho at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/wl12xx/testmode.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
+index 4ae8eff..abfb120 100644
+--- a/drivers/net/wireless/wl12xx/testmode.c
++++ b/drivers/net/wireless/wl12xx/testmode.c
+@@ -36,6 +36,7 @@ enum wl1271_tm_commands {
+ WL1271_TM_CMD_TEST,
+ WL1271_TM_CMD_INTERROGATE,
+ WL1271_TM_CMD_CONFIGURE,
++ WL1271_TM_CMD_NVS_PUSH, /* Not in use. Keep to not break ABI */
+ WL1271_TM_CMD_SET_PLT_MODE,
+ WL1271_TM_CMD_RECOVER,
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch
new file mode 100644
index 0000000..77fcc8b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch
@@ -0,0 +1,93 @@
+From 9c146884a6b099ed8892c056e26eae85019bc2c9 Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton at samba.org>
+Date: Wed, 23 Nov 2011 20:07:17 +0000
+Subject: [PATCH 12/49] powerpc/time: Handle wrapping of decrementer
+
+commit 37fb9a0231ee43d42d069863bdfd567fca2b61af upstream.
+
+When re-enabling interrupts we have code to handle edge sensitive
+decrementers by resetting the decrementer to 1 whenever it is negative.
+If interrupts were disabled long enough that the decrementer wrapped to
+positive we do nothing. This means interrupts can be delayed for a long
+time until it finally goes negative again.
+
+While we hope interrupts are never be disabled long enough for the
+decrementer to go positive, we have a very good test team that can
+drive any kernel into the ground. The softlockup data we get back
+from these fails could be seconds in the future, completely missing
+the cause of the lockup.
+
+We already keep track of the timebase of the next event so use that
+to work out if we should trigger a decrementer exception.
+
+Signed-off-by: Anton Blanchard <anton at samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/powerpc/include/asm/time.h | 2 ++
+ arch/powerpc/kernel/irq.c | 15 ++++++---------
+ arch/powerpc/kernel/time.c | 9 +++++++++
+ 3 files changed, 17 insertions(+), 9 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/time.h b/arch/powerpc/include/asm/time.h
+index fe6f7c2..bc3c745 100644
+--- a/arch/powerpc/include/asm/time.h
++++ b/arch/powerpc/include/asm/time.h
+@@ -219,5 +219,7 @@ DECLARE_PER_CPU(struct cpu_usage, cpu_usage_array);
+ extern void secondary_cpu_time_init(void);
+ extern void iSeries_time_init_early(void);
+
++extern void decrementer_check_overflow(void);
++
+ #endif /* __KERNEL__ */
+ #endif /* __POWERPC_TIME_H */
+diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
+index 5c3c469..745c1e7 100644
+--- a/arch/powerpc/kernel/irq.c
++++ b/arch/powerpc/kernel/irq.c
+@@ -164,16 +164,13 @@ notrace void arch_local_irq_restore(unsigned long en)
+ */
+ local_paca->hard_enabled = en;
+
+-#ifndef CONFIG_BOOKE
+- /* On server, re-trigger the decrementer if it went negative since
+- * some processors only trigger on edge transitions of the sign bit.
+- *
+- * BookE has a level sensitive decrementer (latches in TSR) so we
+- * don't need that
++ /*
++ * Trigger the decrementer if we have a pending event. Some processors
++ * only trigger on edge transitions of the sign bit. We might also
++ * have disabled interrupts long enough that the decrementer wrapped
++ * to positive.
+ */
+- if ((int)mfspr(SPRN_DEC) < 0)
+- mtspr(SPRN_DEC, 1);
+-#endif /* CONFIG_BOOKE */
++ decrementer_check_overflow();
+
+ /*
+ * Force the delivery of pending soft-disabled interrupts on PS3.
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index 522bb1d..5db163c 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -889,6 +889,15 @@ static void __init clocksource_init(void)
+ clock->name, clock->mult, clock->shift);
+ }
+
++void decrementer_check_overflow(void)
++{
++ u64 now = get_tb_or_rtc();
++ struct decrementer_clock *decrementer = &__get_cpu_var(decrementers);
++
++ if (now >= decrementer->next_tb)
++ set_dec(1);
++}
++
+ static int decrementer_set_next_event(unsigned long evt,
+ struct clock_event_device *dev)
+ {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch
new file mode 100644
index 0000000..69c746e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch
@@ -0,0 +1,85 @@
+From 78f337d172aafe8577dab8044f26326850b6c5d0 Mon Sep 17 00:00:00 2001
+From: Li Zhong <zhong at linux.vnet.ibm.com>
+Date: Sun, 18 Dec 2011 16:03:04 +0000
+Subject: [PATCH 13/49] powerpc: Fix unpaired probe_hcall_entry and
+ probe_hcall_exit
+
+commit e4f387d8db3ba3c2dae4d8bdfe7bb5f4fe1bcb0d upstream.
+
+Unpaired calling of probe_hcall_entry and probe_hcall_exit might happen
+as following, which could cause incorrect preempt count.
+
+__trace_hcall_entry => trace_hcall_entry -> probe_hcall_entry =>
+get_cpu_var => preempt_disable
+
+__trace_hcall_exit => trace_hcall_exit -> probe_hcall_exit =>
+put_cpu_var => preempt_enable
+
+where:
+A => B and A -> B means A calls B, but
+=> means A will call B through function name, and B will definitely be
+called.
+-> means A will call B through function pointer, so B might not be
+called if the function pointer is not set.
+
+So error happens when only one of probe_hcall_entry and probe_hcall_exit
+get called during a hcall.
+
+This patch tries to move the preempt count operations from
+probe_hcall_entry and probe_hcall_exit to its callers.
+
+Reported-by: Paul E. McKenney <paulmck at linux.vnet.ibm.com>
+Signed-off-by: Li Zhong <zhong at linux.vnet.ibm.com>
+Tested-by: Paul E. McKenney <paulmck at linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/powerpc/platforms/pseries/hvCall_inst.c | 4 +---
+ arch/powerpc/platforms/pseries/lpar.c | 2 ++
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/hvCall_inst.c b/arch/powerpc/platforms/pseries/hvCall_inst.c
+index f106662..c9311cf 100644
+--- a/arch/powerpc/platforms/pseries/hvCall_inst.c
++++ b/arch/powerpc/platforms/pseries/hvCall_inst.c
+@@ -109,7 +109,7 @@ static void probe_hcall_entry(void *ignored, unsigned long opcode, unsigned long
+ if (opcode > MAX_HCALL_OPCODE)
+ return;
+
+- h = &get_cpu_var(hcall_stats)[opcode / 4];
++ h = &__get_cpu_var(hcall_stats)[opcode / 4];
+ h->tb_start = mftb();
+ h->purr_start = mfspr(SPRN_PURR);
+ }
+@@ -126,8 +126,6 @@ static void probe_hcall_exit(void *ignored, unsigned long opcode, unsigned long
+ h->num_calls++;
+ h->tb_total += mftb() - h->tb_start;
+ h->purr_total += mfspr(SPRN_PURR) - h->purr_start;
+-
+- put_cpu_var(hcall_stats);
+ }
+
+ static int __init hcall_inst_init(void)
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index 27a4950..dc36ea6 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -554,6 +554,7 @@ void __trace_hcall_entry(unsigned long opcode, unsigned long *args)
+ goto out;
+
+ (*depth)++;
++ preempt_disable();
+ trace_hcall_entry(opcode, args);
+ (*depth)--;
+
+@@ -576,6 +577,7 @@ void __trace_hcall_exit(long opcode, unsigned long retval,
+
+ (*depth)++;
+ trace_hcall_exit(opcode, retval, retbuf);
++ preempt_enable();
+ (*depth)--;
+
+ out:
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch
new file mode 100644
index 0000000..8f8624a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch
@@ -0,0 +1,78 @@
+From 838487db8eb68ce5fa5417e9ea1333795f172523 Mon Sep 17 00:00:00 2001
+From: Ram Vepa <ram.vepa at qlogic.com>
+Date: Fri, 23 Dec 2011 08:01:43 -0500
+Subject: [PATCH 14/49] IB/qib: Fix a possible data corruption when receiving
+ packets
+
+commit eddfb675256f49d14e8c5763098afe3eb2c93701 upstream.
+
+Prevent a receive data corruption by ensuring that the write to update
+the rcvhdrheadn register to generate an interrupt is at the very end
+of the receive processing.
+
+Signed-off-by: Ramkrishna Vepa <ram.vepa at qlogic.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn at qlogic.com>
+Signed-off-by: Roland Dreier <roland at purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/infiniband/hw/qib/qib_iba6120.c | 4 +++-
+ drivers/infiniband/hw/qib/qib_iba7220.c | 4 +++-
+ drivers/infiniband/hw/qib/qib_iba7322.c | 6 ++++--
+ 3 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
+index 781a802..4f18e2d 100644
+--- a/drivers/infiniband/hw/qib/qib_iba6120.c
++++ b/drivers/infiniband/hw/qib/qib_iba6120.c
+@@ -2076,9 +2076,11 @@ static void qib_6120_config_ctxts(struct qib_devdata *dd)
+ static void qib_update_6120_usrhead(struct qib_ctxtdata *rcd, u64 hd,
+ u32 updegr, u32 egrhd, u32 npkts)
+ {
+- qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+ if (updegr)
+ qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
++ mmiowb();
++ qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
++ mmiowb();
+ }
+
+ static u32 qib_6120_hdrqempty(struct qib_ctxtdata *rcd)
+diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
+index 439d3c5..7ec4048 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7220.c
++++ b/drivers/infiniband/hw/qib/qib_iba7220.c
+@@ -2725,9 +2725,11 @@ static int qib_7220_set_loopback(struct qib_pportdata *ppd, const char *what)
+ static void qib_update_7220_usrhead(struct qib_ctxtdata *rcd, u64 hd,
+ u32 updegr, u32 egrhd, u32 npkts)
+ {
+- qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+ if (updegr)
+ qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
++ mmiowb();
++ qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
++ mmiowb();
+ }
+
+ static u32 qib_7220_hdrqempty(struct qib_ctxtdata *rcd)
+diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
+index 1d58959..5a070e8 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7322.c
++++ b/drivers/infiniband/hw/qib/qib_iba7322.c
+@@ -4082,10 +4082,12 @@ static void qib_update_7322_usrhead(struct qib_ctxtdata *rcd, u64 hd,
+ */
+ if (hd >> IBA7322_HDRHEAD_PKTINT_SHIFT)
+ adjust_rcv_timeout(rcd, npkts);
+- qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+- qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+ if (updegr)
+ qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
++ mmiowb();
++ qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
++ qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
++ mmiowb();
+ }
+
+ static u32 qib_7322_hdrqempty(struct qib_ctxtdata *rcd)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch
new file mode 100644
index 0000000..bff1351
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch
@@ -0,0 +1,96 @@
+From a2beea13ae4c2ffcaa7f0ddf94fde1246e2e6fc1 Mon Sep 17 00:00:00 2001
+From: Eli Cohen <eli at dev.mellanox.co.il>
+Date: Tue, 3 Jan 2012 20:36:48 -0800
+Subject: [PATCH 15/49] IB/uverbs: Protect QP multicast list
+
+commit e214a0fe2b382fa302c036ecd6e6ffe99e3b9875 upstream.
+
+Userspace verbs multicast attach/detach operations on a QP are done
+while holding the rwsem of the QP for reading. That's not sufficient
+since a reader lock allows more than one reader to acquire the
+lock. However, multicast attach/detach does list manipulation that
+can corrupt the list if multiple threads run in parallel.
+
+Fix this by acquiring the rwsem as a writer to serialize attach/detach
+operations. Add idr_write_qp() and put_qp_write() to encapsulate
+this.
+
+This fixes oops seen when running applications that perform multicast
+joins/leaves.
+
+Reported by: Mike Dubman <miked at mellanox.com>
+Signed-off-by: Eli Cohen <eli at mellanox.com>
+Signed-off-by: Roland Dreier <roland at purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/infiniband/core/uverbs_cmd.c | 21 +++++++++++++++++----
+ 1 files changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 254f164..e3db8ef 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -241,11 +241,24 @@ static struct ib_qp *idr_read_qp(int qp_handle, struct ib_ucontext *context)
+ return idr_read_obj(&ib_uverbs_qp_idr, qp_handle, context, 0);
+ }
+
++static struct ib_qp *idr_write_qp(int qp_handle, struct ib_ucontext *context)
++{
++ struct ib_uobject *uobj;
++
++ uobj = idr_write_uobj(&ib_uverbs_qp_idr, qp_handle, context);
++ return uobj ? uobj->object : NULL;
++}
++
+ static void put_qp_read(struct ib_qp *qp)
+ {
+ put_uobj_read(qp->uobject);
+ }
+
++static void put_qp_write(struct ib_qp *qp)
++{
++ put_uobj_write(qp->uobject);
++}
++
+ static struct ib_srq *idr_read_srq(int srq_handle, struct ib_ucontext *context)
+ {
+ return idr_read_obj(&ib_uverbs_srq_idr, srq_handle, context, 0);
+@@ -2375,7 +2388,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
+ if (copy_from_user(&cmd, buf, sizeof cmd))
+ return -EFAULT;
+
+- qp = idr_read_qp(cmd.qp_handle, file->ucontext);
++ qp = idr_write_qp(cmd.qp_handle, file->ucontext);
+ if (!qp)
+ return -EINVAL;
+
+@@ -2404,7 +2417,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
+ kfree(mcast);
+
+ out_put:
+- put_qp_read(qp);
++ put_qp_write(qp);
+
+ return ret ? ret : in_len;
+ }
+@@ -2422,7 +2435,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
+ if (copy_from_user(&cmd, buf, sizeof cmd))
+ return -EFAULT;
+
+- qp = idr_read_qp(cmd.qp_handle, file->ucontext);
++ qp = idr_write_qp(cmd.qp_handle, file->ucontext);
+ if (!qp)
+ return -EINVAL;
+
+@@ -2441,7 +2454,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
+ }
+
+ out_put:
+- put_qp_read(qp);
++ put_qp_write(qp);
+
+ return ret ? ret : in_len;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0016-iwlagn-fix-TID-use-bug.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0016-iwlagn-fix-TID-use-bug.patch
new file mode 100644
index 0000000..7c02037
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0016-iwlagn-fix-TID-use-bug.patch
@@ -0,0 +1,50 @@
+From 274a64cd739d2b5e33e6e2112f78c896b18849a9 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg at intel.com>
+Date: Fri, 2 Dec 2011 12:22:54 -0800
+Subject: [PATCH 16/49] iwlagn: fix TID use bug
+
+commit 9a215e40d70ae63762963ab3ccc7f31dd966dc6a upstream.
+
+The driver everywhere uses max TID count as 9,
+which is wrong, it should be 8.
+
+I think the reason it uses 9 here is off-by-one
+confusion by whoever wrote this. We do use the
+value IWL_MAX_TID_COUNT for "not QoS/no TID"
+but that is completely correct even if it is 8
+and not 9 since 0-7 are only valid.
+
+As a side effect, this fixes the following bug:
+
+ Open BA session requested for 00:23:cd:16:8a:7e tid 8
+ ------------[ cut here ]------------
+ kernel BUG at drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h:350!
+ ...
+
+when you do
+echo "tx start 8" > /sys/kernel/debug/ieee80211/*/*/*/*/agg_status
+
+Reported-by: Nikolay Martynov <mar.kolya at gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg at intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/iwlwifi/iwl-commands.h | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
+index 69d5f85..8b9ff28 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
++++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
+@@ -809,7 +809,7 @@ struct iwl_qosparam_cmd {
+ #define IWLAGN_STATION_COUNT 16
+
+ #define IWL_INVALID_STATION 255
+-#define IWL_MAX_TID_COUNT 9
++#define IWL_MAX_TID_COUNT 8
+
+ #define STA_FLG_TX_RATE_MSK cpu_to_le32(1 << 2)
+ #define STA_FLG_PWR_SAVE_MSK cpu_to_le32(1 << 8)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch
new file mode 100644
index 0000000..5dcc7c4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch
@@ -0,0 +1,180 @@
+From 8de3e18bbd1ec02914f9bf1517d2c3557c666314 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg at intel.com>
+Date: Mon, 19 Dec 2011 14:00:59 -0800
+Subject: [PATCH 17/49] iwlagn: fix (remove) use of PAGE_SIZE
+
+commit 106671369e6d046c0b3e1e72b18ad6dd9cb298b0 upstream.
+
+The ICT code erroneously uses PAGE_SIZE. The bug
+is that PAGE_SIZE isn't necessarily 4096, so on
+such platforms this code will not work correctly
+as we'll try to attempt to read an index in the
+table that the device never wrote, it always has
+4096-byte pages.
+
+Additionally, the manual alignment code here is
+unnecessary -- Documentation/DMA-API-HOWTO.txt
+states:
+ The cpu return address and the DMA bus master address are both
+ guaranteed to be aligned to the smallest PAGE_SIZE order which
+ is greater than or equal to the requested size. This invariant
+ exists (for example) to guarantee that if you allocate a chunk
+ which is smaller than or equal to 64 kilobytes, the extent of the
+ buffer you receive will not cross a 64K boundary.
+
+Just use appropriate new constants and get rid of
+the alignment code.
+
+Cc: Emmanuel Grumbach <emmanuel.grumbach at intel.com>
+Signed-off-by: Johannes Berg <johannes.berg at intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy at intel.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h | 2 -
+ drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c | 73 +++++++++------------
+ 2 files changed, 31 insertions(+), 44 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
+index 2b6756e..5c29281 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
++++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
+@@ -219,9 +219,7 @@ struct iwl_trans_pcie {
+
+ /* INT ICT Table */
+ __le32 *ict_tbl;
+- void *ict_tbl_vir;
+ dma_addr_t ict_tbl_dma;
+- dma_addr_t aligned_ict_tbl_dma;
+ int ict_index;
+ u32 inta;
+ bool use_ict;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+index 374c68c..1920237 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+@@ -1136,7 +1136,11 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
+ * ICT functions
+ *
+ ******************************************************************************/
+-#define ICT_COUNT (PAGE_SIZE/sizeof(u32))
++
++/* a device (PCI-E) page is 4096 bytes long */
++#define ICT_SHIFT 12
++#define ICT_SIZE (1 << ICT_SHIFT)
++#define ICT_COUNT (ICT_SIZE / sizeof(u32))
+
+ /* Free dram table */
+ void iwl_free_isr_ict(struct iwl_trans *trans)
+@@ -1144,21 +1148,19 @@ void iwl_free_isr_ict(struct iwl_trans *trans)
+ struct iwl_trans_pcie *trans_pcie =
+ IWL_TRANS_GET_PCIE_TRANS(trans);
+
+- if (trans_pcie->ict_tbl_vir) {
+- dma_free_coherent(bus(trans)->dev,
+- (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
+- trans_pcie->ict_tbl_vir,
++ if (trans_pcie->ict_tbl) {
++ dma_free_coherent(bus(trans)->dev, ICT_SIZE,
++ trans_pcie->ict_tbl,
+ trans_pcie->ict_tbl_dma);
+- trans_pcie->ict_tbl_vir = NULL;
+- memset(&trans_pcie->ict_tbl_dma, 0,
+- sizeof(trans_pcie->ict_tbl_dma));
+- memset(&trans_pcie->aligned_ict_tbl_dma, 0,
+- sizeof(trans_pcie->aligned_ict_tbl_dma));
++ trans_pcie->ict_tbl = NULL;
++ trans_pcie->ict_tbl_dma = 0;
+ }
+ }
+
+
+-/* allocate dram shared table it is a PAGE_SIZE aligned
++/*
++ * allocate dram shared table, it is an aligned memory
++ * block of ICT_SIZE.
+ * also reset all data related to ICT table interrupt.
+ */
+ int iwl_alloc_isr_ict(struct iwl_trans *trans)
+@@ -1166,36 +1168,26 @@ int iwl_alloc_isr_ict(struct iwl_trans *trans)
+ struct iwl_trans_pcie *trans_pcie =
+ IWL_TRANS_GET_PCIE_TRANS(trans);
+
+- /* allocate shrared data table */
+- trans_pcie->ict_tbl_vir =
+- dma_alloc_coherent(bus(trans)->dev,
+- (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
+- &trans_pcie->ict_tbl_dma, GFP_KERNEL);
+- if (!trans_pcie->ict_tbl_vir)
++ trans_pcie->ict_tbl =
++ dma_alloc_coherent(bus(trans)->dev, ICT_SIZE,
++ &trans_pcie->ict_tbl_dma,
++ GFP_KERNEL);
++ if (!trans_pcie->ict_tbl)
+ return -ENOMEM;
+
+- /* align table to PAGE_SIZE boundary */
+- trans_pcie->aligned_ict_tbl_dma =
+- ALIGN(trans_pcie->ict_tbl_dma, PAGE_SIZE);
+-
+- IWL_DEBUG_ISR(trans, "ict dma addr %Lx dma aligned %Lx diff %d\n",
+- (unsigned long long)trans_pcie->ict_tbl_dma,
+- (unsigned long long)trans_pcie->aligned_ict_tbl_dma,
+- (int)(trans_pcie->aligned_ict_tbl_dma -
+- trans_pcie->ict_tbl_dma));
++ /* just an API sanity check ... it is guaranteed to be aligned */
++ if (WARN_ON(trans_pcie->ict_tbl_dma & (ICT_SIZE - 1))) {
++ iwl_free_isr_ict(trans);
++ return -EINVAL;
++ }
+
+- trans_pcie->ict_tbl = trans_pcie->ict_tbl_vir +
+- (trans_pcie->aligned_ict_tbl_dma -
+- trans_pcie->ict_tbl_dma);
++ IWL_DEBUG_ISR(trans, "ict dma addr %Lx\n",
++ (unsigned long long)trans_pcie->ict_tbl_dma);
+
+- IWL_DEBUG_ISR(trans, "ict vir addr %p vir aligned %p diff %d\n",
+- trans_pcie->ict_tbl, trans_pcie->ict_tbl_vir,
+- (int)(trans_pcie->aligned_ict_tbl_dma -
+- trans_pcie->ict_tbl_dma));
++ IWL_DEBUG_ISR(trans, "ict vir addr %p\n", trans_pcie->ict_tbl);
+
+ /* reset table and index to all 0 */
+- memset(trans_pcie->ict_tbl_vir, 0,
+- (sizeof(u32) * ICT_COUNT) + PAGE_SIZE);
++ memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
+ trans_pcie->ict_index = 0;
+
+ /* add periodic RX interrupt */
+@@ -1213,23 +1205,20 @@ int iwl_reset_ict(struct iwl_trans *trans)
+ struct iwl_trans_pcie *trans_pcie =
+ IWL_TRANS_GET_PCIE_TRANS(trans);
+
+- if (!trans_pcie->ict_tbl_vir)
++ if (!trans_pcie->ict_tbl)
+ return 0;
+
+ spin_lock_irqsave(&trans->shrd->lock, flags);
+ iwl_disable_interrupts(trans);
+
+- memset(&trans_pcie->ict_tbl[0], 0, sizeof(u32) * ICT_COUNT);
++ memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
+
+- val = trans_pcie->aligned_ict_tbl_dma >> PAGE_SHIFT;
++ val = trans_pcie->ict_tbl_dma >> ICT_SHIFT;
+
+ val |= CSR_DRAM_INT_TBL_ENABLE;
+ val |= CSR_DRAM_INIT_TBL_WRAP_CHECK;
+
+- IWL_DEBUG_ISR(trans, "CSR_DRAM_INT_TBL_REG =0x%X "
+- "aligned dma address %Lx\n",
+- val,
+- (unsigned long long)trans_pcie->aligned_ict_tbl_dma);
++ IWL_DEBUG_ISR(trans, "CSR_DRAM_INT_TBL_REG =0x%x\n", val);
+
+ iwl_write32(bus(trans), CSR_DRAM_INT_TBL_REG, val);
+ trans_pcie->use_ict = true;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch
new file mode 100644
index 0000000..96e1c79
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch
@@ -0,0 +1,37 @@
+From 3d69705bbc0503baa930a277c3570ccdc2b82ac1 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt at redhat.com>
+Date: Fri, 4 Nov 2011 16:32:25 -0400
+Subject: [PATCH 18/49] perf: Fix parsing of __print_flags() in TP_printk()
+
+commit 49908a1b25d448d68fd26faca260e1850201575f upstream.
+
+A update is made to the sched:sched_switch event that adds some
+logic to the first parameter of the __print_flags() that shows the
+state of tasks. This change cause perf to fail parsing the flags.
+
+A simple fix is needed to have the parser be able to process ops
+within the argument.
+
+Reported-by: Andrew Vagin <avagin at openvz.org>
+Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ tools/perf/util/trace-event-parse.c | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
+index 6c164dc..bf54c48 100644
+--- a/tools/perf/util/trace-event-parse.c
++++ b/tools/perf/util/trace-event-parse.c
+@@ -1582,6 +1582,8 @@ process_symbols(struct event *event, struct print_arg *arg, char **tok)
+ field = malloc_or_die(sizeof(*field));
+
+ type = process_arg(event, field, &token);
++ while (type == EVENT_OP)
++ type = process_op(event, field, &token);
+ if (test_type_token(type, token, EVENT_DELIM, ","))
+ goto out_free;
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch
new file mode 100644
index 0000000..903491a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch
@@ -0,0 +1,41 @@
+From b892a813649b593177f4b36c200691ec7b610af7 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh at panasas.com>
+Date: Tue, 27 Dec 2011 19:23:36 +0200
+Subject: [PATCH 19/49] ore: Fix crash in case of an IO error.
+
+commit ffefb8eaa367e8a5c14f779233d9da1fbc23d164 upstream.
+
+The users of ore_check_io() expect the reported device
+(In case of error) to be indexed relative to the passed-in
+ore_components table, and not the logical dev index.
+
+This causes a crash inside objlayoutdriver in case of
+an IO error.
+
+Signed-off-by: Boaz Harrosh <bharrosh at panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/exofs/ore.c | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c
+index d271ad8..894f3e1 100644
+--- a/fs/exofs/ore.c
++++ b/fs/exofs/ore.c
+@@ -445,10 +445,10 @@ int ore_check_io(struct ore_io_state *ios, ore_on_dev_error on_dev_error)
+ u64 residual = ios->reading ?
+ or->in.residual : or->out.residual;
+ u64 offset = (ios->offset + ios->length) - residual;
+- struct ore_dev *od = ios->oc->ods[
+- per_dev->dev - ios->oc->first_dev];
++ unsigned dev = per_dev->dev - ios->oc->first_dev;
++ struct ore_dev *od = ios->oc->ods[dev];
+
+- on_dev_error(ios, od, per_dev->dev, osi.osd_err_pri,
++ on_dev_error(ios, od, dev, osi.osd_err_pri,
+ offset, residual);
+ }
+ if (osi.osd_err_pri >= acumulated_osd_err) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch
new file mode 100644
index 0000000..76fe4bf
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch
@@ -0,0 +1,56 @@
+From 3c8f1a35fab7418f9afeda2618992c1fd5504475 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh at panasas.com>
+Date: Wed, 28 Dec 2011 19:14:23 +0200
+Subject: [PATCH 20/49] ore: fix BUG_ON, too few sgs when reading
+
+commit 361aba569f55dd159b850489a3538253afbb3973 upstream.
+
+When reading RAID5 files, in rare cases, we calculated too
+few sg segments. There should be two extra for the beginning
+and end partial units.
+
+Also "too few sg segments" should not be a BUG_ON there is
+all the mechanics in place to handle it, as a short read.
+So just return -ENOMEM and the rest of the code will gracefully
+split the IO.
+
+Signed-off-by: Boaz Harrosh <bharrosh at panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/exofs/ore.c | 2 +-
+ fs/exofs/ore_raid.c | 6 +++++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c
+index 894f3e1..49cf230 100644
+--- a/fs/exofs/ore.c
++++ b/fs/exofs/ore.c
+@@ -266,7 +266,7 @@ int ore_get_rw_state(struct ore_layout *layout, struct ore_components *oc,
+
+ /* first/last seg is split */
+ num_raid_units += layout->group_width;
+- sgs_per_dev = div_u64(num_raid_units, data_devs);
++ sgs_per_dev = div_u64(num_raid_units, data_devs) + 2;
+ } else {
+ /* For Writes add parity pages array. */
+ max_par_pages = num_raid_units * pages_in_unit *
+diff --git a/fs/exofs/ore_raid.c b/fs/exofs/ore_raid.c
+index 29c47e5..414a2df 100644
+--- a/fs/exofs/ore_raid.c
++++ b/fs/exofs/ore_raid.c
+@@ -551,7 +551,11 @@ int _ore_add_parity_unit(struct ore_io_state *ios,
+ unsigned cur_len)
+ {
+ if (ios->reading) {
+- BUG_ON(per_dev->cur_sg >= ios->sgs_per_dev);
++ if (per_dev->cur_sg >= ios->sgs_per_dev) {
++ ORE_DBGMSG("cur_sg(%d) >= sgs_per_dev(%d)\n" ,
++ per_dev->cur_sg, ios->sgs_per_dev);
++ return -ENOMEM;
++ }
+ _ore_add_sg_seg(per_dev, cur_len, true);
+ } else {
+ struct __stripe_pages_2d *sp2d = ios->sp2d;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch
new file mode 100644
index 0000000..94fe29e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch
@@ -0,0 +1,163 @@
+From f3db3efc229dac1097a71b9d793d61aefb033ac2 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh at panasas.com>
+Date: Wed, 28 Dec 2011 19:21:45 +0200
+Subject: [PATCH 21/49] ore: Must support none-PAGE-aligned IO
+
+commit 724577ca355795b0a25c93ccbeee927871ca1a77 upstream.
+
+NFS might send us offsets that are not PAGE aligned. So
+we must read in the reminder of the first/last pages, in cases
+we need it for Parity calculations.
+
+We only add an sg segments to read the partial page. But
+we don't mark it as read=true because it is a lock-for-write
+page.
+
+TODO: In some cases (IO spans a single unit) we can just
+adjust the raid_unit offset/length, but this is left for
+later Kernels.
+
+Signed-off-by: Boaz Harrosh <bharrosh at panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/exofs/ore_raid.c | 72 ++++++++++++++++++++++++++++++++++++++++++--------
+ 1 files changed, 60 insertions(+), 12 deletions(-)
+
+diff --git a/fs/exofs/ore_raid.c b/fs/exofs/ore_raid.c
+index 414a2df..d222c77 100644
+--- a/fs/exofs/ore_raid.c
++++ b/fs/exofs/ore_raid.c
+@@ -328,8 +328,8 @@ static int _alloc_read_4_write(struct ore_io_state *ios)
+ /* @si contains info of the to-be-inserted page. Update of @si should be
+ * maintained by caller. Specificaly si->dev, si->obj_offset, ...
+ */
+-static int _add_to_read_4_write(struct ore_io_state *ios,
+- struct ore_striping_info *si, struct page *page)
++static int _add_to_r4w(struct ore_io_state *ios, struct ore_striping_info *si,
++ struct page *page, unsigned pg_len)
+ {
+ struct request_queue *q;
+ struct ore_per_dev_state *per_dev;
+@@ -366,17 +366,60 @@ static int _add_to_read_4_write(struct ore_io_state *ios,
+ _ore_add_sg_seg(per_dev, gap, true);
+ }
+ q = osd_request_queue(ore_comp_dev(read_ios->oc, per_dev->dev));
+- added_len = bio_add_pc_page(q, per_dev->bio, page, PAGE_SIZE, 0);
+- if (unlikely(added_len != PAGE_SIZE)) {
++ added_len = bio_add_pc_page(q, per_dev->bio, page, pg_len,
++ si->obj_offset % PAGE_SIZE);
++ if (unlikely(added_len != pg_len)) {
+ ORE_DBGMSG("Failed to bio_add_pc_page bi_vcnt=%d\n",
+ per_dev->bio->bi_vcnt);
+ return -ENOMEM;
+ }
+
+- per_dev->length += PAGE_SIZE;
++ per_dev->length += pg_len;
+ return 0;
+ }
+
++/* read the beginning of an unaligned first page */
++static int _add_to_r4w_first_page(struct ore_io_state *ios, struct page *page)
++{
++ struct ore_striping_info si;
++ unsigned pg_len;
++
++ ore_calc_stripe_info(ios->layout, ios->offset, 0, &si);
++
++ pg_len = si.obj_offset % PAGE_SIZE;
++ si.obj_offset -= pg_len;
++
++ ORE_DBGMSG("offset=0x%llx len=0x%x index=0x%lx dev=%x\n",
++ _LLU(si.obj_offset), pg_len, page->index, si.dev);
++
++ return _add_to_r4w(ios, &si, page, pg_len);
++}
++
++/* read the end of an incomplete last page */
++static int _add_to_r4w_last_page(struct ore_io_state *ios, u64 *offset)
++{
++ struct ore_striping_info si;
++ struct page *page;
++ unsigned pg_len, p, c;
++
++ ore_calc_stripe_info(ios->layout, *offset, 0, &si);
++
++ p = si.unit_off / PAGE_SIZE;
++ c = _dev_order(ios->layout->group_width * ios->layout->mirrors_p1,
++ ios->layout->mirrors_p1, si.par_dev, si.dev);
++ page = ios->sp2d->_1p_stripes[p].pages[c];
++
++ pg_len = PAGE_SIZE - (si.unit_off % PAGE_SIZE);
++ *offset += pg_len;
++
++ ORE_DBGMSG("p=%d, c=%d next-offset=0x%llx len=0x%x dev=%x par_dev=%d\n",
++ p, c, _LLU(*offset), pg_len, si.dev, si.par_dev);
++
++ BUG_ON(!page);
++
++ return _add_to_r4w(ios, &si, page, pg_len);
++}
++
+ static void _mark_read4write_pages_uptodate(struct ore_io_state *ios, int ret)
+ {
+ struct bio_vec *bv;
+@@ -444,9 +487,13 @@ static int _read_4_write(struct ore_io_state *ios)
+ struct page **pp = &_1ps->pages[c];
+ bool uptodate;
+
+- if (*pp)
++ if (*pp) {
++ if (ios->offset % PAGE_SIZE)
++ /* Read the remainder of the page */
++ _add_to_r4w_first_page(ios, *pp);
+ /* to-be-written pages start here */
+ goto read_last_stripe;
++ }
+
+ *pp = ios->r4w->get_page(ios->private, offset,
+ &uptodate);
+@@ -454,7 +501,7 @@ static int _read_4_write(struct ore_io_state *ios)
+ return -ENOMEM;
+
+ if (!uptodate)
+- _add_to_read_4_write(ios, &read_si, *pp);
++ _add_to_r4w(ios, &read_si, *pp, PAGE_SIZE);
+
+ /* Mark read-pages to be cache_released */
+ _1ps->page_is_read[c] = true;
+@@ -465,8 +512,11 @@ static int _read_4_write(struct ore_io_state *ios)
+ }
+
+ read_last_stripe:
+- offset = ios->offset + (ios->length + PAGE_SIZE - 1) /
+- PAGE_SIZE * PAGE_SIZE;
++ offset = ios->offset + ios->length;
++ if (offset % PAGE_SIZE)
++ _add_to_r4w_last_page(ios, &offset);
++ /* offset will be aligned to next page */
++
+ last_stripe_end = div_u64(offset + bytes_in_stripe - 1, bytes_in_stripe)
+ * bytes_in_stripe;
+ if (offset == last_stripe_end) /* Optimize for the aligned case */
+@@ -503,7 +553,7 @@ read_last_stripe:
+ /* Mark read-pages to be cache_released */
+ _1ps->page_is_read[c] = true;
+ if (!uptodate)
+- _add_to_read_4_write(ios, &read_si, page);
++ _add_to_r4w(ios, &read_si, page, PAGE_SIZE);
+ }
+
+ offset += PAGE_SIZE;
+@@ -616,8 +666,6 @@ int _ore_post_alloc_raid_stuff(struct ore_io_state *ios)
+ return -ENOMEM;
+ }
+
+- BUG_ON(ios->offset % PAGE_SIZE);
+-
+ /* Round io down to last full strip */
+ first_stripe = div_u64(ios->offset, stripe_size);
+ last_stripe = div_u64(ios->offset + ios->length, stripe_size);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch
new file mode 100644
index 0000000..a55cd86
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch
@@ -0,0 +1,89 @@
+From db0889eb6584510c3e1d860bfcfc7a85efc6fabe Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh at panasas.com>
+Date: Tue, 29 Nov 2011 15:35:53 -0800
+Subject: [PATCH 22/49] ore: FIX breakage when MISC_FILESYSTEMS is not set
+
+commit 831c2dc5f47c1dc79c32229d75065ada1dcc66e1 upstream.
+
+As Reported by Randy Dunlap
+
+When MISC_FILESYSTEMS is not enabled and NFS4.1 is:
+
+fs/built-in.o: In function `objio_alloc_io_state':
+objio_osd.c:(.text+0xcb525): undefined reference to `ore_get_rw_state'
+fs/built-in.o: In function `_write_done':
+objio_osd.c:(.text+0xcb58d): undefined reference to `ore_check_io'
+fs/built-in.o: In function `_read_done':
+...
+
+When MISC_FILESYSTEMS, which is more of a GUI thing then anything else,
+is not selected. exofs/Kconfig is never examined during Kconfig,
+and it can not do it's magic stuff to automatically select everything
+needed.
+
+We must split exofs/Kconfig in two. The ore one is always included.
+And the exofs one is left in it's old place in the menu.
+
+Reported-by: Randy Dunlap <rdunlap at xenotime.net>
+Signed-off-by: Boaz Harrosh <bharrosh at panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/Kconfig | 2 ++
+ fs/exofs/Kconfig | 11 -----------
+ fs/exofs/Kconfig.ore | 12 ++++++++++++
+ 3 files changed, 14 insertions(+), 11 deletions(-)
+ create mode 100644 fs/exofs/Kconfig.ore
+
+diff --git a/fs/Kconfig b/fs/Kconfig
+index 5f4c45d..6ad58a5 100644
+--- a/fs/Kconfig
++++ b/fs/Kconfig
+@@ -218,6 +218,8 @@ source "fs/exofs/Kconfig"
+
+ endif # MISC_FILESYSTEMS
+
++source "fs/exofs/Kconfig.ore"
++
+ menuconfig NETWORK_FILESYSTEMS
+ bool "Network File Systems"
+ default y
+diff --git a/fs/exofs/Kconfig b/fs/exofs/Kconfig
+index da42f32..86194b2 100644
+--- a/fs/exofs/Kconfig
++++ b/fs/exofs/Kconfig
+@@ -1,14 +1,3 @@
+-# Note ORE needs to "select ASYNC_XOR". So Not to force multiple selects
+-# for every ORE user we do it like this. Any user should add itself here
+-# at the "depends on EXOFS_FS || ..." with an ||. The dependencies are
+-# selected here, and we default to "ON". So in effect it is like been
+-# selected by any of the users.
+-config ORE
+- tristate
+- depends on EXOFS_FS || PNFS_OBJLAYOUT
+- select ASYNC_XOR
+- default SCSI_OSD_ULD
+-
+ config EXOFS_FS
+ tristate "exofs: OSD based file system support"
+ depends on SCSI_OSD_ULD
+diff --git a/fs/exofs/Kconfig.ore b/fs/exofs/Kconfig.ore
+new file mode 100644
+index 0000000..1ca7fb7
+--- /dev/null
++++ b/fs/exofs/Kconfig.ore
+@@ -0,0 +1,12 @@
++# ORE - Objects Raid Engine (libore.ko)
++#
++# Note ORE needs to "select ASYNC_XOR". So Not to force multiple selects
++# for every ORE user we do it like this. Any user should add itself here
++# at the "depends on EXOFS_FS || ..." with an ||. The dependencies are
++# selected here, and we default to "ON". So in effect it is like been
++# selected by any of the users.
++config ORE
++ tristate
++ depends on EXOFS_FS || PNFS_OBJLAYOUT
++ select ASYNC_XOR
++ default SCSI_OSD_ULD
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch
new file mode 100644
index 0000000..0121579
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch
@@ -0,0 +1,34 @@
+From 914681dc085b7bdeae0de64fba94532a6bcd093e Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack at suse.cz>
+Date: Wed, 21 Dec 2011 17:35:34 +0100
+Subject: [PATCH 23/49] reiserfs: Fix quota mount option parsing
+
+commit a06d789b424190e9f59da391681f908486db2554 upstream.
+
+When jqfmt mount option is not specified on remount, we mistakenly clear
+s_jquota_fmt value stored in superblock. Fix the problem.
+
+CC: reiserfs-devel at vger.kernel.org
+Signed-off-by: Jan Kara <jack at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/reiserfs/super.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index 14363b9..f9eaa4a 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -1164,7 +1164,8 @@ static void handle_quota_files(struct super_block *s, char **qf_names,
+ kfree(REISERFS_SB(s)->s_qf_names[i]);
+ REISERFS_SB(s)->s_qf_names[i] = qf_names[i];
+ }
+- REISERFS_SB(s)->s_jquota_fmt = *qfmt;
++ if (*qfmt)
++ REISERFS_SB(s)->s_jquota_fmt = *qfmt;
+ }
+ #endif
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch
new file mode 100644
index 0000000..32475f9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch
@@ -0,0 +1,70 @@
+From 0621050323cd3eef6fe27f168151e8823a6f63dd Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm at suse.com>
+Date: Wed, 21 Dec 2011 21:18:43 +0100
+Subject: [PATCH 24/49] reiserfs: Force inode evictions before umount to avoid
+ crash
+
+commit a9e36da655e54545c3289b2a0700b5c443de0edd upstream.
+
+This patch fixes a crash in reiserfs_delete_xattrs during umount.
+
+When shrink_dcache_for_umount clears the dcache from
+generic_shutdown_super, delayed evictions are forced to disk. If an
+evicted inode has extended attributes associated with it, it will
+need to walk the xattr tree to locate and remove them.
+
+But since shrink_dcache_for_umount will BUG if it encounters active
+dentries, the xattr tree must be released before it's called or it will
+crash during every umount.
+
+This patch forces the evictions to occur before generic_shutdown_super
+by calling shrink_dcache_sb first. The additional evictions caused
+by the removal of each associated xattr file and dir will be automatically
+handled as they're added to the LRU list.
+
+CC: reiserfs-devel at vger.kernel.org
+Signed-off-by: Jeff Mahoney <jeffm at suse.com>
+Signed-off-by: Jan Kara <jack at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/reiserfs/super.c | 24 ++++++++++++++----------
+ 1 files changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index f9eaa4a..5e3527b 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -453,16 +453,20 @@ int remove_save_link(struct inode *inode, int truncate)
+ static void reiserfs_kill_sb(struct super_block *s)
+ {
+ if (REISERFS_SB(s)) {
+- if (REISERFS_SB(s)->xattr_root) {
+- d_invalidate(REISERFS_SB(s)->xattr_root);
+- dput(REISERFS_SB(s)->xattr_root);
+- REISERFS_SB(s)->xattr_root = NULL;
+- }
+- if (REISERFS_SB(s)->priv_root) {
+- d_invalidate(REISERFS_SB(s)->priv_root);
+- dput(REISERFS_SB(s)->priv_root);
+- REISERFS_SB(s)->priv_root = NULL;
+- }
++ /*
++ * Force any pending inode evictions to occur now. Any
++ * inodes to be removed that have extended attributes
++ * associated with them need to clean them up before
++ * we can release the extended attribute root dentries.
++ * shrink_dcache_for_umount will BUG if we don't release
++ * those before it's called so ->put_super is too late.
++ */
++ shrink_dcache_sb(s);
++
++ dput(REISERFS_SB(s)->xattr_root);
++ REISERFS_SB(s)->xattr_root = NULL;
++ dput(REISERFS_SB(s)->priv_root);
++ REISERFS_SB(s)->priv_root = NULL;
+ }
+
+ kill_block_super(s);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch
new file mode 100644
index 0000000..5a04017
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch
@@ -0,0 +1,73 @@
+From d6bc098d6daabceca79a299bfe95dfe218661423 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack at suse.cz>
+Date: Thu, 22 Dec 2011 16:49:05 +0100
+Subject: [PATCH 25/49] ext3: Don't warn from writepage when readonly inode is
+ spotted after error
+
+commit 33c104d415e92a51aaf638dc3d93920cfa601e5c upstream.
+
+WARN_ON_ONCE(IS_RDONLY(inode)) tends to trip when filesystem hits error and is
+remounted read-only. This unnecessarily scares users (well, they should be
+scared because of filesystem error, but the stack trace distracts them from the
+right source of their fear ;-). We could as well just remove the WARN_ON but
+it's not hard to fix it to not trip on filesystem with errors and not use more
+cycles in the common case so that's what we do.
+
+Signed-off-by: Jan Kara <jack at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/ext3/inode.c | 24 +++++++++++++++++++++---
+ 1 files changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
+index 85fe655..5b3f907 100644
+--- a/fs/ext3/inode.c
++++ b/fs/ext3/inode.c
+@@ -1617,7 +1617,13 @@ static int ext3_ordered_writepage(struct page *page,
+ int err;
+
+ J_ASSERT(PageLocked(page));
+- WARN_ON_ONCE(IS_RDONLY(inode));
++ /*
++ * We don't want to warn for emergency remount. The condition is
++ * ordered to avoid dereferencing inode->i_sb in non-error case to
++ * avoid slow-downs.
++ */
++ WARN_ON_ONCE(IS_RDONLY(inode) &&
++ !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
+
+ /*
+ * We give up here if we're reentered, because it might be for a
+@@ -1692,7 +1698,13 @@ static int ext3_writeback_writepage(struct page *page,
+ int err;
+
+ J_ASSERT(PageLocked(page));
+- WARN_ON_ONCE(IS_RDONLY(inode));
++ /*
++ * We don't want to warn for emergency remount. The condition is
++ * ordered to avoid dereferencing inode->i_sb in non-error case to
++ * avoid slow-downs.
++ */
++ WARN_ON_ONCE(IS_RDONLY(inode) &&
++ !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
+
+ if (ext3_journal_current_handle())
+ goto out_fail;
+@@ -1735,7 +1747,13 @@ static int ext3_journalled_writepage(struct page *page,
+ int err;
+
+ J_ASSERT(PageLocked(page));
+- WARN_ON_ONCE(IS_RDONLY(inode));
++ /*
++ * We don't want to warn for emergency remount. The condition is
++ * ordered to avoid dereferencing inode->i_sb in non-error case to
++ * avoid slow-downs.
++ */
++ WARN_ON_ONCE(IS_RDONLY(inode) &&
++ !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
+
+ if (ext3_journal_current_handle())
+ goto no_write;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch
new file mode 100644
index 0000000..98dedab
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch
@@ -0,0 +1,70 @@
+From b9e6c637b69ffe81b7f272f433f18e3cd2f58052 Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys at microsoft.com>
+Date: Thu, 1 Dec 2011 09:59:34 -0800
+Subject: [PATCH 26/49] drivers: hv: Don't OOPS when you cannot init vmbus
+
+commit cf6a2eacbcb2593b5b91d0817915c4f0464bb534 upstream.
+
+The hv vmbus driver was causing an OOPS since it was trying to register drivers
+on top of the bus even if initialization of the bus has failed for some
+reason (such as the odd chance someone would run a hv enabled kernel in a
+non-hv environment).
+
+Signed-off-by: Sasha Levin <levinsasha928 at gmail.com>
+Signed-off-by: K. Y. Srinivasan <kys at microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/hv/vmbus_drv.c | 16 ++++++++++++++++
+ 1 files changed, 16 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 0c048dd..d3b0b4f 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -62,6 +62,14 @@ struct hv_device_info {
+ struct hv_dev_port_info outbound;
+ };
+
++static int vmbus_exists(void)
++{
++ if (hv_acpi_dev == NULL)
++ return -ENODEV;
++
++ return 0;
++}
++
+
+ static void get_channel_info(struct hv_device *device,
+ struct hv_device_info *info)
+@@ -590,6 +598,10 @@ int __vmbus_driver_register(struct hv_driver *hv_driver, struct module *owner, c
+
+ pr_info("registering driver %s\n", hv_driver->name);
+
++ ret = vmbus_exists();
++ if (ret < 0)
++ return ret;
++
+ hv_driver->driver.name = hv_driver->name;
+ hv_driver->driver.owner = owner;
+ hv_driver->driver.mod_name = mod_name;
+@@ -614,6 +626,9 @@ void vmbus_driver_unregister(struct hv_driver *hv_driver)
+ {
+ pr_info("unregistering driver %s\n", hv_driver->name);
+
++ if (!vmbus_exists())
++ return;
++
+ driver_unregister(&hv_driver->driver);
+
+ }
+@@ -776,6 +791,7 @@ static int __init hv_acpi_init(void)
+
+ cleanup:
+ acpi_bus_unregister_driver(&vmbus_acpi_driver);
++ hv_acpi_dev = NULL;
+ return ret;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch
new file mode 100644
index 0000000..e6184ae
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch
@@ -0,0 +1,40 @@
+From 797931db7094985a8aa99b24695192d1773129de Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys at microsoft.com>
+Date: Tue, 27 Dec 2011 13:49:37 -0800
+Subject: [PATCH 27/49] Drivers:hv: Fix a bug in vmbus_driver_unregister()
+
+commit 8f257a142fc3868d69de3f996b95d7bdbc509560 upstream.
+
+The function vmbus_exists() was introduced recently to deal with cases where
+the vmbus driver failed to initialize and yet other Hyper-V drivers attempted
+to register with the vmbus bus driver. This patch introduced a bug where
+vmbus_driver_unregister() would fail to unregister the driver. This patch
+fixes the problem.
+
+Signed-off-by: K. Y. Srinivasan <kys at microsoft.com>
+Signed-off-by: Fuzhou Chen <fuzhouch at microsoft.com>
+Cc: Sasha Levin <levinsasha928 at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/hv/vmbus_drv.c | 5 +----
+ 1 files changed, 1 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index d3b0b4f..d2d0a2a 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -627,10 +627,7 @@ void vmbus_driver_unregister(struct hv_driver *hv_driver)
+ pr_info("unregistering driver %s\n", hv_driver->name);
+
+ if (!vmbus_exists())
+- return;
+-
+- driver_unregister(&hv_driver->driver);
+-
++ driver_unregister(&hv_driver->driver);
+ }
+ EXPORT_SYMBOL_GPL(vmbus_driver_unregister);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0028-USB-update-documentation-for-usbmon.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0028-USB-update-documentation-for-usbmon.patch
new file mode 100644
index 0000000..8a6a5fb
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0028-USB-update-documentation-for-usbmon.patch
@@ -0,0 +1,54 @@
+From a4d5730e9c4b209e74eab2f7650b23f95417dc71 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern at rowland.harvard.edu>
+Date: Wed, 4 Jan 2012 16:36:35 -0500
+Subject: [PATCH 28/49] USB: update documentation for usbmon
+
+commit d8cae98cddd286e38db1724dda1b0e7b467f9237 upstream.
+
+The documentation for usbmon is out of date; the usbfs "devices" file
+now exists in /sys/kernel/debug/usb rather than /proc/bus/usb. This
+patch (as1505) updates the documentation accordingly, and also
+mentions that the necessary information can be found by running lsusb.
+
+Signed-off-by: Alan Stern <stern at rowland.harvard.edu>
+CC: Pete Zaitcev <zaitcev at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ Documentation/usb/usbmon.txt | 14 +++++++++-----
+ 1 files changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/Documentation/usb/usbmon.txt b/Documentation/usb/usbmon.txt
+index a4efa04..5335fa8 100644
+--- a/Documentation/usb/usbmon.txt
++++ b/Documentation/usb/usbmon.txt
+@@ -47,10 +47,11 @@ This allows to filter away annoying devices that talk continuously.
+
+ 2. Find which bus connects to the desired device
+
+-Run "cat /proc/bus/usb/devices", and find the T-line which corresponds to
+-the device. Usually you do it by looking for the vendor string. If you have
+-many similar devices, unplug one and compare two /proc/bus/usb/devices outputs.
+-The T-line will have a bus number. Example:
++Run "cat /sys/kernel/debug/usb/devices", and find the T-line which corresponds
++to the device. Usually you do it by looking for the vendor string. If you have
++many similar devices, unplug one and compare the two
++/sys/kernel/debug/usb/devices outputs. The T-line will have a bus number.
++Example:
+
+ T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+ D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
+@@ -58,7 +59,10 @@ P: Vendor=0557 ProdID=2004 Rev= 1.00
+ S: Manufacturer=ATEN
+ S: Product=UC100KM V2.00
+
+-Bus=03 means it's bus 3.
++"Bus=03" means it's bus 3. Alternatively, you can look at the output from
++"lsusb" and get the bus number from the appropriate line. Example:
++
++Bus 003 Device 002: ID 0557:2004 ATEN UC100KM V2.00
+
+ 3. Start 'cat'
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch
new file mode 100644
index 0000000..dfc6d0b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch
@@ -0,0 +1,125 @@
+From 6b544616a14b48a670d0c7ce10a5f8de1246cc96 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp at linux.intel.com>
+Date: Fri, 16 Dec 2011 11:26:30 -0800
+Subject: [PATCH 29/49] usbfs: Fix oops related to user namespace conversion.
+
+commit 1b41c8321e495337e877ca02d0b9680bc4112eff upstream.
+
+When running the Point Grey "flycap" program for their USB 3.0 camera
+(which was running as a USB 2.0 device for some reason), I trigger this
+oops whenever I try to open a video stream:
+
+Dec 15 16:48:34 puck kernel: [ 1798.715559] BUG: unable to handle kernel NULL pointer dereference at (null)
+Dec 15 16:48:34 puck kernel: [ 1798.719153] IP: [<ffffffff8147841e>] free_async+0x1e/0x70
+Dec 15 16:48:34 puck kernel: [ 1798.720991] PGD 6f833067 PUD 6fc56067 PMD 0
+Dec 15 16:48:34 puck kernel: [ 1798.722815] Oops: 0002 [#1] SMP
+Dec 15 16:48:34 puck kernel: [ 1798.724627] CPU 0
+Dec 15 16:48:34 puck kernel: [ 1798.724636] Modules linked in: ecryptfs encrypted_keys sha1_generic trusted binfmt_misc sha256_generic aesni_intel cryptd aes_x86_64 aes_generic parport_pc dm_crypt ppdev joydev snd_hda_codec_hdmi snd_hda_codec_conexant arc4 iwlwifi snd_hda_intel snd_hda_codec snd_hwdep snd_pcm thinkpad_acpi mac80211 snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer btusb uvcvideo snd_seq_device bluetooth videodev psmouse snd v4l2_compat_ioctl32 serio_raw tpm_tis cfg80211 tpm tpm_bios nvram soundcore snd_page_alloc lp parport i915 xhci_hcd ahci libahci drm_kms_helper drm sdhci_pci sdhci e1000e i2c_algo_bit video
+Dec 15 16:48:34 puck kernel: [ 1798.734212]
+Dec 15 16:48:34 puck kernel: [ 1798.736162] Pid: 2713, comm: FlyCap2 Not tainted 3.2.0-rc5+ #28 LENOVO 4286CTO/4286CTO
+Dec 15 16:48:34 puck kernel: [ 1798.738148] RIP: 0010:[<ffffffff8147841e>] [<ffffffff8147841e>] free_async+0x1e/0x70
+Dec 15 16:48:34 puck kernel: [ 1798.740134] RSP: 0018:ffff88005715fd78 EFLAGS: 00010296
+Dec 15 16:48:34 puck kernel: [ 1798.742118] RAX: 00000000fffffff4 RBX: ffff88006fe8f900 RCX: 0000000000004118
+Dec 15 16:48:34 puck kernel: [ 1798.744116] RDX: 0000000001000000 RSI: 0000000000016390 RDI: 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.746087] RBP: ffff88005715fd88 R08: 0000000000000000 R09: ffffffff8146f22e
+Dec 15 16:48:34 puck kernel: [ 1798.748018] R10: ffff88006e520ac0 R11: 0000000000000001 R12: ffff88005715fe28
+Dec 15 16:48:34 puck kernel: [ 1798.749916] R13: ffff88005d31df00 R14: ffff88006fe8f900 R15: 00007f688c995cb8
+Dec 15 16:48:34 puck kernel: [ 1798.751785] FS: 00007f68a366da40(0000) GS:ffff880100200000(0000) knlGS:0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.753659] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+Dec 15 16:48:34 puck kernel: [ 1798.755509] CR2: 0000000000000000 CR3: 00000000706bb000 CR4: 00000000000406f0
+Dec 15 16:48:34 puck kernel: [ 1798.757334] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.759124] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Dec 15 16:48:34 puck kernel: [ 1798.760871] Process FlyCap2 (pid: 2713, threadinfo ffff88005715e000, task ffff88006c675b80)
+Dec 15 16:48:34 puck kernel: [ 1798.762605] Stack:
+Dec 15 16:48:34 puck kernel: [ 1798.764297] ffff88005715fe28 0000000000000000 ffff88005715fe08 ffffffff81479058
+Dec 15 16:48:34 puck kernel: [ 1798.766020] 0000000000000000 ffffea0000004000 ffff880000004118 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.767750] ffff880000000001 ffff88006e520ac0 fffffff46fd81180 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.769472] Call Trace:
+Dec 15 16:48:34 puck kernel: [ 1798.771147] [<ffffffff81479058>] proc_do_submiturb+0x778/0xa00
+Dec 15 16:48:34 puck kernel: [ 1798.772798] [<ffffffff8147a5fd>] usbdev_do_ioctl+0x24d/0x1200
+Dec 15 16:48:34 puck kernel: [ 1798.774410] [<ffffffff8147b5de>] usbdev_ioctl+0xe/0x20
+Dec 15 16:48:34 puck kernel: [ 1798.775975] [<ffffffff81189259>] do_vfs_ioctl+0x99/0x600
+Dec 15 16:48:34 puck kernel: [ 1798.777534] [<ffffffff81189851>] sys_ioctl+0x91/0xa0
+Dec 15 16:48:34 puck kernel: [ 1798.779088] [<ffffffff816247c2>] system_call_fastpath+0x16/0x1b
+ec 15 16:48:34 puck kernel: [ 1798.780634] Code: 51 ff ff ff e9 29 ff ff ff 0f 1f 40 00 55 48 89 e5 53 48 83 ec 08 66 66 66 66 90 48 89 fb 48 8b 7f 18 e8 a6 ea c0 ff 4
+8 8b 7b 20 <f0> ff 0f 0f 94 c0 84 c0 74 05 e8 d3 99 c1 ff 48 8b 43 40 48 8b
+Dec 15 16:48:34 puck kernel: [ 1798.783970] RIP [<ffffffff8147841e>] free_async+0x1e/0x70
+Dec 15 16:48:34 puck kernel: [ 1798.785630] RSP <ffff88005715fd78>
+Dec 15 16:48:34 puck kernel: [ 1798.787274] CR2: 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.794728] ---[ end trace 52894d3355f88d19 ]---
+
+markup_oops.pl says the oops is in put_cred:
+
+ ffffffff81478401: 48 89 e5 mov %rsp,%rbp
+ ffffffff81478404: 53 push %rbx
+ ffffffff81478405: 48 83 ec 08 sub $0x8,%rsp
+ ffffffff81478409: e8 f2 c0 1a 00 callq ffffffff81624500 <mcount>
+ ffffffff8147840e: 48 89 fb mov %rdi,%rbx | %ebx => ffff88006fe8f900
+ put_pid(as->pid);
+ ffffffff81478411: 48 8b 7f 18 mov 0x18(%rdi),%rdi
+ ffffffff81478415: e8 a6 ea c0 ff callq ffffffff81086ec0 <put_pid>
+ put_cred(as->cred);
+ ffffffff8147841a: 48 8b 7b 20 mov 0x20(%rbx),%rdi | %edi => 0 %ebx = ffff88006fe8f900
+ */
+ static inline int atomic_dec_and_test(atomic_t *v)
+ {
+ unsigned char c;
+
+ asm volatile(LOCK_PREFIX "decl %0; sete %1"
+*ffffffff8147841e: f0 ff 0f lock decl (%rdi) | %edi = 0 <--- faulting instruction
+ ffffffff81478421: 0f 94 c0 sete %al
+ static inline void put_cred(const struct cred *_cred)
+ {
+ struct cred *cred = (struct cred *) _cred;
+
+ validate_creds(cred);
+ if (atomic_dec_and_test(&(cred)->usage))
+ ffffffff81478424: 84 c0 test %al,%al
+ ffffffff81478426: 74 05 je ffffffff8147842d <free_async+0x2d>
+ __put_cred(cred);
+ ffffffff81478428: e8 d3 99 c1 ff callq ffffffff81091e00 <__put_cred>
+ kfree(as->urb->transfer_buffer);
+ ffffffff8147842d: 48 8b 43 40 mov 0x40(%rbx),%rax
+ ffffffff81478431: 48 8b 78 68 mov 0x68(%rax),%rdi
+ ffffffff81478435: e8 a6 e1 ce ff callq ffffffff811665e0 <kfree>
+ kfree(as->urb->setup_packet);
+ ffffffff8147843a: 48 8b 43 40 mov 0x40(%rbx),%rax
+ ffffffff8147843e: 48 8b b8 90 00 00 00 mov 0x90(%rax),%rdi
+ ffffffff81478445: e8 96 e1 ce ff callq ffffffff811665e0 <kfree>
+ usb_free_urb(as->urb);
+ ffffffff8147844a: 48 8b 7b 40 mov 0x40(%rbx),%rdi
+ ffffffff8147844e: e8 0d 6b ff ff callq ffffffff8146ef60 <usb_free_urb>
+
+This bug seems to have been introduced by commit
+d178bc3a708f39cbfefc3fab37032d3f2511b4ec "user namespace: usb: make usb
+urbs user namespace aware (v2)"
+
+I'm not sure if this is right fix, but it does stop the oops.
+
+Unfortunately, the Point Grey software still refuses to work, but it's a
+closed source app, so I can't fix it.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp at linux.intel.com>
+Acked-by: Serge Hallyn <serge.hallyn at canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/core/devio.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index e3beaf2..7abf060 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -249,7 +249,8 @@ static struct async *alloc_async(unsigned int numisoframes)
+ static void free_async(struct async *as)
+ {
+ put_pid(as->pid);
+- put_cred(as->cred);
++ if (as->cred)
++ put_cred(as->cred);
+ kfree(as->urb->transfer_buffer);
+ kfree(as->urb->setup_packet);
+ usb_free_urb(as->urb);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch
new file mode 100644
index 0000000..75f2b51
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch
@@ -0,0 +1,47 @@
+From 2918b666fe0636d9d90ce6defda2d3ec908231a8 Mon Sep 17 00:00:00 2001
+From: Claudio Scordino <claudio at evidence.eu.com>
+Date: Fri, 16 Dec 2011 15:08:49 +0100
+Subject: [PATCH 30/49] atmel_serial: fix spinlock lockup in RS485 code
+
+commit dbf1115d3f8c7052788aa4e6e46abd27f3b3eeba upstream.
+
+Patch to fix a spinlock lockup in the driver that sometimes happens when the
+tasklet starts.
+
+Signed-off-by: Claudio Scordino <claudio at evidence.eu.com>
+Signed-off-by: Dave Bender <codehero at gmail.com>
+Tested-by: Dave Bender <codehero at gmail.com>
+Acked-by: Nicolas Ferre <nicolas.ferre at atmel.com>
+Acked-by: Alan Cox <alan at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/tty/serial/atmel_serial.c | 5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 4c823f3..90c8e3a 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -212,8 +212,9 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+ {
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+ unsigned int mode;
++ unsigned long flags;
+
+- spin_lock(&port->lock);
++ spin_lock_irqsave(&port->lock, flags);
+
+ /* Disable interrupts */
+ UART_PUT_IDR(port, atmel_port->tx_done_mask);
+@@ -244,7 +245,7 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+ /* Enable interrupts */
+ UART_PUT_IER(port, atmel_port->tx_done_mask);
+
+- spin_unlock(&port->lock);
++ spin_unlock_irqrestore(&port->lock, flags);
+
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch
new file mode 100644
index 0000000..649d103
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch
@@ -0,0 +1,50 @@
+From 7e755f9707e34e7de22e2f3b77ab26d1d8de5a4b Mon Sep 17 00:00:00 2001
+From: Li Zefan <lizf at cn.fujitsu.com>
+Date: Tue, 27 Dec 2011 14:25:55 +0800
+Subject: [PATCH 31/49] cgroup: fix to allow mounting a hierarchy by name
+
+commit 0d19ea866562e46989412a0676412fa0983c9ce7 upstream.
+
+If we mount a hierarchy with a specified name, the name is unique,
+and we can use it to mount the hierarchy without specifying its
+set of subsystem names. This feature is documented is
+Documentation/cgroups/cgroups.txt section 2.3
+
+Here's an example:
+
+ # mount -t cgroup -o cpuset,name=myhier xxx /cgroup1
+ # mount -t cgroup -o name=myhier xxx /cgroup2
+
+But it was broken by commit 32a8cf235e2f192eb002755076994525cdbaa35a
+(cgroup: make the mount options parsing more accurate)
+
+This fixes the regression.
+
+Signed-off-by: Li Zefan <lizf at cn.fujitsu.com>
+Signed-off-by: Tejun Heo <tj at kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ kernel/cgroup.c | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index a184470..cdc0354 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -1175,10 +1175,10 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
+
+ /*
+ * If the 'all' option was specified select all the subsystems,
+- * otherwise 'all, 'none' and a subsystem name options were not
+- * specified, let's default to 'all'
++ * otherwise if 'none', 'name=' and a subsystem name options
++ * were not specified, let's default to 'all'
+ */
+- if (all_ss || (!all_ss && !one_ss && !opts->none)) {
++ if (all_ss || (!one_ss && !opts->none && !opts->name)) {
+ for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+ struct cgroup_subsys *ss = subsys[i];
+ if (ss == NULL)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch
new file mode 100644
index 0000000..e5d99f7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch
@@ -0,0 +1,130 @@
+From b2b56aa7932508ce3a81187a68e6a558268efc35 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack at suse.cz>
+Date: Sat, 10 Dec 2011 02:30:48 +0100
+Subject: [PATCH 32/49] udf: Fix deadlock when converting file from in-ICB one
+ to normal one
+
+commit d2eb8c359309ec45d6bf5b147303ab8e13be86ea upstream.
+
+During BKL removal in 2.6.38, conversion of files from in-ICB format to normal
+format got broken. We call ->writepage with i_data_sem held but udf_get_block()
+also acquires i_data_sem thus creating A-A deadlock.
+
+We fix the problem by dropping i_data_sem before calling ->writepage() which is
+safe since i_mutex still protects us against any changes in the file. Also fix
+pagelock - i_data_sem lock inversion in udf_expand_file_adinicb() by dropping
+i_data_sem before calling find_or_create_page().
+
+Reported-by: Matthias Matiak <netzpython at mail-on.us>
+Tested-by: Matthias Matiak <netzpython at mail-on.us>
+Reviewed-by: Namjae Jeon <linkinjeon at gmail.com>
+Signed-off-by: Jan Kara <jack at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/udf/file.c | 6 +++---
+ fs/udf/inode.c | 21 ++++++++++++++++++---
+ 2 files changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/fs/udf/file.c b/fs/udf/file.c
+index d8ffa7c..dca0c38 100644
+--- a/fs/udf/file.c
++++ b/fs/udf/file.c
+@@ -125,7 +125,6 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
+ err = udf_expand_file_adinicb(inode);
+ if (err) {
+ udf_debug("udf_expand_adinicb: err=%d\n", err);
+- up_write(&iinfo->i_data_sem);
+ return err;
+ }
+ } else {
+@@ -133,9 +132,10 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
+ iinfo->i_lenAlloc = pos + count;
+ else
+ iinfo->i_lenAlloc = inode->i_size;
++ up_write(&iinfo->i_data_sem);
+ }
+- }
+- up_write(&iinfo->i_data_sem);
++ } else
++ up_write(&iinfo->i_data_sem);
+
+ retval = generic_file_aio_write(iocb, iov, nr_segs, ppos);
+ if (retval > 0)
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 4fd1d80..e2787d0 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -151,6 +151,12 @@ const struct address_space_operations udf_aops = {
+ .bmap = udf_bmap,
+ };
+
++/*
++ * Expand file stored in ICB to a normal one-block-file
++ *
++ * This function requires i_data_sem for writing and releases it.
++ * This function requires i_mutex held
++ */
+ int udf_expand_file_adinicb(struct inode *inode)
+ {
+ struct page *page;
+@@ -169,9 +175,15 @@ int udf_expand_file_adinicb(struct inode *inode)
+ iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
+ /* from now on we have normal address_space methods */
+ inode->i_data.a_ops = &udf_aops;
++ up_write(&iinfo->i_data_sem);
+ mark_inode_dirty(inode);
+ return 0;
+ }
++ /*
++ * Release i_data_sem so that we can lock a page - page lock ranks
++ * above i_data_sem. i_mutex still protects us against file changes.
++ */
++ up_write(&iinfo->i_data_sem);
+
+ page = find_or_create_page(inode->i_mapping, 0, GFP_NOFS);
+ if (!page)
+@@ -187,6 +199,7 @@ int udf_expand_file_adinicb(struct inode *inode)
+ SetPageUptodate(page);
+ kunmap(page);
+ }
++ down_write(&iinfo->i_data_sem);
+ memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr, 0x00,
+ iinfo->i_lenAlloc);
+ iinfo->i_lenAlloc = 0;
+@@ -196,17 +209,20 @@ int udf_expand_file_adinicb(struct inode *inode)
+ iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
+ /* from now on we have normal address_space methods */
+ inode->i_data.a_ops = &udf_aops;
++ up_write(&iinfo->i_data_sem);
+ err = inode->i_data.a_ops->writepage(page, &udf_wbc);
+ if (err) {
+ /* Restore everything back so that we don't lose data... */
+ lock_page(page);
+ kaddr = kmap(page);
++ down_write(&iinfo->i_data_sem);
+ memcpy(iinfo->i_ext.i_data + iinfo->i_lenEAttr, kaddr,
+ inode->i_size);
+ kunmap(page);
+ unlock_page(page);
+ iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB;
+ inode->i_data.a_ops = &udf_adinicb_aops;
++ up_write(&iinfo->i_data_sem);
+ }
+ page_cache_release(page);
+ mark_inode_dirty(inode);
+@@ -1111,10 +1127,9 @@ int udf_setsize(struct inode *inode, loff_t newsize)
+ if (bsize <
+ (udf_file_entry_alloc_offset(inode) + newsize)) {
+ err = udf_expand_file_adinicb(inode);
+- if (err) {
+- up_write(&iinfo->i_data_sem);
++ if (err)
+ return err;
+- }
++ down_write(&iinfo->i_data_sem);
+ } else
+ iinfo->i_lenAlloc = newsize;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch
new file mode 100644
index 0000000..e5e7b95
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch
@@ -0,0 +1,45 @@
+From 2aabf017a2a76405dd9efbca80320965d8361302 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia at diku.dk>
+Date: Fri, 23 Dec 2011 14:02:55 +0100
+Subject: [PATCH 33/49] drivers/usb/class/cdc-acm.c: clear dangling pointer
+
+commit e7c8e8605d0bafc705ff27f9da98a1668427cc0f upstream.
+
+On some failures, the country_code field of an acm structure is freed
+without freeing the acm structure itself. Elsewhere, operations including
+memcpy and kfree are performed on the country_code field. The patch sets
+the country_code field to NULL when it is freed, and likewise sets the
+country_code_size field to 0.
+
+Signed-off-by: Julia Lawall <julia at diku.dk>
+Acked-by: Oliver Neukum <oneukum at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/class/cdc-acm.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index a8078d0..ea5e487 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1183,6 +1183,8 @@ made_compressed_probe:
+ i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
+ if (i < 0) {
+ kfree(acm->country_codes);
++ acm->country_codes = NULL;
++ acm->country_code_size = 0;
+ goto skip_countries;
+ }
+
+@@ -1191,6 +1193,8 @@ made_compressed_probe:
+ if (i < 0) {
+ device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
+ kfree(acm->country_codes);
++ acm->country_codes = NULL;
++ acm->country_code_size = 0;
+ goto skip_countries;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch
new file mode 100644
index 0000000..ed02f1e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch
@@ -0,0 +1,47 @@
+From 1d24cdb0797a26e1fb1d3545f6d4b992a5a23e96 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh at suse.de>
+Date: Mon, 5 Dec 2011 14:02:59 -0800
+Subject: [PATCH 34/49] USB: isight: fix kernel bug when loading firmware
+
+commit 59bf5cf94f0fa3b08fb1258b52649077b7d0914d upstream.
+
+We were sending data on the stack when uploading firmware, which causes
+some machines fits, and is not allowed. Fix this by using the buffer we
+already had around for this very purpose.
+
+Reported-by: Wouter M. Koolen <wmkoolen at cwi.nl>
+Tested-by: Wouter M. Koolen <wmkoolen at cwi.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/misc/isight_firmware.c | 6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/isight_firmware.c b/drivers/usb/misc/isight_firmware.c
+index fe1d443..8f725f6 100644
+--- a/drivers/usb/misc/isight_firmware.c
++++ b/drivers/usb/misc/isight_firmware.c
+@@ -55,8 +55,9 @@ static int isight_firmware_load(struct usb_interface *intf,
+
+ ptr = firmware->data;
+
++ buf[0] = 0x01;
+ if (usb_control_msg
+- (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\1", 1,
++ (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
+ 300) != 1) {
+ printk(KERN_ERR
+ "Failed to initialise isight firmware loader\n");
+@@ -100,8 +101,9 @@ static int isight_firmware_load(struct usb_interface *intf,
+ }
+ }
+
++ buf[0] = 0x00;
+ if (usb_control_msg
+- (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1,
++ (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
+ 300) != 1) {
+ printk(KERN_ERR "isight firmware loading completion failed\n");
+ ret = -ENODEV;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch
new file mode 100644
index 0000000..3b4450a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch
@@ -0,0 +1,121 @@
+From 713ad0e8402a7e377bb8b4254b9b522628c9afeb Mon Sep 17 00:00:00 2001
+From: Huajun Li <huajun.li.lee at gmail.com>
+Date: Wed, 4 Jan 2012 19:25:33 +0800
+Subject: [PATCH 35/49] usb: usb-storage doesn't support dynamic id currently,
+ the patch disables the feature to fix an oops
+
+commit 1a3a026ba1b6bbfe0b7f79ab38cf991d691e7c9a upstream.
+
+Echo vendor and product number of a non usb-storage device to
+usb-storage driver's new_id, then plug in the device to host and you
+will find following oops msg, the root cause is usb_stor_probe1()
+refers invalid id entry if giving a dynamic id, so just disable the
+feature.
+
+[ 3105.018012] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
+[ 3105.018062] CPU 0
+[ 3105.018075] Modules linked in: usb_storage usb_libusual bluetooth
+dm_crypt binfmt_misc snd_hda_codec_analog snd_hda_intel snd_hda_codec
+snd_hwdep hp_wmi ppdev sparse_keymap snd_pcm snd_seq_midi snd_rawmidi
+snd_seq_midi_event snd_seq snd_timer snd_seq_device psmouse snd
+serio_raw tpm_infineon soundcore i915 snd_page_alloc tpm_tis
+parport_pc tpm tpm_bios drm_kms_helper drm i2c_algo_bit video lp
+parport usbhid hid sg sr_mod sd_mod ehci_hcd uhci_hcd usbcore e1000e
+usb_common floppy
+[ 3105.018408]
+[ 3105.018419] Pid: 189, comm: khubd Tainted: G I 3.2.0-rc7+
+#29 Hewlett-Packard HP Compaq dc7800p Convertible Minitower/0AACh
+[ 3105.018481] RIP: 0010:[<ffffffffa045830d>] [<ffffffffa045830d>]
+usb_stor_probe1+0x2fd/0xc20 [usb_storage]
+[ 3105.018536] RSP: 0018:ffff880056a3d830 EFLAGS: 00010286
+[ 3105.018562] RAX: ffff880065f4e648 RBX: ffff88006bb28000 RCX: 0000000000000000
+[ 3105.018597] RDX: ffff88006f23c7b0 RSI: 0000000000000001 RDI: 0000000000000206
+[ 3105.018632] RBP: ffff880056a3d900 R08: 0000000000000000 R09: ffff880067365000
+[ 3105.018665] R10: 00000000000002ac R11: 0000000000000010 R12: ffff6000b41a7340
+[ 3105.018698] R13: ffff880065f4ef60 R14: ffff88006bb28b88 R15: ffff88006f23d270
+[ 3105.018733] FS: 0000000000000000(0000) GS:ffff88007a200000(0000)
+knlGS:0000000000000000
+[ 3105.018773] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+[ 3105.018801] CR2: 00007fc99c8c4650 CR3: 0000000001e05000 CR4: 00000000000006f0
+[ 3105.018835] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 3105.018870] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+[ 3105.018906] Process khubd (pid: 189, threadinfo ffff880056a3c000,
+task ffff88005677a400)
+[ 3105.018945] Stack:
+[ 3105.018959] 0000000000000000 0000000000000000 ffff880056a3d8d0
+0000000000000002
+[ 3105.019011] 0000000000000000 ffff880056a3d918 ffff880000000000
+0000000000000002
+[ 3105.019058] ffff880056a3d8d0 0000000000000012 ffff880056a3d8d0
+0000000000000006
+[ 3105.019105] Call Trace:
+[ 3105.019128] [<ffffffffa0458cd4>] storage_probe+0xa4/0xe0 [usb_storage]
+[ 3105.019173] [<ffffffffa0097822>] usb_probe_interface+0x172/0x330 [usbcore]
+[ 3105.019211] [<ffffffff815fda67>] driver_probe_device+0x257/0x3b0
+[ 3105.019243] [<ffffffff815fdd43>] __device_attach+0x73/0x90
+[ 3105.019272] [<ffffffff815fdcd0>] ? __driver_attach+0x110/0x110
+[ 3105.019303] [<ffffffff815fb93c>] bus_for_each_drv+0x9c/0xf0
+[ 3105.019334] [<ffffffff815fd6c7>] device_attach+0xf7/0x120
+[ 3105.019364] [<ffffffff815fc905>] bus_probe_device+0x45/0x80
+[ 3105.019396] [<ffffffff815f98a6>] device_add+0x876/0x990
+[ 3105.019434] [<ffffffffa0094e42>] usb_set_configuration+0x822/0x9e0 [usbcore]
+[ 3105.019479] [<ffffffffa00a3492>] generic_probe+0x62/0xf0 [usbcore]
+[ 3105.019518] [<ffffffffa0097a46>] usb_probe_device+0x66/0xb0 [usbcore]
+[ 3105.019555] [<ffffffff815fda67>] driver_probe_device+0x257/0x3b0
+[ 3105.019589] [<ffffffff815fdd43>] __device_attach+0x73/0x90
+[ 3105.019617] [<ffffffff815fdcd0>] ? __driver_attach+0x110/0x110
+[ 3105.019648] [<ffffffff815fb93c>] bus_for_each_drv+0x9c/0xf0
+[ 3105.019680] [<ffffffff815fd6c7>] device_attach+0xf7/0x120
+[ 3105.019709] [<ffffffff815fc905>] bus_probe_device+0x45/0x80
+[ 3105.021040] usb usb6: usb auto-resume
+[ 3105.021045] usb usb6: wakeup_rh
+[ 3105.024849] [<ffffffff815f98a6>] device_add+0x876/0x990
+[ 3105.025086] [<ffffffffa0088987>] usb_new_device+0x1e7/0x2b0 [usbcore]
+[ 3105.025086] [<ffffffffa008a4d7>] hub_thread+0xb27/0x1ec0 [usbcore]
+[ 3105.025086] [<ffffffff810d5200>] ? wake_up_bit+0x50/0x50
+[ 3105.025086] [<ffffffffa00899b0>] ? usb_remote_wakeup+0xa0/0xa0 [usbcore]
+[ 3105.025086] [<ffffffff810d49b8>] kthread+0xd8/0xf0
+[ 3105.025086] [<ffffffff81939884>] kernel_thread_helper+0x4/0x10
+[ 3105.025086] [<ffffffff8192a8c0>] ? _raw_spin_unlock_irq+0x50/0x80
+[ 3105.025086] [<ffffffff8192b1b4>] ? retint_restore_args+0x13/0x13
+[ 3105.025086] [<ffffffff810d48e0>] ? __init_kthread_worker+0x80/0x80
+[ 3105.025086] [<ffffffff81939880>] ? gs_change+0x13/0x13
+[ 3105.025086] Code: 00 48 83 05 cd ad 00 00 01 48 83 05 cd ad 00 00
+01 4c 8b ab 30 0c 00 00 48 8b 50 08 48 83 c0 30 48 89 45 a0 4c 89 a3
+40 0c 00 00 <41> 0f b6 44 24 10 48 89 55 a8 3c ff 0f 84 b8 04 00 00 48
+83 05
+[ 3105.025086] RIP [<ffffffffa045830d>] usb_stor_probe1+0x2fd/0xc20
+[usb_storage]
+[ 3105.025086] RSP <ffff880056a3d830>
+[ 3105.060037] hub 6-0:1.0: hub_resume
+[ 3105.062616] usb usb5: usb auto-resume
+[ 3105.064317] ehci_hcd 0000:00:1d.7: resume root hub
+[ 3105.094809] ---[ end trace a7919e7f17c0a727 ]---
+[ 3105.130069] hub 5-0:1.0: hub_resume
+[ 3105.132131] usb usb4: usb auto-resume
+[ 3105.132136] usb usb4: wakeup_rh
+[ 3105.180059] hub 4-0:1.0: hub_resume
+[ 3106.290052] usb usb6: suspend_rh (auto-stop)
+[ 3106.290077] usb usb4: suspend_rh (auto-stop)
+
+Signed-off-by: Huajun Li <huajun.li.lee at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/storage/usb.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
+index c325e69..9e069ef 100644
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -1073,6 +1073,7 @@ static struct usb_driver usb_storage_driver = {
+ .id_table = usb_storage_usb_ids,
+ .supports_autosuspend = 1,
+ .soft_unbind = 1,
++ .no_dynamic_id = 1,
+ };
+
+ static int __init usb_stor_init(void)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0036-USB-pxa168-Fix-compilation-error.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0036-USB-pxa168-Fix-compilation-error.patch
new file mode 100644
index 0000000..87cc3a5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0036-USB-pxa168-Fix-compilation-error.patch
@@ -0,0 +1,42 @@
+From 17e7ea93a7ec7bb64e3bcd6b3cbee1fea5021587 Mon Sep 17 00:00:00 2001
+From: Tanmay Upadhyay <tanmay.upadhyay at einfochips.com>
+Date: Thu, 8 Dec 2011 10:03:49 +0530
+Subject: [PATCH 36/49] USB: pxa168: Fix compilation error
+
+commit 35657c4d72925936c7219cc5caac118ca632acc2 upstream.
+
+After commit c430131a02d677aa708f56342c1565edfdacb3c0 (Support
+controllers with big endian capability regs), HC_LENGTH takes
+two arguments. This patch fixes following compilation error:
+
+In file included from drivers/usb/host/ehci-hcd.c:1323:
+drivers/usb/host/ehci-pxa168.c:302:54: error: macro "HC_LENGTH" requires 2 arguments, but only 1 given
+In file included from drivers/usb/host/ehci-hcd.c:1323:
+drivers/usb/host/ehci-pxa168.c: In function 'ehci_pxa168_drv_probe':
+drivers/usb/host/ehci-pxa168.c:302: error: 'HC_LENGTH' undeclared (first use in this function)
+drivers/usb/host/ehci-pxa168.c:302: error: (Each undeclared identifier is reported only once
+drivers/usb/host/ehci-pxa168.c:302: error: for each function it appears in.)
+
+Signed-off-by: Tanmay Upadhyay <tanmay.upadhyay at einfochips.com>
+Acked-by: Alan Stern <stern at rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/host/ehci-pxa168.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-pxa168.c b/drivers/usb/host/ehci-pxa168.c
+index ac0c16e..8d0e7a2 100644
+--- a/drivers/usb/host/ehci-pxa168.c
++++ b/drivers/usb/host/ehci-pxa168.c
+@@ -299,7 +299,7 @@ static int __devinit ehci_pxa168_drv_probe(struct platform_device *pdev)
+ ehci = hcd_to_ehci(hcd);
+ ehci->caps = hcd->regs + 0x100;
+ ehci->regs = hcd->regs + 0x100 +
+- HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
++ HC_LENGTH(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase));
+ ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
+ hcd->has_tt = 1;
+ ehci->sbrn = 0x20;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0037-USB-add-quirk-for-another-camera.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0037-USB-add-quirk-for-another-camera.patch
new file mode 100644
index 0000000..c981711
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0037-USB-add-quirk-for-another-camera.patch
@@ -0,0 +1,37 @@
+From ae803972522d34f68270782827580ba0d762468c Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver at neukum.org>
+Date: Tue, 3 Jan 2012 09:58:54 +0100
+Subject: [PATCH 37/49] USB: add quirk for another camera
+
+commit 35284b3d2f68a8a3703745e629999469f78386b5 upstream.
+
+The Guillemot Webcam Hercules Dualpix Exchange camera
+has been reported with a second ID.
+
+Signed-off-by: Oliver Neukum <oneukum at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/core/quirks.c | 5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index ecf12e1..4c65eb6 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -117,9 +117,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x06a3, 0x0006), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
+- /* Guillemot Webcam Hercules Dualpix Exchange*/
++ /* Guillemot Webcam Hercules Dualpix Exchange (2nd ID) */
+ { USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Guillemot Webcam Hercules Dualpix Exchange*/
++ { USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* M-Systems Flash Disk Pioneers */
+ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0038-USB-omninet-fix-write_room.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0038-USB-omninet-fix-write_room.patch
new file mode 100644
index 0000000..cbd585a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0038-USB-omninet-fix-write_room.patch
@@ -0,0 +1,34 @@
+From 4a6a3895c6ffe420a07f90df0f8ad5d7ac5a47a4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold at gmail.com>
+Date: Sun, 6 Nov 2011 19:06:21 +0100
+Subject: [PATCH 38/49] USB: omninet: fix write_room
+
+commit 694c6301e515bad574af74b6552134c4d9dcb334 upstream.
+
+Fix regression introduced by commit 507ca9bc047666 ([PATCH] USB: add
+ability for usb-serial drivers to determine if their write urb is
+currently being used.) which inverted the logic in write_room so that it
+returns zero when the write urb is actually free.
+
+Signed-off-by: Johan Hovold <jhovold at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/serial/omninet.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
+index 60f38d5..0a8c1e6 100644
+--- a/drivers/usb/serial/omninet.c
++++ b/drivers/usb/serial/omninet.c
+@@ -315,7 +315,7 @@ static int omninet_write_room(struct tty_struct *tty)
+ int room = 0; /* Default: no room */
+
+ /* FIXME: no consistent locking for write_urb_busy */
+- if (wport->write_urb_busy)
++ if (!wport->write_urb_busy)
+ room = wport->bulk_out_size - OMNINET_HEADERLEN;
+
+ dbg("%s - returns %d", __func__, room);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch
new file mode 100644
index 0000000..7c062f0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch
@@ -0,0 +1,53 @@
+From bd6e892c7f49027eb7d6f5739406142db70fee7e Mon Sep 17 00:00:00 2001
+From: Janne Snabb <snabb at epipe.com>
+Date: Wed, 28 Dec 2011 19:36:00 +0000
+Subject: [PATCH 39/49] usb: option: add ZD Incorporated HSPA modem
+
+commit 3c8c9316710b83e906e425024153bf0929887b59 upstream.
+
+Add support for Chinese Noname HSPA USB modem which is apparently
+manufactured by a company called ZD Incorporated (based on texts in the
+Windows drivers).
+
+This product is available at least from Dealextreme (SKU 80032) and
+possibly in India with name Olive V-MW250. It is based on Qualcomm
+MSM6280 chip.
+
+I needed to also add "options usb-storage quirks=0685:7000:i" in modprobe
+configuration because udevd or the kernel keeps poking the embedded
+fake-cd-rom which fails and causes the device to reset. There might be
+a better way to accomplish the same. usb_modeswitch is not needed with
+this device.
+
+Signed-off-by: Janne Snabb <snabb at epipe.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/serial/option.c | 5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 6dd6453..c96b6b6 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -476,6 +476,10 @@ static void option_instat_callback(struct urb *urb);
+ #define VIETTEL_VENDOR_ID 0x2262
+ #define VIETTEL_PRODUCT_VT1000 0x0002
+
++/* ZD Incorporated */
++#define ZD_VENDOR_ID 0x0685
++#define ZD_PRODUCT_7000 0x7000
++
+ /* some devices interfaces need special handling due to a number of reasons */
+ enum option_blacklist_reason {
+ OPTION_BLACKLIST_NONE = 0,
+@@ -1178,6 +1182,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU528) },
+ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
+ { USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch
new file mode 100644
index 0000000..164d169
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch
@@ -0,0 +1,36 @@
+From a558d5668e8c66327a1a84f5db8381e94c2b0cd9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Malte=20Schr=C3=B6der?= <maltesch at gmx.de>
+Date: Thu, 5 Jan 2012 20:34:40 +0100
+Subject: [PATCH 40/49] USB: Add USB-ID for Multiplex RC serial adapter to
+ cp210x.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 08e87d0d773dc9ca5faf4c3306e238ed0ea129b0 upstream.
+
+Hi, below patch adds the USB-ID of the serial adapters sold by
+Multiplex RC (www.multiplex-rc.de).
+
+Signed-off-by: Malte Schröder <maltesch at gmx.de>
+Cc: stable <stable at vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index fd67cc5..a1a324b 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -92,6 +92,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */
+ { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */
+ { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
++ { USB_DEVICE(0x10C4, 0x81A9) }, /* Multiplex RC Interface */
+ { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
+ { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */
+ { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch
new file mode 100644
index 0000000..bc2716a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch
@@ -0,0 +1,155 @@
+From 61ff4bd883cde399d333204fe9878e90b6f87329 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens at ladisch.de>
+Date: Sat, 3 Dec 2011 23:41:31 +0100
+Subject: [PATCH 41/49] usb: fix number of mapped SG DMA entries
+
+commit bc677d5b64644c399cd3db6a905453e611f402ab upstream.
+
+Add a new field num_mapped_sgs to struct urb so that we have a place to
+store the number of mapped entries and can also retain the original
+value of entries in num_sgs. Previously, usb_hcd_map_urb_for_dma()
+would overwrite this with the number of mapped entries, which would
+break dma_unmap_sg() because it requires the original number of entries.
+
+This fixes warnings like the following when using USB storage devices:
+ ------------[ cut here ]------------
+ WARNING: at lib/dma-debug.c:902 check_unmap+0x4e4/0x695()
+ ehci_hcd 0000:00:12.2: DMA-API: device driver frees DMA sg list with different entry count [map count=4] [unmap count=1]
+ Modules linked in: ohci_hcd ehci_hcd
+ Pid: 0, comm: kworker/0:1 Not tainted 3.2.0-rc2+ #319
+ Call Trace:
+ <IRQ> [<ffffffff81036d3b>] warn_slowpath_common+0x80/0x98
+ [<ffffffff81036de7>] warn_slowpath_fmt+0x41/0x43
+ [<ffffffff811fa5ae>] check_unmap+0x4e4/0x695
+ [<ffffffff8105e92c>] ? trace_hardirqs_off+0xd/0xf
+ [<ffffffff8147208b>] ? _raw_spin_unlock_irqrestore+0x33/0x50
+ [<ffffffff811fa84a>] debug_dma_unmap_sg+0xeb/0x117
+ [<ffffffff8137b02f>] usb_hcd_unmap_urb_for_dma+0x71/0x188
+ [<ffffffff8137b166>] unmap_urb_for_dma+0x20/0x22
+ [<ffffffff8137b1c5>] usb_hcd_giveback_urb+0x5d/0xc0
+ [<ffffffffa0000d02>] ehci_urb_done+0xf7/0x10c [ehci_hcd]
+ [<ffffffffa0001140>] qh_completions+0x429/0x4bd [ehci_hcd]
+ [<ffffffffa000340a>] ehci_work+0x95/0x9c0 [ehci_hcd]
+ ...
+ ---[ end trace f29ac88a5a48c580 ]---
+ Mapped at:
+ [<ffffffff811faac4>] debug_dma_map_sg+0x45/0x139
+ [<ffffffff8137bc0b>] usb_hcd_map_urb_for_dma+0x22e/0x478
+ [<ffffffff8137c494>] usb_hcd_submit_urb+0x63f/0x6fa
+ [<ffffffff8137d01c>] usb_submit_urb+0x2c7/0x2de
+ [<ffffffff8137dcd4>] usb_sg_wait+0x55/0x161
+
+Signed-off-by: Clemens Ladisch <clemens at ladisch.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/core/hcd.c | 5 ++---
+ drivers/usb/host/ehci-q.c | 2 +-
+ drivers/usb/host/uhci-q.c | 2 +-
+ drivers/usb/host/whci/qset.c | 4 ++--
+ drivers/usb/host/xhci-ring.c | 4 ++--
+ include/linux/usb.h | 1 +
+ 6 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 13222d3..179e364 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1412,11 +1412,10 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
+ ret = -EAGAIN;
+ else
+ urb->transfer_flags |= URB_DMA_MAP_SG;
+- if (n != urb->num_sgs) {
+- urb->num_sgs = n;
++ urb->num_mapped_sgs = n;
++ if (n != urb->num_sgs)
+ urb->transfer_flags |=
+ URB_DMA_SG_COMBINED;
+- }
+ } else if (urb->sg) {
+ struct scatterlist *sg = urb->sg;
+ urb->transfer_dma = dma_map_page(
+diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
+index 4e4066c..fef1db3 100644
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -647,7 +647,7 @@ qh_urb_transaction (
+ /*
+ * data transfer stage: buffer setup
+ */
+- i = urb->num_sgs;
++ i = urb->num_mapped_sgs;
+ if (len > 0 && i > 0) {
+ sg = urb->sg;
+ buf = sg_dma_address(sg);
+diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
+index f6ca80e..d2c6f5a 100644
+--- a/drivers/usb/host/uhci-q.c
++++ b/drivers/usb/host/uhci-q.c
+@@ -943,7 +943,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
+ if (usb_pipein(urb->pipe))
+ status |= TD_CTRL_SPD;
+
+- i = urb->num_sgs;
++ i = urb->num_mapped_sgs;
+ if (len > 0 && i > 0) {
+ sg = urb->sg;
+ data = sg_dma_address(sg);
+diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
+index a403b53..76083ae 100644
+--- a/drivers/usb/host/whci/qset.c
++++ b/drivers/usb/host/whci/qset.c
+@@ -443,7 +443,7 @@ static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *u
+
+ remaining = urb->transfer_buffer_length;
+
+- for_each_sg(urb->sg, sg, urb->num_sgs, i) {
++ for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) {
+ dma_addr_t dma_addr;
+ size_t dma_remaining;
+ dma_addr_t sp, ep;
+@@ -561,7 +561,7 @@ static int qset_add_urb_sg_linearize(struct whc *whc, struct whc_qset *qset,
+
+ remaining = urb->transfer_buffer_length;
+
+- for_each_sg(urb->sg, sg, urb->num_sgs, i) {
++ for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) {
+ size_t len;
+ size_t sg_remaining;
+ void *orig;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 9f1d4b1..d28c586 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2561,7 +2561,7 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
+ struct scatterlist *sg;
+
+ sg = NULL;
+- num_sgs = urb->num_sgs;
++ num_sgs = urb->num_mapped_sgs;
+ temp = urb->transfer_buffer_length;
+
+ xhci_dbg(xhci, "count sg list trbs: \n");
+@@ -2745,7 +2745,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ return -EINVAL;
+
+ num_trbs = count_sg_trbs_needed(xhci, urb);
+- num_sgs = urb->num_sgs;
++ num_sgs = urb->num_mapped_sgs;
+ total_packet_count = roundup(urb->transfer_buffer_length,
+ usb_endpoint_maxp(&urb->ep->desc));
+
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 1cea207..7626e5a 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -1222,6 +1222,7 @@ struct urb {
+ void *transfer_buffer; /* (in) associated data buffer */
+ dma_addr_t transfer_dma; /* (in) dma addr for transfer_buffer */
+ struct scatterlist *sg; /* (in) scatter gather buffer list */
++ int num_mapped_sgs; /* (internal) mapped sg entries */
+ int num_sgs; /* (in) number of entries in the sg list */
+ u32 transfer_buffer_length; /* (in) data buffer length */
+ u32 actual_length; /* (return) actual transfer length */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch
new file mode 100644
index 0000000..607ae21
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch
@@ -0,0 +1,62 @@
+From df0f4624e1225d9b7fb4d8934565418c81b42c04 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede at redhat.com>
+Date: Wed, 4 Jan 2012 23:29:18 +0100
+Subject: [PATCH 42/49] xhci: Properly handle COMP_2ND_BW_ERR
+
+commit 71d85724bdd947a3b42a88d08af79f290a1a767b upstream.
+
+I encountered a result of COMP_2ND_BW_ERR while improving how the pwc
+webcam driver handles not having the full usb1 bandwidth available to
+itself.
+
+I created the following test setup, a NEC xhci controller with a
+single TT USB 2 hub plugged into it, with a usb keyboard and a pwc webcam
+plugged into the usb2 hub. This caused the following to show up in dmesg
+when trying to stream from the pwc camera at its highest alt setting:
+
+xhci_hcd 0000:01:00.0: ERROR: unexpected command completion code 0x23.
+usb 6-2.1: Not enough bandwidth for altsetting 9
+
+And usb_set_interface returned -EINVAL, which caused my pwc code to not
+do the right thing as it expected -ENOSPC.
+
+This patch makes the xhci driver properly handle COMP_2ND_BW_ERR and makes
+usb_set_interface return -ENOSPC as expected.
+
+This should be backported to stable kernels as old as 2.6.32.
+
+Signed-off-by: Hans de Goede <hdegoede at redhat.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/host/xhci.c | 1 +
+ drivers/usb/host/xhci.h | 1 -
+ 2 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index a1afb7c..36f9dd8 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1620,6 +1620,7 @@ static int xhci_configure_endpoint_result(struct xhci_hcd *xhci,
+ /* FIXME: can we allocate more resources for the HC? */
+ break;
+ case COMP_BW_ERR:
++ case COMP_2ND_BW_ERR:
+ dev_warn(&udev->dev, "Not enough bandwidth "
+ "for new device state.\n");
+ ret = -ENOSPC;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 3c8fbd2..09eda3a 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1033,7 +1033,6 @@ struct xhci_transfer_event {
+ /* Invalid Stream ID Error */
+ #define COMP_STRID_ERR 34
+ /* Secondary Bandwidth Error - may be returned by a Configure Endpoint cmd */
+-/* FIXME - check for this */
+ #define COMP_2ND_BW_ERR 35
+ /* Split Transaction Error */
+ #define COMP_SPLIT_ERR 36
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch
new file mode 100644
index 0000000..a96c372
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch
@@ -0,0 +1,81 @@
+From db46f35cb2853ffa42157c7222335cae15eda7e0 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi at ti.com>
+Date: Mon, 2 Jan 2012 13:35:41 +0200
+Subject: [PATCH 43/49] usb: ch9: fix up MaxStreams helper
+
+commit 18b7ede5f7ee2092aedcb578d3ac30bd5d4fc23c upstream.
+
+[ removed the dwc3 portion of the patch as it didn't apply to
+older kernels - gregkh]
+
+According to USB 3.0 Specification Table 9-22, if
+bmAttributes [4:0] are set to zero, it means "no
+streams supported", but the way this helper was
+defined on Linux, we will *always* have one stream
+which might cause several problems.
+
+For example on DWC3, we would tell the controller
+endpoint has streams enabled and yet start transfers
+with Stream ID set to 0, which would goof up the host
+side.
+
+While doing that, convert the macro to an inline
+function due to the different checks we now need.
+
+Signed-off-by: Felipe Balbi <balbi at ti.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/host/xhci.c | 3 +--
+ include/linux/usb/ch9.h | 20 +++++++++++++++++++-
+ 2 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 36f9dd8..b33f059 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -2797,8 +2797,7 @@ static int xhci_calculate_streams_and_bitmask(struct xhci_hcd *xhci,
+ if (ret < 0)
+ return ret;
+
+- max_streams = USB_SS_MAX_STREAMS(
+- eps[i]->ss_ep_comp.bmAttributes);
++ max_streams = usb_ss_max_streams(&eps[i]->ss_ep_comp);
+ if (max_streams < (*num_streams - 1)) {
+ xhci_dbg(xhci, "Ep 0x%x only supports %u stream IDs.\n",
+ eps[i]->desc.bEndpointAddress,
+diff --git a/include/linux/usb/ch9.h b/include/linux/usb/ch9.h
+index d5da6c6..61b2905 100644
+--- a/include/linux/usb/ch9.h
++++ b/include/linux/usb/ch9.h
+@@ -605,8 +605,26 @@ struct usb_ss_ep_comp_descriptor {
+ } __attribute__ ((packed));
+
+ #define USB_DT_SS_EP_COMP_SIZE 6
++
+ /* Bits 4:0 of bmAttributes if this is a bulk endpoint */
+-#define USB_SS_MAX_STREAMS(p) (1 << ((p) & 0x1f))
++static inline int
++usb_ss_max_streams(const struct usb_ss_ep_comp_descriptor *comp)
++{
++ int max_streams;
++
++ if (!comp)
++ return 0;
++
++ max_streams = comp->bmAttributes & 0x1f;
++
++ if (!max_streams)
++ return 0;
++
++ max_streams = 1 << max_streams;
++
++ return max_streams;
++}
++
+ /* Bits 1:0 of bmAttributes if this is an isoc endpoint */
+ #define USB_SS_MULT(p) (1 + ((p) & 0x3))
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch
new file mode 100644
index 0000000..d740353
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch
@@ -0,0 +1,37 @@
+From 53876956cbd176ad0da89ca8e066202f6c143ea8 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Mon, 9 Jan 2012 14:06:46 -0800
+Subject: [PATCH 44/49] igmp: Avoid zero delay when receiving odd mixture of
+ IGMP queries
+
+commit a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27 upstream.
+
+Commit 5b7c84066733c5dfb0e4016d939757b38de189e4 ('ipv4: correct IGMP
+behavior on v3 query during v2-compatibility mode') added yet another
+case for query parsing, which can result in max_delay = 0. Substitute
+a value of 1, as in the usual v3 case.
+
+Reported-by: Simon McVittie <smcv at debian.org>
+References: http://bugs.debian.org/654876
+Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+---
+ net/ipv4/igmp.c | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index b2ca095..c3cc64c 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -875,6 +875,8 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+ * to be intended in a v3 query.
+ */
+ max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
++ if (!max_delay)
++ max_delay = 1; /* can't mod w/ 0 */
+ } else { /* v3 */
+ if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
+ return;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch
new file mode 100644
index 0000000..93da6cd
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch
@@ -0,0 +1,38 @@
+From eaa03e7a01f7dd67773c27e82d446a44440843a6 Mon Sep 17 00:00:00 2001
+From: Aurelien Jacobs <aurel at gnuage.org>
+Date: Sat, 7 Jan 2012 12:15:16 -0800
+Subject: [PATCH 45/49] asix: fix infinite loop in rx_fixup()
+
+commit 6c15d74defd38e7e7f8805392578b7a1d508097e upstream.
+
+At this point if skb->len happens to be 2, the subsequant skb_pull(skb, 4)
+call won't work and the skb->len won't be decreased and won't ever reach 0,
+resulting in an infinite loop.
+
+With an ASIX 88772 under heavy load, without this patch, rx_fixup() reaches
+an infinite loop in less than a minute. With this patch applied,
+no infinite loop even after hours of heavy load.
+
+Signed-off-by: Aurelien Jacobs <aurel at gnuage.org>
+Cc: Jussi Kivilinna <jussi.kivilinna at mbnet.fi>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+---
+ drivers/net/usb/asix.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
+index e95f0e6..dd2625a 100644
+--- a/drivers/net/usb/asix.c
++++ b/drivers/net/usb/asix.c
+@@ -376,7 +376,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+
+ skb_pull(skb, (size + 1) & 0xfffe);
+
+- if (skb->len == 0)
++ if (skb->len < sizeof(header))
+ break;
+
+ head = (u8 *) skb->data;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch
new file mode 100644
index 0000000..7b7e03a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch
@@ -0,0 +1,68 @@
+From b40864c73fef3aefced0863fc2b3c3a7716d9f09 Mon Sep 17 00:00:00 2001
+From: stephen hemminger <shemminger at vyatta.com>
+Date: Sat, 31 Dec 2011 13:26:46 +0000
+Subject: [PATCH 46/49] bonding: fix error handling if slave is busy (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit f7d9821a6a9c83450ac35e76d3709e32fd38b76f upstream.
+
+If slave device already has a receive handler registered, then the
+error unwind of bonding device enslave function is broken.
+
+The following will leave a pointer to freed memory in the slave
+device list, causing a later kernel panic.
+# modprobe dummy
+# ip li add dummy0-1 link dummy0 type macvlan
+# modprobe bonding
+# echo +dummy0 >/sys/class/net/bond0/bonding/slaves
+
+The fix is to detach the slave (which removes it from the list)
+in the unwind path.
+
+Signed-off-by: Stephen Hemminger <shemminger at vyatta.com>
+Reviewed-by: Nicolas de Pesloüan <nicolas.2p.debian at free.fr>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/bonding/bond_main.c | 9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 7f87568..e58aa2b 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1822,7 +1822,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ "but new slave device does not support netpoll.\n",
+ bond_dev->name);
+ res = -EBUSY;
+- goto err_close;
++ goto err_detach;
+ }
+ }
+ #endif
+@@ -1831,7 +1831,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+
+ res = bond_create_slave_symlinks(bond_dev, slave_dev);
+ if (res)
+- goto err_close;
++ goto err_detach;
+
+ res = netdev_rx_handler_register(slave_dev, bond_handle_frame,
+ new_slave);
+@@ -1852,6 +1852,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ err_dest_symlinks:
+ bond_destroy_slave_symlinks(bond_dev, slave_dev);
+
++err_detach:
++ write_lock_bh(&bond->lock);
++ bond_detach_slave(bond, new_slave);
++ write_unlock_bh(&bond->lock);
++
+ err_close:
+ dev_close(slave_dev);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch
new file mode 100644
index 0000000..f9363aa
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch
@@ -0,0 +1,54 @@
+From 9d3898fe46309ee5688697d1a65975208dc49639 Mon Sep 17 00:00:00 2001
+From: Thilo-Alexander Ginkel <thilo at ginkel.com>
+Date: Sat, 17 Dec 2011 10:55:10 +0100
+Subject: [PATCH 47/49] usb: cdc-acm: Fix acm_tty_hangup() vs. acm_tty_close()
+ race
+
+[Not upstream as it was fixed differently for 3.3 with a much more
+"intrusive" rework of the driver - gregkh]
+
+There is a race condition involving acm_tty_hangup() and acm_tty_close()
+where hangup() would attempt to access tty->driver_data without proper
+locking and NULL checking after close() has potentially already set it
+to NULL. One possibility to (sporadically) trigger this behavior is to
+perform a suspend/resume cycle with a running WWAN data connection.
+
+This patch addresses the issue by introducing a NULL check for
+tty->driver_data in acm_tty_hangup() protected by open_mutex and exiting
+gracefully when hangup() is invoked on a device that has already been
+closed.
+
+Signed-off-by: Thilo-Alexander Ginkel <thilo at ginkel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/usb/class/cdc-acm.c | 12 ++++++++++--
+ 1 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index ea5e487..e61d9c4 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -554,10 +554,18 @@ static void acm_port_down(struct acm *acm)
+
+ static void acm_tty_hangup(struct tty_struct *tty)
+ {
+- struct acm *acm = tty->driver_data;
+- tty_port_hangup(&acm->port);
++ struct acm *acm;
++
+ mutex_lock(&open_mutex);
++ acm = tty->driver_data;
++
++ if (!acm)
++ goto out;
++
++ tty_port_hangup(&acm->port);
+ acm_port_down(acm);
++
++out:
+ mutex_unlock(&open_mutex);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch
new file mode 100644
index 0000000..1ddf63d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch
@@ -0,0 +1,34 @@
+From 5af63c5af9a335ff2af8d6b84d512e92ac522995 Mon Sep 17 00:00:00 2001
+From: Xi Wang <xi.wang at gmail.com>
+Date: Mon, 12 Dec 2011 21:55:52 +0000
+Subject: [PATCH 48/49] xfs: fix acl count validation in xfs_acl_from_disk()
+
+commit 093019cf1b18dd31b2c3b77acce4e000e2cbc9ce upstream.
+
+Commit fa8b18ed didn't prevent the integer overflow and possible
+memory corruption. "count" can go negative and bypass the check.
+
+Signed-off-by: Xi Wang <xi.wang at gmail.com>
+Reviewed-by: Christoph Hellwig <hch at lst.de>
+Signed-off-by: Ben Myers <bpm at sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/xfs/xfs_acl.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
+index 76e4266..ac702a6 100644
+--- a/fs/xfs/xfs_acl.c
++++ b/fs/xfs/xfs_acl.c
+@@ -39,7 +39,7 @@ xfs_acl_from_disk(struct xfs_acl *aclp)
+ struct posix_acl_entry *acl_e;
+ struct posix_acl *acl;
+ struct xfs_acl_entry *ace;
+- int count, i;
++ unsigned int count, i;
+
+ count = be32_to_cpu(aclp->acl_cnt);
+ if (count > XFS_ACL_MAX_ENTRIES)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0049-Linux-3.2.1.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0049-Linux-3.2.1.patch
new file mode 100644
index 0000000..37c5764
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0049-Linux-3.2.1.patch
@@ -0,0 +1,24 @@
+From 78d772bb92fa633fc41d234887b050dce88542bc Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh at suse.de>
+Date: Thu, 12 Jan 2012 11:42:45 -0800
+Subject: [PATCH 49/49] Linux 3.2.1
+
+---
+ Makefile | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index adddd11..c5edffa 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 0
++SUBLEVEL = 1
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch
new file mode 100644
index 0000000..08b2918
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch
@@ -0,0 +1,39 @@
+From 9589d3910b50c6e66f1a050e365c22271936b6b0 Mon Sep 17 00:00:00 2001
+From: Roman Tereshonkov <roman.tereshonkov at nokia.com>
+Date: Tue, 29 Nov 2011 12:49:18 +0200
+Subject: [PATCH 001/130] mtdoops: fix the oops_page_used array size
+
+commit 556f063580db2953a7e53cd46b47724246320f60 upstream.
+
+The array of unsigned long pointed by oops_page_used is allocated
+by vmalloc which requires the size to be in bytes.
+
+BITS_PER_LONG is equal to 32.
+If we want to allocate memory for 32 pages with one bit per page then
+32 / BITS_PER_LONG is equal to 1 byte that is 8 bits.
+To fix it we need to multiply the result by sizeof(unsigned long) equal to 4.
+
+Signed-off-by: Roman Tereshonkov <roman.tereshonkov at nokia.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy at linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/mtd/mtdoops.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
+index 1e2fa62..0782b31 100644
+--- a/drivers/mtd/mtdoops.c
++++ b/drivers/mtd/mtdoops.c
+@@ -369,7 +369,7 @@ static void mtdoops_notify_add(struct mtd_info *mtd)
+
+ /* oops_page_used is a bit field */
+ cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages,
+- BITS_PER_LONG));
++ BITS_PER_LONG) * sizeof(unsigned long));
+ if (!cxt->oops_page_used) {
+ printk(KERN_ERR "mtdoops: could not allocate page array\n");
+ return;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch
new file mode 100644
index 0000000..82e97cc
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch
@@ -0,0 +1,36 @@
+From e8f072aad40b7d45c605e27f1337b5eb7b6fbc11 Mon Sep 17 00:00:00 2001
+From: Roman Tereshonkov <roman.tereshonkov at nokia.com>
+Date: Fri, 2 Dec 2011 15:07:17 +0200
+Subject: [PATCH 002/130] mtd: mtdoops: skip reading initially bad blocks
+
+commit 3538c56329936c78f7d356889908790006d0124c upstream.
+
+Use block_isbad to check and skip the bad blocks reading.
+This will allow to get rid of the read errors if bad blocks
+are present initially.
+
+Signed-off-by: Roman Tereshonkov <roman.tereshonkov at nokia.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/mtd/mtdoops.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
+index 0782b31..f3cdce9 100644
+--- a/drivers/mtd/mtdoops.c
++++ b/drivers/mtd/mtdoops.c
+@@ -253,6 +253,9 @@ static void find_next_position(struct mtdoops_context *cxt)
+ size_t retlen;
+
+ for (page = 0; page < cxt->oops_pages; page++) {
++ if (mtd->block_isbad &&
++ mtd->block_isbad(mtd, page * record_size))
++ continue;
+ /* Assume the page is used */
+ mark_page_used(cxt, page);
+ ret = mtd->read(mtd, page * record_size, MTDOOPS_HEADER_SIZE,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch
new file mode 100644
index 0000000..1aa180c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch
@@ -0,0 +1,85 @@
+From 7e1c31ad0d3116ac301e5d6ef6df036eec548229 Mon Sep 17 00:00:00 2001
+From: Brian Norris <computersforpeace at gmail.com>
+Date: Mon, 7 Nov 2011 15:51:05 -0800
+Subject: [PATCH 003/130] mtd: mtd_blkdevs: don't increase 'open' count on
+ error path
+
+commit 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 upstream.
+
+Some error paths in mtd_blkdevs were fixed in the following commit:
+
+ commit 94735ec4044a6d318b83ad3c5794e931ed168d10
+ mtd: mtd_blkdevs: fix error path in blktrans_open
+
+But on these error paths, the block device's `dev->open' count is
+already incremented before we check for errors. This meant that, while
+the error path was handled correctly on the first time through
+blktrans_open(), the device is erroneously considered already open on
+the second time through.
+
+This problem can be seen, for instance, when a UBI volume is
+simultaneously mounted as a UBIFS partition and read through its
+corresponding gluebi mtdblockX device. This results in blktrans_open()
+passing its error checks (with `dev->open > 0') without actually having
+a handle on the device. Here's a summarized log of the actions and
+results with nandsim:
+
+ # modprobe nandsim
+ # modprobe mtdblock
+ # modprobe gluebi
+ # modprobe ubifs
+ # ubiattach /dev/ubi_ctrl -m 0
+ ...
+ # ubimkvol /dev/ubi0 -N test -s 16MiB
+ ...
+ # mount -t ubifs ubi0:test /mnt
+ # ls /dev/mtdblock*
+ /dev/mtdblock0 /dev/mtdblock1
+ # cat /dev/mtdblock1 > /dev/null
+ cat: can't open '/dev/mtdblock4': Device or resource busy
+ # cat /dev/mtdblock1 > /dev/null
+
+ CPU 0 Unable to handle kernel paging request at virtual address
+ fffffff0, epc == 8031536c, ra == 8031f280
+ Oops[#1]:
+ ...
+ Call Trace:
+ [<8031536c>] ubi_leb_read+0x14/0x164
+ [<8031f280>] gluebi_read+0xf0/0x148
+ [<802edba8>] mtdblock_readsect+0x64/0x198
+ [<802ecfe4>] mtd_blktrans_thread+0x330/0x3f4
+ [<8005be98>] kthread+0x88/0x90
+ [<8000bc04>] kernel_thread_helper+0x10/0x18
+
+Signed-off-by: Brian Norris <computersforpeace at gmail.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy at linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/mtd/mtd_blkdevs.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
+index ed8b5e7..424ca5f 100644
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -215,7 +215,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
+
+ mutex_lock(&dev->lock);
+
+- if (dev->open++)
++ if (dev->open)
+ goto unlock;
+
+ kref_get(&dev->ref);
+@@ -235,6 +235,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
+ goto error_release;
+
+ unlock:
++ dev->open++;
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ return ret;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch
new file mode 100644
index 0000000..f28f386
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch
@@ -0,0 +1,60 @@
+From 24935db264c015f91046c597ead8f42a3de24858 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <w.sang at pengutronix.de>
+Date: Tue, 29 Nov 2011 15:34:08 +0100
+Subject: [PATCH 004/130] mtd: tests: stresstest: bail out if device has not
+ enough eraseblocks
+
+commit 2f4478ccff7df845dc9c0f8996a96373122c4417 upstream.
+
+stresstest needs at least two eraseblocks. Bail out gracefully if that
+condition is not met. Fixes the following 'division by zero' OOPS:
+
+[ 619.100000] mtd_stresstest: MTD device size 131072, eraseblock size 131072, page size 2048, count of eraseblocks 1, pages per eraseblock 64, OOB size 64
+[ 619.120000] mtd_stresstest: scanning for bad eraseblocks
+[ 619.120000] mtd_stresstest: scanned 1 eraseblocks, 0 are bad
+[ 619.130000] mtd_stresstest: doing operations
+[ 619.130000] mtd_stresstest: 0 operations done
+[ 619.140000] Division by zero in kernel.
+...
+
+caused by
+
+ /* Read or write up 2 eraseblocks at a time - hence 'ebcnt - 1' */
+ eb %= (ebcnt - 1);
+
+Signed-off-by: Wolfram Sang <w.sang at pengutronix.de>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/mtd/tests/mtd_stresstest.c | 7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/mtd/tests/mtd_stresstest.c b/drivers/mtd/tests/mtd_stresstest.c
+index 52ffd91..811642f 100644
+--- a/drivers/mtd/tests/mtd_stresstest.c
++++ b/drivers/mtd/tests/mtd_stresstest.c
+@@ -284,6 +284,12 @@ static int __init mtd_stresstest_init(void)
+ (unsigned long long)mtd->size, mtd->erasesize,
+ pgsize, ebcnt, pgcnt, mtd->oobsize);
+
++ if (ebcnt < 2) {
++ printk(PRINT_PREF "error: need at least 2 eraseblocks\n");
++ err = -ENOSPC;
++ goto out_put_mtd;
++ }
++
+ /* Read or write up 2 eraseblocks at a time */
+ bufsize = mtd->erasesize * 2;
+
+@@ -322,6 +328,7 @@ out:
+ kfree(bbt);
+ vfree(writebuf);
+ vfree(readbuf);
++out_put_mtd:
+ put_mtd_device(mtd);
+ if (err)
+ printk(PRINT_PREF "error %d occurred\n", err);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch
new file mode 100644
index 0000000..15c214e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch
@@ -0,0 +1,53 @@
+From 0ff595b93bc982c60777d727c282cf76050802bf Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Tue, 10 Jan 2012 15:11:02 -0800
+Subject: [PATCH 005/130] drivers/rtc/interface.c: fix alarm rollover when day
+ or month is out-of-range
+
+commit e74a8f2edb92cb690b467cea0ab652c509e9f624 upstream.
+
+Commit f44f7f96a20a ("RTC: Initialize kernel state from RTC") introduced a
+potential infinite loop. If an alarm time contains a wildcard month and
+an invalid day (> 31), or a wildcard year and an invalid month (>= 12),
+the loop searching for the next matching date will never terminate. Treat
+the invalid values as wildcards.
+
+Fixes <http://bugs.debian.org/646429>, <http://bugs.debian.org/653331>
+
+Reported-by: leo weppelman <leoweppelman at googlemail.com>
+Reported-by: "P. van Gaans" <mailme667 at yahoo.co.uk>
+Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
+Signed-off-by: Jonathan Nieder <jrnieder at gmail.com>
+Cc: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Cc: Marcelo Roberto Jimenez <mroberto at cpti.cetuc.puc-rio.br>
+Cc: Thomas Gleixner <tglx at linutronix.de>
+Cc: John Stultz <john.stultz at linaro.org>
+Acked-by: Alessandro Zummo <a.zummo at towertech.it>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/rtc/interface.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index 8e28625..8a1c031 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -228,11 +228,11 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ alarm->time.tm_hour = now.tm_hour;
+
+ /* For simplicity, only support date rollover for now */
+- if (alarm->time.tm_mday == -1) {
++ if (alarm->time.tm_mday < 1 || alarm->time.tm_mday > 31) {
+ alarm->time.tm_mday = now.tm_mday;
+ missing = day;
+ }
+- if (alarm->time.tm_mon == -1) {
++ if ((unsigned)alarm->time.tm_mon >= 12) {
+ alarm->time.tm_mon = now.tm_mon;
+ if (missing == none)
+ missing = month;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch
new file mode 100644
index 0000000..3306542
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch
@@ -0,0 +1,109 @@
+From 90d3fbe7c2f63a83921d15a9bb1f451d03040f9b Mon Sep 17 00:00:00 2001
+From: Djalal Harouni <tixxdz at opendz.org>
+Date: Wed, 4 Jan 2012 17:09:52 -0500
+Subject: [PATCH 006/130] ext4: add missing ext4_resize_end on error paths
+
+commit 014a1770371a028d22f364718c805f4216911ecd upstream.
+
+Online resize ioctls 'EXT4_IOC_GROUP_EXTEND' and 'EXT4_IOC_GROUP_ADD'
+call ext4_resize_begin() to check permissions and to set the
+EXT4_RESIZING bit lock, they do their work and they must finish with
+ext4_resize_end() which calls clear_bit_unlock() to unlock and to
+avoid -EBUSY errors for the next resize operations.
+
+This patch adds the missing ext4_resize_end() calls on error paths.
+
+Patch tested.
+
+Signed-off-by: Djalal Harouni <tixxdz at opendz.org>
+Signed-off-by: "Theodore Ts'o" <tytso at mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/ext4/ioctl.c | 28 ++++++++++++++++++----------
+ 1 files changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index a567968..ab25f57 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -182,19 +182,22 @@ setversion_out:
+ if (err)
+ return err;
+
+- if (get_user(n_blocks_count, (__u32 __user *)arg))
+- return -EFAULT;
++ if (get_user(n_blocks_count, (__u32 __user *)arg)) {
++ err = -EFAULT;
++ goto group_extend_out;
++ }
+
+ if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
+ EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
+ ext4_msg(sb, KERN_ERR,
+ "Online resizing not supported with bigalloc");
+- return -EOPNOTSUPP;
++ err = -EOPNOTSUPP;
++ goto group_extend_out;
+ }
+
+ err = mnt_want_write(filp->f_path.mnt);
+ if (err)
+- return err;
++ goto group_extend_out;
+
+ err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
+ if (EXT4_SB(sb)->s_journal) {
+@@ -204,9 +207,10 @@ setversion_out:
+ }
+ if (err == 0)
+ err = err2;
++
+ mnt_drop_write(filp->f_path.mnt);
++group_extend_out:
+ ext4_resize_end(sb);
+-
+ return err;
+ }
+
+@@ -267,19 +271,22 @@ mext_out:
+ return err;
+
+ if (copy_from_user(&input, (struct ext4_new_group_input __user *)arg,
+- sizeof(input)))
+- return -EFAULT;
++ sizeof(input))) {
++ err = -EFAULT;
++ goto group_add_out;
++ }
+
+ if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
+ EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
+ ext4_msg(sb, KERN_ERR,
+ "Online resizing not supported with bigalloc");
+- return -EOPNOTSUPP;
++ err = -EOPNOTSUPP;
++ goto group_add_out;
+ }
+
+ err = mnt_want_write(filp->f_path.mnt);
+ if (err)
+- return err;
++ goto group_add_out;
+
+ err = ext4_group_add(sb, &input);
+ if (EXT4_SB(sb)->s_journal) {
+@@ -289,9 +296,10 @@ mext_out:
+ }
+ if (err == 0)
+ err = err2;
++
+ mnt_drop_write(filp->f_path.mnt);
++group_add_out:
+ ext4_resize_end(sb);
+-
+ return err;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch
new file mode 100644
index 0000000..95f0d2e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch
@@ -0,0 +1,74 @@
+From 149672e502af36fdb60960faaf2ca3bdde96bd5e Mon Sep 17 00:00:00 2001
+From: Xi Wang <xi.wang at gmail.com>
+Date: Tue, 10 Jan 2012 11:51:10 -0500
+Subject: [PATCH 007/130] ext4: fix undefined behavior in
+ ext4_fill_flex_info()
+
+commit d50f2ab6f050311dbf7b8f5501b25f0bf64a439b upstream.
+
+Commit 503358ae01b70ce6909d19dd01287093f6b6271c ("ext4: avoid divide by
+zero when trying to mount a corrupted file system") fixes CVE-2009-4307
+by performing a sanity check on s_log_groups_per_flex, since it can be
+set to a bogus value by an attacker.
+
+ sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
+ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+
+ if (groups_per_flex < 2) { ... }
+
+This patch fixes two potential issues in the previous commit.
+
+1) The sanity check might only work on architectures like PowerPC.
+On x86, 5 bits are used for the shifting amount. That means, given a
+large s_log_groups_per_flex value like 36, groups_per_flex = 1 << 36
+is essentially 1 << 4 = 16, rather than 0. This will bypass the check,
+leaving s_log_groups_per_flex and groups_per_flex inconsistent.
+
+2) The sanity check relies on undefined behavior, i.e., oversized shift.
+A standard-confirming C compiler could rewrite the check in unexpected
+ways. Consider the following equivalent form, assuming groups_per_flex
+is unsigned for simplicity.
+
+ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+ if (groups_per_flex == 0 || groups_per_flex == 1) {
+
+We compile the code snippet using Clang 3.0 and GCC 4.6. Clang will
+completely optimize away the check groups_per_flex == 0, leaving the
+patched code as vulnerable as the original. GCC keeps the check, but
+there is no guarantee that future versions will do the same.
+
+Signed-off-by: Xi Wang <xi.wang at gmail.com>
+Signed-off-by: "Theodore Ts'o" <tytso at mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/ext4/super.c | 7 +++----
+ 1 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 3e1329e..9281dbe 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2006,17 +2006,16 @@ static int ext4_fill_flex_info(struct super_block *sb)
+ struct ext4_group_desc *gdp = NULL;
+ ext4_group_t flex_group_count;
+ ext4_group_t flex_group;
+- int groups_per_flex = 0;
++ unsigned int groups_per_flex = 0;
+ size_t size;
+ int i;
+
+ sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
+- groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+-
+- if (groups_per_flex < 2) {
++ if (sbi->s_log_groups_per_flex < 1 || sbi->s_log_groups_per_flex > 31) {
+ sbi->s_log_groups_per_flex = 0;
+ return 1;
+ }
++ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+
+ /* We allocate both existing and potentially added groups */
+ flex_group_count = ((sbi->s_groups_count + groups_per_flex - 1) +
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch
new file mode 100644
index 0000000..922b70a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch
@@ -0,0 +1,54 @@
+From 77b0511fab25f495a30242f4b2fd940e71ce11ad Mon Sep 17 00:00:00 2001
+From: Karsten Wiese <fzu at wemgehoertderstaat.de>
+Date: Fri, 30 Dec 2011 01:42:01 +0100
+Subject: [PATCH 008/130] ALSA: snd-usb-us122l: Delete calls to
+ preempt_disable
+
+commit d0f3a2eb9062560bebca8b923424f3ca02a331ba upstream.
+
+They are not needed here.
+
+Signed-off-by: Karsten Wiese <fzu at wemgehoertderstaat.de>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ sound/usb/usx2y/usb_stream.c | 6 ++----
+ 1 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c
+index c400ade..1e7a47a 100644
+--- a/sound/usb/usx2y/usb_stream.c
++++ b/sound/usb/usx2y/usb_stream.c
+@@ -674,7 +674,7 @@ dotry:
+ inurb->transfer_buffer_length =
+ inurb->number_of_packets *
+ inurb->iso_frame_desc[0].length;
+- preempt_disable();
++
+ if (u == 0) {
+ int now;
+ struct usb_device *dev = inurb->dev;
+@@ -686,19 +686,17 @@ dotry:
+ }
+ err = usb_submit_urb(inurb, GFP_ATOMIC);
+ if (err < 0) {
+- preempt_enable();
+ snd_printk(KERN_ERR"usb_submit_urb(sk->inurb[%i])"
+ " returned %i\n", u, err);
+ return err;
+ }
+ err = usb_submit_urb(outurb, GFP_ATOMIC);
+ if (err < 0) {
+- preempt_enable();
+ snd_printk(KERN_ERR"usb_submit_urb(sk->outurb[%i])"
+ " returned %i\n", u, err);
+ return err;
+ }
+- preempt_enable();
++
+ if (inurb->start_frame != outurb->start_frame) {
+ snd_printd(KERN_DEBUG
+ "u[%i] start_frames differ in:%u out:%u\n",
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch
new file mode 100644
index 0000000..266d112
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch
@@ -0,0 +1,57 @@
+From c237e8b240ea09139d387e89f7474fbcd2b4bd0c Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson at canonical.com>
+Date: Mon, 2 Jan 2012 12:40:15 +0100
+Subject: [PATCH 009/130] ALSA: HDA: Fix master control for Cirrus Logic 421X
+
+commit 40d03e63e91af8ddccdfd5a536cc2a6e51433e1d upstream.
+
+The control name "HP/Speakers" is non-standard, and since there is
+only one DAC on this chip there is no need for a virtual master
+anyway.
+
+Signed-off-by: David Henningsson <david.henningsson at canonical.com>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ sound/pci/hda/patch_cirrus.c | 13 +------------
+ 1 files changed, 1 insertions(+), 12 deletions(-)
+
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index 70a7abd..f55ceb6 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -1771,30 +1771,19 @@ static int build_cs421x_output(struct hda_codec *codec)
+ struct auto_pin_cfg *cfg = &spec->autocfg;
+ struct snd_kcontrol *kctl;
+ int err;
+- char *name = "HP/Speakers";
++ char *name = "Master";
+
+ fix_volume_caps(codec, dac);
+- if (!spec->vmaster_sw) {
+- err = add_vmaster(codec, dac);
+- if (err < 0)
+- return err;
+- }
+
+ err = add_mute(codec, name, 0,
+ HDA_COMPOSE_AMP_VAL(dac, 3, 0, HDA_OUTPUT), 0, &kctl);
+ if (err < 0)
+ return err;
+- err = snd_ctl_add_slave(spec->vmaster_sw, kctl);
+- if (err < 0)
+- return err;
+
+ err = add_volume(codec, name, 0,
+ HDA_COMPOSE_AMP_VAL(dac, 3, 0, HDA_OUTPUT), 0, &kctl);
+ if (err < 0)
+ return err;
+- err = snd_ctl_add_slave(spec->vmaster_vol, kctl);
+- if (err < 0)
+- return err;
+
+ if (cfg->speaker_outs) {
+ err = snd_hda_ctl_add(codec, 0,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch
new file mode 100644
index 0000000..c3a57e8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch
@@ -0,0 +1,48 @@
+From d08570c3c46be8ea5797897e7ae4df418d404c2d Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson at canonical.com>
+Date: Mon, 2 Jan 2012 12:40:16 +0100
+Subject: [PATCH 010/130] ALSA: HDA: Fix automute for Cirrus Logic 421x
+
+commit 78e2a928e377d5124932d4399c6c581908b027a0 upstream.
+
+There was a bug in the automute logic causing speakers not to
+mute when headphones were plugged in.
+
+Tested-by: Hsin-Yi Chen <hychen at canonical.com>
+Signed-off-by: David Henningsson <david.henningsson at canonical.com>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ sound/pci/hda/patch_cirrus.c | 14 ++++++--------
+ 1 files changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index f55ceb6..5b0a9bb 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -920,16 +920,14 @@ static void cs_automute(struct hda_codec *codec)
+
+ /* mute speakers if spdif or hp jack is plugged in */
+ for (i = 0; i < cfg->speaker_outs; i++) {
++ int pin_ctl = hp_present ? 0 : PIN_OUT;
++ /* detect on spdif is specific to CS421x */
++ if (spdif_present && (spec->vendor_nid == CS421X_VENDOR_NID))
++ pin_ctl = 0;
++
+ nid = cfg->speaker_pins[i];
+ snd_hda_codec_write(codec, nid, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL,
+- hp_present ? 0 : PIN_OUT);
+- /* detect on spdif is specific to CS421x */
+- if (spec->vendor_nid == CS421X_VENDOR_NID) {
+- snd_hda_codec_write(codec, nid, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL,
+- spdif_present ? 0 : PIN_OUT);
+- }
++ AC_VERB_SET_PIN_WIDGET_CONTROL, pin_ctl);
+ }
+ if (spec->gpio_eapd_hp) {
+ unsigned int gpio = hp_present ?
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch
new file mode 100644
index 0000000..a311248
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch
@@ -0,0 +1,38 @@
+From 37a4221e9e94eb1841d5367baba68e31b0c29d4b Mon Sep 17 00:00:00 2001
+From: Pavel Hofman <pavel.hofman at ivitera.com>
+Date: Thu, 5 Jan 2012 23:05:18 +0100
+Subject: [PATCH 011/130] ALSA: ice1724 - Check for ac97 to avoid kernel oops
+
+commit e7848163aa2a649d9065f230fadff80dc3519775 upstream.
+
+Cards with identical PCI ids but no AC97 config in EEPROM do not have
+the ac97 field initialized. We must check for this case to avoid kernel oops.
+
+Signed-off-by: Pavel Hofman <pavel.hofman at ivitera.com>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ sound/pci/ice1712/amp.c | 7 +++++--
+ 1 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/ice1712/amp.c b/sound/pci/ice1712/amp.c
+index e328cfb..e525da2 100644
+--- a/sound/pci/ice1712/amp.c
++++ b/sound/pci/ice1712/amp.c
+@@ -68,8 +68,11 @@ static int __devinit snd_vt1724_amp_init(struct snd_ice1712 *ice)
+
+ static int __devinit snd_vt1724_amp_add_controls(struct snd_ice1712 *ice)
+ {
+- /* we use pins 39 and 41 of the VT1616 for left and right read outputs */
+- snd_ac97_write_cache(ice->ac97, 0x5a, snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
++ if (ice->ac97)
++ /* we use pins 39 and 41 of the VT1616 for left and right
++ read outputs */
++ snd_ac97_write_cache(ice->ac97, 0x5a,
++ snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch
new file mode 100644
index 0000000..98db255
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch
@@ -0,0 +1,46 @@
+From 3997412715c72bd24b2433c841b63590ec175755 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai at suse.de>
+Date: Mon, 9 Jan 2012 11:37:20 +0100
+Subject: [PATCH 012/130] ALSA: usb-audio - Avoid flood of frame-active debug
+ messages
+
+commit 80c8a2a372599e604b04a9c568952fe39cd1851d upstream.
+
+With some buggy devices, the usb-audio driver may give "frame xxx active"
+kernel messages too often. Better to keep it as debug-only using
+snd_printdd(), and also add the rate-limit for avoiding floods.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=738681
+
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ sound/usb/endpoint.c | 5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 81c6ede..08dcce5 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -17,6 +17,7 @@
+
+ #include <linux/gfp.h>
+ #include <linux/init.h>
++#include <linux/ratelimit.h>
+ #include <linux/usb.h>
+ #include <linux/usb/audio.h>
+
+@@ -458,8 +459,8 @@ static int retire_capture_urb(struct snd_usb_substream *subs,
+
+ for (i = 0; i < urb->number_of_packets; i++) {
+ cp = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset;
+- if (urb->iso_frame_desc[i].status) {
+- snd_printd(KERN_ERR "frame %d active: %d\n", i, urb->iso_frame_desc[i].status);
++ if (urb->iso_frame_desc[i].status && printk_ratelimit()) {
++ snd_printdd("frame %d active: %d\n", i, urb->iso_frame_desc[i].status);
+ // continue;
+ }
+ bytes = urb->iso_frame_desc[i].actual_length;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch
new file mode 100644
index 0000000..20e9a98
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch
@@ -0,0 +1,37 @@
+From 82b777e29dcdaa78de5834c88eec7d6733f7aaff Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai at suse.de>
+Date: Tue, 10 Jan 2012 08:59:56 +0100
+Subject: [PATCH 013/130] ALSA: hda - Use auto-parser for HP laptops with
+ cx20459 codec
+
+commit de4da59e480cdf1075b33dbaf8078fc87bc52241 upstream.
+
+These laptops can work well with the auto-parser and their BIOS setups,
+and in addition, the auto-parser fixes the problem with S3/S4 where
+the unsol event handling is killed after resume due to fallback to the
+single-cmd mode.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740115
+
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ sound/pci/hda/patch_conexant.c | 2 --
+ 1 files changed, 0 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 0de2119..7072251 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1120,8 +1120,6 @@ static const char * const cxt5045_models[CXT5045_MODELS] = {
+
+ static const struct snd_pci_quirk cxt5045_cfg_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x30d5, "HP 530", CXT5045_LAPTOP_HP530),
+- SND_PCI_QUIRK_MASK(0x103c, 0xff00, 0x3000, "HP DV Series",
+- CXT5045_LAPTOP_HPSENSE),
+ SND_PCI_QUIRK(0x1179, 0xff31, "Toshiba P105", CXT5045_LAPTOP_MICSENSE),
+ SND_PCI_QUIRK(0x152d, 0x0753, "Benq R55E", CXT5045_BENQ),
+ SND_PCI_QUIRK(0x1734, 0x10ad, "Fujitsu Si1520", CXT5045_LAPTOP_MICSENSE),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch
new file mode 100644
index 0000000..d7b647a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch
@@ -0,0 +1,58 @@
+From b347c4f831da8a0e1498b0947e7a334e9113cd83 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai at suse.de>
+Date: Tue, 10 Jan 2012 12:41:22 +0100
+Subject: [PATCH 014/130] ALSA: hda - Return the error from get_wcaps_type()
+ for invalid NIDs
+
+commit 3a90274de3548ebb2aabfbf488cea8e275a73dc6 upstream.
+
+When an invalid NID is given, get_wcaps() returns zero as the error,
+but get_wcaps_type() takes it as the normal value and returns a bogus
+AC_WID_AUD_OUT value. This confuses the parser.
+
+With this patch, get_wcaps_type() returns -1 when value 0 is given,
+i.e. an invalid NID is passed to get_wcaps().
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740118
+
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ sound/pci/hda/hda_local.h | 7 ++++++-
+ sound/pci/hda/hda_proc.c | 2 ++
+ 2 files changed, 8 insertions(+), 1 deletions(-)
+
+diff --git a/sound/pci/hda/hda_local.h b/sound/pci/hda/hda_local.h
+index 618ddad..368f0c5 100644
+--- a/sound/pci/hda/hda_local.h
++++ b/sound/pci/hda/hda_local.h
+@@ -487,7 +487,12 @@ static inline u32 get_wcaps(struct hda_codec *codec, hda_nid_t nid)
+ }
+
+ /* get the widget type from widget capability bits */
+-#define get_wcaps_type(wcaps) (((wcaps) & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT)
++static inline int get_wcaps_type(unsigned int wcaps)
++{
++ if (!wcaps)
++ return -1; /* invalid type */
++ return (wcaps & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT;
++}
+
+ static inline unsigned int get_wcaps_channels(u32 wcaps)
+ {
+diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
+index 2c981b5..254ab52 100644
+--- a/sound/pci/hda/hda_proc.c
++++ b/sound/pci/hda/hda_proc.c
+@@ -54,6 +54,8 @@ static const char *get_wid_type_name(unsigned int wid_value)
+ [AC_WID_BEEP] = "Beep Generator Widget",
+ [AC_WID_VENDOR] = "Vendor Defined Widget",
+ };
++ if (wid_value == -1)
++ return "UNKNOWN Widget";
+ wid_value &= 0xf;
+ if (names[wid_value])
+ return names[wid_value];
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch
new file mode 100644
index 0000000..d2a40b7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch
@@ -0,0 +1,42 @@
+From ea14c41fb5a54a4f2089c97f85c399965415871a Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai at suse.de>
+Date: Tue, 10 Jan 2012 15:16:02 +0100
+Subject: [PATCH 015/130] ALSA: hda - Fix the detection of "Loopback Mixing"
+ control for VIA codecs
+
+commit 4808d12d1dddb046ec86425e5f6766f02e950292 upstream.
+
+Currently the driver checks only the out_mix_path[] for the primary
+output route for judging whether to create the loopback-mixing control
+or not. But, there are cases where aamix-routing is available only on
+headphone or speaker paths but not on the primary output path. So, the
+driver ignores such cases inappropriately.
+
+This patch fixes the check of the loopback-mixing control by testing
+all mix-routing paths.
+
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ sound/pci/hda/patch_via.c | 5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index b513762..8d69e59 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -2200,7 +2200,10 @@ static int via_auto_create_loopback_switch(struct hda_codec *codec)
+ {
+ struct via_spec *spec = codec->spec;
+
+- if (!spec->aa_mix_nid || !spec->out_mix_path.depth)
++ if (!spec->aa_mix_nid)
++ return 0; /* no loopback switching available */
++ if (!(spec->out_mix_path.depth || spec->hp_mix_path.depth ||
++ spec->speaker_path.depth))
+ return 0; /* no loopback switching available */
+ if (!via_clone_control(spec, &via_aamix_ctl_enum))
+ return -ENOMEM;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch
new file mode 100644
index 0000000..01e3a6b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch
@@ -0,0 +1,92 @@
+From 53eb674241d25d1496c966cd5f140b0bb213dbdc Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai at suse.de>
+Date: Wed, 11 Jan 2012 12:34:11 +0100
+Subject: [PATCH 016/130] ALSA: hda - Fix the lost power-setup of seconary
+ pins after PM resume
+
+commit f2cbba7602383cd9cdd21f0a5d0b8bd1aad47b33 upstream.
+
+When multiple headphone or other detectable output pins are present,
+the power-map has to be updated after resume appropriately, but the
+current driver doesn't check all pins but only the first pin (since
+it's enough to check it for the mute-behavior). This resulted in the
+silent output from the secondary outputs after PM resume.
+
+This patch fixes the problem by checking all pins at (re-)init time.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740347
+
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ sound/pci/hda/patch_sigmatel.c | 36 +++++++++++++++++++++++-------------
+ 1 files changed, 23 insertions(+), 13 deletions(-)
+
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 616678f..a87b260 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4326,6 +4326,27 @@ static void stac_store_hints(struct hda_codec *codec)
+ }
+ }
+
++static void stac_issue_unsol_events(struct hda_codec *codec, int num_pins,
++ const hda_nid_t *pins)
++{
++ while (num_pins--)
++ stac_issue_unsol_event(codec, *pins++);
++}
++
++/* fake event to set up pins */
++static void stac_fake_hp_events(struct hda_codec *codec)
++{
++ struct sigmatel_spec *spec = codec->spec;
++
++ if (spec->autocfg.hp_outs)
++ stac_issue_unsol_events(codec, spec->autocfg.hp_outs,
++ spec->autocfg.hp_pins);
++ if (spec->autocfg.line_outs &&
++ spec->autocfg.line_out_pins[0] != spec->autocfg.hp_pins[0])
++ stac_issue_unsol_events(codec, spec->autocfg.line_outs,
++ spec->autocfg.line_out_pins);
++}
++
+ static int stac92xx_init(struct hda_codec *codec)
+ {
+ struct sigmatel_spec *spec = codec->spec;
+@@ -4376,10 +4397,7 @@ static int stac92xx_init(struct hda_codec *codec)
+ stac92xx_auto_set_pinctl(codec, spec->autocfg.line_out_pins[0],
+ AC_PINCTL_OUT_EN);
+ /* fake event to set up pins */
+- if (cfg->hp_pins[0])
+- stac_issue_unsol_event(codec, cfg->hp_pins[0]);
+- else if (cfg->line_out_pins[0])
+- stac_issue_unsol_event(codec, cfg->line_out_pins[0]);
++ stac_fake_hp_events(codec);
+ } else {
+ stac92xx_auto_init_multi_out(codec);
+ stac92xx_auto_init_hp_out(codec);
+@@ -5028,19 +5046,11 @@ static void stac927x_proc_hook(struct snd_info_buffer *buffer,
+ #ifdef CONFIG_PM
+ static int stac92xx_resume(struct hda_codec *codec)
+ {
+- struct sigmatel_spec *spec = codec->spec;
+-
+ stac92xx_init(codec);
+ snd_hda_codec_resume_amp(codec);
+ snd_hda_codec_resume_cache(codec);
+ /* fake event to set up pins again to override cached values */
+- if (spec->hp_detect) {
+- if (spec->autocfg.hp_pins[0])
+- stac_issue_unsol_event(codec, spec->autocfg.hp_pins[0]);
+- else if (spec->autocfg.line_out_pins[0])
+- stac_issue_unsol_event(codec,
+- spec->autocfg.line_out_pins[0]);
+- }
++ stac_fake_hp_events(codec);
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch
new file mode 100644
index 0000000..93e7b23
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch
@@ -0,0 +1,43 @@
+From d69882b450293b61af0820e75dc1bfb8823c58bd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5 at gmail.com>
+Date: Fri, 23 Dec 2011 20:32:18 +0100
+Subject: [PATCH 017/130] drm/radeon/kms: workaround invalid AVI infoframe
+ checksum issue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 92db7f6c860b8190571a9dc1fcbc16d003422fe8 upstream.
+
+This change was verified to fix both issues with no video I've
+investigated. I've also checked checksum calculation with fglrx on:
+RV620, HD54xx, HD5450, HD6310, HD6320.
+
+Signed-off-by: Rafał Miłecki <zajec5 at gmail.com>
+Signed-off-by: Dave Airlie <airlied at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/gpu/drm/radeon/r600_hdmi.c | 7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
+index f5ac7e7..c45d921 100644
+--- a/drivers/gpu/drm/radeon/r600_hdmi.c
++++ b/drivers/gpu/drm/radeon/r600_hdmi.c
+@@ -196,6 +196,13 @@ static void r600_hdmi_videoinfoframe(
+ frame[0xD] = (right_bar >> 8);
+
+ r600_hdmi_infoframe_checksum(0x82, 0x02, 0x0D, frame);
++ /* Our header values (type, version, length) should be alright, Intel
++ * is using the same. Checksum function also seems to be OK, it works
++ * fine for audio infoframe. However calculated value is always lower
++ * by 2 in comparison to fglrx. It breaks displaying anything in case
++ * of TVs that strictly check the checksum. Hack it manually here to
++ * workaround this issue. */
++ frame[0x0] += 2;
+
+ WREG32(offset+R600_HDMI_VIDEOINFOFRAME_0,
+ frame[0x0] | (frame[0x1] << 8) | (frame[0x2] << 16) | (frame[0x3] << 24));
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch
new file mode 100644
index 0000000..690c3ab
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch
@@ -0,0 +1,40 @@
+From 056276f2509223f4f07a0778f1f1b398fdc8ae87 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher at amd.com>
+Date: Tue, 3 Jan 2012 09:48:38 -0500
+Subject: [PATCH 018/130] drm/radeon/kms: disable writeback on pre-R300 asics
+
+commit 28eebb703e28bc455ba704adb1026f76649b768c upstream.
+
+We often end up missing fences on older asics with
+writeback enabled which leads to delays in the userspace
+accel code, so just disable it by default on those asics.
+
+Reported-by: Helge Deller <deller at gmx.de>
+Reported-by: Dave Airlie <airlied at redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
+Signed-off-by: Dave Airlie <airlied at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index c4d00a1..9b39145 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -224,8 +224,11 @@ int radeon_wb_init(struct radeon_device *rdev)
+ if (radeon_no_wb == 1)
+ rdev->wb.enabled = false;
+ else {
+- /* often unreliable on AGP */
+ if (rdev->flags & RADEON_IS_AGP) {
++ /* often unreliable on AGP */
++ rdev->wb.enabled = false;
++ } else if (rdev->family < CHIP_R300) {
++ /* often unreliable on pre-r300 */
+ rdev->wb.enabled = false;
+ } else {
+ rdev->wb.enabled = true;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch
new file mode 100644
index 0000000..7d85919
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch
@@ -0,0 +1,70 @@
+From a4064a0d9fab7c0a6aa4b6bf170d6ffaed93601a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer at amd.com>
+Date: Thu, 5 Jan 2012 18:42:17 +0100
+Subject: [PATCH 019/130] radeon: Fix disabling PCI bus mastering on big
+ endian hosts.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 3df96909b75835d487a9178761622b0cbd7310d4 upstream.
+
+It would previously write basically random bits to PCI configuration space...
+Not very surprising that the GPU tended to stop responding completely. The
+resulting MCE even froze the whole machine sometimes.
+
+Now resetting the GPU after a lockup has at least a fighting chance of
+succeeding.
+
+Signed-off-by: Michel Dänzer <michel.daenzer at amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
+Signed-off-by: Dave Airlie <airlied at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/gpu/drm/radeon/r100.c | 5 +++--
+ drivers/gpu/drm/radeon/rs600.c | 4 ++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
+index bfc08f6..31b0d1a 100644
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -2177,6 +2177,7 @@ bool r100_gpu_is_lockup(struct radeon_device *rdev)
+ void r100_bm_disable(struct radeon_device *rdev)
+ {
+ u32 tmp;
++ u16 tmp16;
+
+ /* disable bus mastering */
+ tmp = RREG32(R_000030_BUS_CNTL);
+@@ -2187,8 +2188,8 @@ void r100_bm_disable(struct radeon_device *rdev)
+ WREG32(R_000030_BUS_CNTL, (tmp & 0xFFFFFFFF) | 0x00000040);
+ tmp = RREG32(RADEON_BUS_CNTL);
+ mdelay(1);
+- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp);
+- pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB);
++ pci_read_config_word(rdev->pdev, 0x4, &tmp16);
++ pci_write_config_word(rdev->pdev, 0x4, tmp16 & 0xFFFB);
+ mdelay(1);
+ }
+
+diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
+index b1053d6..c259e21 100644
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -324,10 +324,10 @@ void rs600_hpd_fini(struct radeon_device *rdev)
+
+ void rs600_bm_disable(struct radeon_device *rdev)
+ {
+- u32 tmp;
++ u16 tmp;
+
+ /* disable bus mastering */
+- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp);
++ pci_read_config_word(rdev->pdev, 0x4, &tmp);
+ pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB);
+ mdelay(1);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch
new file mode 100644
index 0000000..0b1e79b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch
@@ -0,0 +1,50 @@
+From df673b323fa5ef227649ad218343f244261c0611 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh at panasas.com>
+Date: Fri, 6 Jan 2012 09:28:12 +0200
+Subject: [PATCH 020/130] pnfs-obj: pNFS errors are communicated on
+ iodata->pnfs_error
+
+commit 5c0b4129c07b902b27d3f3ebc087757f534a3abd upstream.
+
+Some time along the way pNFS IO errors were switched to
+communicate with a special iodata->pnfs_error member instead
+of the regular RPC members. But objlayout was not switched
+over.
+
+Fix that!
+Without this fix any IO error is hanged, because IO is not
+switched to MDS and pages are never cleared or read.
+
+[Applies to 3.2.0. Same bug different patch for 3.1/0 Kernels]
+Signed-off-by: Boaz Harrosh <bharrosh at panasas.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/nfs/objlayout/objlayout.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/fs/nfs/objlayout/objlayout.c b/fs/nfs/objlayout/objlayout.c
+index 72074e3..b3c2903 100644
+--- a/fs/nfs/objlayout/objlayout.c
++++ b/fs/nfs/objlayout/objlayout.c
+@@ -254,6 +254,8 @@ objlayout_read_done(struct objlayout_io_res *oir, ssize_t status, bool sync)
+ oir->status = rdata->task.tk_status = status;
+ if (status >= 0)
+ rdata->res.count = status;
++ else
++ rdata->pnfs_error = status;
+ objlayout_iodone(oir);
+ /* must not use oir after this point */
+
+@@ -334,6 +336,8 @@ objlayout_write_done(struct objlayout_io_res *oir, ssize_t status, bool sync)
+ if (status >= 0) {
+ wdata->res.count = status;
+ wdata->verf.committed = oir->committed;
++ } else {
++ wdata->pnfs_error = status;
+ }
+ objlayout_iodone(oir);
+ /* must not use oir after this point */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch
new file mode 100644
index 0000000..0b31c54
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch
@@ -0,0 +1,92 @@
+From 9c85d688c42a6feb8f72204730514ae658854828 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh at panasas.com>
+Date: Fri, 6 Jan 2012 09:31:20 +0200
+Subject: [PATCH 021/130] pnfs-obj: Must return layout on IO error
+
+commit fe0fe83585f88346557868a803a479dfaaa0688a upstream.
+
+As mandated by the standard. In case of an IO error, a pNFS
+objects layout driver must return it's layout. This is because
+all device errors are reported to the server as part of the
+layout return buffer.
+
+This is implemented the same way PNFS_LAYOUTRET_ON_SETATTR
+is done, through a bit flag on the pnfs_layoutdriver_type->flags
+member. The flag is set by the layout driver that wants a
+layout_return preformed at pnfs_ld_{write,read}_done in case
+of an error.
+(Though I have not defined a wrapper like pnfs_ld_layoutret_on_setattr
+ because this code is never called outside of pnfs.c and pnfs IO
+ paths)
+
+Without this patch 3.[0-2] Kernels leak memory and have an annoying
+WARN_ON after every IO error utilizing the pnfs-obj driver.
+
+Signed-off-by: Boaz Harrosh <bharrosh at panasas.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/nfs/objlayout/objio_osd.c | 3 ++-
+ fs/nfs/pnfs.c | 12 ++++++++++++
+ fs/nfs/pnfs.h | 1 +
+ 3 files changed, 15 insertions(+), 1 deletions(-)
+
+diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
+index c807ab9..55d0128 100644
+--- a/fs/nfs/objlayout/objio_osd.c
++++ b/fs/nfs/objlayout/objio_osd.c
+@@ -551,7 +551,8 @@ static const struct nfs_pageio_ops objio_pg_write_ops = {
+ static struct pnfs_layoutdriver_type objlayout_type = {
+ .id = LAYOUT_OSD2_OBJECTS,
+ .name = "LAYOUT_OSD2_OBJECTS",
+- .flags = PNFS_LAYOUTRET_ON_SETATTR,
++ .flags = PNFS_LAYOUTRET_ON_SETATTR |
++ PNFS_LAYOUTRET_ON_ERROR,
+
+ .alloc_layout_hdr = objlayout_alloc_layout_hdr,
+ .free_layout_hdr = objlayout_free_layout_hdr,
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 8e672a2..f881a63 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1178,6 +1178,15 @@ void pnfs_ld_write_done(struct nfs_write_data *data)
+ put_lseg(data->lseg);
+ data->lseg = NULL;
+ dprintk("pnfs write error = %d\n", data->pnfs_error);
++ if (NFS_SERVER(data->inode)->pnfs_curr_ld->flags &
++ PNFS_LAYOUTRET_ON_ERROR) {
++ /* Don't lo_commit on error, Server will needs to
++ * preform a file recovery.
++ */
++ clear_bit(NFS_INO_LAYOUTCOMMIT,
++ &NFS_I(data->inode)->flags);
++ pnfs_return_layout(data->inode);
++ }
+ }
+ data->mds_ops->rpc_release(data);
+ }
+@@ -1267,6 +1276,9 @@ static void pnfs_ld_handle_read_error(struct nfs_read_data *data)
+ put_lseg(data->lseg);
+ data->lseg = NULL;
+ dprintk("pnfs write error = %d\n", data->pnfs_error);
++ if (NFS_SERVER(data->inode)->pnfs_curr_ld->flags &
++ PNFS_LAYOUTRET_ON_ERROR)
++ pnfs_return_layout(data->inode);
+
+ nfs_pageio_init_read_mds(&pgio, data->inode);
+
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index 1509530..53d593a 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -68,6 +68,7 @@ enum {
+ enum layoutdriver_policy_flags {
+ /* Should the pNFS client commit and return the layout upon a setattr */
+ PNFS_LAYOUTRET_ON_SETATTR = 1 << 0,
++ PNFS_LAYOUTRET_ON_ERROR = 1 << 1,
+ };
+
+ struct nfs4_deviceid_node;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch
new file mode 100644
index 0000000..8c4acc6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch
@@ -0,0 +1,94 @@
+From 1ef216baa398a27c95a9de67f36805cbeea81fe6 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever at oracle.com>
+Date: Mon, 5 Dec 2011 15:40:30 -0500
+Subject: [PATCH 022/130] NFS: Retry mounting NFSROOT
+
+commit 43717c7daebf10b43f12e68512484b3095bb1ba5 upstream.
+
+Lukas Razik <linux at razik.name> reports that on his SPARC system,
+booting with an NFS root file system stopped working after commit
+56463e50 "NFS: Use super.c for NFSROOT mount option parsing."
+
+We found that the network switch to which Lukas' client was attached
+was delaying access to the LAN after the client's NIC driver reported
+that its link was up. The delay was longer than the timeouts used in
+the NFS client during mounting.
+
+NFSROOT worked for Lukas before commit 56463e50 because in those
+kernels, the client's first operation was an rpcbind request to
+determine which port the NFS server was listening on. When that
+request failed after a long timeout, the client simply selected the
+default NFS port (2049). By that time the switch was allowing access
+to the LAN, and the mount succeeded.
+
+Neither of these client behaviors is desirable, so reverting 56463e50
+is really not a choice. Instead, introduce a mechanism that retries
+the NFSROOT mount request several times. This is the same tactic that
+normal user space NFS mounts employ to overcome server and network
+delays.
+
+Signed-off-by: Lukas Razik <linux at razik.name>
+[ cel: match kernel coding style, add proper patch description ]
+[ cel: add exponential back-off ]
+Signed-off-by: Chuck Lever <chuck.lever at oracle.com>
+Tested-by: Lukas Razik <linux at razik.name>
+Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ init/do_mounts.c | 35 +++++++++++++++++++++++++++++++----
+ 1 files changed, 31 insertions(+), 4 deletions(-)
+
+diff --git a/init/do_mounts.c b/init/do_mounts.c
+index 0f6e1d9..db6e5ee 100644
+--- a/init/do_mounts.c
++++ b/init/do_mounts.c
+@@ -398,15 +398,42 @@ out:
+ }
+
+ #ifdef CONFIG_ROOT_NFS
++
++#define NFSROOT_TIMEOUT_MIN 5
++#define NFSROOT_TIMEOUT_MAX 30
++#define NFSROOT_RETRY_MAX 5
++
+ static int __init mount_nfs_root(void)
+ {
+ char *root_dev, *root_data;
++ unsigned int timeout;
++ int try, err;
+
+- if (nfs_root_data(&root_dev, &root_data) != 0)
+- return 0;
+- if (do_mount_root(root_dev, "nfs", root_mountflags, root_data) != 0)
++ err = nfs_root_data(&root_dev, &root_data);
++ if (err != 0)
+ return 0;
+- return 1;
++
++ /*
++ * The server or network may not be ready, so try several
++ * times. Stop after a few tries in case the client wants
++ * to fall back to other boot methods.
++ */
++ timeout = NFSROOT_TIMEOUT_MIN;
++ for (try = 1; ; try++) {
++ err = do_mount_root(root_dev, "nfs",
++ root_mountflags, root_data);
++ if (err == 0)
++ return 1;
++ if (try > NFSROOT_RETRY_MAX)
++ break;
++
++ /* Wait, in case the server refused us immediately */
++ ssleep(timeout);
++ timeout <<= 1;
++ if (timeout > NFSROOT_TIMEOUT_MAX)
++ timeout = NFSROOT_TIMEOUT_MAX;
++ }
++ return 0;
+ }
+ #endif
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch
new file mode 100644
index 0000000..62c5b45
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch
@@ -0,0 +1,30 @@
+From a4d5a638ff204626f6244b3a316cf8f01ef3e2fa Mon Sep 17 00:00:00 2001
+From: Andy Adamson <andros at netapp.com>
+Date: Wed, 9 Nov 2011 13:58:20 -0500
+Subject: [PATCH 023/130] NFSv4.1: fix backchannel slotid off-by-one bug
+
+commit 61f2e5106582d02f30b6807e3f9c07463c572ccb upstream.
+
+Signed-off-by: Andy Adamson <andros at netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/nfs/callback_proc.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index 43926ad..54cea8a 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -339,7 +339,7 @@ validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
+ dprintk("%s enter. slotid %d seqid %d\n",
+ __func__, args->csa_slotid, args->csa_sequenceid);
+
+- if (args->csa_slotid > NFS41_BC_MAX_CALLBACKS)
++ if (args->csa_slotid >= NFS41_BC_MAX_CALLBACKS)
+ return htonl(NFS4ERR_BADSLOT);
+
+ slot = tbl->slots + args->csa_slotid;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch
new file mode 100644
index 0000000..7f82511
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch
@@ -0,0 +1,60 @@
+From 876118d108ac910a4b4b4384b6d827ef9eb599bb Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb at suse.de>
+Date: Wed, 16 Nov 2011 11:46:31 +1100
+Subject: [PATCH 024/130] NFS - fix recent breakage to NFS error handling.
+
+commit 2edb6bc3852c681c0d948245bd55108dc6407604 upstream.
+
+ From c6d615d2b97fe305cbf123a8751ced859dca1d5e Mon Sep 17 00:00:00 2001
+ From: NeilBrown <neilb at suse.de>
+ Date: Wed, 16 Nov 2011 09:39:05 +1100
+ Subject: NFS - fix recent breakage to NFS error handling.
+
+commit 02c24a82187d5a628c68edfe71ae60dc135cd178 made a small and
+presumably unintended change to write error handling in NFS.
+
+Previously an error from filemap_write_and_wait_range would only be of
+interest if nfs_file_fsync did not return an error. After this commit,
+an error from filemap_write_and_wait_range would mean that (the rest of)
+nfs_file_fsync would not even be called.
+
+This means that:
+ 1/ you are more likely to see EIO than e.g. EDQUOT or ENOSPC.
+ 2/ NFS_CONTEXT_ERROR_WRITE remains set for longer so more writes are
+ synchronous.
+
+This patch restores previous behaviour.
+
+Cc: Josef Bacik <josef at redhat.com>
+Cc: Jan Kara <jack at suse.cz>
+Cc: Al Viro <viro at zeniv.linux.org.uk>
+Signed-off-by: NeilBrown <neilb at suse.de>
+Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/nfs/file.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index 606ef0f..c43a452 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -272,13 +272,13 @@ nfs_file_fsync(struct file *file, loff_t start, loff_t end, int datasync)
+ datasync);
+
+ ret = filemap_write_and_wait_range(inode->i_mapping, start, end);
+- if (ret)
+- return ret;
+ mutex_lock(&inode->i_mutex);
+
+ nfs_inc_stats(inode, NFSIOS_VFSFSYNC);
+ have_error = test_and_clear_bit(NFS_CONTEXT_ERROR_WRITE, &ctx->flags);
+ status = nfs_commit_inode(inode, FLUSH_SYNC);
++ if (status >= 0 && ret < 0)
++ status = ret;
+ have_error |= test_bit(NFS_CONTEXT_ERROR_WRITE, &ctx->flags);
+ if (have_error)
+ ret = xchg(&ctx->error, 0);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch
new file mode 100644
index 0000000..383a8f1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch
@@ -0,0 +1,313 @@
+From ea3a3ed18130c4a0fe0dbdd3f7dabc59a67c5064 Mon Sep 17 00:00:00 2001
+From: Andy Adamson <andros at netapp.com>
+Date: Wed, 7 Dec 2011 11:55:27 -0500
+Subject: [PATCH 025/130] NFSv4: include bitmap in nfsv4 get acl data
+
+commit bf118a342f10dafe44b14451a1392c3254629a1f upstream.
+
+The NFSv4 bitmap size is unbounded: a server can return an arbitrary
+sized bitmap in an FATTR4_WORD0_ACL request. Replace using the
+nfs4_fattr_bitmap_maxsz as a guess to the maximum bitmask returned by a server
+with the inclusion of the bitmap (xdr length plus bitmasks) and the acl data
+xdr length to the (cached) acl page data.
+
+This is a general solution to commit e5012d1f "NFSv4.1: update
+nfs4_fattr_bitmap_maxsz" and fixes hitting a BUG_ON in xdr_shrink_bufhead
+when getting ACLs.
+
+Fix a bug in decode_getacl that returned -EINVAL on ACLs > page when getxattr
+was called with a NULL buffer, preventing ACL > PAGE_SIZE from being retrieved.
+
+Signed-off-by: Andy Adamson <andros at netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/nfs/nfs4proc.c | 96 ++++++++++++++++++++++++++------------------
+ fs/nfs/nfs4xdr.c | 31 ++++++++++----
+ include/linux/nfs_xdr.h | 5 ++
+ include/linux/sunrpc/xdr.h | 2 +
+ net/sunrpc/xdr.c | 3 +-
+ 5 files changed, 89 insertions(+), 48 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index d9f4d78..055d702 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3430,19 +3430,6 @@ static inline int nfs4_server_supports_acls(struct nfs_server *server)
+ */
+ #define NFS4ACL_MAXPAGES (XATTR_SIZE_MAX >> PAGE_CACHE_SHIFT)
+
+-static void buf_to_pages(const void *buf, size_t buflen,
+- struct page **pages, unsigned int *pgbase)
+-{
+- const void *p = buf;
+-
+- *pgbase = offset_in_page(buf);
+- p -= *pgbase;
+- while (p < buf + buflen) {
+- *(pages++) = virt_to_page(p);
+- p += PAGE_CACHE_SIZE;
+- }
+-}
+-
+ static int buf_to_pages_noslab(const void *buf, size_t buflen,
+ struct page **pages, unsigned int *pgbase)
+ {
+@@ -3539,9 +3526,19 @@ out:
+ nfs4_set_cached_acl(inode, acl);
+ }
+
++/*
++ * The getxattr API returns the required buffer length when called with a
++ * NULL buf. The NFSv4 acl tool then calls getxattr again after allocating
++ * the required buf. On a NULL buf, we send a page of data to the server
++ * guessing that the ACL request can be serviced by a page. If so, we cache
++ * up to the page of ACL data, and the 2nd call to getxattr is serviced by
++ * the cache. If not so, we throw away the page, and cache the required
++ * length. The next getxattr call will then produce another round trip to
++ * the server, this time with the input buf of the required size.
++ */
+ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
+ {
+- struct page *pages[NFS4ACL_MAXPAGES];
++ struct page *pages[NFS4ACL_MAXPAGES] = {NULL, };
+ struct nfs_getaclargs args = {
+ .fh = NFS_FH(inode),
+ .acl_pages = pages,
+@@ -3556,41 +3553,60 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
+ .rpc_argp = &args,
+ .rpc_resp = &res,
+ };
+- struct page *localpage = NULL;
+- int ret;
++ int ret = -ENOMEM, npages, i, acl_len = 0;
+
+- if (buflen < PAGE_SIZE) {
+- /* As long as we're doing a round trip to the server anyway,
+- * let's be prepared for a page of acl data. */
+- localpage = alloc_page(GFP_KERNEL);
+- resp_buf = page_address(localpage);
+- if (localpage == NULL)
+- return -ENOMEM;
+- args.acl_pages[0] = localpage;
+- args.acl_pgbase = 0;
+- args.acl_len = PAGE_SIZE;
+- } else {
+- resp_buf = buf;
+- buf_to_pages(buf, buflen, args.acl_pages, &args.acl_pgbase);
++ npages = (buflen + PAGE_SIZE - 1) >> PAGE_SHIFT;
++ /* As long as we're doing a round trip to the server anyway,
++ * let's be prepared for a page of acl data. */
++ if (npages == 0)
++ npages = 1;
++
++ for (i = 0; i < npages; i++) {
++ pages[i] = alloc_page(GFP_KERNEL);
++ if (!pages[i])
++ goto out_free;
++ }
++ if (npages > 1) {
++ /* for decoding across pages */
++ args.acl_scratch = alloc_page(GFP_KERNEL);
++ if (!args.acl_scratch)
++ goto out_free;
+ }
+- ret = nfs4_call_sync(NFS_SERVER(inode)->client, NFS_SERVER(inode), &msg, &args.seq_args, &res.seq_res, 0);
++ args.acl_len = npages * PAGE_SIZE;
++ args.acl_pgbase = 0;
++ /* Let decode_getfacl know not to fail if the ACL data is larger than
++ * the page we send as a guess */
++ if (buf == NULL)
++ res.acl_flags |= NFS4_ACL_LEN_REQUEST;
++ resp_buf = page_address(pages[0]);
++
++ dprintk("%s buf %p buflen %ld npages %d args.acl_len %ld\n",
++ __func__, buf, buflen, npages, args.acl_len);
++ ret = nfs4_call_sync(NFS_SERVER(inode)->client, NFS_SERVER(inode),
++ &msg, &args.seq_args, &res.seq_res, 0);
+ if (ret)
+ goto out_free;
+- if (res.acl_len > args.acl_len)
+- nfs4_write_cached_acl(inode, NULL, res.acl_len);
++
++ acl_len = res.acl_len - res.acl_data_offset;
++ if (acl_len > args.acl_len)
++ nfs4_write_cached_acl(inode, NULL, acl_len);
+ else
+- nfs4_write_cached_acl(inode, resp_buf, res.acl_len);
++ nfs4_write_cached_acl(inode, resp_buf + res.acl_data_offset,
++ acl_len);
+ if (buf) {
+ ret = -ERANGE;
+- if (res.acl_len > buflen)
++ if (acl_len > buflen)
+ goto out_free;
+- if (localpage)
+- memcpy(buf, resp_buf, res.acl_len);
++ _copy_from_pages(buf, pages, res.acl_data_offset,
++ res.acl_len);
+ }
+- ret = res.acl_len;
++ ret = acl_len;
+ out_free:
+- if (localpage)
+- __free_page(localpage);
++ for (i = 0; i < npages; i++)
++ if (pages[i])
++ __free_page(pages[i]);
++ if (args.acl_scratch)
++ __free_page(args.acl_scratch);
+ return ret;
+ }
+
+@@ -3621,6 +3637,8 @@ static ssize_t nfs4_proc_get_acl(struct inode *inode, void *buf, size_t buflen)
+ nfs_zap_acl_cache(inode);
+ ret = nfs4_read_cached_acl(inode, buf, buflen);
+ if (ret != -ENOENT)
++ /* -ENOENT is returned if there is no ACL or if there is an ACL
++ * but no cached acl data, just the acl length */
+ return ret;
+ return nfs4_get_acl_uncached(inode, buf, buflen);
+ }
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index e6161b2..dcaf693 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -2517,11 +2517,13 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr,
+ encode_compound_hdr(xdr, req, &hdr);
+ encode_sequence(xdr, &args->seq_args, &hdr);
+ encode_putfh(xdr, args->fh, &hdr);
+- replen = hdr.replen + op_decode_hdr_maxsz + nfs4_fattr_bitmap_maxsz + 1;
++ replen = hdr.replen + op_decode_hdr_maxsz + 1;
+ encode_getattr_two(xdr, FATTR4_WORD0_ACL, 0, &hdr);
+
+ xdr_inline_pages(&req->rq_rcv_buf, replen << 2,
+ args->acl_pages, args->acl_pgbase, args->acl_len);
++ xdr_set_scratch_buffer(xdr, page_address(args->acl_scratch), PAGE_SIZE);
++
+ encode_nops(&hdr);
+ }
+
+@@ -4957,17 +4959,18 @@ decode_restorefh(struct xdr_stream *xdr)
+ }
+
+ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
+- size_t *acl_len)
++ struct nfs_getaclres *res)
+ {
+- __be32 *savep;
++ __be32 *savep, *bm_p;
+ uint32_t attrlen,
+ bitmap[3] = {0};
+ struct kvec *iov = req->rq_rcv_buf.head;
+ int status;
+
+- *acl_len = 0;
++ res->acl_len = 0;
+ if ((status = decode_op_hdr(xdr, OP_GETATTR)) != 0)
+ goto out;
++ bm_p = xdr->p;
+ if ((status = decode_attr_bitmap(xdr, bitmap)) != 0)
+ goto out;
+ if ((status = decode_attr_length(xdr, &attrlen, &savep)) != 0)
+@@ -4979,18 +4982,30 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
+ size_t hdrlen;
+ u32 recvd;
+
++ /* The bitmap (xdr len + bitmaps) and the attr xdr len words
++ * are stored with the acl data to handle the problem of
++ * variable length bitmaps.*/
++ xdr->p = bm_p;
++ res->acl_data_offset = be32_to_cpup(bm_p) + 2;
++ res->acl_data_offset <<= 2;
++
+ /* We ignore &savep and don't do consistency checks on
+ * the attr length. Let userspace figure it out.... */
+ hdrlen = (u8 *)xdr->p - (u8 *)iov->iov_base;
++ attrlen += res->acl_data_offset;
+ recvd = req->rq_rcv_buf.len - hdrlen;
+ if (attrlen > recvd) {
+- dprintk("NFS: server cheating in getattr"
+- " acl reply: attrlen %u > recvd %u\n",
++ if (res->acl_flags & NFS4_ACL_LEN_REQUEST) {
++ /* getxattr interface called with a NULL buf */
++ res->acl_len = attrlen;
++ goto out;
++ }
++ dprintk("NFS: acl reply: attrlen %u > recvd %u\n",
+ attrlen, recvd);
+ return -EINVAL;
+ }
+ xdr_read_pages(xdr, attrlen);
+- *acl_len = attrlen;
++ res->acl_len = attrlen;
+ } else
+ status = -EOPNOTSUPP;
+
+@@ -6028,7 +6043,7 @@ nfs4_xdr_dec_getacl(struct rpc_rqst *rqstp, struct xdr_stream *xdr,
+ status = decode_putfh(xdr);
+ if (status)
+ goto out;
+- status = decode_getacl(xdr, rqstp, &res->acl_len);
++ status = decode_getacl(xdr, rqstp, res);
+
+ out:
+ return status;
+diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
+index 2a7c533..6c898af 100644
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -602,11 +602,16 @@ struct nfs_getaclargs {
+ size_t acl_len;
+ unsigned int acl_pgbase;
+ struct page ** acl_pages;
++ struct page * acl_scratch;
+ struct nfs4_sequence_args seq_args;
+ };
+
++/* getxattr ACL interface flags */
++#define NFS4_ACL_LEN_REQUEST 0x0001 /* zero length getxattr buffer */
+ struct nfs_getaclres {
+ size_t acl_len;
++ size_t acl_data_offset;
++ int acl_flags;
+ struct nfs4_sequence_res seq_res;
+ };
+
+diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
+index a20970e..af70af3 100644
+--- a/include/linux/sunrpc/xdr.h
++++ b/include/linux/sunrpc/xdr.h
+@@ -191,6 +191,8 @@ extern int xdr_decode_array2(struct xdr_buf *buf, unsigned int base,
+ struct xdr_array2_desc *desc);
+ extern int xdr_encode_array2(struct xdr_buf *buf, unsigned int base,
+ struct xdr_array2_desc *desc);
++extern void _copy_from_pages(char *p, struct page **pages, size_t pgbase,
++ size_t len);
+
+ /*
+ * Provide some simple tools for XDR buffer overflow-checking etc.
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 277ebd4..593f4c6 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -296,7 +296,7 @@ _copy_to_pages(struct page **pages, size_t pgbase, const char *p, size_t len)
+ * Copies data into an arbitrary memory location from an array of pages
+ * The copy is assumed to be non-overlapping.
+ */
+-static void
++void
+ _copy_from_pages(char *p, struct page **pages, size_t pgbase, size_t len)
+ {
+ struct page **pgfrom;
+@@ -324,6 +324,7 @@ _copy_from_pages(char *p, struct page **pages, size_t pgbase, size_t len)
+
+ } while ((len -= copy) != 0);
+ }
++EXPORT_SYMBOL_GPL(_copy_from_pages);
+
+ /*
+ * xdr_shrink_bufhead
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch
new file mode 100644
index 0000000..02f9fe1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch
@@ -0,0 +1,147 @@
+From e7d23a1c02013b27699c8d993ef0ceb6e3110955 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton at redhat.com>
+Date: Tue, 20 Dec 2011 06:57:45 -0500
+Subject: [PATCH 026/130] nfs: fix regression in handling of context= option
+ in NFSv4
+
+commit 8a0d551a59ac92d8ff048d6cb29d3a02073e81e8 upstream.
+
+Setting the security context of a NFSv4 mount via the context= mount
+option is currently broken. The NFSv4 codepath allocates a parsed
+options struct, and then parses the mount options to fill it. It
+eventually calls nfs4_remote_mount which calls security_init_mnt_opts.
+That clobbers the lsm_opts struct that was populated earlier. This bug
+also looks like it causes a small memory leak on each v4 mount where
+context= is used.
+
+Fix this by moving the initialization of the lsm_opts into
+nfs_alloc_parsed_mount_data. Also, add a destructor for
+nfs_parsed_mount_data to make it easier to free all of the allocations
+hanging off of it, and to ensure that the security_free_mnt_opts is
+called whenever security_init_mnt_opts is.
+
+I believe this regression was introduced quite some time ago, probably
+by commit c02d7adf.
+
+Signed-off-by: Jeff Layton <jlayton at redhat.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/nfs/super.c | 43 +++++++++++++++++++------------------------
+ 1 files changed, 19 insertions(+), 24 deletions(-)
+
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 1347774..3ada13c 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -909,10 +909,24 @@ static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(unsigned int ve
+ data->auth_flavor_len = 1;
+ data->version = version;
+ data->minorversion = 0;
++ security_init_mnt_opts(&data->lsm_opts);
+ }
+ return data;
+ }
+
++static void nfs_free_parsed_mount_data(struct nfs_parsed_mount_data *data)
++{
++ if (data) {
++ kfree(data->client_address);
++ kfree(data->mount_server.hostname);
++ kfree(data->nfs_server.export_path);
++ kfree(data->nfs_server.hostname);
++ kfree(data->fscache_uniq);
++ security_free_mnt_opts(&data->lsm_opts);
++ kfree(data);
++ }
++}
++
+ /*
+ * Sanity-check a server address provided by the mount command.
+ *
+@@ -2220,9 +2234,7 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
+ data = nfs_alloc_parsed_mount_data(NFS_DEFAULT_VERSION);
+ mntfh = nfs_alloc_fhandle();
+ if (data == NULL || mntfh == NULL)
+- goto out_free_fh;
+-
+- security_init_mnt_opts(&data->lsm_opts);
++ goto out;
+
+ /* Validate the mount data */
+ error = nfs_validate_mount_data(raw_data, data, mntfh, dev_name);
+@@ -2234,8 +2246,6 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
+ #ifdef CONFIG_NFS_V4
+ if (data->version == 4) {
+ mntroot = nfs4_try_mount(flags, dev_name, data);
+- kfree(data->client_address);
+- kfree(data->nfs_server.export_path);
+ goto out;
+ }
+ #endif /* CONFIG_NFS_V4 */
+@@ -2290,13 +2300,8 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
+ s->s_flags |= MS_ACTIVE;
+
+ out:
+- kfree(data->nfs_server.hostname);
+- kfree(data->mount_server.hostname);
+- kfree(data->fscache_uniq);
+- security_free_mnt_opts(&data->lsm_opts);
+-out_free_fh:
++ nfs_free_parsed_mount_data(data);
+ nfs_free_fhandle(mntfh);
+- kfree(data);
+ return mntroot;
+
+ out_err_nosb:
+@@ -2623,9 +2628,7 @@ nfs4_remote_mount(struct file_system_type *fs_type, int flags,
+
+ mntfh = nfs_alloc_fhandle();
+ if (data == NULL || mntfh == NULL)
+- goto out_free_fh;
+-
+- security_init_mnt_opts(&data->lsm_opts);
++ goto out;
+
+ /* Get a volume representation */
+ server = nfs4_create_server(data, mntfh);
+@@ -2677,13 +2680,10 @@ nfs4_remote_mount(struct file_system_type *fs_type, int flags,
+
+ s->s_flags |= MS_ACTIVE;
+
+- security_free_mnt_opts(&data->lsm_opts);
+ nfs_free_fhandle(mntfh);
+ return mntroot;
+
+ out:
+- security_free_mnt_opts(&data->lsm_opts);
+-out_free_fh:
+ nfs_free_fhandle(mntfh);
+ return ERR_PTR(error);
+
+@@ -2838,7 +2838,7 @@ static struct dentry *nfs4_mount(struct file_system_type *fs_type,
+
+ data = nfs_alloc_parsed_mount_data(4);
+ if (data == NULL)
+- goto out_free_data;
++ goto out;
+
+ /* Validate the mount data */
+ error = nfs4_validate_mount_data(raw_data, data, dev_name);
+@@ -2852,12 +2852,7 @@ static struct dentry *nfs4_mount(struct file_system_type *fs_type,
+ error = PTR_ERR(res);
+
+ out:
+- kfree(data->client_address);
+- kfree(data->nfs_server.export_path);
+- kfree(data->nfs_server.hostname);
+- kfree(data->fscache_uniq);
+-out_free_data:
+- kfree(data);
++ nfs_free_parsed_mount_data(data);
+ dprintk("<-- nfs4_mount() = %d%s\n", error,
+ error != 0 ? " [error]" : "");
+ return res;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch
new file mode 100644
index 0000000..86e599f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch
@@ -0,0 +1,35 @@
+From 1d30ef7aee8f11c3f90038ba7d57a82e0acbadb5 Mon Sep 17 00:00:00 2001
+From: Chase Douglas <chase.douglas at canonical.com>
+Date: Mon, 7 Nov 2011 11:08:05 -0800
+Subject: [PATCH 027/130] HID: bump maximum global item tag report size to 96
+ bytes
+
+commit e46e927b9b7e8d95526e69322855243882b7e1a3 upstream.
+
+This allows the latest N-Trig devices to function properly.
+
+BugLink: https://bugs.launchpad.net/bugs/724831
+
+Signed-off-by: Chase Douglas <chase.douglas at canonical.com>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/hid/hid-core.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index af35384..1473067 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -362,7 +362,7 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
+
+ case HID_GLOBAL_ITEM_TAG_REPORT_SIZE:
+ parser->global.report_size = item_udata(item);
+- if (parser->global.report_size > 32) {
++ if (parser->global.report_size > 96) {
+ dbg_hid("invalid report_size %d\n",
+ parser->global.report_size);
+ return -1;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch
new file mode 100644
index 0000000..c2132bd
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch
@@ -0,0 +1,33 @@
+From f60dd210e7edd913a760ca4c4f9df2c6341f5ef8 Mon Sep 17 00:00:00 2001
+From: David Herrmann <dh.herrmann at googlemail.com>
+Date: Wed, 7 Dec 2011 21:33:59 +0100
+Subject: [PATCH 028/130] HID: wiimote: Select INPUT_FF_MEMLESS
+
+commit ef6f41157f3864d9bf42671b2ed66062dcafb72e upstream.
+
+We depend on memless force-feedback support, therefore correctly select the
+related config options.
+
+Reported-by: Randy Dunlap <rdunlap at xenotime.net>
+Signed-off-by: David Herrmann <dh.herrmann at googlemail.com>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/hid/Kconfig | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 22a4a05..332c22a 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -620,6 +620,7 @@ config HID_WIIMOTE
+ depends on BT_HIDP
+ depends on LEDS_CLASS
+ select POWER_SUPPLY
++ select INPUT_FF_MEMLESS
+ ---help---
+ Support for the Nintendo Wii Remote bluetooth device.
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch
new file mode 100644
index 0000000..b6b6bd3
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch
@@ -0,0 +1,81 @@
+From e20542f497522671fa121d7612442a2557bfa2ff Mon Sep 17 00:00:00 2001
+From: Bhavesh Parekh <bparekh at nvidia.com>
+Date: Wed, 30 Nov 2011 17:43:42 +0530
+Subject: [PATCH 029/130] UBI: fix missing scrub when there is a bit-flip
+
+commit e801e128b2200c40a0ec236cf2330b2586b6e05a upstream.
+
+Under some cases, when scrubbing the PEB if we did not get the lock on
+the PEB it fails to scrub. Add that PEB again to the scrub list
+
+Artem: minor amendments.
+
+Signed-off-by: Bhavesh Parekh <bparekh at nvidia.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/mtd/ubi/eba.c | 6 ++++--
+ drivers/mtd/ubi/ubi.h | 2 ++
+ drivers/mtd/ubi/wl.c | 5 ++++-
+ 3 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index fb7f19b..cd26da8 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -1028,12 +1028,14 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
+ * 'ubi_wl_put_peb()' function on the @ubi->move_mutex. In turn, we are
+ * holding @ubi->move_mutex and go sleep on the LEB lock. So, if the
+ * LEB is already locked, we just do not move it and return
+- * %MOVE_CANCEL_RACE, which means that UBI will re-try, but later.
++ * %MOVE_RETRY. Note, we do not return %MOVE_CANCEL_RACE here because
++ * we do not know the reasons of the contention - it may be just a
++ * normal I/O on this LEB, so we want to re-try.
+ */
+ err = leb_write_trylock(ubi, vol_id, lnum);
+ if (err) {
+ dbg_wl("contention on LEB %d:%d, cancel", vol_id, lnum);
+- return MOVE_CANCEL_RACE;
++ return MOVE_RETRY;
+ }
+
+ /*
+diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
+index dc64c76..d51d75d 100644
+--- a/drivers/mtd/ubi/ubi.h
++++ b/drivers/mtd/ubi/ubi.h
+@@ -120,6 +120,7 @@ enum {
+ * PEB
+ * MOVE_CANCEL_BITFLIPS: canceled because a bit-flip was detected in the
+ * target PEB
++ * MOVE_RETRY: retry scrubbing the PEB
+ */
+ enum {
+ MOVE_CANCEL_RACE = 1,
+@@ -127,6 +128,7 @@ enum {
+ MOVE_TARGET_RD_ERR,
+ MOVE_TARGET_WR_ERR,
+ MOVE_CANCEL_BITFLIPS,
++ MOVE_RETRY,
+ };
+
+ /**
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 42c684c..277c429 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -795,7 +795,10 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ protect = 1;
+ goto out_not_moved;
+ }
+-
++ if (err == MOVE_RETRY) {
++ scrubbing = 1;
++ goto out_not_moved;
++ }
+ if (err == MOVE_CANCEL_BITFLIPS || err == MOVE_TARGET_WR_ERR ||
+ err == MOVE_TARGET_RD_ERR) {
+ /*
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch
new file mode 100644
index 0000000..223b41a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch
@@ -0,0 +1,52 @@
+From e9089302a9d795113e8efe652fe30331d75d1fd8 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
+Date: Thu, 5 Jan 2012 10:47:18 +0200
+Subject: [PATCH 030/130] UBI: fix use-after-free on error path
+
+commit e57e0d8e818512047fe379157c3f77f1b9fabffb upstream.
+
+When we fail to erase a PEB, we free the corresponding erase entry object,
+but then re-schedule this object if the error code was something like -EAGAIN.
+Obviously, it is a bug to use the object after we have freed it.
+
+Reported-by: Emese Revfy <re.emese at gmail.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/mtd/ubi/wl.c | 7 ++++---
+ 1 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 277c429..0696e36 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1052,7 +1052,6 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
+
+ ubi_err("failed to erase PEB %d, error %d", pnum, err);
+ kfree(wl_wrk);
+- kmem_cache_free(ubi_wl_entry_slab, e);
+
+ if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
+ err == -EBUSY) {
+@@ -1065,14 +1064,16 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
+ goto out_ro;
+ }
+ return err;
+- } else if (err != -EIO) {
++ }
++
++ kmem_cache_free(ubi_wl_entry_slab, e);
++ if (err != -EIO)
+ /*
+ * If this is not %-EIO, we have no idea what to do. Scheduling
+ * this physical eraseblock for erasure again would cause
+ * errors again and again. Well, lets switch to R/O mode.
+ */
+ goto out_ro;
+- }
+
+ /* It is %-EIO, the PEB went bad */
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch
new file mode 100644
index 0000000..c7947be
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch
@@ -0,0 +1,32 @@
+From 9d9e1e743ab7ca6f40a0f6f60f5ebda2a6b8b07b Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson at redhat.com>
+Date: Wed, 16 Nov 2011 09:24:16 -0700
+Subject: [PATCH 031/130] PCI: Fix PCI_EXP_TYPE_RC_EC value
+
+commit 1830ea91c20b06608f7cdb2455ce05ba834b3214 upstream.
+
+Spec shows this as 1010b = 0xa
+
+Signed-off-by: Alex Williamson <alex.williamson at redhat.com>
+Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ include/linux/pci_regs.h | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/include/linux/pci_regs.h b/include/linux/pci_regs.h
+index b5d9657..411c412 100644
+--- a/include/linux/pci_regs.h
++++ b/include/linux/pci_regs.h
+@@ -392,7 +392,7 @@
+ #define PCI_EXP_TYPE_DOWNSTREAM 0x6 /* Downstream Port */
+ #define PCI_EXP_TYPE_PCI_BRIDGE 0x7 /* PCI/PCI-X Bridge */
+ #define PCI_EXP_TYPE_RC_END 0x9 /* Root Complex Integrated Endpoint */
+-#define PCI_EXP_TYPE_RC_EC 0x10 /* Root Complex Event Collector */
++#define PCI_EXP_TYPE_RC_EC 0xa /* Root Complex Event Collector */
+ #define PCI_EXP_FLAGS_SLOT 0x0100 /* Slot implemented */
+ #define PCI_EXP_FLAGS_IRQ 0x3e00 /* Interrupt message number */
+ #define PCI_EXP_DEVCAP 4 /* Device capabilities */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch
new file mode 100644
index 0000000..f8c36b7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch
@@ -0,0 +1,53 @@
+From 63365de9ebb1b944d0306668f726ad62a08a0371 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm at xmission.com>
+Date: Mon, 17 Oct 2011 11:46:06 -0700
+Subject: [PATCH 032/130] PCI: msi: Disable msi interrupts when we initialize
+ a pci device
+
+commit a776c491ca5e38c26d9f66923ff574d041e747f4 upstream.
+
+I traced a nasty kexec on panic boot failure to the fact that we had
+screaming msi interrupts and we were not disabling the msi messages at
+kernel startup. The booting kernel had not enabled those interupts so
+was not prepared to handle them.
+
+I can see no reason why we would ever want to leave the msi interrupts
+enabled at boot if something else has enabled those interrupts. The pci
+spec specifies that msi interrupts should be off by default. Drivers
+are expected to enable the msi interrupts if they want to use them. Our
+interrupt handling code reprograms the interrupt handlers at boot and
+will not be be able to do anything useful with an unexpected interrupt.
+
+This patch applies cleanly all of the way back to 2.6.32 where I noticed
+the problem.
+
+Signed-off-by: Eric W. Biederman <ebiederm at xmission.com>
+Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/pci/msi.c | 10 ++++++++++
+ 1 files changed, 10 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index 0e6d04d..e3efb43 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -870,5 +870,15 @@ EXPORT_SYMBOL(pci_msi_enabled);
+
+ void pci_msi_init_pci_dev(struct pci_dev *dev)
+ {
++ int pos;
+ INIT_LIST_HEAD(&dev->msi_list);
++
++ /* Disable the msi hardware to avoid screaming interrupts
++ * during boot. This is the power on reset default so
++ * usually this should be a noop.
++ */
++ pos = pci_find_capability(dev, PCI_CAP_ID_MSI);
++ if (pos)
++ msi_set_enable(dev, pos, 0);
++ msix_set_enable(dev, 0);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch
new file mode 100644
index 0000000..8149969
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch
@@ -0,0 +1,65 @@
+From 5040b50e89f45f17231e6d2ad101596bedc5e431 Mon Sep 17 00:00:00 2001
+From: Gary Hade <garyhade at us.ibm.com>
+Date: Mon, 14 Nov 2011 15:42:16 -0800
+Subject: [PATCH 033/130] x86/PCI: Ignore CPU non-addressable _CRS reserved
+ memory resources
+
+commit ae5cd86455381282ece162966183d3f208c6fad7 upstream.
+
+This assures that a _CRS reserved host bridge window or window region is
+not used if it is not addressable by the CPU. The new code either trims
+the window to exclude the non-addressable portion or totally ignores the
+window if the entire window is non-addressable.
+
+The current code has been shown to be problematic with 32-bit non-PAE
+kernels on systems where _CRS reserves resources above 4GB.
+
+Signed-off-by: Gary Hade <garyhade at us.ibm.com>
+Reviewed-by: Bjorn Helgaas <bhelgaas at google.com>
+Cc: Thomas Renninger <trenn at novell.com>
+Cc: linux-kernel at vger.kernel.org
+Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/x86/pci/acpi.c | 18 ++++++++++++++++--
+ 1 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
+index 404f21a..f8348ab 100644
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -149,7 +149,7 @@ setup_resource(struct acpi_resource *acpi_res, void *data)
+ struct acpi_resource_address64 addr;
+ acpi_status status;
+ unsigned long flags;
+- u64 start, end;
++ u64 start, orig_end, end;
+
+ status = resource_to_addr(acpi_res, &addr);
+ if (!ACPI_SUCCESS(status))
+@@ -165,7 +165,21 @@ setup_resource(struct acpi_resource *acpi_res, void *data)
+ return AE_OK;
+
+ start = addr.minimum + addr.translation_offset;
+- end = addr.maximum + addr.translation_offset;
++ orig_end = end = addr.maximum + addr.translation_offset;
++
++ /* Exclude non-addressable range or non-addressable portion of range */
++ end = min(end, (u64)iomem_resource.end);
++ if (end <= start) {
++ dev_info(&info->bridge->dev,
++ "host bridge window [%#llx-%#llx] "
++ "(ignored, not CPU addressable)\n", start, orig_end);
++ return AE_OK;
++ } else if (orig_end != end) {
++ dev_info(&info->bridge->dev,
++ "host bridge window [%#llx-%#llx] "
++ "([%#llx-%#llx] ignored, not CPU addressable)\n",
++ start, orig_end, end + 1, orig_end);
++ }
+
+ res = &info->res[info->res_num];
+ res->name = info->name;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch
new file mode 100644
index 0000000..ff16fb4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch
@@ -0,0 +1,160 @@
+From c6f611b87ae8cf8a5bd1fc916b4b63e0fd48d6f3 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas at google.com>
+Date: Thu, 5 Jan 2012 14:27:19 -0700
+Subject: [PATCH 034/130] x86/PCI: amd: factor out MMCONFIG discovery
+
+commit 24d25dbfa63c376323096660bfa9ad45a08870ce upstream.
+
+This factors out the AMD native MMCONFIG discovery so we can use it
+outside amd_bus.c.
+
+amd_bus.c reads AMD MSRs so it can remove the MMCONFIG area from the
+PCI resources. We may also need the MMCONFIG information to work
+around BIOS defects in the ACPI MCFG table.
+
+Cc: Borislav Petkov <borislav.petkov at amd.com>
+Cc: Yinghai Lu <yinghai at kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas at google.com>
+Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/x86/include/asm/amd_nb.h | 2 +
+ arch/x86/kernel/amd_nb.c | 31 ++++++++++++++++++++++++++++++
+ arch/x86/pci/amd_bus.c | 42 ++++++++++------------------------------
+ 3 files changed, 44 insertions(+), 31 deletions(-)
+
+diff --git a/arch/x86/include/asm/amd_nb.h b/arch/x86/include/asm/amd_nb.h
+index 8e41071..49ad773 100644
+--- a/arch/x86/include/asm/amd_nb.h
++++ b/arch/x86/include/asm/amd_nb.h
+@@ -1,6 +1,7 @@
+ #ifndef _ASM_X86_AMD_NB_H
+ #define _ASM_X86_AMD_NB_H
+
++#include <linux/ioport.h>
+ #include <linux/pci.h>
+
+ struct amd_nb_bus_dev_range {
+@@ -13,6 +14,7 @@ extern const struct pci_device_id amd_nb_misc_ids[];
+ extern const struct amd_nb_bus_dev_range amd_nb_bus_dev_ranges[];
+
+ extern bool early_is_amd_nb(u32 value);
++extern struct resource *amd_get_mmconfig_range(struct resource *res);
+ extern int amd_cache_northbridges(void);
+ extern void amd_flush_garts(void);
+ extern int amd_numa_init(void);
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index 4c39baa..bae1efe 100644
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -119,6 +119,37 @@ bool __init early_is_amd_nb(u32 device)
+ return false;
+ }
+
++struct resource *amd_get_mmconfig_range(struct resource *res)
++{
++ u32 address;
++ u64 base, msr;
++ unsigned segn_busn_bits;
++
++ if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
++ return NULL;
++
++ /* assume all cpus from fam10h have mmconfig */
++ if (boot_cpu_data.x86 < 0x10)
++ return NULL;
++
++ address = MSR_FAM10H_MMIO_CONF_BASE;
++ rdmsrl(address, msr);
++
++ /* mmconfig is not enabled */
++ if (!(msr & FAM10H_MMIO_CONF_ENABLE))
++ return NULL;
++
++ base = msr & (FAM10H_MMIO_CONF_BASE_MASK<<FAM10H_MMIO_CONF_BASE_SHIFT);
++
++ segn_busn_bits = (msr >> FAM10H_MMIO_CONF_BUSRANGE_SHIFT) &
++ FAM10H_MMIO_CONF_BUSRANGE_MASK;
++
++ res->flags = IORESOURCE_MEM;
++ res->start = base;
++ res->end = base + (1ULL<<(segn_busn_bits + 20)) - 1;
++ return res;
++}
++
+ int amd_get_subcaches(int cpu)
+ {
+ struct pci_dev *link = node_to_amd_nb(amd_get_nb_id(cpu))->link;
+diff --git a/arch/x86/pci/amd_bus.c b/arch/x86/pci/amd_bus.c
+index 026e493..385a940 100644
+--- a/arch/x86/pci/amd_bus.c
++++ b/arch/x86/pci/amd_bus.c
+@@ -30,34 +30,6 @@ static struct pci_hostbridge_probe pci_probes[] __initdata = {
+ { 0, 0x18, PCI_VENDOR_ID_AMD, 0x1300 },
+ };
+
+-static u64 __initdata fam10h_mmconf_start;
+-static u64 __initdata fam10h_mmconf_end;
+-static void __init get_pci_mmcfg_amd_fam10h_range(void)
+-{
+- u32 address;
+- u64 base, msr;
+- unsigned segn_busn_bits;
+-
+- /* assume all cpus from fam10h have mmconf */
+- if (boot_cpu_data.x86 < 0x10)
+- return;
+-
+- address = MSR_FAM10H_MMIO_CONF_BASE;
+- rdmsrl(address, msr);
+-
+- /* mmconfig is not enable */
+- if (!(msr & FAM10H_MMIO_CONF_ENABLE))
+- return;
+-
+- base = msr & (FAM10H_MMIO_CONF_BASE_MASK<<FAM10H_MMIO_CONF_BASE_SHIFT);
+-
+- segn_busn_bits = (msr >> FAM10H_MMIO_CONF_BUSRANGE_SHIFT) &
+- FAM10H_MMIO_CONF_BUSRANGE_MASK;
+-
+- fam10h_mmconf_start = base;
+- fam10h_mmconf_end = base + (1ULL<<(segn_busn_bits + 20)) - 1;
+-}
+-
+ #define RANGE_NUM 16
+
+ /**
+@@ -85,6 +57,9 @@ static int __init early_fill_mp_bus_info(void)
+ u64 val;
+ u32 address;
+ bool found;
++ struct resource fam10h_mmconf_res, *fam10h_mmconf;
++ u64 fam10h_mmconf_start;
++ u64 fam10h_mmconf_end;
+
+ if (!early_pci_allowed())
+ return -1;
+@@ -211,12 +186,17 @@ static int __init early_fill_mp_bus_info(void)
+ subtract_range(range, RANGE_NUM, 0, end);
+
+ /* get mmconfig */
+- get_pci_mmcfg_amd_fam10h_range();
++ fam10h_mmconf = amd_get_mmconfig_range(&fam10h_mmconf_res);
+ /* need to take out mmconf range */
+- if (fam10h_mmconf_end) {
+- printk(KERN_DEBUG "Fam 10h mmconf [%llx, %llx]\n", fam10h_mmconf_start, fam10h_mmconf_end);
++ if (fam10h_mmconf) {
++ printk(KERN_DEBUG "Fam 10h mmconf %pR\n", fam10h_mmconf);
++ fam10h_mmconf_start = fam10h_mmconf->start;
++ fam10h_mmconf_end = fam10h_mmconf->end;
+ subtract_range(range, RANGE_NUM, fam10h_mmconf_start,
+ fam10h_mmconf_end + 1);
++ } else {
++ fam10h_mmconf_start = 0;
++ fam10h_mmconf_end = 0;
+ }
+
+ /* mmio resource */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch
new file mode 100644
index 0000000..7967028
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch
@@ -0,0 +1,37 @@
+From a67bd4738894215f045d9d1aed024277cb5ae99e Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas at google.com>
+Date: Thu, 12 Jan 2012 08:01:40 -0700
+Subject: [PATCH 035/130] x86/PCI: build amd_bus.o only when CONFIG_AMD_NB=y
+
+commit 5cf9a4e69c1ff0ccdd1d2b7404f95c0531355274 upstream.
+
+We only need amd_bus.o for AMD systems with PCI. arch/x86/pci/Makefile
+already depends on CONFIG_PCI=y, so this patch just adds the dependency
+on CONFIG_AMD_NB.
+
+Cc: Yinghai Lu <yinghai at kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas at google.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/x86/pci/Makefile | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/arch/x86/pci/Makefile b/arch/x86/pci/Makefile
+index 6b8759f..d24d3da 100644
+--- a/arch/x86/pci/Makefile
++++ b/arch/x86/pci/Makefile
+@@ -18,8 +18,9 @@ obj-$(CONFIG_X86_NUMAQ) += numaq_32.o
+ obj-$(CONFIG_X86_MRST) += mrst.o
+
+ obj-y += common.o early.o
+-obj-y += amd_bus.o bus_numa.o
++obj-y += bus_numa.o
+
++obj-$(CONFIG_AMD_NB) += amd_bus.o
+ obj-$(CONFIG_PCI_CNB20LE_QUIRK) += broadcom_bus.o
+
+ ifeq ($(CONFIG_PCI_DEBUG),y)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch
new file mode 100644
index 0000000..c9647f7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch
@@ -0,0 +1,56 @@
+From c96f90776325ceb9fcda278cba8bc85e287d8d15 Mon Sep 17 00:00:00 2001
+From: "nagalakshmi.nandigama at lsi.com" <nagalakshmi.nandigama at lsi.com>
+Date: Thu, 1 Dec 2011 07:52:56 +0530
+Subject: [PATCH 036/130] SCSI: mpt2sas: Release spinlock for the raid device
+ list before blocking it
+
+commit 30c43282f3d347f47f9e05199d2b14f56f3f2837 upstream.
+
+Added code to release the spinlock that is used to protect the
+raid device list before calling a function that can block. The
+blocking was causing a reschedule, and subsequently it is tried
+to acquire the same lock, resulting in a panic (NMI Watchdog
+detecting a CPU lockup).
+
+Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama at lsi.com>
+Signed-off-by: James Bottomley <JBottomley at Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 7 ++++---
+ 1 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+index d570573..3a4f666 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -6714,6 +6714,7 @@ _scsih_mark_responding_raid_device(struct MPT2SAS_ADAPTER *ioc, u64 wwid,
+ } else
+ sas_target_priv_data = NULL;
+ raid_device->responding = 1;
++ spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
+ starget_printk(KERN_INFO, raid_device->starget,
+ "handle(0x%04x), wwid(0x%016llx)\n", handle,
+ (unsigned long long)raid_device->wwid);
+@@ -6724,16 +6725,16 @@ _scsih_mark_responding_raid_device(struct MPT2SAS_ADAPTER *ioc, u64 wwid,
+ */
+ _scsih_init_warpdrive_properties(ioc, raid_device);
+ if (raid_device->handle == handle)
+- goto out;
++ return;
+ printk(KERN_INFO "\thandle changed from(0x%04x)!!!\n",
+ raid_device->handle);
+ raid_device->handle = handle;
+ if (sas_target_priv_data)
+ sas_target_priv_data->handle = handle;
+- goto out;
++ return;
+ }
+ }
+- out:
++
+ spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch
new file mode 100644
index 0000000..36d2703
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch
@@ -0,0 +1,177 @@
+From fe5907648567469336c06cf215932adac76a8e11 Mon Sep 17 00:00:00 2001
+From: "nagalakshmi.nandigama at lsi.com" <nagalakshmi.nandigama at lsi.com>
+Date: Thu, 1 Dec 2011 07:53:08 +0530
+Subject: [PATCH 037/130] SCSI: mpt2sas : Fix for memory allocation error for
+ large host credits
+
+commit aff132d95ffe14eca96cab90597cdd010b457af7 upstream.
+
+The amount of memory required for tracking chain buffers is rather
+large, and when the host credit count is big, memory allocation
+failure occurs inside __get_free_pages.
+
+The fix is to limit the number of chains to 100,000. In addition,
+the number of host credits is limited to 30,000 IOs. However this
+limitation can be overridden this using the command line option
+max_queue_depth. The algorithm for calculating the
+reply_post_queue_depth is changed so that it is equal to
+(reply_free_queue_depth + 16), previously it was (reply_free_queue_depth * 2).
+
+Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama at lsi.com>
+Signed-off-by: James Bottomley <JBottomley at Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c | 83 +++++++++++-----------------------
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 4 +-
+ 2 files changed, 29 insertions(+), 58 deletions(-)
+
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
+index beda04a..0794c72 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -65,6 +65,8 @@ static MPT_CALLBACK mpt_callbacks[MPT_MAX_CALLBACKS];
+
+ #define FAULT_POLLING_INTERVAL 1000 /* in milliseconds */
+
++#define MAX_HBA_QUEUE_DEPTH 30000
++#define MAX_CHAIN_DEPTH 100000
+ static int max_queue_depth = -1;
+ module_param(max_queue_depth, int, 0);
+ MODULE_PARM_DESC(max_queue_depth, " max controller queue depth ");
+@@ -2311,8 +2313,6 @@ _base_release_memory_pools(struct MPT2SAS_ADAPTER *ioc)
+ }
+ if (ioc->chain_dma_pool)
+ pci_pool_destroy(ioc->chain_dma_pool);
+- }
+- if (ioc->chain_lookup) {
+ free_pages((ulong)ioc->chain_lookup, ioc->chain_pages);
+ ioc->chain_lookup = NULL;
+ }
+@@ -2330,9 +2330,7 @@ static int
+ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ {
+ struct mpt2sas_facts *facts;
+- u32 queue_size, queue_diff;
+ u16 max_sge_elements;
+- u16 num_of_reply_frames;
+ u16 chains_needed_per_io;
+ u32 sz, total_sz, reply_post_free_sz;
+ u32 retry_sz;
+@@ -2359,7 +2357,8 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ max_request_credit = (max_queue_depth < facts->RequestCredit)
+ ? max_queue_depth : facts->RequestCredit;
+ else
+- max_request_credit = facts->RequestCredit;
++ max_request_credit = min_t(u16, facts->RequestCredit,
++ MAX_HBA_QUEUE_DEPTH);
+
+ ioc->hba_queue_depth = max_request_credit;
+ ioc->hi_priority_depth = facts->HighPriorityCredit;
+@@ -2400,50 +2399,25 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ }
+ ioc->chains_needed_per_io = chains_needed_per_io;
+
+- /* reply free queue sizing - taking into account for events */
+- num_of_reply_frames = ioc->hba_queue_depth + 32;
+-
+- /* number of replies frames can't be a multiple of 16 */
+- /* decrease number of reply frames by 1 */
+- if (!(num_of_reply_frames % 16))
+- num_of_reply_frames--;
+-
+- /* calculate number of reply free queue entries
+- * (must be multiple of 16)
+- */
+-
+- /* (we know reply_free_queue_depth is not a multiple of 16) */
+- queue_size = num_of_reply_frames;
+- queue_size += 16 - (queue_size % 16);
+- ioc->reply_free_queue_depth = queue_size;
+-
+- /* reply descriptor post queue sizing */
+- /* this size should be the number of request frames + number of reply
+- * frames
+- */
+-
+- queue_size = ioc->hba_queue_depth + num_of_reply_frames + 1;
+- /* round up to 16 byte boundary */
+- if (queue_size % 16)
+- queue_size += 16 - (queue_size % 16);
+-
+- /* check against IOC maximum reply post queue depth */
+- if (queue_size > facts->MaxReplyDescriptorPostQueueDepth) {
+- queue_diff = queue_size -
+- facts->MaxReplyDescriptorPostQueueDepth;
++ /* reply free queue sizing - taking into account for 64 FW events */
++ ioc->reply_free_queue_depth = ioc->hba_queue_depth + 64;
+
+- /* round queue_diff up to multiple of 16 */
+- if (queue_diff % 16)
+- queue_diff += 16 - (queue_diff % 16);
+-
+- /* adjust hba_queue_depth, reply_free_queue_depth,
+- * and queue_size
+- */
+- ioc->hba_queue_depth -= (queue_diff / 2);
+- ioc->reply_free_queue_depth -= (queue_diff / 2);
+- queue_size = facts->MaxReplyDescriptorPostQueueDepth;
++ /* align the reply post queue on the next 16 count boundary */
++ if (!ioc->reply_free_queue_depth % 16)
++ ioc->reply_post_queue_depth = ioc->reply_free_queue_depth + 16;
++ else
++ ioc->reply_post_queue_depth = ioc->reply_free_queue_depth +
++ 32 - (ioc->reply_free_queue_depth % 16);
++ if (ioc->reply_post_queue_depth >
++ facts->MaxReplyDescriptorPostQueueDepth) {
++ ioc->reply_post_queue_depth = min_t(u16,
++ (facts->MaxReplyDescriptorPostQueueDepth -
++ (facts->MaxReplyDescriptorPostQueueDepth % 16)),
++ (ioc->hba_queue_depth - (ioc->hba_queue_depth % 16)));
++ ioc->reply_free_queue_depth = ioc->reply_post_queue_depth - 16;
++ ioc->hba_queue_depth = ioc->reply_free_queue_depth - 64;
+ }
+- ioc->reply_post_queue_depth = queue_size;
++
+
+ dinitprintk(ioc, printk(MPT2SAS_INFO_FMT "scatter gather: "
+ "sge_in_main_msg(%d), sge_per_chain(%d), sge_per_io(%d), "
+@@ -2529,15 +2503,12 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ "depth(%d)\n", ioc->name, ioc->request,
+ ioc->scsiio_depth));
+
+- /* loop till the allocation succeeds */
+- do {
+- sz = ioc->chain_depth * sizeof(struct chain_tracker);
+- ioc->chain_pages = get_order(sz);
+- ioc->chain_lookup = (struct chain_tracker *)__get_free_pages(
+- GFP_KERNEL, ioc->chain_pages);
+- if (ioc->chain_lookup == NULL)
+- ioc->chain_depth -= 100;
+- } while (ioc->chain_lookup == NULL);
++ ioc->chain_depth = min_t(u32, ioc->chain_depth, MAX_CHAIN_DEPTH);
++ sz = ioc->chain_depth * sizeof(struct chain_tracker);
++ ioc->chain_pages = get_order(sz);
++
++ ioc->chain_lookup = (struct chain_tracker *)__get_free_pages(
++ GFP_KERNEL, ioc->chain_pages);
+ ioc->chain_dma_pool = pci_pool_create("chain pool", ioc->pdev,
+ ioc->request_sz, 16, 0);
+ if (!ioc->chain_dma_pool) {
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+index 3a4f666..9bc6fb2 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -1007,8 +1007,8 @@ _scsih_get_chain_buffer_tracker(struct MPT2SAS_ADAPTER *ioc, u16 smid)
+ spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+ if (list_empty(&ioc->free_chain_list)) {
+ spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
+- printk(MPT2SAS_WARN_FMT "chain buffers not available\n",
+- ioc->name);
++ dfailprintk(ioc, printk(MPT2SAS_WARN_FMT "chain buffers not "
++ "available\n", ioc->name));
+ return NULL;
+ }
+ chain_req = list_entry(ioc->free_chain_list.next,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch
new file mode 100644
index 0000000..fcf777c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch
@@ -0,0 +1,78 @@
+From fbefcde91f27d0a80ebe70c0b3359b2e6c463cc0 Mon Sep 17 00:00:00 2001
+From: Ian Campbell <Ian.Campbell at citrix.com>
+Date: Wed, 4 Jan 2012 09:34:49 +0000
+Subject: [PATCH 038/130] xen/xenbus: Reject replies with payload >
+ XENSTORE_PAYLOAD_MAX.
+
+commit 9e7860cee18241633eddb36a4c34c7b61d8cecbc upstream.
+
+Haogang Chen found out that:
+
+ There is a potential integer overflow in process_msg() that could result
+ in cross-domain attack.
+
+ body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH);
+
+ When a malicious guest passes 0xffffffff in msg->hdr.len, the subsequent
+ call to xb_read() would write to a zero-length buffer.
+
+ The other end of this connection is always the xenstore backend daemon
+ so there is no guest (malicious or otherwise) which can do this. The
+ xenstore daemon is a trusted component in the system.
+
+ However this seem like a reasonable robustness improvement so we should
+ have it.
+
+And Ian when read the API docs found that:
+ The payload length (len field of the header) is limited to 4096
+ (XENSTORE_PAYLOAD_MAX) in both directions. If a client exceeds the
+ limit, its xenstored connection will be immediately killed by
+ xenstored, which is usually catastrophic from the client's point of
+ view. Clients (particularly domains, which cannot just reconnect)
+ should avoid this.
+
+so this patch checks against that instead.
+
+This also avoids a potential integer overflow pointed out by Haogang Chen.
+
+Signed-off-by: Ian Campbell <ian.campbell at citrix.com>
+Cc: Haogang Chen <haogangchen at gmail.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk at oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/xen/xenbus/xenbus_xs.c | 6 ++++++
+ include/xen/interface/io/xs_wire.h | 3 +++
+ 2 files changed, 9 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
+index ede860f..a580b17 100644
+--- a/drivers/xen/xenbus/xenbus_xs.c
++++ b/drivers/xen/xenbus/xenbus_xs.c
+@@ -801,6 +801,12 @@ static int process_msg(void)
+ goto out;
+ }
+
++ if (msg->hdr.len > XENSTORE_PAYLOAD_MAX) {
++ kfree(msg);
++ err = -EINVAL;
++ goto out;
++ }
++
+ body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH);
+ if (body == NULL) {
+ kfree(msg);
+diff --git a/include/xen/interface/io/xs_wire.h b/include/xen/interface/io/xs_wire.h
+index f6f07aa..7cdfca2 100644
+--- a/include/xen/interface/io/xs_wire.h
++++ b/include/xen/interface/io/xs_wire.h
+@@ -87,4 +87,7 @@ struct xenstore_domain_interface {
+ XENSTORE_RING_IDX rsp_cons, rsp_prod;
+ };
+
++/* Violating this is very bad. See docs/misc/xenstore.txt. */
++#define XENSTORE_PAYLOAD_MAX 4096
++
+ #endif /* _XS_WIRE_H */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch
new file mode 100644
index 0000000..99b3f12
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch
@@ -0,0 +1,56 @@
+From b08c639fb415855bbca91bff089b8bada0f4b044 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb at suse.de>
+Date: Mon, 9 Jan 2012 01:41:51 +1100
+Subject: [PATCH 039/130] md/raid1: perform bad-block tests for WriteMostly
+ devices too.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 307729c8bc5b5a41361af8af95906eee7552acb1 upstream.
+
+We normally try to avoid reading from write-mostly devices, but when
+we do we really have to check for bad blocks and be sure not to
+try reading them.
+
+With the current code, best_good_sectors might not get set and that
+causes zero-length read requests to be send down which is very
+confusing.
+
+This bug was introduced in commit d2eb35acfdccbe2 and so the patch
+is suitable for 3.1.x and 3.2.x
+
+Reported-and-tested-by: Michał Mirosław <mirq-linux at rere.qmqm.pl>
+Reported-and-tested-by: Art -kwaak- van Breemen <ard at telegraafnet.nl>
+Signed-off-by: NeilBrown <neilb at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/md/raid1.c | 11 ++++++++++-
+ 1 files changed, 10 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index ede2461..7d9e071 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -525,8 +525,17 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ if (test_bit(WriteMostly, &rdev->flags)) {
+ /* Don't balance among write-mostly, just
+ * use the first as a last resort */
+- if (best_disk < 0)
++ if (best_disk < 0) {
++ if (is_badblock(rdev, this_sector, sectors,
++ &first_bad, &bad_sectors)) {
++ if (first_bad < this_sector)
++ /* Cannot use this */
++ continue;
++ best_good_sectors = first_bad - this_sector;
++ } else
++ best_good_sectors = sectors;
+ best_disk = disk;
++ }
+ continue;
+ }
+ /* This is a reasonable device to use. It might
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0040-ima-free-duplicate-measurement-memory.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0040-ima-free-duplicate-measurement-memory.patch
new file mode 100644
index 0000000..40457fa
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0040-ima-free-duplicate-measurement-memory.patch
@@ -0,0 +1,52 @@
+From 52e6ae83dbb962de0a33d2cd1b610cdfd0a09b0d Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu at polito.it>
+Date: Mon, 19 Dec 2011 15:57:27 +0100
+Subject: [PATCH 040/130] ima: free duplicate measurement memory
+
+commit 45fae7493970d7c45626ccd96d4a74f5f1eea5a9 upstream.
+
+Info about new measurements are cached in the iint for performance. When
+the inode is flushed from cache, the associated iint is flushed as well.
+Subsequent access to the inode will cause the inode to be re-measured and
+will attempt to add a duplicate entry to the measurement list.
+
+This patch frees the duplicate measurement memory, fixing a memory leak.
+
+Signed-off-by: Roberto Sassu <roberto.sassu at polito.it>
+Signed-off-by: Mimi Zohar <zohar at us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ security/integrity/ima/ima_api.c | 4 ++--
+ security/integrity/ima/ima_queue.c | 1 +
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
+index 0d50df0..88a2788 100644
+--- a/security/integrity/ima/ima_api.c
++++ b/security/integrity/ima/ima_api.c
+@@ -178,8 +178,8 @@ void ima_store_measurement(struct integrity_iint_cache *iint,
+ strncpy(entry->template.file_name, filename, IMA_EVENT_NAME_LEN_MAX);
+
+ result = ima_store_template(entry, violation, inode);
+- if (!result)
++ if (!result || result == -EEXIST)
+ iint->flags |= IMA_MEASURED;
+- else
++ if (result < 0)
+ kfree(entry);
+ }
+diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
+index 8e28f04..e1a5062 100644
+--- a/security/integrity/ima/ima_queue.c
++++ b/security/integrity/ima/ima_queue.c
+@@ -114,6 +114,7 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
+ memcpy(digest, entry->digest, sizeof digest);
+ if (ima_lookup_digest_entry(digest)) {
+ audit_cause = "hash_exists";
++ result = -EEXIST;
+ goto out;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0041-ima-fix-invalid-memory-reference.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0041-ima-fix-invalid-memory-reference.patch
new file mode 100644
index 0000000..66139b9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0041-ima-fix-invalid-memory-reference.patch
@@ -0,0 +1,68 @@
+From b5be4dc54cfe7c5bb0ce387519c2019d9915435e Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu at polito.it>
+Date: Mon, 19 Dec 2011 15:57:28 +0100
+Subject: [PATCH 041/130] ima: fix invalid memory reference
+
+commit 7b7e5916aa2f46e57f8bd8cb89c34620ebfda5da upstream.
+
+Don't free a valid measurement entry on TPM PCR extend failure.
+
+Signed-off-by: Roberto Sassu <roberto.sassu at polito.it>
+Signed-off-by: Mimi Zohar <zohar at us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ security/integrity/ima/ima_queue.c | 16 +++++++++++-----
+ 1 files changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
+index e1a5062..55a6271 100644
+--- a/security/integrity/ima/ima_queue.c
++++ b/security/integrity/ima/ima_queue.c
+@@ -23,6 +23,8 @@
+ #include <linux/slab.h>
+ #include "ima.h"
+
++#define AUDIT_CAUSE_LEN_MAX 32
++
+ LIST_HEAD(ima_measurements); /* list of all measurements */
+
+ /* key: inode (before secure-hashing a file) */
+@@ -94,7 +96,8 @@ static int ima_pcr_extend(const u8 *hash)
+
+ result = tpm_pcr_extend(TPM_ANY_NUM, CONFIG_IMA_MEASURE_PCR_IDX, hash);
+ if (result != 0)
+- pr_err("IMA: Error Communicating to TPM chip\n");
++ pr_err("IMA: Error Communicating to TPM chip, result: %d\n",
++ result);
+ return result;
+ }
+
+@@ -106,8 +109,9 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
+ {
+ u8 digest[IMA_DIGEST_SIZE];
+ const char *audit_cause = "hash_added";
++ char tpm_audit_cause[AUDIT_CAUSE_LEN_MAX];
+ int audit_info = 1;
+- int result = 0;
++ int result = 0, tpmresult = 0;
+
+ mutex_lock(&ima_extend_list_mutex);
+ if (!violation) {
+@@ -129,9 +133,11 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
+ if (violation) /* invalidate pcr */
+ memset(digest, 0xff, sizeof digest);
+
+- result = ima_pcr_extend(digest);
+- if (result != 0) {
+- audit_cause = "TPM error";
++ tpmresult = ima_pcr_extend(digest);
++ if (tpmresult != 0) {
++ snprintf(tpm_audit_cause, AUDIT_CAUSE_LEN_MAX, "TPM_error(%d)",
++ tpmresult);
++ audit_cause = tpm_audit_cause;
+ audit_info = 0;
+ }
+ out:
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch
new file mode 100644
index 0000000..87a49ae
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch
@@ -0,0 +1,47 @@
+From c25b1c3dffca9191001f97e64c9be8e1ff861c0a Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet at gmail.com>
+Date: Tue, 13 Dec 2011 04:57:06 +0100
+Subject: [PATCH 042/130] slub: fix a possible memleak in __slab_alloc()
+
+commit 73736e0387ba0e6d2b703407b4d26168d31516a7 upstream.
+
+Zhihua Che reported a possible memleak in slub allocator on
+CONFIG_PREEMPT=y builds.
+
+It is possible current thread migrates right before disabling irqs in
+__slab_alloc(). We must check again c->freelist, and perform a normal
+allocation instead of scratching c->freelist.
+
+Many thanks to Zhihua Che for spotting this bug, introduced in 2.6.39
+
+V2: Its also possible an IRQ freed one (or several) object(s) and
+populated c->freelist, so its not a CONFIG_PREEMPT only problem.
+
+Reported-by: Zhihua Che <zhihua.che at gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
+Acked-by: Christoph Lameter <cl at linux.com>
+Signed-off-by: Pekka Enberg <penberg at kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ mm/slub.c | 5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/mm/slub.c b/mm/slub.c
+index ed3334d..1a919f0 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -2166,6 +2166,11 @@ redo:
+ goto new_slab;
+ }
+
++ /* must check again c->freelist in case of cpu migration or IRQ */
++ object = c->freelist;
++ if (object)
++ goto load_freelist;
++
+ stat(s, ALLOC_SLOWPATH);
+
+ do {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch
new file mode 100644
index 0000000..d539c66
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch
@@ -0,0 +1,101 @@
+From c450bfbe6e0d5b7feb3c7570c2f22c4a8da7ca44 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas at google.com>
+Date: Thu, 5 Jan 2012 14:27:24 -0700
+Subject: [PATCH 043/130] PNP: work around Dell 1536/1546 BIOS MMCONFIG bug
+ that breaks USB
+
+commit eb31aae8cb5eb54e234ed2d857ddac868195d911 upstream.
+
+Some Dell BIOSes have MCFG tables that don't report the entire
+MMCONFIG area claimed by the chipset. If we move PCI devices into
+that claimed-but-unreported area, they don't work.
+
+This quirk reads the AMD MMCONFIG MSRs and adds PNP0C01 resources as
+needed to cover the entire area.
+
+Example problem scenario:
+
+ BIOS-e820: 00000000cfec5400 - 00000000d4000000 (reserved)
+ Fam 10h mmconf [d0000000, dfffffff]
+ PCI: MMCONFIG for domain 0000 [bus 00-3f] at [mem 0xd0000000-0xd3ffffff] (base 0xd0000000)
+ pnp 00:0c: [mem 0xd0000000-0xd3ffffff]
+ pci 0000:00:12.0: reg 10: [mem 0xffb00000-0xffb00fff]
+ pci 0000:00:12.0: no compatible bridge window for [mem 0xffb00000-0xffb00fff]
+ pci 0000:00:12.0: BAR 0: assigned [mem 0xd4000000-0xd40000ff]
+
+Reported-by: Lisa Salimbas <lisa.salimbas at canonical.com>
+Reported-by: <thuban at singularity.fr>
+Tested-by: dann frazier <dann.frazier at canonical.com>
+References: https://bugzilla.kernel.org/show_bug.cgi?id=31602
+References: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/647043
+References: https://bugzilla.redhat.com/show_bug.cgi?id=770308
+Signed-off-by: Bjorn Helgaas <bhelgaas at google.com>
+Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/pnp/quirks.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ 1 files changed, 42 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c
+index dfbd5a6..258fef2 100644
+--- a/drivers/pnp/quirks.c
++++ b/drivers/pnp/quirks.c
+@@ -295,6 +295,45 @@ static void quirk_system_pci_resources(struct pnp_dev *dev)
+ }
+ }
+
++#ifdef CONFIG_AMD_NB
++
++#include <asm/amd_nb.h>
++
++static void quirk_amd_mmconfig_area(struct pnp_dev *dev)
++{
++ resource_size_t start, end;
++ struct pnp_resource *pnp_res;
++ struct resource *res;
++ struct resource mmconfig_res, *mmconfig;
++
++ mmconfig = amd_get_mmconfig_range(&mmconfig_res);
++ if (!mmconfig)
++ return;
++
++ list_for_each_entry(pnp_res, &dev->resources, list) {
++ res = &pnp_res->res;
++ if (res->end < mmconfig->start || res->start > mmconfig->end ||
++ (res->start == mmconfig->start && res->end == mmconfig->end))
++ continue;
++
++ dev_info(&dev->dev, FW_BUG
++ "%pR covers only part of AMD MMCONFIG area %pR; adding more reservations\n",
++ res, mmconfig);
++ if (mmconfig->start < res->start) {
++ start = mmconfig->start;
++ end = res->start - 1;
++ pnp_add_mem_resource(dev, start, end, 0);
++ }
++ if (mmconfig->end > res->end) {
++ start = res->end + 1;
++ end = mmconfig->end;
++ pnp_add_mem_resource(dev, start, end, 0);
++ }
++ break;
++ }
++}
++#endif
++
+ /*
+ * PnP Quirks
+ * Cards or devices that need some tweaking due to incomplete resource info
+@@ -322,6 +361,9 @@ static struct pnp_fixup pnp_fixups[] = {
+ /* PnP resources that might overlap PCI BARs */
+ {"PNP0c01", quirk_system_pci_resources},
+ {"PNP0c02", quirk_system_pci_resources},
++#ifdef CONFIG_AMD_NB
++ {"PNP0c01", quirk_amd_mmconfig_area},
++#endif
+ {""}
+ };
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch
new file mode 100644
index 0000000..88c4419
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch
@@ -0,0 +1,45 @@
+From 95bb58957d5f4db07339eb5c6c87345ec877a3b6 Mon Sep 17 00:00:00 2001
+From: Jussi Kivilinna <jussi.kivilinna at mbnet.fi>
+Date: Tue, 10 Jan 2012 06:40:23 +0000
+Subject: [PATCH 044/130] asix: fix setting custom MAC address on Asix 88178
+ devices
+
+commit 71bc5d94061516c4e70303570128797bcf768b10 upstream.
+
+In kernel v3.2 initialization sequence for Asix 88178 devices was changed so
+that hardware is reseted on every time interface is brought up (ifconfig up),
+instead just at USB probe time. This causes problem with setting custom MAC
+address to device as ax88178_reset causes reload of MAC address from EEPROM.
+
+This patch fixes the issue by rewriting MAC address at end of ax88178_reset.
+
+Signed-off-by: Jussi Kivilinna <jussi.kivilinna at mbnet.fi>
+Acked-by: Grant Grundler <grundler at chromium.org>
+Cc: Allan Chou <allan at asix.com.tw>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/usb/asix.c | 7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
+index dd2625a..b495821 100644
+--- a/drivers/net/usb/asix.c
++++ b/drivers/net/usb/asix.c
+@@ -1316,6 +1316,13 @@ static int ax88178_reset(struct usbnet *dev)
+ if (ret < 0)
+ return ret;
+
++ /* Rewrite MAC address */
++ memcpy(data->mac_addr, dev->net->dev_addr, ETH_ALEN);
++ ret = asix_write_cmd(dev, AX_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
++ data->mac_addr);
++ if (ret < 0)
++ return ret;
++
+ ret = asix_write_rx_ctl(dev, AX_DEFAULT_RX_CTL);
+ if (ret < 0)
+ return ret;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch
new file mode 100644
index 0000000..05e1512
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch
@@ -0,0 +1,53 @@
+From 25a43c8a8f51501928b5d209ab3880ecd5b180fe Mon Sep 17 00:00:00 2001
+From: Jussi Kivilinna <jussi.kivilinna at mbnet.fi>
+Date: Tue, 10 Jan 2012 06:40:17 +0000
+Subject: [PATCH 045/130] asix: fix setting custom MAC address on Asix 88772
+ devices
+
+commit 8ef66bdc4bda6aac2dae73b84d79dc8c2db33637 upstream.
+
+In kernel v3.2 initialization sequence for Asix 88772 devices was changed so
+that hardware is reseted on every time interface is brought up (ifconfig up),
+instead just at USB probe time. This causes problem with setting custom MAC
+address to device as ax88772_reset causes reload of MAC address from EEPROM.
+
+This patch fixes the issue by rewriting MAC address at end of ax88772_reset.
+
+Signed-off-by: Jussi Kivilinna <jussi.kivilinna at mbnet.fi>
+Acked-by: Grant Grundler <grundler at chromium.org>
+Cc: Allan Chou <allan at asix.com.tw>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/usb/asix.c | 8 ++++++++
+ 1 files changed, 8 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
+index b495821..f5e063a 100644
+--- a/drivers/net/usb/asix.c
++++ b/drivers/net/usb/asix.c
+@@ -974,6 +974,7 @@ static int ax88772_link_reset(struct usbnet *dev)
+
+ static int ax88772_reset(struct usbnet *dev)
+ {
++ struct asix_data *data = (struct asix_data *)&dev->data;
+ int ret, embd_phy;
+ u16 rx_ctl;
+
+@@ -1051,6 +1052,13 @@ static int ax88772_reset(struct usbnet *dev)
+ goto out;
+ }
+
++ /* Rewrite MAC address */
++ memcpy(data->mac_addr, dev->net->dev_addr, ETH_ALEN);
++ ret = asix_write_cmd(dev, AX_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
++ data->mac_addr);
++ if (ret < 0)
++ goto out;
++
+ /* Set RX_CTL to default values with 2k buffer, and enable cactus */
+ ret = asix_write_rx_ctl(dev, AX_DEFAULT_RX_CTL);
+ if (ret < 0)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch
new file mode 100644
index 0000000..04a4c7e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch
@@ -0,0 +1,54 @@
+From 56d30a3ff947d9e4be88a6083eb257bffb7d059e Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam at gmail.com>
+Date: Thu, 12 Jan 2012 17:20:20 -0800
+Subject: [PATCH 046/130] include/linux/crash_dump.h needs elf.h
+
+commit 1f536b9e9f85456df93614b3c2f6a1a2b7d7cb9b upstream.
+
+Building an ARM target we get the following warnings:
+
+ CC arch/arm/kernel/setup.o
+ In file included from arch/arm/kernel/setup.c:39:
+ arch/arm/include/asm/elf.h:102:1: warning: "vmcore_elf64_check_arch" redefined
+ In file included from arch/arm/kernel/setup.c:24:
+ include/linux/crash_dump.h:30:1: warning: this is the location of the previous definition
+
+Quoting Russell King:
+
+"linux/crash_dump.h makes no attempt to include asm/elf.h, but it depends
+on stuff in asm/elf.h to determine how stuff inside this file is defined
+at parse time.
+
+So, if asm/elf.h is included after linux/crash_dump.h or not at all, you
+get a different result from the situation where asm/elf.h is included
+before."
+
+So add elf.h header to crash_dump.h to avoid this problem.
+
+The original discussion about this can be found at:
+http://www.spinics.net/lists/arm-kernel/msg154113.html
+
+Signed-off-by: Fabio Estevam <fabio.estevam at freescale.com>
+Cc: Russell King <rmk at arm.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ include/linux/crash_dump.h | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h
+index 5c4abce..b936763 100644
+--- a/include/linux/crash_dump.h
++++ b/include/linux/crash_dump.h
+@@ -5,6 +5,7 @@
+ #include <linux/kexec.h>
+ #include <linux/device.h>
+ #include <linux/proc_fs.h>
++#include <linux/elf.h>
+
+ #define ELFCORE_ADDR_MAX (-1ULL)
+ #define ELFCORE_ADDR_ERR (-2ULL)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch
new file mode 100644
index 0000000..ed8e772
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch
@@ -0,0 +1,44 @@
+From 5b48b119d0d1a2331b6368b4be7e3c1406cbda40 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger at lwfinger.net>
+Date: Wed, 4 Jan 2012 20:50:47 -0600
+Subject: [PATCH 047/130] rtl8192se: Fix BUG caused by failure to check skb
+ allocation
+
+commit d90db4b12bc1b9b8a787ef28550fdb767ee25a49 upstream.
+
+When downloading firmware into the device, the driver fails to check the
+return when allocating an skb. When the allocation fails, a BUG can be
+generated, as seen in https://bugzilla.redhat.com/show_bug.cgi?id=771656.
+
+Signed-off-by: Larry Finger <Larry.Finger at lwfinger.net>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/rtlwifi/rtl8192se/fw.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.c b/drivers/net/wireless/rtlwifi/rtl8192se/fw.c
+index 6f91a14..3fda6b1 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.c
+@@ -196,6 +196,8 @@ static bool _rtl92s_firmware_downloadcode(struct ieee80211_hw *hw,
+ /* Allocate skb buffer to contain firmware */
+ /* info and tx descriptor info. */
+ skb = dev_alloc_skb(frag_length);
++ if (!skb)
++ return false;
+ skb_reserve(skb, extra_descoffset);
+ seg_ptr = (u8 *)skb_put(skb, (u32)(frag_length -
+ extra_descoffset));
+@@ -573,6 +575,8 @@ static bool _rtl92s_firmware_set_h2c_cmd(struct ieee80211_hw *hw, u8 h2c_cmd,
+
+ len = _rtl92s_get_h2c_cmdlen(MAX_TRANSMIT_BUFFER_SIZE, 1, &cmd_len);
+ skb = dev_alloc_skb(len);
++ if (!skb)
++ return false;
+ cb_desc = (struct rtl_tcb_desc *)(skb->cb);
+ cb_desc->queue_index = TXCMD_QUEUE;
+ cb_desc->cmd_or_init = DESC_PACKET_TYPE_NORMAL;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch
new file mode 100644
index 0000000..1efb1c2
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch
@@ -0,0 +1,52 @@
+From 70f755e08b2df34528ff568bcbe2b856ddd769e1 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka at redhat.com>
+Date: Wed, 11 Jan 2012 09:26:54 +0100
+Subject: [PATCH 048/130] mac80211: fix rx->key NULL pointer dereference in
+ promiscuous mode
+
+commit 1140afa862842ac3e56678693050760edc4ecde9 upstream.
+
+Since:
+
+commit 816c04fe7ef01dd9649f5ccfe796474db8708be5
+Author: Christian Lamparter <chunkeey at googlemail.com>
+Date: Sat Apr 30 15:24:30 2011 +0200
+
+ mac80211: consolidate MIC failure report handling
+
+is possible to that we dereference rx->key == NULL when driver set
+RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in
+promiscuous mode. This happen with rt73usb and rt61pci at least.
+
+Before the commit we always check rx->key against NULL, so I assume
+fix should be done in mac80211 (also mic_fail path has similar check).
+
+References:
+https://bugzilla.redhat.com/show_bug.cgi?id=769766
+http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html
+
+Reported-by: Stuart D Gathman <stuart at gathman.org>
+Reported-by: Kai Wohlfahrt <kai.scorpio at gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka at redhat.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ net/mac80211/wpa.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
+index f614ce7..28a39bb 100644
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -106,7 +106,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
+ if (status->flag & RX_FLAG_MMIC_ERROR)
+ goto mic_fail;
+
+- if (!(status->flag & RX_FLAG_IV_STRIPPED))
++ if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
+ goto update_iv;
+
+ return RX_CONTINUE;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch
new file mode 100644
index 0000000..3fbfd6d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch
@@ -0,0 +1,68 @@
+From 11da5d38bc749c576b8def78827c2ca82d6d6bb6 Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanohar at qca.qualcomm.com>
+Date: Mon, 9 Jan 2012 15:37:53 +0530
+Subject: [PATCH 049/130] ath9k: Fix regression in channelwidth switch at the
+ same channel
+
+commit 1a19f77f3642b8194ad9cf55548cc5d92e841766 upstream.
+
+The commit "ath9k: Fix invalid noisefloor reading due to channel update"
+preserves the current channel noisefloor readings before updating
+channel type at the same channel index. It is also updating the curchan
+pointer. As survey updation is also referring curchan pointer to fetch
+the appropriate index, which might leads to invalid memory access. This
+patch partially reverts the change and stores the noise floor history
+buffer before updating channel type w/o updating curchan.
+
+Cc: Gary Morain <gmorain at google.com>
+Cc: Paul Stewart <pstew at google.com>
+Reported-by: Mohammed Shafi Shajakhan <mohammed at qca.qualcomm.com>
+Signed-off-by: Rajkumar Manoharan <rmanohar at qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/ath/ath9k/calib.c | 1 +
+ drivers/net/wireless/ath/ath9k/main.c | 8 ++------
+ 2 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
+index 9953881..8ddef3e 100644
+--- a/drivers/net/wireless/ath/ath9k/calib.c
++++ b/drivers/net/wireless/ath/ath9k/calib.c
+@@ -402,6 +402,7 @@ bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
+ ah->noise = ath9k_hw_getchan_noise(ah, chan);
+ return true;
+ }
++EXPORT_SYMBOL(ath9k_hw_getnf);
+
+ void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
+ struct ath9k_channel *chan)
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index a9c5ae7..f76a814 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1667,7 +1667,6 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
+
+ if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+ struct ieee80211_channel *curchan = hw->conf.channel;
+- struct ath9k_channel old_chan;
+ int pos = curchan->hw_value;
+ int old_pos = -1;
+ unsigned long flags;
+@@ -1693,11 +1692,8 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
+ * Preserve the current channel values, before updating
+ * the same channel
+ */
+- if (old_pos == pos) {
+- memcpy(&old_chan, &sc->sc_ah->channels[pos],
+- sizeof(struct ath9k_channel));
+- ah->curchan = &old_chan;
+- }
++ if (ah->curchan && (old_pos == pos))
++ ath9k_hw_getnf(ah, ah->curchan);
+
+ ath9k_cmn_update_ichannel(&sc->sc_ah->channels[pos],
+ curchan, conf->channel_type);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch
new file mode 100644
index 0000000..47ee79b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch
@@ -0,0 +1,179 @@
+From 256d142444317960a68e5c5e7a8b41a520b62bd9 Mon Sep 17 00:00:00 2001
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu at jp.fujitsu.com>
+Date: Thu, 12 Jan 2012 17:17:44 -0800
+Subject: [PATCH 050/130] memcg: add mem_cgroup_replace_page_cache() to fix
+ LRU issue
+
+commit ab936cbcd02072a34b60d268f94440fd5cf1970b upstream.
+
+Commit ef6a3c6311 ("mm: add replace_page_cache_page() function") added a
+function replace_page_cache_page(). This function replaces a page in the
+radix-tree with a new page. WHen doing this, memory cgroup needs to fix
+up the accounting information. memcg need to check PCG_USED bit etc.
+
+In some(many?) cases, 'newpage' is on LRU before calling
+replace_page_cache(). So, memcg's LRU accounting information should be
+fixed, too.
+
+This patch adds mem_cgroup_replace_page_cache() and removes the old hooks.
+ In that function, old pages will be unaccounted without touching
+res_counter and new page will be accounted to the memcg (of old page).
+WHen overwriting pc->mem_cgroup of newpage, take zone->lru_lock and avoid
+races with LRU handling.
+
+Background:
+ replace_page_cache_page() is called by FUSE code in its splice() handling.
+ Here, 'newpage' is replacing oldpage but this newpage is not a newly allocated
+ page and may be on LRU. LRU mis-accounting will be critical for memory cgroup
+ because rmdir() checks the whole LRU is empty and there is no account leak.
+ If a page is on the other LRU than it should be, rmdir() will fail.
+
+This bug was added in March 2011, but no bug report yet. I guess there
+are not many people who use memcg and FUSE at the same time with upstream
+kernels.
+
+The result of this bug is that admin cannot destroy a memcg because of
+account leak. So, no panic, no deadlock. And, even if an active cgroup
+exist, umount can succseed. So no problem at shutdown.
+
+Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu at jp.fujitsu.com>
+Acked-by: Johannes Weiner <hannes at cmpxchg.org>
+Acked-by: Michal Hocko <mhocko at suse.cz>
+Cc: Miklos Szeredi <mszeredi at suse.cz>
+Cc: Hugh Dickins <hughd at google.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ include/linux/memcontrol.h | 6 ++++++
+ mm/filemap.c | 18 ++----------------
+ mm/memcontrol.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 52 insertions(+), 16 deletions(-)
+
+diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
+index b87068a..81572af 100644
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -119,6 +119,8 @@ struct zone_reclaim_stat*
+ mem_cgroup_get_reclaim_stat_from_page(struct page *page);
+ extern void mem_cgroup_print_oom_info(struct mem_cgroup *memcg,
+ struct task_struct *p);
++extern void mem_cgroup_replace_page_cache(struct page *oldpage,
++ struct page *newpage);
+
+ #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
+ extern int do_swap_account;
+@@ -366,6 +368,10 @@ static inline
+ void mem_cgroup_count_vm_event(struct mm_struct *mm, enum vm_event_item idx)
+ {
+ }
++static inline void mem_cgroup_replace_page_cache(struct page *oldpage,
++ struct page *newpage)
++{
++}
+ #endif /* CONFIG_CGROUP_MEM_CONT */
+
+ #if !defined(CONFIG_CGROUP_MEM_RES_CTLR) || !defined(CONFIG_DEBUG_VM)
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 5f0a3c9..90286a4 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -393,24 +393,11 @@ EXPORT_SYMBOL(filemap_write_and_wait_range);
+ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
+ {
+ int error;
+- struct mem_cgroup *memcg = NULL;
+
+ VM_BUG_ON(!PageLocked(old));
+ VM_BUG_ON(!PageLocked(new));
+ VM_BUG_ON(new->mapping);
+
+- /*
+- * This is not page migration, but prepare_migration and
+- * end_migration does enough work for charge replacement.
+- *
+- * In the longer term we probably want a specialized function
+- * for moving the charge from old to new in a more efficient
+- * manner.
+- */
+- error = mem_cgroup_prepare_migration(old, new, &memcg, gfp_mask);
+- if (error)
+- return error;
+-
+ error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
+ if (!error) {
+ struct address_space *mapping = old->mapping;
+@@ -432,13 +419,12 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
+ if (PageSwapBacked(new))
+ __inc_zone_page_state(new, NR_SHMEM);
+ spin_unlock_irq(&mapping->tree_lock);
++ /* mem_cgroup codes must not be called under tree_lock */
++ mem_cgroup_replace_page_cache(old, new);
+ radix_tree_preload_end();
+ if (freepage)
+ freepage(old);
+ page_cache_release(old);
+- mem_cgroup_end_migration(memcg, old, new, true);
+- } else {
+- mem_cgroup_end_migration(memcg, old, new, false);
+ }
+
+ return error;
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index b63f5f7..f538e9b 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -3366,6 +3366,50 @@ void mem_cgroup_end_migration(struct mem_cgroup *memcg,
+ cgroup_release_and_wakeup_rmdir(&memcg->css);
+ }
+
++/*
++ * At replace page cache, newpage is not under any memcg but it's on
++ * LRU. So, this function doesn't touch res_counter but handles LRU
++ * in correct way. Both pages are locked so we cannot race with uncharge.
++ */
++void mem_cgroup_replace_page_cache(struct page *oldpage,
++ struct page *newpage)
++{
++ struct mem_cgroup *memcg;
++ struct page_cgroup *pc;
++ struct zone *zone;
++ enum charge_type type = MEM_CGROUP_CHARGE_TYPE_CACHE;
++ unsigned long flags;
++
++ if (mem_cgroup_disabled())
++ return;
++
++ pc = lookup_page_cgroup(oldpage);
++ /* fix accounting on old pages */
++ lock_page_cgroup(pc);
++ memcg = pc->mem_cgroup;
++ mem_cgroup_charge_statistics(memcg, PageCgroupCache(pc), -1);
++ ClearPageCgroupUsed(pc);
++ unlock_page_cgroup(pc);
++
++ if (PageSwapBacked(oldpage))
++ type = MEM_CGROUP_CHARGE_TYPE_SHMEM;
++
++ zone = page_zone(newpage);
++ pc = lookup_page_cgroup(newpage);
++ /*
++ * Even if newpage->mapping was NULL before starting replacement,
++ * the newpage may be on LRU(or pagevec for LRU) already. We lock
++ * LRU while we overwrite pc->mem_cgroup.
++ */
++ spin_lock_irqsave(&zone->lru_lock, flags);
++ if (PageLRU(newpage))
++ del_page_from_lru_list(zone, newpage, page_lru(newpage));
++ __mem_cgroup_commit_charge(memcg, newpage, 1, pc, type);
++ if (PageLRU(newpage))
++ add_page_to_lru_list(zone, newpage, page_lru(newpage));
++ spin_unlock_irqrestore(&zone->lru_lock, flags);
++}
++
+ #ifdef CONFIG_DEBUG_VM
+ static struct page_cgroup *lookup_page_cgroup_used(struct page *page)
+ {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0051-x86-Fix-mmap-random-address-range.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0051-x86-Fix-mmap-random-address-range.patch
new file mode 100644
index 0000000..828090b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0051-x86-Fix-mmap-random-address-range.patch
@@ -0,0 +1,47 @@
+From 706ade85b9f24b43d5e2b456b2eaf5acf4708fa7 Mon Sep 17 00:00:00 2001
+From: Ludwig Nussel <ludwig.nussel at suse.de>
+Date: Tue, 15 Nov 2011 14:46:46 -0800
+Subject: [PATCH 051/130] x86: Fix mmap random address range
+
+commit 9af0c7a6fa860698d080481f24a342ba74b68982 upstream.
+
+On x86_32 casting the unsigned int result of get_random_int() to
+long may result in a negative value. On x86_32 the range of
+mmap_rnd() therefore was -255 to 255. The 32bit mode on x86_64
+used 0 to 255 as intended.
+
+The bug was introduced by 675a081 ("x86: unify mmap_{32|64}.c")
+in January 2008.
+
+Signed-off-by: Ludwig Nussel <ludwig.nussel at suse.de>
+Cc: Linus Torvalds <torvalds at linux-foundation.org>
+Cc: harvey.harrison at gmail.com
+Cc: "H. Peter Anvin" <hpa at zytor.com>
+Cc: Harvey Harrison <harvey.harrison at gmail.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Link: http://lkml.kernel.org/r/201111152246.pAFMklOB028527@wpaz5.hot.corp.google.com
+Signed-off-by: Ingo Molnar <mingo at elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/x86/mm/mmap.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
+index 4b5ba85..845df68 100644
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -75,9 +75,9 @@ static unsigned long mmap_rnd(void)
+ */
+ if (current->flags & PF_RANDOMIZE) {
+ if (mmap_is_ia32())
+- rnd = (long)get_random_int() % (1<<8);
++ rnd = get_random_int() % (1<<8);
+ else
+- rnd = (long)(get_random_int() % (1<<28));
++ rnd = get_random_int() % (1<<28);
+ }
+ return rnd << PAGE_SHIFT;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0052-UBI-fix-nameless-volumes-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0052-UBI-fix-nameless-volumes-handling.patch
new file mode 100644
index 0000000..ac5f8a8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0052-UBI-fix-nameless-volumes-handling.patch
@@ -0,0 +1,37 @@
+From fb25b1761ccc5ff102d6d4a8b2997437a9f1f999 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard at nod.at>
+Date: Fri, 13 Jan 2012 15:07:40 +0100
+Subject: [PATCH 052/130] UBI: fix nameless volumes handling
+
+commit 4a59c797a18917a5cf3ff7ade296b46134d91e6a upstream.
+
+Currently it's possible to create a volume without a name. E.g:
+ubimkvol -n 32 -s 2MiB -t static /dev/ubi0 -N ""
+
+After that vtbl_check() will always fail because it does not permit
+empty strings.
+
+Signed-off-by: Richard Weinberger <richard at nod.at>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/mtd/ubi/cdev.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
+index 3320a50..ad76592 100644
+--- a/drivers/mtd/ubi/cdev.c
++++ b/drivers/mtd/ubi/cdev.c
+@@ -632,6 +632,9 @@ static int verify_mkvol_req(const struct ubi_device *ubi,
+ if (req->alignment != 1 && n)
+ goto bad;
+
++ if (!req->name[0] || !req->name_len)
++ goto bad;
++
+ if (req->name_len > UBI_VOL_NAME_MAX) {
+ err = -ENAMETOOLONG;
+ goto bad;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0053-UBI-fix-debugging-messages.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0053-UBI-fix-debugging-messages.patch
new file mode 100644
index 0000000..16cccbc
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0053-UBI-fix-debugging-messages.patch
@@ -0,0 +1,42 @@
+From 5aefc74158a4193f8e1f0ee3b9af21fd76ace6ca Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
+Date: Tue, 10 Jan 2012 19:32:30 +0200
+Subject: [PATCH 053/130] UBI: fix debugging messages
+
+commit 72f0d453d81d35087b1d3ad7c8285628c2be6e1d upstream.
+
+Patch ab50ff684707031ed4bad2fdd313208ae392e5bb broke UBI debugging messages:
+before that commit when UBI debugging was enabled, users saw few useful
+debugging messages after attaching an MTD device. However, that patch turned
+'dbg_msg()' into 'pr_debug()', so to enable the debugging messages users have
+to enable them first via /sys/kernel/debug/dynamic_debug/control, which is
+very impractical.
+
+This commit makes 'dbg_msg()' to use 'printk()' instead of 'pr_debug()', just
+as it was before the breakage.
+
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/mtd/ubi/debug.h | 5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/mtd/ubi/debug.h b/drivers/mtd/ubi/debug.h
+index 64fbb00..ead2cd1 100644
+--- a/drivers/mtd/ubi/debug.h
++++ b/drivers/mtd/ubi/debug.h
+@@ -43,7 +43,10 @@
+ pr_debug("UBI DBG " type ": " fmt "\n", ##__VA_ARGS__)
+
+ /* Just a debugging messages not related to any specific UBI subsystem */
+-#define dbg_msg(fmt, ...) ubi_dbg_msg("msg", fmt, ##__VA_ARGS__)
++#define dbg_msg(fmt, ...) \
++ printk(KERN_DEBUG "UBI DBG (pid %d): %s: " fmt "\n", \
++ current->pid, __func__, ##__VA_ARGS__)
++
+ /* General debugging messages */
+ #define dbg_gen(fmt, ...) ubi_dbg_msg("gen", fmt, ##__VA_ARGS__)
+ /* Messages from the eraseblock association sub-system */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0054-UBI-make-vid_hdr-non-static.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0054-UBI-make-vid_hdr-non-static.patch
new file mode 100644
index 0000000..db26da8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0054-UBI-make-vid_hdr-non-static.patch
@@ -0,0 +1,36 @@
+From 7435d88f019f5550cf2d481b582e17ad65b061c0 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <rw at linutronix.de>
+Date: Thu, 22 Dec 2011 16:12:57 +0100
+Subject: [PATCH 054/130] UBI: make vid_hdr non-static
+
+commit 6bdccffe8c4268d02f71873102131fb6ed37ed9a upstream.
+
+Remove 'static' modifier from the 'vid_hdr' local variable. I do not know
+how it slipped in, but this is a bug and will break UBI if someone attaches
+2 UBI volumes at the same time.
+
+Artem: amended teh commit message, added -stable.
+
+Signed-off-by: Richard Weinberger <rw at linutronix.de>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/mtd/ubi/vtbl.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
+index 9ad18da..890754c 100644
+--- a/drivers/mtd/ubi/vtbl.c
++++ b/drivers/mtd/ubi/vtbl.c
+@@ -306,7 +306,7 @@ static int create_vtbl(struct ubi_device *ubi, struct ubi_scan_info *si,
+ int copy, void *vtbl)
+ {
+ int err, tries = 0;
+- static struct ubi_vid_hdr *vid_hdr;
++ struct ubi_vid_hdr *vid_hdr;
+ struct ubi_scan_leb *new_seb;
+
+ ubi_msg("create volume table (copy #%d)", copy + 1);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0055-UBIFS-fix-debugging-messages.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0055-UBIFS-fix-debugging-messages.patch
new file mode 100644
index 0000000..a27e70f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0055-UBIFS-fix-debugging-messages.patch
@@ -0,0 +1,41 @@
+From 1b3cf92e4f993769ceaf78263ccebc8eaf67a804 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
+Date: Tue, 10 Jan 2012 19:32:30 +0200
+Subject: [PATCH 055/130] UBIFS: fix debugging messages
+
+commit d34315da9146253351146140ea4b277193ee5e5f upstream.
+
+Patch 56e46742e846e4de167dde0e1e1071ace1c882a5 broke UBIFS debugging messages:
+before that commit when UBIFS debugging was enabled, users saw few useful
+debugging messages after mount. However, that patch turned 'dbg_msg()' into
+'pr_debug()', so to enable the debugging messages users have to enable them
+first via /sys/kernel/debug/dynamic_debug/control, which is very impractical.
+
+This commit makes 'dbg_msg()' to use 'printk()' instead of 'pr_debug()', just
+as it was before the breakage.
+
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/ubifs/debug.h | 5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
+index 8d9c468..3f65829 100644
+--- a/fs/ubifs/debug.h
++++ b/fs/ubifs/debug.h
+@@ -190,7 +190,10 @@ extern spinlock_t dbg_lock;
+ } while (0)
+
+ /* Just a debugging messages not related to any specific UBIFS subsystem */
+-#define dbg_msg(fmt, ...) ubifs_dbg_msg("msg", fmt, ##__VA_ARGS__)
++#define dbg_msg(fmt, ...) \
++ printk(KERN_DEBUG "UBIFS DBG (pid %d): %s: " fmt "\n", current->pid, \
++ __func__, ##__VA_ARGS__)
++
+ /* General messages */
+ #define dbg_gen(fmt, ...) ubifs_dbg_msg("gen", fmt, ##__VA_ARGS__)
+ /* Additional journal messages */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch
new file mode 100644
index 0000000..26a4324
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch
@@ -0,0 +1,57 @@
+From fd7fabbc63907ebe083460603caa1ba54bef0e80 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
+Date: Wed, 11 Jan 2012 15:13:27 +0200
+Subject: [PATCH 056/130] UBIFS: make debugging messages light again
+
+commit 1f5d78dc4823a85f112aaa2d0f17624f8c2a6c52 upstream.
+
+We switch to dynamic debugging in commit
+56e46742e846e4de167dde0e1e1071ace1c882a5 but did not take into account that
+now we do not control anymore whether a specific message is enabled or not.
+So now we lock the "dbg_lock" and release it in every debugging macro, which
+make them not so light-weight.
+
+This commit removes the "dbg_lock" protection from the debugging macros to
+fix the issue.
+
+The downside is that now our DBGKEY() stuff is broken, but this is not
+critical at all and will be fixed later.
+
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/ubifs/debug.h | 12 +++++-------
+ 1 files changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
+index 3f65829..c9d2941 100644
+--- a/fs/ubifs/debug.h
++++ b/fs/ubifs/debug.h
+@@ -175,19 +175,17 @@ const char *dbg_key_str1(const struct ubifs_info *c,
+ const union ubifs_key *key);
+
+ /*
+- * DBGKEY macros require @dbg_lock to be held, which it is in the dbg message
+- * macros.
++ * TODO: these macros are now broken because there is no locking around them
++ * and we use a global buffer for the key string. This means that in case of
++ * concurrent execution we will end up with incorrect and messy key strings.
+ */
+ #define DBGKEY(key) dbg_key_str0(c, (key))
+ #define DBGKEY1(key) dbg_key_str1(c, (key))
+
+ extern spinlock_t dbg_lock;
+
+-#define ubifs_dbg_msg(type, fmt, ...) do { \
+- spin_lock(&dbg_lock); \
+- pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__); \
+- spin_unlock(&dbg_lock); \
+-} while (0)
++#define ubifs_dbg_msg(type, fmt, ...) \
++ pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__)
+
+ /* Just a debugging messages not related to any specific UBIFS subsystem */
+ #define dbg_msg(fmt, ...) \
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch
new file mode 100644
index 0000000..6ebe7da
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch
@@ -0,0 +1,197 @@
+From 2c28d6c10fef2ab34270bd90ce2b75207cb951ee Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali at linux-fr.org>
+Date: Thu, 12 Jan 2012 20:32:03 +0100
+Subject: [PATCH 057/130] i2c: Fix error value returned by several bus drivers
+
+commit 7c1f59c9d5caf3a84f35549b5d58f3c055a68da5 upstream.
+
+When adding checks for ACPI resource conflicts to many bus drivers,
+not enough attention was paid to the error paths, and for several
+drivers this causes 0 to be returned on error in some cases. Fix this
+by properly returning a non-zero value on every error.
+
+Signed-off-by: Jean Delvare <khali at linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/i2c/busses/i2c-ali1535.c | 11 +++++++----
+ drivers/i2c/busses/i2c-nforce2.c | 2 +-
+ drivers/i2c/busses/i2c-sis5595.c | 4 ++--
+ drivers/i2c/busses/i2c-sis630.c | 6 +++++-
+ drivers/i2c/busses/i2c-viapro.c | 7 +++++--
+ 5 files changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c
+index b6807db..5b667e5 100644
+--- a/drivers/i2c/busses/i2c-ali1535.c
++++ b/drivers/i2c/busses/i2c-ali1535.c
+@@ -140,7 +140,7 @@ static unsigned short ali1535_smba;
+ defined to make the transition easier. */
+ static int __devinit ali1535_setup(struct pci_dev *dev)
+ {
+- int retval = -ENODEV;
++ int retval;
+ unsigned char temp;
+
+ /* Check the following things:
+@@ -155,6 +155,7 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ if (ali1535_smba == 0) {
+ dev_warn(&dev->dev,
+ "ALI1535_smb region uninitialized - upgrade BIOS?\n");
++ retval = -ENODEV;
+ goto exit;
+ }
+
+@@ -167,6 +168,7 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ ali1535_driver.name)) {
+ dev_err(&dev->dev, "ALI1535_smb region 0x%x already in use!\n",
+ ali1535_smba);
++ retval = -EBUSY;
+ goto exit;
+ }
+
+@@ -174,6 +176,7 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ pci_read_config_byte(dev, SMBCFG, &temp);
+ if ((temp & ALI1535_SMBIO_EN) == 0) {
+ dev_err(&dev->dev, "SMB device not enabled - upgrade BIOS?\n");
++ retval = -ENODEV;
+ goto exit_free;
+ }
+
+@@ -181,6 +184,7 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ pci_read_config_byte(dev, SMBHSTCFG, &temp);
+ if ((temp & 1) == 0) {
+ dev_err(&dev->dev, "SMBus controller not enabled - upgrade BIOS?\n");
++ retval = -ENODEV;
+ goto exit_free;
+ }
+
+@@ -198,12 +202,11 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ dev_dbg(&dev->dev, "SMBREV = 0x%X\n", temp);
+ dev_dbg(&dev->dev, "ALI1535_smba = 0x%X\n", ali1535_smba);
+
+- retval = 0;
+-exit:
+- return retval;
++ return 0;
+
+ exit_free:
+ release_region(ali1535_smba, ALI1535_SMB_IOSIZE);
++exit:
+ return retval;
+ }
+
+diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
+index ff1e127..4853b52 100644
+--- a/drivers/i2c/busses/i2c-nforce2.c
++++ b/drivers/i2c/busses/i2c-nforce2.c
+@@ -356,7 +356,7 @@ static int __devinit nforce2_probe_smb (struct pci_dev *dev, int bar,
+ error = acpi_check_region(smbus->base, smbus->size,
+ nforce2_driver.name);
+ if (error)
+- return -1;
++ return error;
+
+ if (!request_region(smbus->base, smbus->size, nforce2_driver.name)) {
+ dev_err(&smbus->adapter.dev, "Error requesting region %02x .. %02X for %s\n",
+diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
+index 4375866..6d60284 100644
+--- a/drivers/i2c/busses/i2c-sis5595.c
++++ b/drivers/i2c/busses/i2c-sis5595.c
+@@ -147,7 +147,7 @@ static int __devinit sis5595_setup(struct pci_dev *SIS5595_dev)
+ u16 a;
+ u8 val;
+ int *i;
+- int retval = -ENODEV;
++ int retval;
+
+ /* Look for imposters */
+ for (i = blacklist; *i != 0; i++) {
+@@ -223,7 +223,7 @@ static int __devinit sis5595_setup(struct pci_dev *SIS5595_dev)
+
+ error:
+ release_region(sis5595_base + SMB_INDEX, 2);
+- return retval;
++ return -ENODEV;
+ }
+
+ static int sis5595_transaction(struct i2c_adapter *adap)
+diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
+index e6f539e..b617fd0 100644
+--- a/drivers/i2c/busses/i2c-sis630.c
++++ b/drivers/i2c/busses/i2c-sis630.c
+@@ -393,7 +393,7 @@ static int __devinit sis630_setup(struct pci_dev *sis630_dev)
+ {
+ unsigned char b;
+ struct pci_dev *dummy = NULL;
+- int retval = -ENODEV, i;
++ int retval, i;
+
+ /* check for supported SiS devices */
+ for (i=0; supported[i] > 0 ; i++) {
+@@ -418,18 +418,21 @@ static int __devinit sis630_setup(struct pci_dev *sis630_dev)
+ */
+ if (pci_read_config_byte(sis630_dev, SIS630_BIOS_CTL_REG,&b)) {
+ dev_err(&sis630_dev->dev, "Error: Can't read bios ctl reg\n");
++ retval = -ENODEV;
+ goto exit;
+ }
+ /* if ACPI already enabled , do nothing */
+ if (!(b & 0x80) &&
+ pci_write_config_byte(sis630_dev, SIS630_BIOS_CTL_REG, b | 0x80)) {
+ dev_err(&sis630_dev->dev, "Error: Can't enable ACPI\n");
++ retval = -ENODEV;
+ goto exit;
+ }
+
+ /* Determine the ACPI base address */
+ if (pci_read_config_word(sis630_dev,SIS630_ACPI_BASE_REG,&acpi_base)) {
+ dev_err(&sis630_dev->dev, "Error: Can't determine ACPI base address\n");
++ retval = -ENODEV;
+ goto exit;
+ }
+
+@@ -445,6 +448,7 @@ static int __devinit sis630_setup(struct pci_dev *sis630_dev)
+ sis630_driver.name)) {
+ dev_err(&sis630_dev->dev, "SMBus registers 0x%04x-0x%04x already "
+ "in use!\n", acpi_base + SMB_STS, acpi_base + SMB_SAA);
++ retval = -EBUSY;
+ goto exit;
+ }
+
+diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
+index 0b012f1..58261d4 100644
+--- a/drivers/i2c/busses/i2c-viapro.c
++++ b/drivers/i2c/busses/i2c-viapro.c
+@@ -324,7 +324,7 @@ static int __devinit vt596_probe(struct pci_dev *pdev,
+ const struct pci_device_id *id)
+ {
+ unsigned char temp;
+- int error = -ENODEV;
++ int error;
+
+ /* Determine the address of the SMBus areas */
+ if (force_addr) {
+@@ -390,6 +390,7 @@ found:
+ dev_err(&pdev->dev, "SMBUS: Error: Host SMBus "
+ "controller not enabled! - upgrade BIOS or "
+ "use force=1\n");
++ error = -ENODEV;
+ goto release_region;
+ }
+ }
+@@ -422,9 +423,11 @@ found:
+ "SMBus Via Pro adapter at %04x", vt596_smba);
+
+ vt596_pdev = pci_dev_get(pdev);
+- if (i2c_add_adapter(&vt596_adapter)) {
++ error = i2c_add_adapter(&vt596_adapter);
++ if (error) {
+ pci_dev_put(vt596_pdev);
+ vt596_pdev = NULL;
++ goto release_region;
+ }
+
+ /* Always return failure here. This is to allow other drivers to bind
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch
new file mode 100644
index 0000000..b164455
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch
@@ -0,0 +1,39 @@
+From ac64016ec74f6fbe586ba55f75a87e6459ba0760 Mon Sep 17 00:00:00 2001
+From: Girish K S <girish.shivananjappa at linaro.org>
+Date: Thu, 15 Dec 2011 17:27:42 +0530
+Subject: [PATCH 058/130] mmc: core: Fix voltage select in DDR mode
+
+commit 913047e9e5787a90696533a9f109552b7694ecc9 upstream.
+
+This patch fixes the wrong comparison before setting the interface
+voltage in DDR mode.
+
+The assignment to the variable ddr before comaprison is either
+ddr = MMC_1_2V_DDR_MODE; or ddr == MMC_1_8V_DDR_MODE. But the comparison
+is done with the extended csd value if ddr == EXT_CSD_CARD_TYPE_DDR_1_2V.
+
+Signed-off-by: Girish K S <girish.shivananjappa at linaro.org>
+Acked-by: Subhash Jadavani <subhashj at codeaurora.org>
+Acked-by: Philip Rakity <prakity at marvell.com>
+Signed-off-by: Chris Ball <cjb at laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/mmc/core/mmc.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index d240427..fb7c27f 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1048,7 +1048,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
+ *
+ * WARNING: eMMC rules are NOT the same as SD DDR
+ */
+- if (ddr == EXT_CSD_CARD_TYPE_DDR_1_2V) {
++ if (ddr == MMC_1_2V_DDR_MODE) {
+ err = mmc_set_signal_voltage(host,
+ MMC_SIGNAL_VOLTAGE_120, 0);
+ if (err)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch
new file mode 100644
index 0000000..4f55423
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch
@@ -0,0 +1,39 @@
+From c1e5c579b2911ebddcdd5cbebc91edbe3a82af4d Mon Sep 17 00:00:00 2001
+From: Aaron Lu <aaron.lu at amd.com>
+Date: Wed, 28 Dec 2011 11:11:12 +0800
+Subject: [PATCH 059/130] mmc: sdhci: Fix tuning timer incorrect setting when
+ suspending host
+
+commit c6ced0db08010ed75df221a2946c5228454b38d5 upstream.
+
+When suspending host, the tuning timer shoule be deactivated.
+And the HOST_NEEDS_TUNING flag should be set after tuning timer is
+deactivated.
+
+Signed-off-by: Philip Rakity <prakity at marvell.com>
+Signed-off-by: Aaron Lu <aaron.lu at amd.com>
+Acked-by: Adrian Hunter <adrian.hunter at intel.com>
+Signed-off-by: Chris Ball <cjb at laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/mmc/host/sdhci.c | 3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 19ed580..9279c1b 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -2336,9 +2336,8 @@ int sdhci_suspend_host(struct sdhci_host *host)
+ /* Disable tuning since we are suspending */
+ if (host->version >= SDHCI_SPEC_300 && host->tuning_count &&
+ host->tuning_mode == SDHCI_TUNING_MODE_1) {
++ del_timer_sync(&host->tuning_timer);
+ host->flags &= ~SDHCI_NEEDS_RETUNING;
+- mod_timer(&host->tuning_timer, jiffies +
+- host->tuning_count * HZ);
+ }
+
+ ret = mmc_suspend_host(host->mmc);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch
new file mode 100644
index 0000000..1057d85
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch
@@ -0,0 +1,38 @@
+From 2bcbb8b0e7cecfd753f470dfa9f0780f7c07e28d Mon Sep 17 00:00:00 2001
+From: Alexander Elbs <alex at segv.de>
+Date: Tue, 3 Jan 2012 23:26:53 -0500
+Subject: [PATCH 060/130] mmc: sd: Fix SDR12 timing regression
+
+commit dd8df17fe83483d7ea06ff229895e35a42071599 upstream.
+
+This patch fixes a failure to recognize SD cards reported on a Dell
+Vostro with O2 Micro SD card reader. Patch 49c468f ("mmc: sd: add
+support for uhs bus speed mode selection") caused the problem, by
+setting the SDHCI_CTRL_HISPD flag even for legacy timings.
+
+Signed-off-by: Alexander Elbs <alex at segv.de>
+Acked-by: Philip Rakity <prakity at marvell.com>
+Acked-by: Arindam Nath <arindam.nath at amd.com>
+Signed-off-by: Chris Ball <cjb at laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/mmc/host/sdhci.c | 3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 9279c1b..6ce32a7 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1364,8 +1364,7 @@ static void sdhci_do_set_ios(struct sdhci_host *host, struct mmc_ios *ios)
+ if ((ios->timing == MMC_TIMING_UHS_SDR50) ||
+ (ios->timing == MMC_TIMING_UHS_SDR104) ||
+ (ios->timing == MMC_TIMING_UHS_DDR50) ||
+- (ios->timing == MMC_TIMING_UHS_SDR25) ||
+- (ios->timing == MMC_TIMING_UHS_SDR12))
++ (ios->timing == MMC_TIMING_UHS_SDR25))
+ ctrl |= SDHCI_CTRL_HISPD;
+
+ ctrl_2 = sdhci_readw(host, SDHCI_HOST_CONTROL2);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch
new file mode 100644
index 0000000..966eaf4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch
@@ -0,0 +1,54 @@
+From 367f7884638cda94299eb0e38e200031a5d3130d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter at oracle.com>
+Date: Thu, 5 Jan 2012 02:27:57 -0300
+Subject: [PATCH 061/130] V4L/DVB: v4l2-ioctl: integer overflow in
+ video_usercopy()
+
+commit 6c06108be53ca5e94d8b0e93883d534dd9079646 upstream.
+
+If ctrls->count is too high the multiplication could overflow and
+array_size would be lower than expected. Mauro and Hans Verkuil
+suggested that we cap it at 1024. That comes from the maximum
+number of controls with lots of room for expantion.
+
+$ grep V4L2_CID include/linux/videodev2.h | wc -l
+211
+
+Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/media/video/v4l2-ioctl.c | 4 ++++
+ include/linux/videodev2.h | 1 +
+ 2 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
+index e1da8fc..639abee 100644
+--- a/drivers/media/video/v4l2-ioctl.c
++++ b/drivers/media/video/v4l2-ioctl.c
+@@ -2226,6 +2226,10 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
+ struct v4l2_ext_controls *ctrls = parg;
+
+ if (ctrls->count != 0) {
++ if (ctrls->count > V4L2_CID_MAX_CTRLS) {
++ ret = -EINVAL;
++ break;
++ }
+ *user_ptr = (void __user *)ctrls->controls;
+ *kernel_ptr = (void *)&ctrls->controls;
+ *array_size = sizeof(struct v4l2_ext_control)
+diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
+index 4b752d5..45a7698 100644
+--- a/include/linux/videodev2.h
++++ b/include/linux/videodev2.h
+@@ -1131,6 +1131,7 @@ struct v4l2_querymenu {
+ #define V4L2_CTRL_FLAG_NEXT_CTRL 0x80000000
+
+ /* User-class control IDs defined by V4L2 */
++#define V4L2_CID_MAX_CTRLS 1024
+ #define V4L2_CID_BASE (V4L2_CTRL_CLASS_USER | 0x900)
+ #define V4L2_CID_USER_BASE V4L2_CID_BASE
+ /* IDs reserved for driver specific controls */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch
new file mode 100644
index 0000000..ce9352d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch
@@ -0,0 +1,71 @@
+From b8292304bc243db5cc68c27e19c7c14c15e19263 Mon Sep 17 00:00:00 2001
+From: Gleb Natapov <gleb at redhat.com>
+Date: Sun, 8 Jan 2012 17:07:28 +0200
+Subject: [PATCH 062/130] Unused iocbs in a batch should not be accounted as
+ active.
+
+commit 69e4747ee9727d660b88d7e1efe0f4afcb35db1b upstream.
+
+Since commit 080d676de095 ("aio: allocate kiocbs in batches") iocbs are
+allocated in a batch during processing of first iocbs. All iocbs in a
+batch are automatically added to ctx->active_reqs list and accounted in
+ctx->reqs_active.
+
+If one (not the last one) of iocbs submitted by an user fails, further
+iocbs are not processed, but they are still present in ctx->active_reqs
+and accounted in ctx->reqs_active. This causes process to stuck in a D
+state in wait_for_all_aios() on exit since ctx->reqs_active will never
+go down to zero. Furthermore since kiocb_batch_free() frees iocb
+without removing it from active_reqs list the list become corrupted
+which may cause oops.
+
+Fix this by removing iocb from ctx->active_reqs and updating
+ctx->reqs_active in kiocb_batch_free().
+
+Signed-off-by: Gleb Natapov <gleb at redhat.com>
+Reviewed-by: Jeff Moyer <jmoyer at redhat.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/aio.c | 11 +++++++++--
+ 1 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/fs/aio.c b/fs/aio.c
+index 78c514c..969beb0 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -476,14 +476,21 @@ static void kiocb_batch_init(struct kiocb_batch *batch, long total)
+ batch->count = total;
+ }
+
+-static void kiocb_batch_free(struct kiocb_batch *batch)
++static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
+ {
+ struct kiocb *req, *n;
+
++ if (list_empty(&batch->head))
++ return;
++
++ spin_lock_irq(&ctx->ctx_lock);
+ list_for_each_entry_safe(req, n, &batch->head, ki_batch) {
+ list_del(&req->ki_batch);
++ list_del(&req->ki_list);
+ kmem_cache_free(kiocb_cachep, req);
++ ctx->reqs_active--;
+ }
++ spin_unlock_irq(&ctx->ctx_lock);
+ }
+
+ /*
+@@ -1742,7 +1749,7 @@ long do_io_submit(aio_context_t ctx_id, long nr,
+ }
+ blk_finish_plug(&plug);
+
+- kiocb_batch_free(&batch);
++ kiocb_batch_free(ctx, &batch);
+ put_ioctx(ctx);
+ return i ? i : ret;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch
new file mode 100644
index 0000000..617f4b3
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch
@@ -0,0 +1,227 @@
+From dedf47c7159cb4b5d1744557aa744145f161eac5 Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa at redhat.com>
+Date: Mon, 5 Dec 2011 18:22:48 +0100
+Subject: [PATCH 063/130] ftrace: Fix unregister ftrace_ops accounting
+
+commit 30fb6aa74011dcf595f306ca2727254d708b786e upstream.
+
+Multiple users of the function tracer can register their functions
+with the ftrace_ops structure. The accounting within ftrace will
+update the counter on each function record that is being traced.
+When the ftrace_ops filtering adds or removes functions, the
+function records will be updated accordingly if the ftrace_ops is
+still registered.
+
+When a ftrace_ops is removed, the counter of the function records,
+that the ftrace_ops traces, are decremented. When they reach zero
+the functions that they represent are modified to stop calling the
+mcount code.
+
+When changes are made, the code is updated via stop_machine() with
+a command passed to the function to tell it what to do. There is an
+ENABLE and DISABLE command that tells the called function to enable
+or disable the functions. But the ENABLE is really a misnomer as it
+should just update the records, as records that have been enabled
+and now have a count of zero should be disabled.
+
+The DISABLE command is used to disable all functions regardless of
+their counter values. This is the big off switch and is not the
+complement of the ENABLE command.
+
+To make matters worse, when a ftrace_ops is unregistered and there
+is another ftrace_ops registered, neither the DISABLE nor the
+ENABLE command are set when calling into the stop_machine() function
+and the records will not be updated to match their counter. A command
+is passed to that function that will update the mcount code to call
+the registered callback directly if it is the only one left. This
+means that the ftrace_ops that is still registered will have its callback
+called by all functions that have been set for it as well as the ftrace_ops
+that was just unregistered.
+
+Here's a way to trigger this bug. Compile the kernel with
+CONFIG_FUNCTION_PROFILER set and with CONFIG_FUNCTION_GRAPH not set:
+
+ CONFIG_FUNCTION_PROFILER=y
+ # CONFIG_FUNCTION_GRAPH is not set
+
+This will force the function profiler to use the function tracer instead
+of the function graph tracer.
+
+ # cd /sys/kernel/debug/tracing
+ # echo schedule > set_ftrace_filter
+ # echo function > current_tracer
+ # cat set_ftrace_filter
+ schedule
+ # cat trace
+ # tracer: nop
+ #
+ # entries-in-buffer/entries-written: 692/68108025 #P:4
+ #
+ # _-----=> irqs-off
+ # / _----=> need-resched
+ # | / _---=> hardirq/softirq
+ # || / _--=> preempt-depth
+ # ||| / delay
+ # TASK-PID CPU# |||| TIMESTAMP FUNCTION
+ # | | | |||| | |
+ kworker/0:2-909 [000] .... 531.235574: schedule <-worker_thread
+ <idle>-0 [001] .N.. 531.235575: schedule <-cpu_idle
+ kworker/0:2-909 [000] .... 531.235597: schedule <-worker_thread
+ sshd-2563 [001] .... 531.235647: schedule <-schedule_hrtimeout_range_clock
+
+ # echo 1 > function_profile_enabled
+ # echo 0 > function_porfile_enabled
+ # cat set_ftrace_filter
+ schedule
+ # cat trace
+ # tracer: function
+ #
+ # entries-in-buffer/entries-written: 159701/118821262 #P:4
+ #
+ # _-----=> irqs-off
+ # / _----=> need-resched
+ # | / _---=> hardirq/softirq
+ # || / _--=> preempt-depth
+ # ||| / delay
+ # TASK-PID CPU# |||| TIMESTAMP FUNCTION
+ # | | | |||| | |
+ <idle>-0 [002] ...1 604.870655: local_touch_nmi <-cpu_idle
+ <idle>-0 [002] d..1 604.870655: enter_idle <-cpu_idle
+ <idle>-0 [002] d..1 604.870656: atomic_notifier_call_chain <-enter_idle
+ <idle>-0 [002] d..1 604.870656: __atomic_notifier_call_chain <-atomic_notifier_call_chain
+
+The same problem could have happened with the trace_probe_ops,
+but they are modified with the set_frace_filter file which does the
+update at closure of the file.
+
+The simple solution is to change ENABLE to UPDATE and call it every
+time an ftrace_ops is unregistered.
+
+Link: http://lkml.kernel.org/r/1323105776-26961-3-git-send-email-jolsa@redhat.com
+
+Signed-off-by: Jiri Olsa <jolsa at redhat.com>
+Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ kernel/trace/ftrace.c | 27 +++++++++++++--------------
+ 1 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index b1e8943..25b4f4d 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -948,7 +948,7 @@ struct ftrace_func_probe {
+ };
+
+ enum {
+- FTRACE_ENABLE_CALLS = (1 << 0),
++ FTRACE_UPDATE_CALLS = (1 << 0),
+ FTRACE_DISABLE_CALLS = (1 << 1),
+ FTRACE_UPDATE_TRACE_FUNC = (1 << 2),
+ FTRACE_START_FUNC_RET = (1 << 3),
+@@ -1519,7 +1519,7 @@ int ftrace_text_reserved(void *start, void *end)
+
+
+ static int
+-__ftrace_replace_code(struct dyn_ftrace *rec, int enable)
++__ftrace_replace_code(struct dyn_ftrace *rec, int update)
+ {
+ unsigned long ftrace_addr;
+ unsigned long flag = 0UL;
+@@ -1527,17 +1527,17 @@ __ftrace_replace_code(struct dyn_ftrace *rec, int enable)
+ ftrace_addr = (unsigned long)FTRACE_ADDR;
+
+ /*
+- * If we are enabling tracing:
++ * If we are updating calls:
+ *
+ * If the record has a ref count, then we need to enable it
+ * because someone is using it.
+ *
+ * Otherwise we make sure its disabled.
+ *
+- * If we are disabling tracing, then disable all records that
++ * If we are disabling calls, then disable all records that
+ * are enabled.
+ */
+- if (enable && (rec->flags & ~FTRACE_FL_MASK))
++ if (update && (rec->flags & ~FTRACE_FL_MASK))
+ flag = FTRACE_FL_ENABLED;
+
+ /* If the state of this record hasn't changed, then do nothing */
+@@ -1553,7 +1553,7 @@ __ftrace_replace_code(struct dyn_ftrace *rec, int enable)
+ return ftrace_make_nop(NULL, rec, ftrace_addr);
+ }
+
+-static void ftrace_replace_code(int enable)
++static void ftrace_replace_code(int update)
+ {
+ struct dyn_ftrace *rec;
+ struct ftrace_page *pg;
+@@ -1567,7 +1567,7 @@ static void ftrace_replace_code(int enable)
+ if (rec->flags & FTRACE_FL_FREE)
+ continue;
+
+- failed = __ftrace_replace_code(rec, enable);
++ failed = __ftrace_replace_code(rec, update);
+ if (failed) {
+ ftrace_bug(failed, rec->ip);
+ /* Stop processing */
+@@ -1623,7 +1623,7 @@ static int __ftrace_modify_code(void *data)
+ */
+ function_trace_stop++;
+
+- if (*command & FTRACE_ENABLE_CALLS)
++ if (*command & FTRACE_UPDATE_CALLS)
+ ftrace_replace_code(1);
+ else if (*command & FTRACE_DISABLE_CALLS)
+ ftrace_replace_code(0);
+@@ -1691,7 +1691,7 @@ static int ftrace_startup(struct ftrace_ops *ops, int command)
+ return -ENODEV;
+
+ ftrace_start_up++;
+- command |= FTRACE_ENABLE_CALLS;
++ command |= FTRACE_UPDATE_CALLS;
+
+ /* ops marked global share the filter hashes */
+ if (ops->flags & FTRACE_OPS_FL_GLOBAL) {
+@@ -1743,8 +1743,7 @@ static void ftrace_shutdown(struct ftrace_ops *ops, int command)
+ if (ops != &global_ops || !global_start_up)
+ ops->flags &= ~FTRACE_OPS_FL_ENABLED;
+
+- if (!ftrace_start_up)
+- command |= FTRACE_DISABLE_CALLS;
++ command |= FTRACE_UPDATE_CALLS;
+
+ if (saved_ftrace_func != ftrace_trace_function) {
+ saved_ftrace_func = ftrace_trace_function;
+@@ -1766,7 +1765,7 @@ static void ftrace_startup_sysctl(void)
+ saved_ftrace_func = NULL;
+ /* ftrace_start_up is true if we want ftrace running */
+ if (ftrace_start_up)
+- ftrace_run_update_code(FTRACE_ENABLE_CALLS);
++ ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+ }
+
+ static void ftrace_shutdown_sysctl(void)
+@@ -2919,7 +2918,7 @@ ftrace_set_regex(struct ftrace_ops *ops, unsigned char *buf, int len,
+ ret = ftrace_hash_move(ops, enable, orig_hash, hash);
+ if (!ret && ops->flags & FTRACE_OPS_FL_ENABLED
+ && ftrace_enabled)
+- ftrace_run_update_code(FTRACE_ENABLE_CALLS);
++ ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+
+ mutex_unlock(&ftrace_lock);
+
+@@ -3107,7 +3106,7 @@ ftrace_regex_release(struct inode *inode, struct file *file)
+ orig_hash, iter->hash);
+ if (!ret && (iter->ops->flags & FTRACE_OPS_FL_ENABLED)
+ && ftrace_enabled)
+- ftrace_run_update_code(FTRACE_ENABLE_CALLS);
++ ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+
+ mutex_unlock(&ftrace_lock);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch
new file mode 100644
index 0000000..8d788a5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch
@@ -0,0 +1,68 @@
+From 700e5b37d0da1b3688992c53abba2ba9c123c547 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt at redhat.com>
+Date: Fri, 13 Jan 2012 17:50:39 -0500
+Subject: [PATCH 064/130] kconfig/streamline-config.pl: Simplify backslash
+ line concatination
+
+commit d060d963e88f3e990cec2fe5214de49de9a49eca upstream.
+
+Simplify the way lines ending with backslashes (continuation) in Makefiles
+is parsed. This is needed to implement a necessary fix.
+
+Tested-by: Thomas Lange <thomas-lange2 at gmx.de>
+Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ scripts/kconfig/streamline_config.pl | 25 ++++++++++++-------------
+ 1 files changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
+index ec7afce..42ef5ea 100644
+--- a/scripts/kconfig/streamline_config.pl
++++ b/scripts/kconfig/streamline_config.pl
+@@ -253,17 +253,22 @@ if ($kconfig) {
+ # Read all Makefiles to map the configs to the objects
+ foreach my $makefile (@makefiles) {
+
+- my $cont = 0;
++ my $line = "";
+
+ open(MIN,$makefile) || die "Can't open $makefile";
+ while (<MIN>) {
+- my $objs;
+-
+- # is this a line after a line with a backslash?
+- if ($cont && /(\S.*)$/) {
+- $objs = $1;
++ # if this line ends with a backslash, continue
++ chomp;
++ if (/^(.*)\\$/) {
++ $line .= $1;
++ next;
+ }
+- $cont = 0;
++
++ $line .= $_;
++ $_ = $line;
++ $line = "";
++
++ my $objs;
+
+ # collect objects after obj-$(CONFIG_FOO_BAR)
+ if (/obj-\$\((CONFIG_[^\)]*)\)\s*[+:]?=\s*(.*)/) {
+@@ -271,12 +276,6 @@ foreach my $makefile (@makefiles) {
+ $objs = $2;
+ }
+ if (defined($objs)) {
+- # test if the line ends with a backslash
+- if ($objs =~ m,(.*)\\$,) {
+- $objs = $1;
+- $cont = 1;
+- }
+-
+ foreach my $obj (split /\s+/,$objs) {
+ $obj =~ s/-/_/g;
+ if ($obj =~ /(.*)\.o$/) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch
new file mode 100644
index 0000000..443ada8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch
@@ -0,0 +1,98 @@
+From 4f45c91ec4a5953d1a1bf1d88d8bf4fa5b0273a0 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt at redhat.com>
+Date: Fri, 13 Jan 2012 17:53:40 -0500
+Subject: [PATCH 065/130] kconfig/streamline-config.pl: Fix parsing Makefile
+ with variables
+
+commit 364212fddaaa60c5a64f67a0f5624ad996ecc8a0 upstream.
+
+Thomas Lange reported that when he did a 'make localmodconfig', his
+config was missing the brcmsmac driver, even though he had the module
+loaded.
+
+Looking into this, I found the file:
+drivers/net/wireless/brcm80211/brcmsmac/Makefile
+had the following in the Makefile:
+
+MODULEPFX := brcmsmac
+
+obj-$(CONFIG_BRCMSMAC) += $(MODULEPFX).o
+
+The way streamline-config.pl works, is parsing all the
+ obj-$(CONFIG_FOO) += foo.o
+lines to find that CONFIG_FOO belongs to the module foo.ko.
+
+But in this case, the brcmsmac.o was not used, but a variable in its place.
+
+By changing streamline-config.pl to remember defined variables in Makefiles
+and substituting them when they are used in the obj-X lines, allows
+Thomas (and others) to have their brcmsmac module stay configured
+when it is loaded and running "make localmodconfig".
+
+Reported-by: Thomas Lange <thomas-lange2 at gmx.de>
+Tested-by: Thomas Lange <thomas-lange2 at gmx.de>
+Cc: Arend van Spriel <arend at broadcom.com>
+Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ scripts/kconfig/streamline_config.pl | 29 +++++++++++++++++++++++++++++
+ 1 files changed, 29 insertions(+), 0 deletions(-)
+
+diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
+index 42ef5ea..bccf07d 100644
+--- a/scripts/kconfig/streamline_config.pl
++++ b/scripts/kconfig/streamline_config.pl
+@@ -250,10 +250,33 @@ if ($kconfig) {
+ read_kconfig($kconfig);
+ }
+
++sub convert_vars {
++ my ($line, %vars) = @_;
++
++ my $process = "";
++
++ while ($line =~ s/^(.*?)(\$\((.*?)\))//) {
++ my $start = $1;
++ my $variable = $2;
++ my $var = $3;
++
++ if (defined($vars{$var})) {
++ $process .= $start . $vars{$var};
++ } else {
++ $process .= $start . $variable;
++ }
++ }
++
++ $process .= $line;
++
++ return $process;
++}
++
+ # Read all Makefiles to map the configs to the objects
+ foreach my $makefile (@makefiles) {
+
+ my $line = "";
++ my %make_vars;
+
+ open(MIN,$makefile) || die "Can't open $makefile";
+ while (<MIN>) {
+@@ -270,10 +293,16 @@ foreach my $makefile (@makefiles) {
+
+ my $objs;
+
++ $_ = convert_vars($_, %make_vars);
++
+ # collect objects after obj-$(CONFIG_FOO_BAR)
+ if (/obj-\$\((CONFIG_[^\)]*)\)\s*[+:]?=\s*(.*)/) {
+ $var = $1;
+ $objs = $2;
++
++ # check if variables are set
++ } elsif (/^\s*(\S+)\s*[:]?=\s*(.*\S)/) {
++ $make_vars{$1} = $2;
+ }
+ if (defined($objs)) {
+ foreach my $obj (split /\s+/,$objs) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch
new file mode 100644
index 0000000..5f9ecc3
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch
@@ -0,0 +1,60 @@
+From 843e6d14e855cc86d260b1077a3226d3344376af Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields at redhat.com>
+Date: Thu, 22 Dec 2011 18:22:49 -0700
+Subject: [PATCH 066/130] svcrpc: fix double-free on shutdown of nfsd after
+ changing pool mode
+
+commit 61c8504c428edcebf23b97775a129c5b393a302b upstream.
+
+The pool_to and to_pool fields of the global svc_pool_map are freed on
+shutdown, but are initialized in nfsd startup only in the
+SVC_POOL_PERCPU and SVC_POOL_PERNODE cases.
+
+They *are* initialized to zero on kernel startup. So as long as you use
+only SVC_POOL_GLOBAL (the default), this will never be a problem.
+
+You're also OK if you only ever use SVC_POOL_PERCPU or SVC_POOL_PERNODE.
+
+However, the following sequence events leads to a double-free:
+
+ 1. set SVC_POOL_PERCPU or SVC_POOL_PERNODE
+ 2. start nfsd: both fields are initialized.
+ 3. shutdown nfsd: both fields are freed.
+ 4. set SVC_POOL_GLOBAL
+ 5. start nfsd: the fields are left untouched.
+ 6. shutdown nfsd: now we try to free them again.
+
+Step 4 is actually unnecessary, since (for some bizarre reason), nfsd
+automatically resets the pool mode to SVC_POOL_GLOBAL on shutdown.
+
+Signed-off-by: J. Bruce Fields <bfields at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ net/sunrpc/svc.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index 6e03888..5443ffd 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -167,6 +167,7 @@ svc_pool_map_alloc_arrays(struct svc_pool_map *m, unsigned int maxpools)
+
+ fail_free:
+ kfree(m->to_pool);
++ m->to_pool = NULL;
+ fail:
+ return -ENOMEM;
+ }
+@@ -287,7 +288,9 @@ svc_pool_map_put(void)
+ if (!--m->count) {
+ m->mode = SVC_POOL_DEFAULT;
+ kfree(m->to_pool);
++ m->to_pool = NULL;
+ kfree(m->pool_to);
++ m->pool_to = NULL;
+ m->npools = 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch
new file mode 100644
index 0000000..021a468
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch
@@ -0,0 +1,85 @@
+From c132bb68434e1dcfc0e148d1e677f4433d6cf075 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields at redhat.com>
+Date: Tue, 29 Nov 2011 11:35:35 -0500
+Subject: [PATCH 067/130] svcrpc: destroy server sockets all at once
+
+commit 2fefb8a09e7ed251ae8996e0c69066e74c5aa560 upstream.
+
+There's no reason I can see that we need to call sv_shutdown between
+closing the two lists of sockets.
+
+Signed-off-by: J. Bruce Fields <bfields at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ include/linux/sunrpc/svcsock.h | 2 +-
+ net/sunrpc/svc.c | 7 +------
+ net/sunrpc/svc_xprt.c | 11 ++++++++++-
+ 3 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/include/linux/sunrpc/svcsock.h b/include/linux/sunrpc/svcsock.h
+index 85c50b4..c84e974 100644
+--- a/include/linux/sunrpc/svcsock.h
++++ b/include/linux/sunrpc/svcsock.h
+@@ -34,7 +34,7 @@ struct svc_sock {
+ /*
+ * Function prototypes.
+ */
+-void svc_close_all(struct list_head *);
++void svc_close_all(struct svc_serv *);
+ int svc_recv(struct svc_rqst *, long);
+ int svc_send(struct svc_rqst *);
+ void svc_drop(struct svc_rqst *);
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index 5443ffd..7ddfb04 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -531,16 +531,11 @@ svc_destroy(struct svc_serv *serv)
+
+ del_timer_sync(&serv->sv_temptimer);
+
+- svc_close_all(&serv->sv_tempsocks);
++ svc_close_all(serv);
+
+ if (serv->sv_shutdown)
+ serv->sv_shutdown(serv);
+
+- svc_close_all(&serv->sv_permsocks);
+-
+- BUG_ON(!list_empty(&serv->sv_permsocks));
+- BUG_ON(!list_empty(&serv->sv_tempsocks));
+-
+ cache_clean_deferred(serv);
+
+ if (svc_serv_is_pooled(serv))
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 447cd0e..dcdc8df 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -928,7 +928,7 @@ void svc_close_xprt(struct svc_xprt *xprt)
+ }
+ EXPORT_SYMBOL_GPL(svc_close_xprt);
+
+-void svc_close_all(struct list_head *xprt_list)
++static void svc_close_list(struct list_head *xprt_list)
+ {
+ struct svc_xprt *xprt;
+ struct svc_xprt *tmp;
+@@ -946,6 +946,15 @@ void svc_close_all(struct list_head *xprt_list)
+ }
+ }
+
++void svc_close_all(struct svc_serv *serv)
++{
++ svc_close_list(&serv->sv_tempsocks);
++ svc_close_list(&serv->sv_permsocks);
++ BUG_ON(!list_empty(&serv->sv_permsocks));
++ BUG_ON(!list_empty(&serv->sv_tempsocks));
++
++}
++
+ /*
+ * Handle defer and revisit of requests
+ */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch
new file mode 100644
index 0000000..e102471
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch
@@ -0,0 +1,156 @@
+From fb5e1630fc3566904898da68a99cc8e764cb420f Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields at redhat.com>
+Date: Tue, 29 Nov 2011 17:00:26 -0500
+Subject: [PATCH 068/130] svcrpc: avoid memory-corruption on pool shutdown
+
+commit b4f36f88b3ee7cf26bf0be84e6c7fc15f84dcb71 upstream.
+
+Socket callbacks use svc_xprt_enqueue() to add an xprt to a
+pool->sp_sockets list. In normal operation a server thread will later
+come along and take the xprt off that list. On shutdown, after all the
+threads have exited, we instead manually walk the sv_tempsocks and
+sv_permsocks lists to find all the xprt's and delete them.
+
+So the sp_sockets lists don't really matter any more. As a result,
+we've mostly just ignored them and hoped they would go away.
+
+Which has gotten us into trouble; witness for example ebc63e531cc6
+"svcrpc: fix list-corrupting race on nfsd shutdown", the result of Ben
+Greear noticing that a still-running svc_xprt_enqueue() could re-add an
+xprt to an sp_sockets list just before it was deleted. The fix was to
+remove it from the list at the end of svc_delete_xprt(). But that only
+made corruption less likely--I can see nothing that prevents a
+svc_xprt_enqueue() from adding another xprt to the list at the same
+moment that we're removing this xprt from the list. In fact, despite
+the earlier xpo_detach(), I don't even see what guarantees that
+svc_xprt_enqueue() couldn't still be running on this xprt.
+
+So, instead, note that svc_xprt_enqueue() essentially does:
+ lock sp_lock
+ if XPT_BUSY unset
+ add to sp_sockets
+ unlock sp_lock
+
+So, if we do:
+
+ set XPT_BUSY on every xprt.
+ Empty every sp_sockets list, under the sp_socks locks.
+
+Then we're left knowing that the sp_sockets lists are all empty and will
+stay that way, since any svc_xprt_enqueue() will check XPT_BUSY under
+the sp_lock and see it set.
+
+And *then* we can continue deleting the xprt's.
+
+(Thanks to Jeff Layton for being correctly suspicious of this code....)
+
+Cc: Ben Greear <greearb at candelatech.com>
+Cc: Jeff Layton <jlayton at redhat.com>
+Signed-off-by: J. Bruce Fields <bfields at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ net/sunrpc/svc.c | 10 +++++++++-
+ net/sunrpc/svc_xprt.c | 48 +++++++++++++++++++++++++++++-------------------
+ 2 files changed, 38 insertions(+), 20 deletions(-)
+
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index 7ddfb04..d4ad50e 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -530,7 +530,15 @@ svc_destroy(struct svc_serv *serv)
+ printk("svc_destroy: no threads for serv=%p!\n", serv);
+
+ del_timer_sync(&serv->sv_temptimer);
+-
++ /*
++ * The set of xprts (contained in the sv_tempsocks and
++ * sv_permsocks lists) is now constant, since it is modified
++ * only by accepting new sockets (done by service threads in
++ * svc_recv) or aging old ones (done by sv_temptimer), or
++ * configuration changes (excluded by whatever locking the
++ * caller is using--nfsd_mutex in the case of nfsd). So it's
++ * safe to traverse those lists and shut everything down:
++ */
+ svc_close_all(serv);
+
+ if (serv->sv_shutdown)
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index dcdc8df..9ed2cd0 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -893,14 +893,7 @@ void svc_delete_xprt(struct svc_xprt *xprt)
+ spin_lock_bh(&serv->sv_lock);
+ if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
+ list_del_init(&xprt->xpt_list);
+- /*
+- * The only time we're called while xpt_ready is still on a list
+- * is while the list itself is about to be destroyed (in
+- * svc_destroy). BUT svc_xprt_enqueue could still be attempting
+- * to add new entries to the sp_sockets list, so we can't leave
+- * a freed xprt on it.
+- */
+- list_del_init(&xprt->xpt_ready);
++ BUG_ON(!list_empty(&xprt->xpt_ready));
+ if (test_bit(XPT_TEMP, &xprt->xpt_flags))
+ serv->sv_tmpcnt--;
+ spin_unlock_bh(&serv->sv_lock);
+@@ -931,28 +924,45 @@ EXPORT_SYMBOL_GPL(svc_close_xprt);
+ static void svc_close_list(struct list_head *xprt_list)
+ {
+ struct svc_xprt *xprt;
+- struct svc_xprt *tmp;
+
+- /*
+- * The server is shutting down, and no more threads are running.
+- * svc_xprt_enqueue() might still be running, but at worst it
+- * will re-add the xprt to sp_sockets, which will soon get
+- * freed. So we don't bother with any more locking, and don't
+- * leave the close to the (nonexistent) server threads:
+- */
+- list_for_each_entry_safe(xprt, tmp, xprt_list, xpt_list) {
++ list_for_each_entry(xprt, xprt_list, xpt_list) {
+ set_bit(XPT_CLOSE, &xprt->xpt_flags);
+- svc_delete_xprt(xprt);
++ set_bit(XPT_BUSY, &xprt->xpt_flags);
+ }
+ }
+
+ void svc_close_all(struct svc_serv *serv)
+ {
++ struct svc_pool *pool;
++ struct svc_xprt *xprt;
++ struct svc_xprt *tmp;
++ int i;
++
+ svc_close_list(&serv->sv_tempsocks);
+ svc_close_list(&serv->sv_permsocks);
++
++ for (i = 0; i < serv->sv_nrpools; i++) {
++ pool = &serv->sv_pools[i];
++
++ spin_lock_bh(&pool->sp_lock);
++ while (!list_empty(&pool->sp_sockets)) {
++ xprt = list_first_entry(&pool->sp_sockets, struct svc_xprt, xpt_ready);
++ list_del_init(&xprt->xpt_ready);
++ }
++ spin_unlock_bh(&pool->sp_lock);
++ }
++ /*
++ * At this point the sp_sockets lists will stay empty, since
++ * svc_enqueue will not add new entries without taking the
++ * sp_lock and checking XPT_BUSY.
++ */
++ list_for_each_entry_safe(xprt, tmp, &serv->sv_tempsocks, xpt_list)
++ svc_delete_xprt(xprt);
++ list_for_each_entry_safe(xprt, tmp, &serv->sv_permsocks, xpt_list)
++ svc_delete_xprt(xprt);
++
+ BUG_ON(!list_empty(&serv->sv_permsocks));
+ BUG_ON(!list_empty(&serv->sv_tempsocks));
+-
+ }
+
+ /*
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0069-nfsd4-fix-lockowner-matching.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0069-nfsd4-fix-lockowner-matching.patch
new file mode 100644
index 0000000..4025ada
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0069-nfsd4-fix-lockowner-matching.patch
@@ -0,0 +1,59 @@
+From a626caf8192900669acd90726f7e2716a7cb4c8d Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields at redhat.com>
+Date: Mon, 7 Nov 2011 16:37:57 -0500
+Subject: [PATCH 069/130] nfsd4: fix lockowner matching
+
+commit b93d87c19821ba7d3ee11557403d782e541071ad upstream.
+
+Lockowners are looked up by file as well as by owner, but we were
+forgetting to do a comparison on the file. This could cause an
+incorrect result from lockt.
+
+(Note looking up the inode from the lockowner is pretty awkward here.
+The data structures need fixing.)
+
+Signed-off-by: J. Bruce Fields <bfields at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/nfsd/nfs4state.c | 17 +++++++++++++++--
+ 1 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 47e94e3..5abced7 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3809,16 +3809,29 @@ nevermind:
+ deny->ld_type = NFS4_WRITE_LT;
+ }
+
++static bool same_lockowner_ino(struct nfs4_lockowner *lo, struct inode *inode, clientid_t *clid, struct xdr_netobj *owner)
++{
++ struct nfs4_ol_stateid *lst;
++
++ if (!same_owner_str(&lo->lo_owner, owner, clid))
++ return false;
++ lst = list_first_entry(&lo->lo_owner.so_stateids,
++ struct nfs4_ol_stateid, st_perstateowner);
++ return lst->st_file->fi_inode == inode;
++}
++
+ static struct nfs4_lockowner *
+ find_lockowner_str(struct inode *inode, clientid_t *clid,
+ struct xdr_netobj *owner)
+ {
+ unsigned int hashval = lock_ownerstr_hashval(inode, clid->cl_id, owner);
++ struct nfs4_lockowner *lo;
+ struct nfs4_stateowner *op;
+
+ list_for_each_entry(op, &lock_ownerstr_hashtbl[hashval], so_strhash) {
+- if (same_owner_str(op, owner, clid))
+- return lockowner(op);
++ lo = lockowner(op);
++ if (same_lockowner_ino(lo, inode, clid, owner))
++ return lo;
+ }
+ return NULL;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch
new file mode 100644
index 0000000..cadcd5a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch
@@ -0,0 +1,82 @@
+From 721aa63a8836ec85efe320a384b97ba3c3048740 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <levinsasha928 at gmail.com>
+Date: Fri, 18 Nov 2011 12:14:49 +0200
+Subject: [PATCH 070/130] nfsd: Fix oops when parsing a 0 length export
+
+commit b2ea70afade7080360ac55c4e64ff7a5fafdb67b upstream.
+
+expkey_parse() oopses when handling a 0 length export. This is easily
+triggerable from usermode by writing 0 bytes into
+'/proc/[proc id]/net/rpc/nfsd.fh/channel'.
+
+Below is the log:
+
+[ 1402.286893] BUG: unable to handle kernel paging request at ffff880077c49fff
+[ 1402.287632] IP: [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1
+[ 1402.287632] PGD 2206063 PUD 1fdfd067 PMD 1ffbc067 PTE 8000000077c49160
+[ 1402.287632] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
+[ 1402.287632] CPU 1
+[ 1402.287632] Pid: 20198, comm: trinity Not tainted 3.2.0-rc2-sasha-00058-gc65cd37 #6
+[ 1402.287632] RIP: 0010:[<ffffffff812b4b99>] [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1
+[ 1402.287632] RSP: 0018:ffff880077f0fd68 EFLAGS: 00010292
+[ 1402.287632] RAX: ffff880077c49fff RBX: 00000000ffffffea RCX: 0000000001043400
+[ 1402.287632] RDX: 0000000000000000 RSI: ffff880077c4a000 RDI: ffffffff82283de0
+[ 1402.287632] RBP: ffff880077f0fe18 R08: 0000000000000001 R09: ffff880000000000
+[ 1402.287632] R10: 0000000000000000 R11: 0000000000000001 R12: ffff880077c4a000
+[ 1402.287632] R13: ffffffff82283de0 R14: 0000000001043400 R15: ffffffff82283de0
+[ 1402.287632] FS: 00007f25fec3f700(0000) GS:ffff88007d400000(0000) knlGS:0000000000000000
+[ 1402.287632] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+[ 1402.287632] CR2: ffff880077c49fff CR3: 0000000077e1d000 CR4: 00000000000406e0
+[ 1402.287632] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 1402.287632] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+[ 1402.287632] Process trinity (pid: 20198, threadinfo ffff880077f0e000, task ffff880077db17b0)
+[ 1402.287632] Stack:
+[ 1402.287632] ffff880077db17b0 ffff880077c4a000 ffff880077f0fdb8 ffffffff810b411e
+[ 1402.287632] ffff880000000000 ffff880077db17b0 ffff880077c4a000 ffffffff82283de0
+[ 1402.287632] 0000000001043400 ffffffff82283de0 ffff880077f0fde8 ffffffff81111f63
+[ 1402.287632] Call Trace:
+[ 1402.287632] [<ffffffff810b411e>] ? lock_release+0x1af/0x1bc
+[ 1402.287632] [<ffffffff81111f63>] ? might_fault+0x97/0x9e
+[ 1402.287632] [<ffffffff81111f1a>] ? might_fault+0x4e/0x9e
+[ 1402.287632] [<ffffffff81a8bcf2>] cache_do_downcall+0x3e/0x4f
+[ 1402.287632] [<ffffffff81a8c950>] cache_write.clone.16+0xbb/0x130
+[ 1402.287632] [<ffffffff81a8c9df>] ? cache_write_pipefs+0x1a/0x1a
+[ 1402.287632] [<ffffffff81a8c9f8>] cache_write_procfs+0x19/0x1b
+[ 1402.287632] [<ffffffff8118dc54>] proc_reg_write+0x8e/0xad
+[ 1402.287632] [<ffffffff8113fe81>] vfs_write+0xaa/0xfd
+[ 1402.287632] [<ffffffff8114142d>] ? fget_light+0x35/0x9e
+[ 1402.287632] [<ffffffff8113ff8b>] sys_write+0x48/0x6f
+[ 1402.287632] [<ffffffff81bbdb92>] system_call_fastpath+0x16/0x1b
+[ 1402.287632] Code: c0 c9 c3 55 48 63 d2 48 89 e5 48 8d 44 32 ff 41 57 41 56 41 55 41 54 53 bb ea ff ff ff 48 81 ec 88 00 00 00 48 89 b5 58 ff ff ff
+[ 1402.287632] 38 0a 0f 85 89 02 00 00 c6 00 00 48 8b 3d 44 4a e5 01 48 85
+[ 1402.287632] RIP [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1
+[ 1402.287632] RSP <ffff880077f0fd68>
+[ 1402.287632] CR2: ffff880077c49fff
+[ 1402.287632] ---[ end trace 368ef53ff773a5e3 ]---
+
+Cc: "J. Bruce Fields" <bfields at fieldses.org>
+Cc: Neil Brown <neilb at suse.de>
+Cc: linux-nfs at vger.kernel.org
+Signed-off-by: Sasha Levin <levinsasha928 at gmail.com>
+Signed-off-by: J. Bruce Fields <bfields at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/nfsd/export.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
+index 62f3b90..5f312ab 100644
+--- a/fs/nfsd/export.c
++++ b/fs/nfsd/export.c
+@@ -87,7 +87,7 @@ static int expkey_parse(struct cache_detail *cd, char *mesg, int mlen)
+ struct svc_expkey key;
+ struct svc_expkey *ek = NULL;
+
+- if (mesg[mlen-1] != '\n')
++ if (mlen < 1 || mesg[mlen-1] != '\n')
+ return -EINVAL;
+ mesg[mlen-1] = 0;
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch
new file mode 100644
index 0000000..df126a5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch
@@ -0,0 +1,61 @@
+From 4af0dd80de2155ea9bdd1a691d5a902884639359 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi at suse.cz>
+Date: Thu, 12 Jan 2012 17:59:46 +0100
+Subject: [PATCH 071/130] fsnotify: don't BUG in fsnotify_destroy_mark()
+
+commit fed474857efbed79cd390d0aee224231ca718f63 upstream.
+
+Removing the parent of a watched file results in "kernel BUG at
+fs/notify/mark.c:139".
+
+To reproduce
+
+ add "-w /tmp/audit/dir/watched_file" to audit.rules
+ rm -rf /tmp/audit/dir
+
+This is caused by fsnotify_destroy_mark() being called without an
+extra reference taken by the caller.
+
+Reported by Francesco Cosoleto here:
+
+ https://bugzilla.novell.com/show_bug.cgi?id=689860
+
+Fix by removing the BUG_ON and adding a comment about not accessing mark after
+the iput.
+
+Signed-off-by: Miklos Szeredi <mszeredi at suse.cz>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/notify/mark.c | 8 +++++---
+ 1 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/notify/mark.c b/fs/notify/mark.c
+index e14587d..f104d56 100644
+--- a/fs/notify/mark.c
++++ b/fs/notify/mark.c
+@@ -135,9 +135,6 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
+
+ mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
+
+- /* 1 from caller and 1 for being on i_list/g_list */
+- BUG_ON(atomic_read(&mark->refcnt) < 2);
+-
+ spin_lock(&group->mark_lock);
+
+ if (mark->flags & FSNOTIFY_MARK_FLAG_INODE) {
+@@ -182,6 +179,11 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
+ iput(inode);
+
+ /*
++ * We don't necessarily have a ref on mark from caller so the above iput
++ * may have already destroyed it. Don't touch from now on.
++ */
++
++ /*
+ * it's possible that this group tried to destroy itself, but this
+ * this mark was simultaneously being freed by inode. If that's the
+ * case, we finish freeing the group here.
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch
new file mode 100644
index 0000000..0fdc59a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch
@@ -0,0 +1,44 @@
+From 9a2eeb78ce5b0f0d7a3a0d0917c10bd128d974d3 Mon Sep 17 00:00:00 2001
+From: Jack Steiner <steiner at sgi.com>
+Date: Fri, 6 Jan 2012 13:19:00 -0600
+Subject: [PATCH 072/130] x86, UV: Update Boot messages for SGI UV2 platform
+
+commit da517a08ac5913cd80ce3507cddd00f2a091b13c upstream.
+
+SGI UV systems print a message during boot:
+
+ UV: Found <num> blades
+
+Due to packaging changes, the blade count is not accurate for
+on the next generation of the platform. This patch corrects the
+count.
+
+Signed-off-by: Jack Steiner <steiner at sgi.com>
+Link: http://lkml.kernel.org/r/20120106191900.GA19772@sgi.com
+Signed-off-by: Ingo Molnar <mingo at elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/x86/kernel/apic/x2apic_uv_x.c | 7 ++++++-
+ 1 files changed, 6 insertions(+), 1 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
+index 9d59bba..79b05b8 100644
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -769,7 +769,12 @@ void __init uv_system_init(void)
+ for(i = 0; i < UVH_NODE_PRESENT_TABLE_DEPTH; i++)
+ uv_possible_blades +=
+ hweight64(uv_read_local_mmr( UVH_NODE_PRESENT_TABLE + i * 8));
+- printk(KERN_DEBUG "UV: Found %d blades\n", uv_num_possible_blades());
++
++ /* uv_num_possible_blades() is really the hub count */
++ printk(KERN_INFO "UV: Found %d blades, %d hubs\n",
++ is_uv1_hub() ? uv_num_possible_blades() :
++ (uv_num_possible_blades() + 1) / 2,
++ uv_num_possible_blades());
+
+ bytes = sizeof(struct uv_blade_info) * uv_num_possible_blades();
+ uv_blade_info = kzalloc(bytes, GFP_KERNEL);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch
new file mode 100644
index 0000000..f4bc909
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch
@@ -0,0 +1,46 @@
+From e27a416d10935bfd79c8783a3b3ccf27e1d16230 Mon Sep 17 00:00:00 2001
+From: David Daney <david.daney at cavium.com>
+Date: Mon, 19 Dec 2011 17:42:42 -0800
+Subject: [PATCH 073/130] recordmcount: Fix handling of elf64 big-endian
+ objects.
+
+commit 2e885057b7f75035f0b85e02f737891482815a81 upstream.
+
+In ELF64, the sh_flags field is 64-bits wide. recordmcount was
+erroneously treating it as a 32-bit wide field. For little endian
+objects this works because the flags of interest (SHF_EXECINSTR)
+reside in the lower 32 bits of the word, and you get the same result
+with either a 32-bit or 64-bit read. Big endian objects on the
+other hand do not work at all with this error.
+
+The fix: Correctly treat sh_flags as 64-bits wide in elf64 objects.
+
+The symptom I observed was that my
+__start_mcount_loc..__stop_mcount_loc was empty even though ftrace
+function tracing was enabled.
+
+Link: http://lkml.kernel.org/r/1324345362-12230-1-git-send-email-ddaney.cavm@gmail.com
+
+Signed-off-by: David Daney <david.daney at cavium.com>
+Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ scripts/recordmcount.h | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
+index f40a6af6..54e35c1 100644
+--- a/scripts/recordmcount.h
++++ b/scripts/recordmcount.h
+@@ -462,7 +462,7 @@ __has_rel_mcount(Elf_Shdr const *const relhdr, /* is SHT_REL or SHT_RELA */
+ succeed_file();
+ }
+ if (w(txthdr->sh_type) != SHT_PROGBITS ||
+- !(w(txthdr->sh_flags) & SHF_EXECINSTR))
++ !(_w(txthdr->sh_flags) & SHF_EXECINSTR))
+ return NULL;
+ return txtname;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch
new file mode 100644
index 0000000..afbd62d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch
@@ -0,0 +1,62 @@
+From 847db7a6053aff7d165a60f10a8cb585a950e6f9 Mon Sep 17 00:00:00 2001
+From: Haogang Chen <haogangchen at gmail.com>
+Date: Tue, 29 Nov 2011 18:32:25 -0300
+Subject: [PATCH 074/130] uvcvideo: Fix integer overflow in
+ uvc_ioctl_ctrl_map()
+
+commit 806e23e95f94a27ee445022d724060b9b45cb64a upstream.
+
+There is a potential integer overflow in uvc_ioctl_ctrl_map(). When a
+large xmap->menu_count is passed from the userspace, the subsequent call
+to kmalloc() will allocate a buffer smaller than expected.
+map->menu_count and map->menu_info would later be used in a loop (e.g.
+in uvc_query_v4l2_ctrl), which leads to out-of-bound access.
+
+The patch checks the ioctl argument and returns -EINVAL for zero or too
+large values in xmap->menu_count.
+
+Signed-off-by: Haogang Chen <haogangchen at gmail.com>
+[laurent.pinchart at ideasonboard.com Prevent excessive memory consumption]
+Signed-off-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/media/video/uvc/uvc_v4l2.c | 9 +++++++++
+ drivers/media/video/uvc/uvcvideo.h | 1 +
+ 2 files changed, 10 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
+index dadf11f..cf7788f 100644
+--- a/drivers/media/video/uvc/uvc_v4l2.c
++++ b/drivers/media/video/uvc/uvc_v4l2.c
+@@ -58,6 +58,15 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
+ break;
+
+ case V4L2_CTRL_TYPE_MENU:
++ /* Prevent excessive memory consumption, as well as integer
++ * overflows.
++ */
++ if (xmap->menu_count == 0 ||
++ xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) {
++ ret = -EINVAL;
++ goto done;
++ }
++
+ size = xmap->menu_count * sizeof(*map->menu_info);
+ map->menu_info = kmalloc(size, GFP_KERNEL);
+ if (map->menu_info == NULL) {
+diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
+index 4c1392e..bc446ba 100644
+--- a/drivers/media/video/uvc/uvcvideo.h
++++ b/drivers/media/video/uvc/uvcvideo.h
+@@ -113,6 +113,7 @@
+
+ /* Maximum allowed number of control mappings per device */
+ #define UVC_MAX_CONTROL_MAPPINGS 1024
++#define UVC_MAX_CONTROL_MENU_ENTRIES 32
+
+ /* Devices quirks */
+ #define UVC_QUIRK_STATUS_INTERVAL 0x00000001
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch
new file mode 100644
index 0000000..d369d7a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch
@@ -0,0 +1,172 @@
+From 48a7a2bae38f29f5b231f460dd2852e00e50d549 Mon Sep 17 00:00:00 2001
+From: Dave Chinner <david at fromorbit.com>
+Date: Tue, 23 Aug 2011 18:56:24 +1000
+Subject: [PATCH 075/130] dcache: use a dispose list in select_parent
+
+commit b48f03b319ba78f3abf9a7044d1f436d8d90f4f9 upstream.
+
+select_parent currently abuses the dentry cache LRU to provide
+cleanup features for child dentries that need to be freed. It moves
+them to the tail of the LRU, then tells shrink_dcache_parent() to
+calls __shrink_dcache_sb to unconditionally move them to a dispose
+list (as DCACHE_REFERENCED is ignored). __shrink_dcache_sb() has to
+relock the dentries to move them off the LRU onto the dispose list,
+but otherwise does not touch the dentries that select_parent() moved
+to the tail of the LRU. It then passses the dispose list to
+shrink_dentry_list() which tries to free the dentries.
+
+IOWs, the use of __shrink_dcache_sb() is superfluous - we can build
+exactly the same list of dentries for disposal directly in
+select_parent() and call shrink_dentry_list() instead of calling
+__shrink_dcache_sb() to do that. This means that we avoid long holds
+on the lru lock walking the LRU moving dentries to the dispose list
+We also avoid the need to relock each dentry just to move it off the
+LRU, reducing the numebr of times we lock each dentry to dispose of
+them in shrink_dcache_parent() from 3 to 2 times.
+
+Further, we remove one of the two callers of __shrink_dcache_sb().
+This also means that __shrink_dcache_sb can be moved into back into
+prune_dcache_sb() and we no longer have to handle referenced
+dentries conditionally, simplifying the code.
+
+Signed-off-by: Dave Chinner <dchinner at redhat.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/dcache.c | 63 +++++++++++++++++++---------------------------------------
+ 1 files changed, 21 insertions(+), 42 deletions(-)
+
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 89509b5..108116e 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -275,15 +275,15 @@ static void dentry_lru_prune(struct dentry *dentry)
+ }
+ }
+
+-static void dentry_lru_move_tail(struct dentry *dentry)
++static void dentry_lru_move_list(struct dentry *dentry, struct list_head *list)
+ {
+ spin_lock(&dcache_lru_lock);
+ if (list_empty(&dentry->d_lru)) {
+- list_add_tail(&dentry->d_lru, &dentry->d_sb->s_dentry_lru);
++ list_add_tail(&dentry->d_lru, list);
+ dentry->d_sb->s_nr_dentry_unused++;
+ dentry_stat.nr_unused++;
+ } else {
+- list_move_tail(&dentry->d_lru, &dentry->d_sb->s_dentry_lru);
++ list_move_tail(&dentry->d_lru, list);
+ }
+ spin_unlock(&dcache_lru_lock);
+ }
+@@ -769,14 +769,18 @@ static void shrink_dentry_list(struct list_head *list)
+ }
+
+ /**
+- * __shrink_dcache_sb - shrink the dentry LRU on a given superblock
+- * @sb: superblock to shrink dentry LRU.
+- * @count: number of entries to prune
+- * @flags: flags to control the dentry processing
++ * prune_dcache_sb - shrink the dcache
++ * @sb: superblock
++ * @count: number of entries to try to free
++ *
++ * Attempt to shrink the superblock dcache LRU by @count entries. This is
++ * done when we need more memory an called from the superblock shrinker
++ * function.
+ *
+- * If flags contains DCACHE_REFERENCED reference dentries will not be pruned.
++ * This function may fail to free any resources if all the dentries are in
++ * use.
+ */
+-static void __shrink_dcache_sb(struct super_block *sb, int count, int flags)
++void prune_dcache_sb(struct super_block *sb, int count)
+ {
+ struct dentry *dentry;
+ LIST_HEAD(referenced);
+@@ -795,13 +799,7 @@ relock:
+ goto relock;
+ }
+
+- /*
+- * If we are honouring the DCACHE_REFERENCED flag and the
+- * dentry has this flag set, don't free it. Clear the flag
+- * and put it back on the LRU.
+- */
+- if (flags & DCACHE_REFERENCED &&
+- dentry->d_flags & DCACHE_REFERENCED) {
++ if (dentry->d_flags & DCACHE_REFERENCED) {
+ dentry->d_flags &= ~DCACHE_REFERENCED;
+ list_move(&dentry->d_lru, &referenced);
+ spin_unlock(&dentry->d_lock);
+@@ -821,23 +819,6 @@ relock:
+ }
+
+ /**
+- * prune_dcache_sb - shrink the dcache
+- * @sb: superblock
+- * @nr_to_scan: number of entries to try to free
+- *
+- * Attempt to shrink the superblock dcache LRU by @nr_to_scan entries. This is
+- * done when we need more memory an called from the superblock shrinker
+- * function.
+- *
+- * This function may fail to free any resources if all the dentries are in
+- * use.
+- */
+-void prune_dcache_sb(struct super_block *sb, int nr_to_scan)
+-{
+- __shrink_dcache_sb(sb, nr_to_scan, DCACHE_REFERENCED);
+-}
+-
+-/**
+ * shrink_dcache_sb - shrink dcache for a superblock
+ * @sb: superblock
+ *
+@@ -1091,7 +1072,7 @@ EXPORT_SYMBOL(have_submounts);
+ * drop the lock and return early due to latency
+ * constraints.
+ */
+-static int select_parent(struct dentry * parent)
++static int select_parent(struct dentry *parent, struct list_head *dispose)
+ {
+ struct dentry *this_parent;
+ struct list_head *next;
+@@ -1113,12 +1094,11 @@ resume:
+
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+
+- /*
+- * move only zero ref count dentries to the end
+- * of the unused list for prune_dcache
++ /*
++ * move only zero ref count dentries to the dispose list.
+ */
+ if (!dentry->d_count) {
+- dentry_lru_move_tail(dentry);
++ dentry_lru_move_list(dentry, dispose);
+ found++;
+ } else {
+ dentry_lru_del(dentry);
+@@ -1180,14 +1160,13 @@ rename_retry:
+ *
+ * Prune the dcache to remove unused children of the parent dentry.
+ */
+-
+ void shrink_dcache_parent(struct dentry * parent)
+ {
+- struct super_block *sb = parent->d_sb;
++ LIST_HEAD(dispose);
+ int found;
+
+- while ((found = select_parent(parent)) != 0)
+- __shrink_dcache_sb(sb, found, 0);
++ while ((found = select_parent(parent, &dispose)) != 0)
++ shrink_dentry_list(&dispose);
+ }
+ EXPORT_SYMBOL(shrink_dcache_parent);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0076-fix-shrink_dcache_parent-livelock.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0076-fix-shrink_dcache_parent-livelock.patch
new file mode 100644
index 0000000..9dd4f0c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0076-fix-shrink_dcache_parent-livelock.patch
@@ -0,0 +1,130 @@
+From 26c9f57c6ada2518c265d0a52b29a26be7bcb746 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <miklos at szeredi.hu>
+Date: Tue, 10 Jan 2012 18:22:25 +0100
+Subject: [PATCH 076/130] fix shrink_dcache_parent() livelock
+
+commit eaf5f9073533cde21c7121c136f1c3f072d9cf59 upstream.
+
+Two (or more) concurrent calls of shrink_dcache_parent() on the same dentry may
+cause shrink_dcache_parent() to loop forever.
+
+Here's what appears to happen:
+
+1 - CPU0: select_parent(P) finds C and puts it on dispose list, returns 1
+
+2 - CPU1: select_parent(P) locks P->d_lock
+
+3 - CPU0: shrink_dentry_list() locks C->d_lock
+ dentry_kill(C) tries to lock P->d_lock but fails, unlocks C->d_lock
+
+4 - CPU1: select_parent(P) locks C->d_lock,
+ moves C from dispose list being processed on CPU0 to the new
+dispose list, returns 1
+
+5 - CPU0: shrink_dentry_list() finds dispose list empty, returns
+
+6 - Goto 2 with CPU0 and CPU1 switched
+
+Basically select_parent() steals the dentry from shrink_dentry_list() and thinks
+it found a new one, causing shrink_dentry_list() to think it's making progress
+and loop over and over.
+
+One way to trigger this is to make udev calls stat() on the sysfs file while it
+is going away.
+
+Having a file in /lib/udev/rules.d/ with only this one rule seems to the trick:
+
+ATTR{vendor}=="0x8086", ATTR{device}=="0x10ca", ENV{PCI_SLOT_NAME}="%k", ENV{MATCHADDR}="$attr{address}", RUN+="/bin/true"
+
+Then execute the following loop:
+
+while true; do
+ echo -bond0 > /sys/class/net/bonding_masters
+ echo +bond0 > /sys/class/net/bonding_masters
+ echo -bond1 > /sys/class/net/bonding_masters
+ echo +bond1 > /sys/class/net/bonding_masters
+done
+
+One fix would be to check all callers and prevent concurrent calls to
+shrink_dcache_parent(). But I think a better solution is to stop the
+stealing behavior.
+
+This patch adds a new dentry flag that is set when the dentry is added to the
+dispose list. The flag is cleared in dentry_lru_del() in case the dentry gets a
+new reference just before being pruned.
+
+If the dentry has this flag, select_parent() will skip it and let
+shrink_dentry_list() retry pruning it. With select_parent() skipping those
+dentries there will not be the appearance of progress (new dentries found) when
+there is none, hence shrink_dcache_parent() will not loop forever.
+
+Set the flag is also set in prune_dcache_sb() for consistency as suggested by
+Linus.
+
+Signed-off-by: Miklos Szeredi <mszeredi at suse.cz>
+Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/dcache.c | 15 +++++++++++----
+ include/linux/dcache.h | 1 +
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 108116e..f7908ae 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -242,6 +242,7 @@ static void dentry_lru_add(struct dentry *dentry)
+ static void __dentry_lru_del(struct dentry *dentry)
+ {
+ list_del_init(&dentry->d_lru);
++ dentry->d_flags &= ~DCACHE_SHRINK_LIST;
+ dentry->d_sb->s_nr_dentry_unused--;
+ dentry_stat.nr_unused--;
+ }
+@@ -805,6 +806,7 @@ relock:
+ spin_unlock(&dentry->d_lock);
+ } else {
+ list_move_tail(&dentry->d_lru, &tmp);
++ dentry->d_flags |= DCACHE_SHRINK_LIST;
+ spin_unlock(&dentry->d_lock);
+ if (!--count)
+ break;
+@@ -1096,14 +1098,19 @@ resume:
+
+ /*
+ * move only zero ref count dentries to the dispose list.
++ *
++ * Those which are presently on the shrink list, being processed
++ * by shrink_dentry_list(), shouldn't be moved. Otherwise the
++ * loop in shrink_dcache_parent() might not make any progress
++ * and loop forever.
+ */
+- if (!dentry->d_count) {
++ if (dentry->d_count) {
++ dentry_lru_del(dentry);
++ } else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
+ dentry_lru_move_list(dentry, dispose);
++ dentry->d_flags |= DCACHE_SHRINK_LIST;
+ found++;
+- } else {
+- dentry_lru_del(dentry);
+ }
+-
+ /*
+ * We can return to the caller if we have found some (this
+ * ensures forward progress). We'll be coming back to find
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index ed9f74f..4eb8c80 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -203,6 +203,7 @@ struct dentry_operations {
+
+ #define DCACHE_CANT_MOUNT 0x0100
+ #define DCACHE_GENOCIDE 0x0200
++#define DCACHE_SHRINK_LIST 0x0400
+
+ #define DCACHE_NFSFS_RENAMED 0x1000
+ /* this dentry has been "silly renamed" and has to be deleted on the last
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch
new file mode 100644
index 0000000..1bcc272
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch
@@ -0,0 +1,64 @@
+From 6feb42647758cf08e5707c9f6a2f0d78d6fb3cc8 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf at gmail.com>
+Date: Thu, 12 Jan 2012 23:18:41 +0800
+Subject: [PATCH 077/130] pnfsblock: acquire im_lock in _preload_range
+
+commit 39e567ae36fe03c2b446e1b83ee3d39bea08f90b upstream.
+
+When calling _add_entry, we should take the im_lock to protect
+agains other modifiers.
+
+Signed-off-by: Peng Tao <peng_tao at emc.com>
+Signed-off-by: Benny Halevy <bhalevy at tonian.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/nfs/blocklayout/extents.c | 11 ++++++-----
+ 1 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/nfs/blocklayout/extents.c b/fs/nfs/blocklayout/extents.c
+index 19fa7b0..c69682a 100644
+--- a/fs/nfs/blocklayout/extents.c
++++ b/fs/nfs/blocklayout/extents.c
+@@ -139,11 +139,13 @@ static int _set_range(struct my_tree *tree, int32_t tag, u64 s, u64 length)
+ }
+
+ /* Ensure that future operations on given range of tree will not malloc */
+-static int _preload_range(struct my_tree *tree, u64 offset, u64 length)
++static int _preload_range(struct pnfs_inval_markings *marks,
++ u64 offset, u64 length)
+ {
+ u64 start, end, s;
+ int count, i, used = 0, status = -ENOMEM;
+ struct pnfs_inval_tracking **storage;
++ struct my_tree *tree = &marks->im_tree;
+
+ dprintk("%s(%llu, %llu) enter\n", __func__, offset, length);
+ start = normalize(offset, tree->mtt_step_size);
+@@ -161,12 +163,11 @@ static int _preload_range(struct my_tree *tree, u64 offset, u64 length)
+ goto out_cleanup;
+ }
+
+- /* Now need lock - HOW??? */
+-
++ spin_lock(&marks->im_lock);
+ for (s = start; s < end; s += tree->mtt_step_size)
+ used += _add_entry(tree, s, INTERNAL_EXISTS, storage[used]);
++ spin_unlock(&marks->im_lock);
+
+- /* Unlock - HOW??? */
+ status = 0;
+
+ out_cleanup:
+@@ -286,7 +287,7 @@ int bl_mark_sectors_init(struct pnfs_inval_markings *marks,
+
+ start = normalize(offset, marks->im_block_size);
+ end = normalize_up(offset + length, marks->im_block_size);
+- if (_preload_range(&marks->im_tree, start, end - start))
++ if (_preload_range(marks, start, end - start))
+ goto outerr;
+
+ spin_lock(&marks->im_lock);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch
new file mode 100644
index 0000000..99b0428
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch
@@ -0,0 +1,46 @@
+From b6fd682adf525b6766b8e16b39e39412153d19da Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf at gmail.com>
+Date: Thu, 12 Jan 2012 23:18:47 +0800
+Subject: [PATCH 078/130] pnfsblock: don't spinlock when freeing block_dev
+
+commit 93a3844ee0f843b05a1df4b52e1a19ff26b98d24 upstream.
+
+bl_free_block_dev() may sleep. We can not call it with spinlock held.
+Besides, there is no need to take bm_lock as we are last user freeing bm_devlist.
+
+Signed-off-by: Peng Tao <peng_tao at emc.com>
+Signed-off-by: Benny Halevy <bhalevy at tonian.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/nfs/blocklayout/blocklayout.c | 11 ++++-------
+ 1 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
+index 281ae95..ce8129d 100644
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -779,16 +779,13 @@ bl_cleanup_layoutcommit(struct nfs4_layoutcommit_data *lcdata)
+ static void free_blk_mountid(struct block_mount_id *mid)
+ {
+ if (mid) {
+- struct pnfs_block_dev *dev;
+- spin_lock(&mid->bm_lock);
+- while (!list_empty(&mid->bm_devlist)) {
+- dev = list_first_entry(&mid->bm_devlist,
+- struct pnfs_block_dev,
+- bm_node);
++ struct pnfs_block_dev *dev, *tmp;
++
++ /* No need to take bm_lock as we are last user freeing bm_devlist */
++ list_for_each_entry_safe(dev, tmp, &mid->bm_devlist, bm_node) {
+ list_del(&dev->bm_node);
+ bl_free_block_dev(dev);
+ }
+- spin_unlock(&mid->bm_lock);
+ kfree(mid);
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0079-pnfsblock-limit-bio-page-count.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0079-pnfsblock-limit-bio-page-count.patch
new file mode 100644
index 0000000..74d1d69
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0079-pnfsblock-limit-bio-page-count.patch
@@ -0,0 +1,51 @@
+From 4ebc5f6665b0d03c9488fafb7ac6f8bd2f104d70 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf at gmail.com>
+Date: Thu, 12 Jan 2012 23:18:48 +0800
+Subject: [PATCH 079/130] pnfsblock: limit bio page count
+
+commit 74a6eeb44ca6174d9cc93b9b8b4d58211c57bc80 upstream.
+
+One bio can have at most BIO_MAX_PAGES pages. We should limit it bec otherwise
+bio_alloc will fail when there are many pages in one read/write_pagelist.
+
+Signed-off-by: Peng Tao <peng_tao at emc.com>
+Signed-off-by: Benny Halevy <bhalevy at tonian.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/nfs/blocklayout/blocklayout.c | 17 +++++++++++------
+ 1 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
+index ce8129d..3db6b82 100644
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -146,14 +146,19 @@ static struct bio *bl_alloc_init_bio(int npg, sector_t isect,
+ {
+ struct bio *bio;
+
++ npg = min(npg, BIO_MAX_PAGES);
+ bio = bio_alloc(GFP_NOIO, npg);
+- if (!bio)
+- return NULL;
++ if (!bio && (current->flags & PF_MEMALLOC)) {
++ while (!bio && (npg /= 2))
++ bio = bio_alloc(GFP_NOIO, npg);
++ }
+
+- bio->bi_sector = isect - be->be_f_offset + be->be_v_offset;
+- bio->bi_bdev = be->be_mdev;
+- bio->bi_end_io = end_io;
+- bio->bi_private = par;
++ if (bio) {
++ bio->bi_sector = isect - be->be_f_offset + be->be_v_offset;
++ bio->bi_bdev = be->be_mdev;
++ bio->bi_end_io = end_io;
++ bio->bi_private = par;
++ }
+ return bio;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch
new file mode 100644
index 0000000..eca2dda
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch
@@ -0,0 +1,635 @@
+From 5b8206fb91b97732d80ada2e494e060d50ab30bd Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg at intel.com>
+Date: Tue, 29 Nov 2011 10:20:02 +0100
+Subject: [PATCH 080/130] mac80211: revert on-channel work optimisations
+
+commit e76aadc572288a158ae18ae1c10fe395c7bca066 upstream.
+
+Backport note:
+This patch it's a full revert of commit b23b025f "mac80211: Optimize
+scans on current operating channel.". On upstrem revert e76aadc5 we
+keep some bits from that commit, which are needed for upstream version
+of mac80211.
+
+The on-channel work optimisations have caused a
+number of issues, and the code is unfortunately
+very complex and almost impossible to follow.
+Instead of attempting to put in more workarounds
+let's just remove those optimisations, we can
+work on them again later, after we change the
+whole auth/assoc design.
+
+This should fix rate_control_send_low() warnings,
+see RH bug 731365.
+
+Signed-off-by: Johannes Berg <johannes.berg at intel.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ net/mac80211/ieee80211_i.h | 13 +++----
+ net/mac80211/main.c | 58 +++-----------------------------
+ net/mac80211/offchannel.c | 68 +++++++++++++++++---------------------
+ net/mac80211/rx.c | 10 ++++-
+ net/mac80211/scan.c | 77 ++++++++++++-------------------------------
+ net/mac80211/tx.c | 3 +-
+ net/mac80211/work.c | 77 ++++++-------------------------------------
+ 7 files changed, 85 insertions(+), 221 deletions(-)
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index ea10a51..73495f1 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -702,6 +702,8 @@ struct tpt_led_trigger {
+ * well be on the operating channel
+ * @SCAN_HW_SCANNING: The hardware is scanning for us, we have no way to
+ * determine if we are on the operating channel or not
++ * @SCAN_OFF_CHANNEL: We're off our operating channel for scanning,
++ * gets only set in conjunction with SCAN_SW_SCANNING
+ * @SCAN_COMPLETED: Set for our scan work function when the driver reported
+ * that the scan completed.
+ * @SCAN_ABORTED: Set for our scan work function when the driver reported
+@@ -710,6 +712,7 @@ struct tpt_led_trigger {
+ enum {
+ SCAN_SW_SCANNING,
+ SCAN_HW_SCANNING,
++ SCAN_OFF_CHANNEL,
+ SCAN_COMPLETED,
+ SCAN_ABORTED,
+ };
+@@ -1140,14 +1143,10 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
+ void ieee80211_sched_scan_stopped_work(struct work_struct *work);
+
+ /* off-channel helpers */
+-bool ieee80211_cfg_on_oper_channel(struct ieee80211_local *local);
+-void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
+- bool tell_ap);
+-void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
+- bool offchannel_ps_enable);
++void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local);
++void ieee80211_offchannel_stop_station(struct ieee80211_local *local);
+ void ieee80211_offchannel_return(struct ieee80211_local *local,
+- bool enable_beaconing,
+- bool offchannel_ps_disable);
++ bool enable_beaconing);
+ void ieee80211_hw_roc_setup(struct ieee80211_local *local);
+
+ /* interface handling */
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index cae4435..a7536fd 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -92,47 +92,6 @@ static void ieee80211_reconfig_filter(struct work_struct *work)
+ ieee80211_configure_filter(local);
+ }
+
+-/*
+- * Returns true if we are logically configured to be on
+- * the operating channel AND the hardware-conf is currently
+- * configured on the operating channel. Compares channel-type
+- * as well.
+- */
+-bool ieee80211_cfg_on_oper_channel(struct ieee80211_local *local)
+-{
+- struct ieee80211_channel *chan, *scan_chan;
+- enum nl80211_channel_type channel_type;
+-
+- /* This logic needs to match logic in ieee80211_hw_config */
+- if (local->scan_channel) {
+- chan = local->scan_channel;
+- /* If scanning on oper channel, use whatever channel-type
+- * is currently in use.
+- */
+- if (chan == local->oper_channel)
+- channel_type = local->_oper_channel_type;
+- else
+- channel_type = NL80211_CHAN_NO_HT;
+- } else if (local->tmp_channel) {
+- chan = scan_chan = local->tmp_channel;
+- channel_type = local->tmp_channel_type;
+- } else {
+- chan = local->oper_channel;
+- channel_type = local->_oper_channel_type;
+- }
+-
+- if (chan != local->oper_channel ||
+- channel_type != local->_oper_channel_type)
+- return false;
+-
+- /* Check current hardware-config against oper_channel. */
+- if ((local->oper_channel != local->hw.conf.channel) ||
+- (local->_oper_channel_type != local->hw.conf.channel_type))
+- return false;
+-
+- return true;
+-}
+-
+ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
+ {
+ struct ieee80211_channel *chan, *scan_chan;
+@@ -145,9 +104,6 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
+
+ scan_chan = local->scan_channel;
+
+- /* If this off-channel logic ever changes, ieee80211_on_oper_channel
+- * may need to change as well.
+- */
+ offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
+ if (scan_chan) {
+ chan = scan_chan;
+@@ -158,19 +114,17 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
+ channel_type = local->_oper_channel_type;
+ else
+ channel_type = NL80211_CHAN_NO_HT;
+- } else if (local->tmp_channel) {
++ local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
++ } else if (local->tmp_channel &&
++ local->oper_channel != local->tmp_channel) {
+ chan = scan_chan = local->tmp_channel;
+ channel_type = local->tmp_channel_type;
++ local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
+ } else {
+ chan = local->oper_channel;
+ channel_type = local->_oper_channel_type;
+- }
+-
+- if (chan != local->oper_channel ||
+- channel_type != local->_oper_channel_type)
+- local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
+- else
+ local->hw.conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
++ }
+
+ offchannel_flag ^= local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
+
+@@ -279,7 +233,7 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
+
+ if (changed & BSS_CHANGED_BEACON_ENABLED) {
+ if (local->quiescing || !ieee80211_sdata_running(sdata) ||
+- test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)) {
++ test_bit(SCAN_SW_SCANNING, &local->scanning)) {
+ sdata->vif.bss_conf.enable_beacon = false;
+ } else {
+ /*
+diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
+index 3d41441..1b239be 100644
+--- a/net/mac80211/offchannel.c
++++ b/net/mac80211/offchannel.c
+@@ -18,14 +18,10 @@
+ #include "driver-trace.h"
+
+ /*
+- * Tell our hardware to disable PS.
+- * Optionally inform AP that we will go to sleep so that it will buffer
+- * the frames while we are doing off-channel work. This is optional
+- * because we *may* be doing work on-operating channel, and want our
+- * hardware unconditionally awake, but still let the AP send us normal frames.
++ * inform AP that we will go to sleep so that it will buffer the frames
++ * while we scan
+ */
+-static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata,
+- bool tell_ap)
++static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
+ {
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+@@ -46,8 +42,8 @@ static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata,
+ ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+ }
+
+- if (tell_ap && (!local->offchannel_ps_enabled ||
+- !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)))
++ if (!(local->offchannel_ps_enabled) ||
++ !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
+ /*
+ * If power save was enabled, no need to send a nullfunc
+ * frame because AP knows that we are sleeping. But if the
+@@ -82,9 +78,6 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
+ * we are sleeping, let's just enable power save mode in
+ * hardware.
+ */
+- /* TODO: Only set hardware if CONF_PS changed?
+- * TODO: Should we set offchannel_ps_enabled to false?
+- */
+ local->hw.conf.flags |= IEEE80211_CONF_PS;
+ ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+ } else if (local->hw.conf.dynamic_ps_timeout > 0) {
+@@ -103,61 +96,63 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
+ ieee80211_sta_reset_conn_monitor(sdata);
+ }
+
+-void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
+- bool offchannel_ps_enable)
++void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local)
+ {
+ struct ieee80211_sub_if_data *sdata;
+
+- /*
+- * notify the AP about us leaving the channel and stop all
+- * STA interfaces.
+- */
+ mutex_lock(&local->iflist_mtx);
+ list_for_each_entry(sdata, &local->interfaces, list) {
+ if (!ieee80211_sdata_running(sdata))
+ continue;
+
+- if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
+- set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+-
+- /* Check to see if we should disable beaconing. */
++ /* disable beaconing */
+ if (sdata->vif.type == NL80211_IFTYPE_AP ||
+ sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+ sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+ ieee80211_bss_info_change_notify(
+ sdata, BSS_CHANGED_BEACON_ENABLED);
+
+- if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
++ /*
++ * only handle non-STA interfaces here, STA interfaces
++ * are handled in ieee80211_offchannel_stop_station(),
++ * e.g., from the background scan state machine.
++ *
++ * In addition, do not stop monitor interface to allow it to be
++ * used from user space controlled off-channel operations.
++ */
++ if (sdata->vif.type != NL80211_IFTYPE_STATION &&
++ sdata->vif.type != NL80211_IFTYPE_MONITOR) {
++ set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+ netif_tx_stop_all_queues(sdata->dev);
+- if (offchannel_ps_enable &&
+- (sdata->vif.type == NL80211_IFTYPE_STATION) &&
+- sdata->u.mgd.associated)
+- ieee80211_offchannel_ps_enable(sdata, true);
+ }
+ }
+ mutex_unlock(&local->iflist_mtx);
+ }
+
+-void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
+- bool tell_ap)
++void ieee80211_offchannel_stop_station(struct ieee80211_local *local)
+ {
+ struct ieee80211_sub_if_data *sdata;
+
++ /*
++ * notify the AP about us leaving the channel and stop all STA interfaces
++ */
+ mutex_lock(&local->iflist_mtx);
+ list_for_each_entry(sdata, &local->interfaces, list) {
+ if (!ieee80211_sdata_running(sdata))
+ continue;
+
+- if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+- sdata->u.mgd.associated)
+- ieee80211_offchannel_ps_enable(sdata, tell_ap);
++ if (sdata->vif.type == NL80211_IFTYPE_STATION) {
++ set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
++ netif_tx_stop_all_queues(sdata->dev);
++ if (sdata->u.mgd.associated)
++ ieee80211_offchannel_ps_enable(sdata);
++ }
+ }
+ mutex_unlock(&local->iflist_mtx);
+ }
+
+ void ieee80211_offchannel_return(struct ieee80211_local *local,
+- bool enable_beaconing,
+- bool offchannel_ps_disable)
++ bool enable_beaconing)
+ {
+ struct ieee80211_sub_if_data *sdata;
+
+@@ -167,8 +162,7 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
+ continue;
+
+ /* Tell AP we're back */
+- if (offchannel_ps_disable &&
+- sdata->vif.type == NL80211_IFTYPE_STATION) {
++ if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+ if (sdata->u.mgd.associated)
+ ieee80211_offchannel_ps_disable(sdata);
+ }
+@@ -188,7 +182,7 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
+ netif_tx_wake_all_queues(sdata->dev);
+ }
+
+- /* Check to see if we should re-enable beaconing */
++ /* re-enable beaconing */
+ if (enable_beaconing &&
+ (sdata->vif.type == NL80211_IFTYPE_AP ||
+ sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index fb123e2..5c51607 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -421,10 +421,16 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
+ return RX_CONTINUE;
+
+ if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
+- test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+ local->sched_scanning)
+ return ieee80211_scan_rx(rx->sdata, skb);
+
++ if (test_bit(SCAN_SW_SCANNING, &local->scanning)) {
++ /* drop all the other packets during a software scan anyway */
++ if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
++ dev_kfree_skb(skb);
++ return RX_QUEUED;
++ }
++
+ /* scanning finished during invoking of handlers */
+ I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
+ return RX_DROP_UNUSABLE;
+@@ -2858,7 +2864,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+ local->dot11ReceivedFragmentCount++;
+
+ if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
+- test_bit(SCAN_SW_SCANNING, &local->scanning)))
++ test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
+ status->rx_flags |= IEEE80211_RX_IN_SCAN;
+
+ if (ieee80211_is_mgmt(fc))
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index 105436d..5279300 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -213,14 +213,6 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
+ if (bss)
+ ieee80211_rx_bss_put(sdata->local, bss);
+
+- /* If we are on-operating-channel, and this packet is for the
+- * current channel, pass the pkt on up the stack so that
+- * the rest of the stack can make use of it.
+- */
+- if (ieee80211_cfg_on_oper_channel(sdata->local)
+- && (channel == sdata->local->oper_channel))
+- return RX_CONTINUE;
+-
+ dev_kfree_skb(skb);
+ return RX_QUEUED;
+ }
+@@ -264,8 +256,6 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
+ bool was_hw_scan)
+ {
+ struct ieee80211_local *local = hw_to_local(hw);
+- bool on_oper_chan;
+- bool enable_beacons = false;
+
+ lockdep_assert_held(&local->mtx);
+
+@@ -298,25 +288,11 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
+ local->scanning = 0;
+ local->scan_channel = NULL;
+
+- on_oper_chan = ieee80211_cfg_on_oper_channel(local);
+-
+- if (was_hw_scan || !on_oper_chan)
+- ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+- else
+- /* Set power back to normal operating levels. */
+- ieee80211_hw_config(local, 0);
+-
++ ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+ if (!was_hw_scan) {
+- bool on_oper_chan2;
+ ieee80211_configure_filter(local);
+ drv_sw_scan_complete(local);
+- on_oper_chan2 = ieee80211_cfg_on_oper_channel(local);
+- /* We should always be on-channel at this point. */
+- WARN_ON(!on_oper_chan2);
+- if (on_oper_chan2 && (on_oper_chan != on_oper_chan2))
+- enable_beacons = true;
+-
+- ieee80211_offchannel_return(local, enable_beacons, true);
++ ieee80211_offchannel_return(local, true);
+ }
+
+ ieee80211_recalc_idle(local);
+@@ -357,15 +333,13 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
+ */
+ drv_sw_scan_start(local);
+
++ ieee80211_offchannel_stop_beaconing(local);
++
+ local->leave_oper_channel_time = 0;
+ local->next_scan_state = SCAN_DECISION;
+ local->scan_channel_idx = 0;
+
+- /* We always want to use off-channel PS, even if we
+- * are not really leaving oper-channel. Don't
+- * tell the AP though, as long as we are on-channel.
+- */
+- ieee80211_offchannel_enable_all_ps(local, false);
++ drv_flush(local, false);
+
+ ieee80211_configure_filter(local);
+
+@@ -508,20 +482,7 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
+ }
+ mutex_unlock(&local->iflist_mtx);
+
+- next_chan = local->scan_req->channels[local->scan_channel_idx];
+-
+- if (ieee80211_cfg_on_oper_channel(local)) {
+- /* We're currently on operating channel. */
+- if (next_chan == local->oper_channel)
+- /* We don't need to move off of operating channel. */
+- local->next_scan_state = SCAN_SET_CHANNEL;
+- else
+- /*
+- * We do need to leave operating channel, as next
+- * scan is somewhere else.
+- */
+- local->next_scan_state = SCAN_LEAVE_OPER_CHANNEL;
+- } else {
++ if (local->scan_channel) {
+ /*
+ * we're currently scanning a different channel, let's
+ * see if we can scan another channel without interfering
+@@ -537,6 +498,7 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
+ *
+ * Otherwise switch back to the operating channel.
+ */
++ next_chan = local->scan_req->channels[local->scan_channel_idx];
+
+ bad_latency = time_after(jiffies +
+ ieee80211_scan_get_channel_time(next_chan),
+@@ -554,6 +516,12 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
+ local->next_scan_state = SCAN_ENTER_OPER_CHANNEL;
+ else
+ local->next_scan_state = SCAN_SET_CHANNEL;
++ } else {
++ /*
++ * we're on the operating channel currently, let's
++ * leave that channel now to scan another one
++ */
++ local->next_scan_state = SCAN_LEAVE_OPER_CHANNEL;
+ }
+
+ *next_delay = 0;
+@@ -562,10 +530,9 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
+ static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *local,
+ unsigned long *next_delay)
+ {
+- /* PS will already be in off-channel mode,
+- * we do that once at the beginning of scanning.
+- */
+- ieee80211_offchannel_stop_vifs(local, false);
++ ieee80211_offchannel_stop_station(local);
++
++ __set_bit(SCAN_OFF_CHANNEL, &local->scanning);
+
+ /*
+ * What if the nullfunc frames didn't arrive?
+@@ -588,15 +555,15 @@ static void ieee80211_scan_state_enter_oper_channel(struct ieee80211_local *loca
+ {
+ /* switch back to the operating channel */
+ local->scan_channel = NULL;
+- if (!ieee80211_cfg_on_oper_channel(local))
+- ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
++ ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+
+ /*
+- * Re-enable vifs and beaconing. Leave PS
+- * in off-channel state..will put that back
+- * on-channel at the end of scanning.
++ * Only re-enable station mode interface now; beaconing will be
++ * re-enabled once the full scan has been completed.
+ */
+- ieee80211_offchannel_return(local, true, false);
++ ieee80211_offchannel_return(local, false);
++
++ __clear_bit(SCAN_OFF_CHANNEL, &local->scanning);
+
+ *next_delay = HZ / 5;
+ local->next_scan_state = SCAN_DECISION;
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 1f8b120..eff1f4e 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -259,8 +259,7 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
+ if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
+ return TX_CONTINUE;
+
+- if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
+- test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
++ if (unlikely(test_bit(SCAN_OFF_CHANNEL, &tx->local->scanning)) &&
+ !ieee80211_is_probe_req(hdr->frame_control) &&
+ !ieee80211_is_nullfunc(hdr->frame_control))
+ /*
+diff --git a/net/mac80211/work.c b/net/mac80211/work.c
+index 6c53b6d..99165ef 100644
+--- a/net/mac80211/work.c
++++ b/net/mac80211/work.c
+@@ -899,26 +899,6 @@ static bool ieee80211_work_ct_coexists(enum nl80211_channel_type wk_ct,
+ return false;
+ }
+
+-static enum nl80211_channel_type
+-ieee80211_calc_ct(enum nl80211_channel_type wk_ct,
+- enum nl80211_channel_type oper_ct)
+-{
+- switch (wk_ct) {
+- case NL80211_CHAN_NO_HT:
+- return oper_ct;
+- case NL80211_CHAN_HT20:
+- if (oper_ct != NL80211_CHAN_NO_HT)
+- return oper_ct;
+- return wk_ct;
+- case NL80211_CHAN_HT40MINUS:
+- case NL80211_CHAN_HT40PLUS:
+- return wk_ct;
+- }
+- WARN_ON(1); /* shouldn't get here */
+- return wk_ct;
+-}
+-
+-
+ static void ieee80211_work_timer(unsigned long data)
+ {
+ struct ieee80211_local *local = (void *) data;
+@@ -969,52 +949,18 @@ static void ieee80211_work_work(struct work_struct *work)
+ }
+
+ if (!started && !local->tmp_channel) {
+- bool on_oper_chan;
+- bool tmp_chan_changed = false;
+- bool on_oper_chan2;
+- enum nl80211_channel_type wk_ct;
+- on_oper_chan = ieee80211_cfg_on_oper_channel(local);
+-
+- /* Work with existing channel type if possible. */
+- wk_ct = wk->chan_type;
+- if (wk->chan == local->hw.conf.channel)
+- wk_ct = ieee80211_calc_ct(wk->chan_type,
+- local->hw.conf.channel_type);
+-
+- if (local->tmp_channel)
+- if ((local->tmp_channel != wk->chan) ||
+- (local->tmp_channel_type != wk_ct))
+- tmp_chan_changed = true;
+-
+- local->tmp_channel = wk->chan;
+- local->tmp_channel_type = wk_ct;
+ /*
+- * Leave the station vifs in awake mode if they
+- * happen to be on the same channel as
+- * the requested channel.
++ * TODO: could optimize this by leaving the
++ * station vifs in awake mode if they
++ * happen to be on the same channel as
++ * the requested channel
+ */
+- on_oper_chan2 = ieee80211_cfg_on_oper_channel(local);
+- if (on_oper_chan != on_oper_chan2) {
+- if (on_oper_chan2) {
+- /* going off oper channel, PS too */
+- ieee80211_offchannel_stop_vifs(local,
+- true);
+- ieee80211_hw_config(local, 0);
+- } else {
+- /* going on channel, but leave PS
+- * off-channel. */
+- ieee80211_hw_config(local, 0);
+- ieee80211_offchannel_return(local,
+- true,
+- false);
+- }
+- } else if (tmp_chan_changed)
+- /* Still off-channel, but on some other
+- * channel, so update hardware.
+- * PS should already be off-channel.
+- */
+- ieee80211_hw_config(local, 0);
++ ieee80211_offchannel_stop_beaconing(local);
++ ieee80211_offchannel_stop_station(local);
+
++ local->tmp_channel = wk->chan;
++ local->tmp_channel_type = wk->chan_type;
++ ieee80211_hw_config(local, 0);
+ started = true;
+ wk->timeout = jiffies;
+ }
+@@ -1100,8 +1046,7 @@ static void ieee80211_work_work(struct work_struct *work)
+ * we still need to do a hardware config. Currently,
+ * we cannot be here while scanning, however.
+ */
+- if (!ieee80211_cfg_on_oper_channel(local))
+- ieee80211_hw_config(local, 0);
++ ieee80211_hw_config(local, 0);
+
+ /* At the least, we need to disable offchannel_ps,
+ * so just go ahead and run the entire offchannel
+@@ -1109,7 +1054,7 @@ static void ieee80211_work_work(struct work_struct *work)
+ * beaconing if we were already on-oper-channel
+ * as a future optimization.
+ */
+- ieee80211_offchannel_return(local, true, true);
++ ieee80211_offchannel_return(local, true);
+
+ /* give connection some time to breathe */
+ run_again(local, jiffies + HZ/2);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch
new file mode 100644
index 0000000..92f4403
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch
@@ -0,0 +1,60 @@
+From 4b66a35b31fdc078582e40ec3cc0ee12abbffd17 Mon Sep 17 00:00:00 2001
+From: Chris Bagwell <chris at cnpbagwell.com>
+Date: Wed, 23 Nov 2011 10:54:27 +0100
+Subject: [PATCH 081/130] HID: hid-multitouch - add another eGalax id
+
+commit 1fd8f047490dd0ec4e4db710fcbc1bd4798d944c upstream.
+
+This allows ASUS Eee Slate touchscreens to work.
+
+Signed-off-by: Chris Bagwell <chris at cnpbagwell.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires at gmail.com>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/hid/hid-core.c | 1 +
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 3 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 1473067..b51cbf2 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1409,6 +1409,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH5) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2515) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_EMS, USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 4a441a6..4c9a342 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -235,6 +235,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2 0x72a1
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3 0x480e
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4 0x726b
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH5 0xa001
+
+ #define USB_VENDOR_ID_ELECOM 0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084 0x0061
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index f1c909f..a59d939 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -662,6 +662,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4) },
++ { .driver_data = MT_CLS_EGALAX,
++ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH5) },
+
+ /* Elo TouchSystems IntelliTouch Plus panel */
+ { .driver_data = MT_CLS_DUAL_NSMU_CONTACTID,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch
new file mode 100644
index 0000000..db1d435
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch
@@ -0,0 +1,112 @@
+From e5664bb7172d41e38788a503d6e33d14af866fb5 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires at enac.fr>
+Date: Wed, 23 Nov 2011 10:54:31 +0100
+Subject: [PATCH 082/130] HID: multitouch: cleanup with eGalax PID definitions
+
+commit e36f690b37945e0a9bb1554e1546eeec93f7d1f6 upstream.
+
+This is just a renaming of USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH{N}
+to USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_{PID} to handle more eGalax
+devices.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires at enac.fr>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/hid/hid-core.c | 12 ++++++------
+ drivers/hid/hid-ids.h | 12 ++++++------
+ drivers/hid/hid-multitouch.c | 24 ++++++++++++------------
+ 3 files changed, 24 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index b51cbf2..4434aba 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1404,12 +1404,12 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_TRUETOUCH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0006) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0011) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH1) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH5) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480D) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480E) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2515) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_EMS, USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 4c9a342..9db8789 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -230,12 +230,12 @@
+
+ #define USB_VENDOR_ID_DWAV 0x0eef
+ #define USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER 0x0001
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH 0x480d
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH1 0x720c
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2 0x72a1
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3 0x480e
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4 0x726b
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH5 0xa001
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480D 0x480d
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480E 0x480e
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C 0x720c
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B 0x726b
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1 0x72a1
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
+
+ #define USB_VENDOR_ID_ELECOM 0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084 0x0061
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index a59d939..815bd22 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -645,26 +645,26 @@ static const struct hid_device_id mt_devices[] = {
+ USB_DEVICE_ID_CYPRESS_TRUETOUCH) },
+
+ /* eGalax devices (resistive) */
+- { .driver_data = MT_CLS_EGALAX,
++ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+- USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH) },
+- { .driver_data = MT_CLS_EGALAX,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480D) },
++ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+- USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3) },
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480E) },
+
+ /* eGalax devices (capacitive) */
+- { .driver_data = MT_CLS_EGALAX,
++ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+- USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH1) },
+- { .driver_data = MT_CLS_EGALAX,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C) },
++ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+- USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2) },
+- { .driver_data = MT_CLS_EGALAX,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B) },
++ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+- USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4) },
+- { .driver_data = MT_CLS_EGALAX,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1) },
++ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+- USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH5) },
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+
+ /* Elo TouchSystems IntelliTouch Plus panel */
+ { .driver_data = MT_CLS_DUAL_NSMU_CONTACTID,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch
new file mode 100644
index 0000000..086ffed
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch
@@ -0,0 +1,62 @@
+From f8c7a53e06ce63f80f74db3c6582be6d07ad0318 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marek.vasut at gmail.com>
+Date: Wed, 23 Nov 2011 10:54:32 +0100
+Subject: [PATCH 083/130] HID: multitouch: Add egalax ID for Acer Iconia W500
+
+commit bb9ff21072043634f147c05ac65dbf8185d4af6d upstream.
+
+This patch adds USB ID for the touchpanel in Acer Iconia W500. The panel
+supports up to five fingers, therefore the need for a new addition of panel
+types.
+
+Signed-off-by: Marek Vasut <marek.vasut at gmail.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires at enac.fr>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/hid/hid-core.c | 1 +
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 3 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 4434aba..9cee7b2 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1409,6 +1409,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2515) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 9db8789..9eb90b1 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -235,6 +235,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C 0x720c
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B 0x726b
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1 0x72a1
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302 0x7302
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
+
+ #define USB_VENDOR_ID_ELECOM 0x056e
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 815bd22..c77d495 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -664,6 +664,9 @@ static const struct hid_device_id mt_devices[] = {
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1) },
+ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302) },
++ { .driver_data = MT_CLS_EGALAX,
++ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+
+ /* Elo TouchSystems IntelliTouch Plus panel */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch
new file mode 100644
index 0000000..885ca10
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch
@@ -0,0 +1,49 @@
+From 5b2c651d5496aad3c5359e72fc6eb6efcadecc4e Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires at enac.fr>
+Date: Wed, 23 Nov 2011 10:54:33 +0100
+Subject: [PATCH 084/130] HID: multitouch: add support for the MSI Windpad
+ 110W
+
+commit 66f06127f34ad6e8a1b24a2c03144b694d19f99f upstream.
+
+Just another eGalax device.
+Please note that adding this device to have_special_driver
+in hid-core.c is not required anymore.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires at enac.fr>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 2 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 9eb90b1..6ccd7df 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -235,6 +235,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C 0x720c
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B 0x726b
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1 0x72a1
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72FA 0x72fa
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302 0x7302
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index c77d495..6f6b1d9 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -664,6 +664,9 @@ static const struct hid_device_id mt_devices[] = {
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1) },
+ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72FA) },
++ { .driver_data = MT_CLS_EGALAX,
++ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302) },
+ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch
new file mode 100644
index 0000000..e67f925
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch
@@ -0,0 +1,63 @@
+From 6da88efbdd98ef411f670b51ad6ab0ca5e3a753b Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires at enac.fr>
+Date: Tue, 29 Nov 2011 13:13:12 +0100
+Subject: [PATCH 085/130] HID: hid-multitouch: add support for new Hanvon
+ panels
+
+commit 545803651da8dde248eeb8ce3ed1e547e9e4ac0a upstream.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires at enac.fr>
+Acked-by: Henrik Rydberg <rydberg at euromail.se>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/hid/hid-core.c | 1 +
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-multitouch.c | 5 +++++
+ 3 files changed, 9 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 9cee7b2..a1cb906 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1425,6 +1425,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HANVON, USB_DEVICE_ID_HANVON_MULTITOUCH) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_HANVON_ALT, USB_DEVICE_ID_HANVON_ALT_MULTITOUCH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6650) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK, USB_DEVICE_ID_HOLTEK_ON_LINE_GRIP) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ILITEK, USB_DEVICE_ID_ILITEK_MULTITOUCH) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 6ccd7df..56df290 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -359,6 +359,9 @@
+ #define USB_VENDOR_ID_HANVON 0x20b3
+ #define USB_DEVICE_ID_HANVON_MULTITOUCH 0x0a18
+
++#define USB_VENDOR_ID_HANVON_ALT 0x22ed
++#define USB_DEVICE_ID_HANVON_ALT_MULTITOUCH 0x1010
++
+ #define USB_VENDOR_ID_HAPP 0x078b
+ #define USB_DEVICE_ID_UGCI_DRIVING 0x0010
+ #define USB_DEVICE_ID_UGCI_FLYING 0x0020
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 6f6b1d9..ea20c8e 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -687,6 +687,11 @@ static const struct hid_device_id mt_devices[] = {
+ HID_USB_DEVICE(USB_VENDOR_ID_GOODTOUCH,
+ USB_DEVICE_ID_GOODTOUCH_000f) },
+
++ /* Hanvon panels */
++ { .driver_data = MT_CLS_DUAL_INRANGE_CONTACTID,
++ HID_USB_DEVICE(USB_VENDOR_ID_HANVON_ALT,
++ USB_DEVICE_ID_HANVON_ALT_MULTITOUCH) },
++
+ /* Ideacom panel */
+ { .driver_data = MT_CLS_SERIAL,
+ HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch
new file mode 100644
index 0000000..1c03e1d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch
@@ -0,0 +1,63 @@
+From ba791aa0bf69b20ba364329edc62dc04ddb86dfc Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires at gmail.com>
+Date: Fri, 23 Dec 2011 15:40:59 +0100
+Subject: [PATCH 086/130] HID: multitouch: add support of Atmel multitouch
+ panels
+
+commit b105712469d957cf1ab223c1ea72b7ba88edb926 upstream.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires at gmail.com>
+Acked-by: Henrik Rydberg <rydberg at euromail.se>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/hid/Kconfig | 1 +
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-multitouch.c | 5 +++++
+ 3 files changed, 9 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 332c22a..36f5df3 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -335,6 +335,7 @@ config HID_MULTITOUCH
+ Say Y here if you have one of the following devices:
+ - 3M PCT touch screens
+ - ActionStar dual touch panels
++ - Atmel panels
+ - Cando dual touch panels
+ - Chunghwa panels
+ - CVTouch panels
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 56df290..bf95a50 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -145,6 +145,9 @@
+ #define USB_DEVICE_ID_ATEN_4PORTKVM 0x2205
+ #define USB_DEVICE_ID_ATEN_4PORTKVMC 0x2208
+
++#define USB_VENDOR_ID_ATMEL 0x03eb
++#define USB_DEVICE_ID_ATMEL_MULTITOUCH 0x211c
++
+ #define USB_VENDOR_ID_AVERMEDIA 0x07ca
+ #define USB_DEVICE_ID_AVER_FM_MR800 0xb800
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index ea20c8e..7f83024 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -615,6 +615,11 @@ static const struct hid_device_id mt_devices[] = {
+ HID_USB_DEVICE(USB_VENDOR_ID_ACTIONSTAR,
+ USB_DEVICE_ID_ACTIONSTAR_1011) },
+
++ /* Atmel panels */
++ { .driver_data = MT_CLS_SERIAL,
++ HID_USB_DEVICE(USB_VENDOR_ID_ATMEL,
++ USB_DEVICE_ID_ATMEL_MULTITOUCH) },
++
+ /* Cando panels */
+ { .driver_data = MT_CLS_DUAL_INRANGE_CONTACTNUMBER,
+ HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch
new file mode 100644
index 0000000..e87a408
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch
@@ -0,0 +1,45 @@
+From 59e1439e23925a4029af1ba09e54e57d6824d6af Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires at gmail.com>
+Date: Fri, 23 Dec 2011 15:41:00 +0100
+Subject: [PATCH 087/130] HID: multitouch: add support for 3M 32"
+
+commit c4fad877cd0efb51d8180ae2eaa791c99c92051c upstream.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires at gmail.com>
+Acked-by: Henrik Rydberg <rydberg at euromail.se>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 2 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index bf95a50..6e53391a 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -21,6 +21,7 @@
+ #define USB_VENDOR_ID_3M 0x0596
+ #define USB_DEVICE_ID_3M1968 0x0500
+ #define USB_DEVICE_ID_3M2256 0x0502
++#define USB_DEVICE_ID_3M3266 0x0506
+
+ #define USB_VENDOR_ID_A4TECH 0x09da
+ #define USB_DEVICE_ID_A4TECH_WCP32PU 0x0006
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 7f83024..4a63dee 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -609,6 +609,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_3M,
+ HID_USB_DEVICE(USB_VENDOR_ID_3M,
+ USB_DEVICE_ID_3M2256) },
++ { .driver_data = MT_CLS_3M,
++ HID_USB_DEVICE(USB_VENDOR_ID_3M,
++ USB_DEVICE_ID_3M3266) },
+
+ /* ActionStar panels */
+ { .driver_data = MT_CLS_DEFAULT,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch
new file mode 100644
index 0000000..9a51d31
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch
@@ -0,0 +1,117 @@
+From 9f0708248c8226860e4fbb4492575f7128e593d5 Mon Sep 17 00:00:00 2001
+From: Masatoshi Hoshikawa <hoshikawa at xiroku.com>
+Date: Thu, 5 Jan 2012 11:53:46 +0900
+Subject: [PATCH 088/130] HID: hid-multitouch: add support 9 new Xiroku
+ devices
+
+commit 11576c6114c3b6505aea2e0c988bedb856a0e20c upstream.
+
+This patch adds support for the Xiroku Inc. panels (SPX/MPX/CSR/etc.).
+
+Signed-off-by: Masatoshi Hoshikawa <hoshikawa at xiroku.com>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/hid/Kconfig | 1 +
+ drivers/hid/hid-core.c | 9 +++++++++
+ drivers/hid/hid-ids.h | 11 +++++++++++
+ drivers/hid/hid-multitouch.c | 29 +++++++++++++++++++++++++++++
+ 4 files changed, 50 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 36f5df3..d21f6d0 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -356,6 +356,7 @@ config HID_MULTITOUCH
+ - Touch International Panels
+ - Unitec Panels
+ - XAT optical touch panels
++ - Xiroku optical touch panels
+
+ If unsure, say N.
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index a1cb906..bb656d8 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1552,6 +1552,15 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_XAT, USB_DEVICE_ID_XAT_CSR) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_SPX) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_MPX) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_CSR) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_SPX1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_MPX1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_CSR1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_SPX2) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_MPX2) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_CSR2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 6e53391a..00cabb3 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -717,6 +717,17 @@
+ #define USB_VENDOR_ID_XAT 0x2505
+ #define USB_DEVICE_ID_XAT_CSR 0x0220
+
++#define USB_VENDOR_ID_XIROKU 0x1477
++#define USB_DEVICE_ID_XIROKU_SPX 0x1006
++#define USB_DEVICE_ID_XIROKU_MPX 0x1007
++#define USB_DEVICE_ID_XIROKU_CSR 0x100e
++#define USB_DEVICE_ID_XIROKU_SPX1 0x1021
++#define USB_DEVICE_ID_XIROKU_CSR1 0x1022
++#define USB_DEVICE_ID_XIROKU_MPX1 0x1023
++#define USB_DEVICE_ID_XIROKU_SPX2 0x1024
++#define USB_DEVICE_ID_XIROKU_CSR2 0x1025
++#define USB_DEVICE_ID_XIROKU_MPX2 0x1026
++
+ #define USB_VENDOR_ID_YEALINK 0x6993
+ #define USB_DEVICE_ID_YEALINK_P1K_P4K_B2K 0xb001
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 4a63dee..995fc4c 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -780,6 +780,35 @@ static const struct hid_device_id mt_devices[] = {
+ HID_USB_DEVICE(USB_VENDOR_ID_XAT,
+ USB_DEVICE_ID_XAT_CSR) },
+
++ /* Xiroku */
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_SPX) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_MPX) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_CSR) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_SPX1) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_MPX1) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_CSR1) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_SPX2) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_MPX2) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_CSR2) },
++
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, mt_devices);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch
new file mode 100644
index 0000000..ba211f0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch
@@ -0,0 +1,49 @@
+From 7d6b552faf6a591c44f680e3e897a1bd6471985a Mon Sep 17 00:00:00 2001
+From: Martin Schwidefsky <schwidefsky at de.ibm.com>
+Date: Thu, 15 Dec 2011 14:56:10 +0100
+Subject: [PATCH 089/130] fix cputime overflow in uptime_proc_show
+
+commit c3e0ef9a298e028a82ada28101ccd5cf64d209ee upstream.
+
+For 32-bit architectures using standard jiffies the idletime calculation
+in uptime_proc_show will quickly overflow. It takes (2^32 / HZ) seconds
+of idle-time, or e.g. 12.45 days with no load on a quad-core with HZ=1000.
+Switch to 64-bit calculations.
+
+Cc: Michael Abbott <michael.abbott at diamond.ac.uk>
+Signed-off-by: Martin Schwidefsky <schwidefsky at de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/proc/uptime.c | 9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/fs/proc/uptime.c b/fs/proc/uptime.c
+index 766b1d4..29166ec 100644
+--- a/fs/proc/uptime.c
++++ b/fs/proc/uptime.c
+@@ -11,15 +11,20 @@ static int uptime_proc_show(struct seq_file *m, void *v)
+ {
+ struct timespec uptime;
+ struct timespec idle;
++ cputime64_t idletime;
++ u64 nsec;
++ u32 rem;
+ int i;
+- cputime_t idletime = cputime_zero;
+
++ idletime = 0;
+ for_each_possible_cpu(i)
+ idletime = cputime64_add(idletime, kstat_cpu(i).cpustat.idle);
+
+ do_posix_clock_monotonic_gettime(&uptime);
+ monotonic_to_bootbased(&uptime);
+- cputime_to_timespec(idletime, &idle);
++ nsec = cputime64_to_jiffies64(idletime) * TICK_NSEC;
++ idle.tv_sec = div_u64_rem(nsec, NSEC_PER_SEC, &rem);
++ idle.tv_nsec = rem;
+ seq_printf(m, "%lu.%02lu %lu.%02lu\n",
+ (unsigned long) uptime.tv_sec,
+ (uptime.tv_nsec / (NSEC_PER_SEC / 100)),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch
new file mode 100644
index 0000000..943cf41
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch
@@ -0,0 +1,166 @@
+From 4adb778fc31d3c9c7707167165b07138f31c78c4 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini at redhat.com>
+Date: Thu, 12 Jan 2012 16:01:27 +0100
+Subject: [PATCH 090/130] block: add and use scsi_blk_cmd_ioctl
+
+commit 577ebb374c78314ac4617242f509e2f5e7156649 upstream.
+
+Introduce a wrapper around scsi_cmd_ioctl that takes a block device.
+
+The function will then be enhanced to detect partition block devices
+and, in that case, subject the ioctls to whitelisting.
+
+Cc: linux-scsi at vger.kernel.org
+Cc: Jens Axboe <axboe at kernel.dk>
+Cc: James Bottomley <JBottomley at parallels.com>
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ block/scsi_ioctl.c | 7 +++++++
+ drivers/block/cciss.c | 6 +++---
+ drivers/block/ub.c | 3 +--
+ drivers/block/virtio_blk.c | 4 ++--
+ drivers/cdrom/cdrom.c | 3 +--
+ drivers/ide/ide-floppy_ioctl.c | 3 +--
+ drivers/scsi/sd.c | 2 +-
+ include/linux/blkdev.h | 2 ++
+ 8 files changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
+index fbdf0d8..a2c11f3 100644
+--- a/block/scsi_ioctl.c
++++ b/block/scsi_ioctl.c
+@@ -690,6 +690,13 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod
+ }
+ EXPORT_SYMBOL(scsi_cmd_ioctl);
+
++int scsi_cmd_blk_ioctl(struct block_device *bd, fmode_t mode,
++ unsigned int cmd, void __user *arg)
++{
++ return scsi_cmd_ioctl(bd->bd_disk->queue, bd->bd_disk, mode, cmd, arg);
++}
++EXPORT_SYMBOL(scsi_cmd_blk_ioctl);
++
+ static int __init blk_scsi_ioctl_init(void)
+ {
+ blk_set_cmd_filter_defaults(&blk_default_cmd_filter);
+diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
+index 587cce5..b0f553b 100644
+--- a/drivers/block/cciss.c
++++ b/drivers/block/cciss.c
+@@ -1735,7 +1735,7 @@ static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
+ case CCISS_BIG_PASSTHRU:
+ return cciss_bigpassthru(h, argp);
+
+- /* scsi_cmd_ioctl handles these, below, though some are not */
++ /* scsi_cmd_blk_ioctl handles these, below, though some are not */
+ /* very meaningful for cciss. SG_IO is the main one people want. */
+
+ case SG_GET_VERSION_NUM:
+@@ -1746,9 +1746,9 @@ static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
+ case SG_EMULATED_HOST:
+ case SG_IO:
+ case SCSI_IOCTL_SEND_COMMAND:
+- return scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
++ return scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
+
+- /* scsi_cmd_ioctl would normally handle these, below, but */
++ /* scsi_cmd_blk_ioctl would normally handle these, below, but */
+ /* they aren't a good fit for cciss, as CD-ROMs are */
+ /* not supported, and we don't have any bus/target/lun */
+ /* which we present to the kernel. */
+diff --git a/drivers/block/ub.c b/drivers/block/ub.c
+index 0e376d4..7333b9e 100644
+--- a/drivers/block/ub.c
++++ b/drivers/block/ub.c
+@@ -1744,12 +1744,11 @@ static int ub_bd_release(struct gendisk *disk, fmode_t mode)
+ static int ub_bd_ioctl(struct block_device *bdev, fmode_t mode,
+ unsigned int cmd, unsigned long arg)
+ {
+- struct gendisk *disk = bdev->bd_disk;
+ void __user *usermem = (void __user *) arg;
+ int ret;
+
+ mutex_lock(&ub_mutex);
+- ret = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, usermem);
++ ret = scsi_cmd_blk_ioctl(bdev, mode, cmd, usermem);
+ mutex_unlock(&ub_mutex);
+
+ return ret;
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 4d0b70a..e46f2f7 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -243,8 +243,8 @@ static int virtblk_ioctl(struct block_device *bdev, fmode_t mode,
+ if (!virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_SCSI))
+ return -ENOTTY;
+
+- return scsi_cmd_ioctl(disk->queue, disk, mode, cmd,
+- (void __user *)data);
++ return scsi_cmd_blk_ioctl(bdev, mode, cmd,
++ (void __user *)data);
+ }
+
+ /* We provide getgeo only to please some old bootloader/partitioning tools */
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index f997c27..cedb231 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2747,12 +2747,11 @@ int cdrom_ioctl(struct cdrom_device_info *cdi, struct block_device *bdev,
+ {
+ void __user *argp = (void __user *)arg;
+ int ret;
+- struct gendisk *disk = bdev->bd_disk;
+
+ /*
+ * Try the generic SCSI command ioctl's first.
+ */
+- ret = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
++ ret = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
+ if (ret != -ENOTTY)
+ return ret;
+
+diff --git a/drivers/ide/ide-floppy_ioctl.c b/drivers/ide/ide-floppy_ioctl.c
+index d267b7a..a22ca84 100644
+--- a/drivers/ide/ide-floppy_ioctl.c
++++ b/drivers/ide/ide-floppy_ioctl.c
+@@ -292,8 +292,7 @@ int ide_floppy_ioctl(ide_drive_t *drive, struct block_device *bdev,
+ * and CDROM_SEND_PACKET (legacy) ioctls
+ */
+ if (cmd != CDROM_SEND_PACKET && cmd != SCSI_IOCTL_SEND_COMMAND)
+- err = scsi_cmd_ioctl(bdev->bd_disk->queue, bdev->bd_disk,
+- mode, cmd, argp);
++ err = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
+
+ if (err == -ENOTTY)
+ err = generic_ide_ioctl(drive, bdev, cmd, arg);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index fa3a591..ffa1c79 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1096,7 +1096,7 @@ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
+ error = scsi_ioctl(sdp, cmd, p);
+ break;
+ default:
+- error = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, p);
++ error = scsi_cmd_blk_ioctl(bdev, mode, cmd, p);
+ if (error != -ENOTTY)
+ break;
+ error = scsi_ioctl(sdp, cmd, p);
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 94acd81..ca7b869 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -675,6 +675,8 @@ extern int blk_insert_cloned_request(struct request_queue *q,
+ struct request *rq);
+ extern void blk_delay_queue(struct request_queue *, unsigned long);
+ extern void blk_recount_segments(struct request_queue *, struct bio *);
++extern int scsi_cmd_blk_ioctl(struct block_device *, fmode_t,
++ unsigned int, void __user *);
+ extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t,
+ unsigned int, void __user *);
+ extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch
new file mode 100644
index 0000000..5074770
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch
@@ -0,0 +1,166 @@
+From b4bc30558b98e2eba6f6d86239d49bf3d60015cb Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini at redhat.com>
+Date: Thu, 12 Jan 2012 16:01:28 +0100
+Subject: [PATCH 091/130] block: fail SCSI passthrough ioctls on partition
+ devices
+
+commit 0bfc96cb77224736dfa35c3c555d37b3646ef35e upstream.
+
+[ Changes with respect to 3.3: return -ENOTTY from scsi_verify_blk_ioctl
+ and -ENOIOCTLCMD from sd_compat_ioctl. ]
+
+Linux allows executing the SG_IO ioctl on a partition or LVM volume, and
+will pass the command to the underlying block device. This is
+well-known, but it is also a large security problem when (via Unix
+permissions, ACLs, SELinux or a combination thereof) a program or user
+needs to be granted access only to part of the disk.
+
+This patch lets partitions forward a small set of harmless ioctls;
+others are logged with printk so that we can see which ioctls are
+actually sent. In my tests only CDROM_GET_CAPABILITY actually occurred.
+Of course it was being sent to a (partition on a) hard disk, so it would
+have failed with ENOTTY and the patch isn't changing anything in
+practice. Still, I'm treating it specially to avoid spamming the logs.
+
+In principle, this restriction should include programs running with
+CAP_SYS_RAWIO. If for example I let a program access /dev/sda2 and
+/dev/sdb, it still should not be able to read/write outside the
+boundaries of /dev/sda2 independent of the capabilities. However, for
+now programs with CAP_SYS_RAWIO will still be allowed to send the
+ioctls. Their actions will still be logged.
+
+This patch does not affect the non-libata IDE driver. That driver
+however already tests for bd != bd->bd_contains before issuing some
+ioctl; it could be restricted further to forbid these ioctls even for
+programs running with CAP_SYS_ADMIN/CAP_SYS_RAWIO.
+
+Cc: linux-scsi at vger.kernel.org
+Cc: Jens Axboe <axboe at kernel.dk>
+Cc: James Bottomley <JBottomley at parallels.com>
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+[ Make it also print the command name when warning - Linus ]
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ block/scsi_ioctl.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
+ drivers/scsi/sd.c | 11 +++++++++--
+ include/linux/blkdev.h | 1 +
+ 3 files changed, 55 insertions(+), 2 deletions(-)
+
+diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
+index a2c11f3..688be8a 100644
+--- a/block/scsi_ioctl.c
++++ b/block/scsi_ioctl.c
+@@ -24,6 +24,7 @@
+ #include <linux/capability.h>
+ #include <linux/completion.h>
+ #include <linux/cdrom.h>
++#include <linux/ratelimit.h>
+ #include <linux/slab.h>
+ #include <linux/times.h>
+ #include <asm/uaccess.h>
+@@ -690,9 +691,53 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod
+ }
+ EXPORT_SYMBOL(scsi_cmd_ioctl);
+
++int scsi_verify_blk_ioctl(struct block_device *bd, unsigned int cmd)
++{
++ if (bd && bd == bd->bd_contains)
++ return 0;
++
++ /* Actually none of these is particularly useful on a partition,
++ * but they are safe.
++ */
++ switch (cmd) {
++ case SCSI_IOCTL_GET_IDLUN:
++ case SCSI_IOCTL_GET_BUS_NUMBER:
++ case SCSI_IOCTL_GET_PCI:
++ case SCSI_IOCTL_PROBE_HOST:
++ case SG_GET_VERSION_NUM:
++ case SG_SET_TIMEOUT:
++ case SG_GET_TIMEOUT:
++ case SG_GET_RESERVED_SIZE:
++ case SG_SET_RESERVED_SIZE:
++ case SG_EMULATED_HOST:
++ return 0;
++ case CDROM_GET_CAPABILITY:
++ /* Keep this until we remove the printk below. udev sends it
++ * and we do not want to spam dmesg about it. CD-ROMs do
++ * not have partitions, so we get here only for disks.
++ */
++ return -ENOTTY;
++ default:
++ break;
++ }
++
++ /* In particular, rule out all resets and host-specific ioctls. */
++ printk_ratelimited(KERN_WARNING
++ "%s: sending ioctl %x to a partition!\n", current->comm, cmd);
++
++ return capable(CAP_SYS_RAWIO) ? 0 : -ENOTTY;
++}
++EXPORT_SYMBOL(scsi_verify_blk_ioctl);
++
+ int scsi_cmd_blk_ioctl(struct block_device *bd, fmode_t mode,
+ unsigned int cmd, void __user *arg)
+ {
++ int ret;
++
++ ret = scsi_verify_blk_ioctl(bd, cmd);
++ if (ret < 0)
++ return ret;
++
+ return scsi_cmd_ioctl(bd->bd_disk->queue, bd->bd_disk, mode, cmd, arg);
+ }
+ EXPORT_SYMBOL(scsi_cmd_blk_ioctl);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index ffa1c79..4b63c73 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1074,6 +1074,10 @@ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
+ SCSI_LOG_IOCTL(1, sd_printk(KERN_INFO, sdkp, "sd_ioctl: disk=%s, "
+ "cmd=0x%x\n", disk->disk_name, cmd));
+
++ error = scsi_verify_blk_ioctl(bdev, cmd);
++ if (error < 0)
++ return error;
++
+ /*
+ * If we are in the middle of error recovery, don't let anyone
+ * else try and use this device. Also, if error recovery fails, it
+@@ -1266,6 +1270,11 @@ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
+ unsigned int cmd, unsigned long arg)
+ {
+ struct scsi_device *sdev = scsi_disk(bdev->bd_disk)->device;
++ int ret;
++
++ ret = scsi_verify_blk_ioctl(bdev, cmd);
++ if (ret < 0)
++ return -ENOIOCTLCMD;
+
+ /*
+ * If we are in the middle of error recovery, don't let anyone
+@@ -1277,8 +1286,6 @@ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
+ return -ENODEV;
+
+ if (sdev->host->hostt->compat_ioctl) {
+- int ret;
+-
+ ret = sdev->host->hostt->compat_ioctl(sdev, cmd, (void __user *)arg);
+
+ return ret;
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index ca7b869..0ed1eb0 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -675,6 +675,7 @@ extern int blk_insert_cloned_request(struct request_queue *q,
+ struct request *rq);
+ extern void blk_delay_queue(struct request_queue *, unsigned long);
+ extern void blk_recount_segments(struct request_queue *, struct bio *);
++extern int scsi_verify_blk_ioctl(struct block_device *, unsigned int);
+ extern int scsi_cmd_blk_ioctl(struct block_device *, fmode_t,
+ unsigned int, void __user *);
+ extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch
new file mode 100644
index 0000000..6cf7708
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch
@@ -0,0 +1,90 @@
+From eb8de39f8d8116261b98f971f3e3e2230fa3abcf Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini at redhat.com>
+Date: Thu, 12 Jan 2012 16:01:29 +0100
+Subject: [PATCH 092/130] dm: do not forward ioctls from logical volumes to
+ the underlying device
+
+commit ec8013beddd717d1740cfefb1a9b900deef85462 upstream.
+
+A logical volume can map to just part of underlying physical volume.
+In this case, it must be treated like a partition.
+
+Based on a patch from Alasdair G Kergon.
+
+Cc: Alasdair G Kergon <agk at redhat.com>
+Cc: dm-devel at redhat.com
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/md/dm-flakey.c | 11 ++++++++++-
+ drivers/md/dm-linear.c | 12 +++++++++++-
+ drivers/md/dm-mpath.c | 6 ++++++
+ 3 files changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index f84c080..9fb18c1 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -368,8 +368,17 @@ static int flakey_status(struct dm_target *ti, status_type_t type,
+ static int flakey_ioctl(struct dm_target *ti, unsigned int cmd, unsigned long arg)
+ {
+ struct flakey_c *fc = ti->private;
++ struct dm_dev *dev = fc->dev;
++ int r = 0;
+
+- return __blkdev_driver_ioctl(fc->dev->bdev, fc->dev->mode, cmd, arg);
++ /*
++ * Only pass ioctls through if the device sizes match exactly.
++ */
++ if (fc->start ||
++ ti->len != i_size_read(dev->bdev->bd_inode) >> SECTOR_SHIFT)
++ r = scsi_verify_blk_ioctl(NULL, cmd);
++
++ return r ? : __blkdev_driver_ioctl(dev->bdev, dev->mode, cmd, arg);
+ }
+
+ static int flakey_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
+diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c
+index 3921e3b..9728839 100644
+--- a/drivers/md/dm-linear.c
++++ b/drivers/md/dm-linear.c
+@@ -116,7 +116,17 @@ static int linear_ioctl(struct dm_target *ti, unsigned int cmd,
+ unsigned long arg)
+ {
+ struct linear_c *lc = (struct linear_c *) ti->private;
+- return __blkdev_driver_ioctl(lc->dev->bdev, lc->dev->mode, cmd, arg);
++ struct dm_dev *dev = lc->dev;
++ int r = 0;
++
++ /*
++ * Only pass ioctls through if the device sizes match exactly.
++ */
++ if (lc->start ||
++ ti->len != i_size_read(dev->bdev->bd_inode) >> SECTOR_SHIFT)
++ r = scsi_verify_blk_ioctl(NULL, cmd);
++
++ return r ? : __blkdev_driver_ioctl(dev->bdev, dev->mode, cmd, arg);
+ }
+
+ static int linear_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 5e0090e..801d92d 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -1520,6 +1520,12 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
+
+ spin_unlock_irqrestore(&m->lock, flags);
+
++ /*
++ * Only pass ioctls through if the device sizes match exactly.
++ */
++ if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT)
++ r = scsi_verify_blk_ioctl(NULL, cmd);
++
+ return r ? : __blkdev_driver_ioctl(bdev, mode, cmd, arg);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch
new file mode 100644
index 0000000..7189318
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch
@@ -0,0 +1,271 @@
+From 483f23031ea337d0abf4392186bdfd2b8ae5dce3 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds at linux-foundation.org>
+Date: Tue, 17 Jan 2012 15:21:19 -0800
+Subject: [PATCH 093/130] proc: clean up and fix /proc/<pid>/mem handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit e268337dfe26dfc7efd422a804dbb27977a3cccc upstream.
+
+Jüri Aedla reported that the /proc/<pid>/mem handling really isn't very
+robust, and it also doesn't match the permission checking of any of the
+other related files.
+
+This changes it to do the permission checks at open time, and instead of
+tracking the process, it tracks the VM at the time of the open. That
+simplifies the code a lot, but does mean that if you hold the file
+descriptor open over an execve(), you'll continue to read from the _old_
+VM.
+
+That is different from our previous behavior, but much simpler. If
+somebody actually finds a load where this matters, we'll need to revert
+this commit.
+
+I suspect that nobody will ever notice - because the process mapping
+addresses will also have changed as part of the execve. So you cannot
+actually usefully access the fd across a VM change simply because all
+the offsets for IO would have changed too.
+
+Reported-by: Jüri Aedla <asd at ut.ee>
+Cc: Al Viro <viro at zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/proc/base.c | 145 +++++++++++++++-----------------------------------------
+ 1 files changed, 39 insertions(+), 106 deletions(-)
+
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 851ba3d..1fc1dca 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -194,65 +194,7 @@ static int proc_root_link(struct inode *inode, struct path *path)
+ return result;
+ }
+
+-static struct mm_struct *__check_mem_permission(struct task_struct *task)
+-{
+- struct mm_struct *mm;
+-
+- mm = get_task_mm(task);
+- if (!mm)
+- return ERR_PTR(-EINVAL);
+-
+- /*
+- * A task can always look at itself, in case it chooses
+- * to use system calls instead of load instructions.
+- */
+- if (task == current)
+- return mm;
+-
+- /*
+- * If current is actively ptrace'ing, and would also be
+- * permitted to freshly attach with ptrace now, permit it.
+- */
+- if (task_is_stopped_or_traced(task)) {
+- int match;
+- rcu_read_lock();
+- match = (ptrace_parent(task) == current);
+- rcu_read_unlock();
+- if (match && ptrace_may_access(task, PTRACE_MODE_ATTACH))
+- return mm;
+- }
+-
+- /*
+- * No one else is allowed.
+- */
+- mmput(mm);
+- return ERR_PTR(-EPERM);
+-}
+-
+-/*
+- * If current may access user memory in @task return a reference to the
+- * corresponding mm, otherwise ERR_PTR.
+- */
+-static struct mm_struct *check_mem_permission(struct task_struct *task)
+-{
+- struct mm_struct *mm;
+- int err;
+-
+- /*
+- * Avoid racing if task exec's as we might get a new mm but validate
+- * against old credentials.
+- */
+- err = mutex_lock_killable(&task->signal->cred_guard_mutex);
+- if (err)
+- return ERR_PTR(err);
+-
+- mm = __check_mem_permission(task);
+- mutex_unlock(&task->signal->cred_guard_mutex);
+-
+- return mm;
+-}
+-
+-struct mm_struct *mm_for_maps(struct task_struct *task)
++static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
+ {
+ struct mm_struct *mm;
+ int err;
+@@ -263,7 +205,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
+
+ mm = get_task_mm(task);
+ if (mm && mm != current->mm &&
+- !ptrace_may_access(task, PTRACE_MODE_READ)) {
++ !ptrace_may_access(task, mode)) {
+ mmput(mm);
+ mm = ERR_PTR(-EACCES);
+ }
+@@ -272,6 +214,11 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
+ return mm;
+ }
+
++struct mm_struct *mm_for_maps(struct task_struct *task)
++{
++ return mm_access(task, PTRACE_MODE_READ);
++}
++
+ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
+ {
+ int res = 0;
+@@ -816,38 +763,39 @@ static const struct file_operations proc_single_file_operations = {
+
+ static int mem_open(struct inode* inode, struct file* file)
+ {
+- file->private_data = (void*)((long)current->self_exec_id);
++ struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
++ struct mm_struct *mm;
++
++ if (!task)
++ return -ESRCH;
++
++ mm = mm_access(task, PTRACE_MODE_ATTACH);
++ put_task_struct(task);
++
++ if (IS_ERR(mm))
++ return PTR_ERR(mm);
++
+ /* OK to pass negative loff_t, we can catch out-of-range */
+ file->f_mode |= FMODE_UNSIGNED_OFFSET;
++ file->private_data = mm;
++
+ return 0;
+ }
+
+ static ssize_t mem_read(struct file * file, char __user * buf,
+ size_t count, loff_t *ppos)
+ {
+- struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
++ int ret;
+ char *page;
+ unsigned long src = *ppos;
+- int ret = -ESRCH;
+- struct mm_struct *mm;
++ struct mm_struct *mm = file->private_data;
+
+- if (!task)
+- goto out_no_task;
++ if (!mm)
++ return 0;
+
+- ret = -ENOMEM;
+ page = (char *)__get_free_page(GFP_TEMPORARY);
+ if (!page)
+- goto out;
+-
+- mm = check_mem_permission(task);
+- ret = PTR_ERR(mm);
+- if (IS_ERR(mm))
+- goto out_free;
+-
+- ret = -EIO;
+-
+- if (file->private_data != (void*)((long)current->self_exec_id))
+- goto out_put;
++ return -ENOMEM;
+
+ ret = 0;
+
+@@ -874,13 +822,7 @@ static ssize_t mem_read(struct file * file, char __user * buf,
+ }
+ *ppos = src;
+
+-out_put:
+- mmput(mm);
+-out_free:
+ free_page((unsigned long) page);
+-out:
+- put_task_struct(task);
+-out_no_task:
+ return ret;
+ }
+
+@@ -889,27 +831,15 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
+ {
+ int copied;
+ char *page;
+- struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
+ unsigned long dst = *ppos;
+- struct mm_struct *mm;
++ struct mm_struct *mm = file->private_data;
+
+- copied = -ESRCH;
+- if (!task)
+- goto out_no_task;
++ if (!mm)
++ return 0;
+
+- copied = -ENOMEM;
+ page = (char *)__get_free_page(GFP_TEMPORARY);
+ if (!page)
+- goto out_task;
+-
+- mm = check_mem_permission(task);
+- copied = PTR_ERR(mm);
+- if (IS_ERR(mm))
+- goto out_free;
+-
+- copied = -EIO;
+- if (file->private_data != (void *)((long)current->self_exec_id))
+- goto out_mm;
++ return -ENOMEM;
+
+ copied = 0;
+ while (count > 0) {
+@@ -933,13 +863,7 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
+ }
+ *ppos = dst;
+
+-out_mm:
+- mmput(mm);
+-out_free:
+ free_page((unsigned long) page);
+-out_task:
+- put_task_struct(task);
+-out_no_task:
+ return copied;
+ }
+
+@@ -959,11 +883,20 @@ loff_t mem_lseek(struct file *file, loff_t offset, int orig)
+ return file->f_pos;
+ }
+
++static int mem_release(struct inode *inode, struct file *file)
++{
++ struct mm_struct *mm = file->private_data;
++
++ mmput(mm);
++ return 0;
++}
++
+ static const struct file_operations proc_mem_operations = {
+ .llseek = mem_lseek,
+ .read = mem_read,
+ .write = mem_write,
+ .open = mem_open,
++ .release = mem_release,
+ };
+
+ static ssize_t environ_read(struct file *file, char __user *buf,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch
new file mode 100644
index 0000000..85652b0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch
@@ -0,0 +1,35 @@
+From 19c9fdb5e8d481a2a13b437ef124486808a35726 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson at canonical.com>
+Date: Thu, 12 Jan 2012 16:31:14 +0100
+Subject: [PATCH 094/130] ALSA: HDA: Use LPIB position fix for Macbook Pro 7,1
+
+commit b01de4fb40137fbda7530550ff0cd37171dafb0c upstream.
+
+Several users have reported "choppy" audio under the 3.2 kernel,
+and that changing position_fix to 1 has resolved their problem.
+The chip is an nVidia Corporation MCP89 High Definition Audio,
+[10de:0d94] (rev a2).
+
+BugLink: https://bugs.launchpad.net/bugs/909419
+Signed-off-by: David Henningsson <david.henningsson at canonical.com>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ sound/pci/hda/hda_intel.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index c2f79e6..5b2b75b 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2509,6 +2509,7 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
+ SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS M2V", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS 1101HA", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB),
++ SND_PCI_QUIRK(0x10de, 0xcb89, "Macbook Pro 7,1", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1297, 0x3166, "Shuttle", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch
new file mode 100644
index 0000000..aa94381
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch
@@ -0,0 +1,37 @@
+From a199c605727cb1fd45800b12ede56637c027e0a2 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens at ladisch.de>
+Date: Sat, 14 Jan 2012 16:42:24 +0100
+Subject: [PATCH 095/130] ALSA: virtuoso: Xonar DS: fix polarity of front
+ output
+
+commit f0e48b6bd4e407459715240cd241ddb6b89bdf81 upstream.
+
+The two DACs for the front output and the surround/center/LFE/back
+outputs are wired up out of phase, so when channels are duplicated,
+their sound can cancel out each other and result in a weaker bass
+response. To fix this, reverse the polarity of the neutron flow to
+the front output.
+
+Reported-any-tested-by: Daniel Hill <daniel at enemyplanet.geek.nz>
+Signed-off-by: Clemens Ladisch <clemens at ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ sound/pci/oxygen/xonar_wm87x6.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/sound/pci/oxygen/xonar_wm87x6.c b/sound/pci/oxygen/xonar_wm87x6.c
+index 42d1ab1..915546a 100644
+--- a/sound/pci/oxygen/xonar_wm87x6.c
++++ b/sound/pci/oxygen/xonar_wm87x6.c
+@@ -177,6 +177,7 @@ static void wm8776_registers_init(struct oxygen *chip)
+ struct xonar_wm87x6 *data = chip->model_data;
+
+ wm8776_write(chip, WM8776_RESET, 0);
++ wm8776_write(chip, WM8776_PHASESWAP, WM8776_PH_MASK);
+ wm8776_write(chip, WM8776_DACCTRL1, WM8776_DZCEN |
+ WM8776_PL_LEFT_LEFT | WM8776_PL_RIGHT_RIGHT);
+ wm8776_write(chip, WM8776_DACMUTE, chip->dac_mute ? WM8776_DMUTE : 0);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch
new file mode 100644
index 0000000..80bf14e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch
@@ -0,0 +1,36 @@
+From 6ddbb15e9a2b460a42697a83ab2b4119978af8c8 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson at canonical.com>
+Date: Mon, 16 Jan 2012 10:52:20 +0100
+Subject: [PATCH 096/130] ALSA: HDA: Fix internal microphone on Dell Studio 16
+ XPS 1645
+
+commit ffe535edb9a9c5b4d5fe03dfa3d89a1495580f1b upstream.
+
+More than one user reports that changing the model from "both" to
+"dmic" makes their Internal Mic work.
+
+Tested-by: Martin Ling <martin-launchpad at earth.li>
+BugLink: https://bugs.launchpad.net/bugs/795823
+Signed-off-by: David Henningsson <david.henningsson at canonical.com>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ sound/pci/hda/patch_sigmatel.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index a87b260..f3c73a9 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1631,7 +1631,7 @@ static const struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = {
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02bd,
+ "Dell Studio 1557", STAC_DELL_M6_DMIC),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02fe,
+- "Dell Studio XPS 1645", STAC_DELL_M6_BOTH),
++ "Dell Studio XPS 1645", STAC_DELL_M6_DMIC),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0413,
+ "Dell Studio 1558", STAC_DELL_M6_DMIC),
+ {} /* terminator */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch
new file mode 100644
index 0000000..b6908ae
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch
@@ -0,0 +1,43 @@
+From 4e99d3453e09872ef6979dfe1518b80377fa5134 Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <from-tomoyo-users-en at I-love.SAKURA.ne.jp>
+Date: Sun, 15 Jan 2012 11:05:59 +0900
+Subject: [PATCH 097/130] TOMOYO: Accept \000 as a valid character.
+
+commit 25add8cf99c9ec8b8dc0acd8b9241e963fc0d29c upstream.
+
+TOMOYO 2.5 in Linux 3.2 and later handles Unix domain socket's address.
+Thus, tomoyo_correct_word2() needs to accept \000 as a valid character, or
+TOMOYO 2.5 cannot handle Unix domain's abstract socket address.
+
+Reported-by: Steven Allen <steven at stebalien.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
+Signed-off-by: James Morris <jmorris at namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ security/tomoyo/util.c | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c
+index 4a9b4b2..867558c 100644
+--- a/security/tomoyo/util.c
++++ b/security/tomoyo/util.c
+@@ -492,13 +492,13 @@ static bool tomoyo_correct_word2(const char *string, size_t len)
+ if (d < '0' || d > '7' || e < '0' || e > '7')
+ break;
+ c = tomoyo_make_byte(c, d, e);
+- if (tomoyo_invalid(c))
+- continue; /* pattern is not \000 */
++ if (c <= ' ' || c >= 127)
++ continue;
+ }
+ goto out;
+ } else if (in_repetition && c == '/') {
+ goto out;
+- } else if (tomoyo_invalid(c)) {
++ } else if (c <= ' ' || c >= 127) {
+ goto out;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch
new file mode 100644
index 0000000..b800a3e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch
@@ -0,0 +1,53 @@
+From 1ca189655bf3edf14c4837eba5873fc9c50f7e15 Mon Sep 17 00:00:00 2001
+From: Thomas Renninger <trenn at suse.de>
+Date: Sun, 4 Dec 2011 22:17:29 +0100
+Subject: [PATCH 098/130] intel idle: Make idle driver more robust
+
+commit 5c2a9f06a9cd7194f884cdc88144866235dec07d upstream.
+
+kvm -cpu host passes the original cpuid info to the guest.
+
+Latest kvm version seem to return true for mwait_leaf cpuid
+function on recent Intel CPUs. But it does not return mwait
+C-states (mwait_substates), instead zero is returned.
+
+While real CPUs seem to always return non-zero values, the intel
+idle driver should not get active in kvm (mwait_substates == 0)
+case and bail out.
+Otherwise a Null pointer exception will happen later when the
+cpuidle subsystem tries to get active:
+[0.984807] BUG: unable to handle kernel NULL pointer dereference at (null)
+[0.984807] IP: [<(null)>] (null)
+...
+[0.984807][<ffffffff8143cf34>] ? cpuidle_idle_call+0xb4/0x340
+[0.984807][<ffffffff8159e7bc>] ? __atomic_notifier_call_chain+0x4c/0x70
+[0.984807][<ffffffff81001198>] ? cpu_idle+0x78/0xd0
+
+Reference:
+https://bugzilla.novell.com/show_bug.cgi?id=726296
+
+Signed-off-by: Thomas Renninger <trenn at suse.de>
+CC: Bruno Friedmann <bruno at ioda-net.ch>
+Signed-off-by: Len Brown <len.brown at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/idle/intel_idle.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index 5d2f8e1..1dafcc3 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -348,7 +348,8 @@ static int intel_idle_probe(void)
+ cpuid(CPUID_MWAIT_LEAF, &eax, &ebx, &ecx, &mwait_substates);
+
+ if (!(ecx & CPUID5_ECX_EXTENSIONS_SUPPORTED) ||
+- !(ecx & CPUID5_ECX_INTERRUPT_BREAK))
++ !(ecx & CPUID5_ECX_INTERRUPT_BREAK) ||
++ !mwait_substates)
+ return -ENODEV;
+
+ pr_debug(PREFIX "MWAIT substates: 0x%x\n", mwait_substates);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0099-intel_idle-fix-API-misuse.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0099-intel_idle-fix-API-misuse.patch
new file mode 100644
index 0000000..2a171be
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0099-intel_idle-fix-API-misuse.patch
@@ -0,0 +1,56 @@
+From aaeec055d714b03aededdf7bd4eb75415e16f1ce Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li at intel.com>
+Date: Tue, 10 Jan 2012 15:48:19 -0800
+Subject: [PATCH 099/130] intel_idle: fix API misuse
+
+commit 39a74fdedd1c1461d6fb6d330b5266886513c98f upstream.
+
+smp_call_function() only lets all other CPUs execute a specific function,
+while we expect all CPUs do in intel_idle. Without the fix, we could have
+one cpu which has auto_demotion enabled or has no broadcast timer setup.
+Usually we don't see impact because auto demotion just harms power and the
+intel_idle init is called in CPU 0, where boradcast timer delivers
+interrupt, but this still could be a problem.
+
+Signed-off-by: Shaohua Li <shaohua.li at intel.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Len Brown <len.brown at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/idle/intel_idle.c | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index 1dafcc3..5b39216 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -395,7 +395,7 @@ static int intel_idle_probe(void)
+ if (boot_cpu_has(X86_FEATURE_ARAT)) /* Always Reliable APIC Timer */
+ lapic_timer_reliable_states = LAPIC_TIMER_ALWAYS_RELIABLE;
+ else {
+- smp_call_function(__setup_broadcast_timer, (void *)true, 1);
++ on_each_cpu(__setup_broadcast_timer, (void *)true, 1);
+ register_cpu_notifier(&setup_broadcast_notifier);
+ }
+
+@@ -472,7 +472,7 @@ static int intel_idle_cpuidle_driver_init(void)
+ }
+
+ if (auto_demotion_disable_flags)
+- smp_call_function(auto_demotion_disable, NULL, 1);
++ on_each_cpu(auto_demotion_disable, NULL, 1);
+
+ return 0;
+ }
+@@ -569,7 +569,7 @@ static void __exit intel_idle_exit(void)
+ cpuidle_unregister_driver(&intel_idle_driver);
+
+ if (lapic_timer_reliable_states != LAPIC_TIMER_ALWAYS_RELIABLE) {
+- smp_call_function(__setup_broadcast_timer, (void *)false, 1);
++ on_each_cpu(__setup_broadcast_timer, (void *)false, 1);
+ unregister_cpu_notifier(&setup_broadcast_notifier);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0100-ACPI-Store-SRAT-table-revision.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0100-ACPI-Store-SRAT-table-revision.patch
new file mode 100644
index 0000000..b729f78
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0100-ACPI-Store-SRAT-table-revision.patch
@@ -0,0 +1,66 @@
+From 30301eff41ac5268c71f2790e22d600785cd2664 Mon Sep 17 00:00:00 2001
+From: Kurt Garloff <kurt at garloff.de>
+Date: Tue, 17 Jan 2012 04:18:02 -0500
+Subject: [PATCH 100/130] ACPI: Store SRAT table revision
+
+commit 8df0eb7c9d96f9e82f233ee8b74e0f0c8471f868 upstream.
+
+In SRAT v1, we had 8bit proximity domain (PXM) fields; SRAT v2 provides
+32bits for these. The new fields were reserved before.
+According to the ACPI spec, the OS must disregrard reserved fields.
+In order to know whether or not, we must know what version the SRAT
+table has.
+
+This patch stores the SRAT table revision for later consumption
+by arch specific __init functions.
+
+Signed-off-by: Kurt Garloff <kurt at garloff.de>
+Signed-off-by: Len Brown <len.brown at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/acpi/numa.c | 6 ++++++
+ include/acpi/acpi_numa.h | 1 +
+ 2 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
+index 3b5c318..e56f3be 100644
+--- a/drivers/acpi/numa.c
++++ b/drivers/acpi/numa.c
+@@ -45,6 +45,8 @@ static int pxm_to_node_map[MAX_PXM_DOMAINS]
+ static int node_to_pxm_map[MAX_NUMNODES]
+ = { [0 ... MAX_NUMNODES - 1] = PXM_INVAL };
+
++unsigned char acpi_srat_revision __initdata;
++
+ int pxm_to_node(int pxm)
+ {
+ if (pxm < 0)
+@@ -255,9 +257,13 @@ acpi_parse_memory_affinity(struct acpi_subtable_header * header,
+
+ static int __init acpi_parse_srat(struct acpi_table_header *table)
+ {
++ struct acpi_table_srat *srat;
+ if (!table)
+ return -EINVAL;
+
++ srat = (struct acpi_table_srat *)table;
++ acpi_srat_revision = srat->header.revision;
++
+ /* Real work done in acpi_table_parse_srat below. */
+
+ return 0;
+diff --git a/include/acpi/acpi_numa.h b/include/acpi/acpi_numa.h
+index 1739726..451823c 100644
+--- a/include/acpi/acpi_numa.h
++++ b/include/acpi/acpi_numa.h
+@@ -15,6 +15,7 @@ extern int pxm_to_node(int);
+ extern int node_to_pxm(int);
+ extern void __acpi_map_pxm_to_node(int, int);
+ extern int acpi_map_pxm_to_node(int);
++extern unsigned char acpi_srat_revision;
+
+ #endif /* CONFIG_ACPI_NUMA */
+ #endif /* __ACP_NUMA_H */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch
new file mode 100644
index 0000000..7cee68e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch
@@ -0,0 +1,50 @@
+From 0e45b514e46f9eff94b28f527e63141cc5690f53 Mon Sep 17 00:00:00 2001
+From: Kurt Garloff <kurt at garloff.de>
+Date: Tue, 17 Jan 2012 04:20:31 -0500
+Subject: [PATCH 101/130] ACPI, x86: Use SRAT table rev to use 8bit or 32bit
+ PXM fields (x86/x86-64)
+
+commit cd298f60a2451a16e0f077404bf69b62ec868733 upstream.
+
+In SRAT v1, we had 8bit proximity domain (PXM) fields; SRAT v2 provides
+32bits for these. The new fields were reserved before.
+According to the ACPI spec, the OS must disregrard reserved fields.
+
+x86/x86-64 was rather inconsistent prior to this patch; it used 8 bits
+for the pxm field in cpu_affinity, but 32 bits in mem_affinity.
+This patch makes it consistent: Either use 8 bits consistently (SRAT
+rev 1 or lower) or 32 bits (SRAT rev 2 or higher).
+
+cc: x86 at kernel.org
+Signed-off-by: Kurt Garloff <kurt at garloff.de>
+Signed-off-by: Len Brown <len.brown at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/x86/mm/srat.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/arch/x86/mm/srat.c b/arch/x86/mm/srat.c
+index 81dbfde..7efd0c6 100644
+--- a/arch/x86/mm/srat.c
++++ b/arch/x86/mm/srat.c
+@@ -104,6 +104,8 @@ acpi_numa_processor_affinity_init(struct acpi_srat_cpu_affinity *pa)
+ if ((pa->flags & ACPI_SRAT_CPU_ENABLED) == 0)
+ return;
+ pxm = pa->proximity_domain_lo;
++ if (acpi_srat_revision >= 2)
++ pxm |= *((unsigned int*)pa->proximity_domain_hi) << 8;
+ node = setup_node(pxm);
+ if (node < 0) {
+ printk(KERN_ERR "SRAT: Too many proximity domains %x\n", pxm);
+@@ -155,6 +157,8 @@ acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
+ start = ma->base_address;
+ end = start + ma->length;
+ pxm = ma->proximity_domain;
++ if (acpi_srat_revision <= 1)
++ pxm &= 0xff;
+ node = setup_node(pxm);
+ if (node < 0) {
+ printk(KERN_ERR "SRAT: Too many proximity domains.\n");
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch
new file mode 100644
index 0000000..0c45ecd
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch
@@ -0,0 +1,66 @@
+From 559618f3ecbf0414d42fdf0d752e86e05b989847 Mon Sep 17 00:00:00 2001
+From: Kurt Garloff <kurt at garloff.de>
+Date: Tue, 17 Jan 2012 04:21:49 -0500
+Subject: [PATCH 102/130] ACPI, ia64: Use SRAT table rev to use 8bit or
+ 16/32bit PXM fields (ia64)
+
+commit 9f10f6a520deb3639fac78d81151a3ade88b4e7f upstream.
+
+In SRAT v1, we had 8bit proximity domain (PXM) fields; SRAT v2 provides
+32bits for these. The new fields were reserved before.
+According to the ACPI spec, the OS must disregrard reserved fields.
+
+ia64 did handle the PXM fields almost consistently, but depending on
+sgi's sn2 platform. This patch leaves the sn2 logic in, but does also
+use 16/32 bits for PXM if the SRAT has rev 2 or higher.
+
+The patch also adds __init to the two pxm accessor functions, as they
+access __initdata now and are called from an __init function only anyway.
+
+Note that the code only uses 16 bits for the PXM field in the processor
+proximity field; the patch does not address this as 16 bits are more than
+enough.
+
+Signed-off-by: Kurt Garloff <kurt at garloff.de>
+Signed-off-by: Len Brown <len.brown at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/ia64/kernel/acpi.c | 10 ++++++----
+ 1 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
+index bfb4d01..5207035 100644
+--- a/arch/ia64/kernel/acpi.c
++++ b/arch/ia64/kernel/acpi.c
+@@ -429,22 +429,24 @@ static u32 __devinitdata pxm_flag[PXM_FLAG_LEN];
+ static struct acpi_table_slit __initdata *slit_table;
+ cpumask_t early_cpu_possible_map = CPU_MASK_NONE;
+
+-static int get_processor_proximity_domain(struct acpi_srat_cpu_affinity *pa)
++static int __init
++get_processor_proximity_domain(struct acpi_srat_cpu_affinity *pa)
+ {
+ int pxm;
+
+ pxm = pa->proximity_domain_lo;
+- if (ia64_platform_is("sn2"))
++ if (ia64_platform_is("sn2") || acpi_srat_revision >= 2)
+ pxm += pa->proximity_domain_hi[0] << 8;
+ return pxm;
+ }
+
+-static int get_memory_proximity_domain(struct acpi_srat_mem_affinity *ma)
++static int __init
++get_memory_proximity_domain(struct acpi_srat_mem_affinity *ma)
+ {
+ int pxm;
+
+ pxm = ma->proximity_domain;
+- if (!ia64_platform_is("sn2"))
++ if (!ia64_platform_is("sn2") && acpi_srat_revision <= 1)
+ pxm &= 0xff;
+
+ return pxm;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch
new file mode 100644
index 0000000..100721e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch
@@ -0,0 +1,59 @@
+From 41a419ec07d2a21659f9258e614ead0a80cf23a8 Mon Sep 17 00:00:00 2001
+From: Lin Ming <ming.m.lin at intel.com>
+Date: Tue, 29 Nov 2011 22:13:35 +0800
+Subject: [PATCH 103/130] ACPICA: Put back the call to
+ acpi_os_validate_address
+
+commit da4d8b287abe783d30e968155614531a0937d090 upstream.
+
+The call to acpi_os_validate_address in acpi_ds_get_region_arguments was
+removed by mistake in commit 9ad19ac(ACPICA: Split large dsopcode and
+dsload.c files).
+
+Put it back.
+
+Reported-and-bisected-by: Luca Tettamanti <kronos.it at gmail.com>
+Signed-off-by: Lin Ming <ming.m.lin at intel.com>
+Signed-off-by: Len Brown <len.brown at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/acpi/acpica/dsargs.c | 24 ++++++++++++++++++++++++
+ 1 files changed, 24 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsargs.c b/drivers/acpi/acpica/dsargs.c
+index 8c7b997..42163d8 100644
+--- a/drivers/acpi/acpica/dsargs.c
++++ b/drivers/acpi/acpica/dsargs.c
+@@ -387,5 +387,29 @@ acpi_status acpi_ds_get_region_arguments(union acpi_operand_object *obj_desc)
+ status = acpi_ds_execute_arguments(node, node->parent,
+ extra_desc->extra.aml_length,
+ extra_desc->extra.aml_start);
++ if (ACPI_FAILURE(status)) {
++ return_ACPI_STATUS(status);
++ }
++
++ /* Validate the region address/length via the host OS */
++
++ status = acpi_os_validate_address(obj_desc->region.space_id,
++ obj_desc->region.address,
++ (acpi_size) obj_desc->region.length,
++ acpi_ut_get_node_name(node));
++
++ if (ACPI_FAILURE(status)) {
++ /*
++ * Invalid address/length. We will emit an error message and mark
++ * the region as invalid, so that it will cause an additional error if
++ * it is ever used. Then return AE_OK.
++ */
++ ACPI_EXCEPTION((AE_INFO, status,
++ "During address validation of OpRegion [%4.4s]",
++ node->name.ascii));
++ obj_desc->common.flags |= AOPOBJ_INVALID;
++ status = AE_OK;
++ }
++
+ return_ACPI_STATUS(status);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch
new file mode 100644
index 0000000..da6b2f8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch
@@ -0,0 +1,75 @@
+From 8f8ad292bbb34d56fdf612c13fb6f24da376c007 Mon Sep 17 00:00:00 2001
+From: Lin Ming <ming.m.lin at intel.com>
+Date: Tue, 13 Dec 2011 09:36:03 +0800
+Subject: [PATCH 104/130] ACPI: processor: fix acpi_get_cpuid for UP processor
+
+commit d640113fe80e45ebd4a5b420b220d3f6bf37f682 upstream.
+
+For UP processor, it is likely that no _MAT method or MADT table defined.
+So currently acpi_get_cpuid(...) always return -1 for UP processor.
+This is wrong. It should return valid value for CPU0.
+
+In the other hand, BIOS may define multiple CPU handles even for UP
+processor, for example
+
+ Scope (_PR)
+ {
+ Processor (CPU0, 0x00, 0x00000410, 0x06) {}
+ Processor (CPU1, 0x01, 0x00000410, 0x06) {}
+ Processor (CPU2, 0x02, 0x00000410, 0x06) {}
+ Processor (CPU3, 0x03, 0x00000410, 0x06) {}
+ }
+
+We should only return valid value for CPU0's acpi handle.
+And return invalid value for others.
+
+http://marc.info/?t=132329819900003&r=1&w=2
+
+Reported-and-tested-by: wallak at free.fr
+Signed-off-by: Lin Ming <ming.m.lin at intel.com>
+Signed-off-by: Len Brown <len.brown at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/acpi/processor_core.c | 26 ++++++++++++++++++++++++--
+ 1 files changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
+index 3a0428e..c850de4 100644
+--- a/drivers/acpi/processor_core.c
++++ b/drivers/acpi/processor_core.c
+@@ -173,8 +173,30 @@ int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
+ apic_id = map_mat_entry(handle, type, acpi_id);
+ if (apic_id == -1)
+ apic_id = map_madt_entry(type, acpi_id);
+- if (apic_id == -1)
+- return apic_id;
++ if (apic_id == -1) {
++ /*
++ * On UP processor, there is no _MAT or MADT table.
++ * So above apic_id is always set to -1.
++ *
++ * BIOS may define multiple CPU handles even for UP processor.
++ * For example,
++ *
++ * Scope (_PR)
++ * {
++ * Processor (CPU0, 0x00, 0x00000410, 0x06) {}
++ * Processor (CPU1, 0x01, 0x00000410, 0x06) {}
++ * Processor (CPU2, 0x02, 0x00000410, 0x06) {}
++ * Processor (CPU3, 0x03, 0x00000410, 0x06) {}
++ * }
++ *
++ * Ignores apic_id and always return 0 for CPU0's handle.
++ * Return -1 for other CPU's handle.
++ */
++ if (acpi_id == 0)
++ return acpi_id;
++ else
++ return apic_id;
++ }
+
+ #ifdef CONFIG_SMP
+ for_each_possible_cpu(i) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch
new file mode 100644
index 0000000..c17898a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch
@@ -0,0 +1,37 @@
+From 40922e4e53c0eaef6473c1cf8ef15fea5076e4b5 Mon Sep 17 00:00:00 2001
+From: Stratos Psomadakis <psomas at gentoo.org>
+Date: Sun, 4 Dec 2011 02:23:54 +0200
+Subject: [PATCH 105/130] sym53c8xx: Fix NULL pointer dereference in
+ slave_destroy
+
+commit cced5041ed5a2d1352186510944b0ddfbdbe4c0b upstream.
+
+sym53c8xx_slave_destroy unconditionally assumes that sym53c8xx_slave_alloc has
+succesesfully allocated a sym_lcb. This can lead to a NULL pointer dereference
+(exposed by commit 4e6c82b).
+
+Signed-off-by: Stratos Psomadakis <psomas at gentoo.org>
+Signed-off-by: James Bottomley <JBottomley at Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/scsi/sym53c8xx_2/sym_glue.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
+index b4543f5..36d1ed7 100644
+--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
++++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
+@@ -839,6 +839,10 @@ static void sym53c8xx_slave_destroy(struct scsi_device *sdev)
+ struct sym_lcb *lp = sym_lp(tp, sdev->lun);
+ unsigned long flags;
+
++ /* if slave_alloc returned before allocating a sym_lcb, return */
++ if (!lp)
++ return;
++
+ spin_lock_irqsave(np->s.host->host_lock, flags);
+
+ if (lp->busy_itlq || lp->busy_itl) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch
new file mode 100644
index 0000000..8c83cb5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch
@@ -0,0 +1,44 @@
+From 93a9397c36390facb429c34a7bca31b7c6c5df39 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland at purestorage.com>
+Date: Tue, 6 Dec 2011 10:02:09 -0800
+Subject: [PATCH 106/130] target: Set response format in INQUIRY response
+
+commit ce136176fea522fc8f4c16dcae7e8ed1d890ca39 upstream.
+
+Current SCSI specs say that the "response format" field in the standard
+INQUIRY response should be set to 2, and all the real SCSI devices I
+have do put 2 here. So let's do that too.
+
+Signed-off-by: Roland Dreier <roland at purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab at linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/target/target_core_cdb.c | 12 ++++++++++++
+ 1 files changed, 12 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
+index 831468b..2e8c1be 100644
+--- a/drivers/target/target_core_cdb.c
++++ b/drivers/target/target_core_cdb.c
+@@ -94,6 +94,18 @@ target_emulate_inquiry_std(struct se_cmd *cmd)
+ buf[2] = dev->transport->get_device_rev(dev);
+
+ /*
++ * NORMACA and HISUP = 0, RESPONSE DATA FORMAT = 2
++ *
++ * SPC4 says:
++ * A RESPONSE DATA FORMAT field set to 2h indicates that the
++ * standard INQUIRY data is in the format defined in this
++ * standard. Response data format values less than 2h are
++ * obsolete. Response data format values greater than 2h are
++ * reserved.
++ */
++ buf[3] = 2;
++
++ /*
+ * Enable SCCS and TPGS fields for Emulated ALUA
+ */
+ if (dev->se_sub_dev->t10_alua.alua_type == SPC3_ALUA_EMULATED)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch
new file mode 100644
index 0000000..ccf6a35
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch
@@ -0,0 +1,177 @@
+From 894360c2f0b3fca21a3e663f60746476a185f100 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland at purestorage.com>
+Date: Tue, 13 Dec 2011 14:55:33 -0800
+Subject: [PATCH 107/130] target: Set additional sense length field in sense
+ data
+
+commit 895f3022523361e9b383cf48f51feb1f7d5e7e53 upstream.
+
+The target code was not setting the additional sense length field in the
+sense data it returned, which meant that at least the Linux stack
+ignored the ASC/ASCQ fields. For example, without this patch, on a
+tcm_loop device:
+
+ # sg_raw -v /dev/sda 2 0 0 0 0 0
+
+gives
+
+ cdb to send: 02 00 00 00 00 00
+ SCSI Status: Check Condition
+
+ Sense Information:
+ Fixed format, current; Sense key: Illegal Request
+ Raw sense data (in hex):
+ 70 00 05 00 00 00 00 00
+
+while after the patch we correctly get the following (which matches what
+a regular disk returns):
+
+ cdb to send: 02 00 00 00 00 00
+ SCSI Status: Check Condition
+
+ Sense Information:
+ Fixed format, current; Sense key: Illegal Request
+ Additional sense: Invalid command operation code
+ Raw sense data (in hex):
+ 70 00 05 00 00 00 00 0a 00 00 00 00 20 00 00 00
+ 00 00
+
+Signed-off-by: Roland Dreier <roland at purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab at linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/target/target_core_transport.c | 14 ++++++++++++++
+ include/target/target_core_base.h | 1 +
+ 2 files changed, 15 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 0257658..e87d0eb 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -4353,6 +4353,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_NON_EXISTENT_LUN:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ILLEGAL REQUEST */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* LOGICAL UNIT NOT SUPPORTED */
+@@ -4362,6 +4363,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_SECTOR_COUNT_TOO_MANY:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ILLEGAL REQUEST */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* INVALID COMMAND OPERATION CODE */
+@@ -4370,6 +4372,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_UNKNOWN_MODE_PAGE:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ILLEGAL REQUEST */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* INVALID FIELD IN CDB */
+@@ -4378,6 +4381,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_CHECK_CONDITION_ABORT_CMD:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* BUS DEVICE RESET FUNCTION OCCURRED */
+@@ -4387,6 +4391,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_INCORRECT_AMOUNT_OF_DATA:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* WRITE ERROR */
+@@ -4397,6 +4402,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_INVALID_CDB_FIELD:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* INVALID FIELD IN CDB */
+@@ -4405,6 +4411,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_INVALID_PARAMETER_LIST:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* INVALID FIELD IN PARAMETER LIST */
+@@ -4413,6 +4420,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_UNEXPECTED_UNSOLICITED_DATA:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* WRITE ERROR */
+@@ -4423,6 +4431,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_SERVICE_CRC_ERROR:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* PROTOCOL SERVICE CRC ERROR */
+@@ -4433,6 +4442,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_SNACK_REJECTED:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* READ ERROR */
+@@ -4443,6 +4453,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_WRITE_PROTECTED:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* DATA PROTECT */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = DATA_PROTECT;
+ /* WRITE PROTECTED */
+@@ -4451,6 +4462,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_CHECK_CONDITION_UNIT_ATTENTION:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* UNIT ATTENTION */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = UNIT_ATTENTION;
+ core_scsi3_ua_for_check_condition(cmd, &asc, &ascq);
+@@ -4460,6 +4472,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_CHECK_CONDITION_NOT_READY:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* Not Ready */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = NOT_READY;
+ transport_get_sense_codes(cmd, &asc, &ascq);
+@@ -4470,6 +4483,7 @@ int transport_send_check_condition_and_sense(
+ default:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ILLEGAL REQUEST */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* LOGICAL UNIT COMMUNICATION FAILURE */
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 6873c7d..a79886c 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -34,6 +34,7 @@
+ #define TRANSPORT_SENSE_BUFFER SCSI_SENSE_BUFFERSIZE
+ /* Used by transport_send_check_condition_and_sense() */
+ #define SPC_SENSE_KEY_OFFSET 2
++#define SPC_ADD_SENSE_LEN_OFFSET 7
+ #define SPC_ASC_KEY_OFFSET 12
+ #define SPC_ASCQ_KEY_OFFSET 13
+ #define TRANSPORT_IQN_LEN 224
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch
new file mode 100644
index 0000000..5ea191a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch
@@ -0,0 +1,44 @@
+From 48f4e889aa88368a9ac548bba39c37663d012739 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5 at gmail.com>
+Date: Fri, 13 Jan 2012 23:58:38 +0100
+Subject: [PATCH 108/130] bcma: invalidate the mapped core over suspend/resume
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 28e7d218da975f6ae1751e293aed938952c55c98 upstream.
+
+This clears the currently mapped core when suspending, to force
+re-mapping after resume. Without that we were touching default core
+registers believing some other core is mapped. Such a behaviour
+resulted in lockups on some machines.
+
+Signed-off-by: Rafał Miłecki <zajec5 at gmail.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/bcma/host_pci.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
+index 990f5a8..48e06be 100644
+--- a/drivers/bcma/host_pci.c
++++ b/drivers/bcma/host_pci.c
+@@ -227,11 +227,14 @@ static void bcma_host_pci_remove(struct pci_dev *dev)
+ #ifdef CONFIG_PM
+ static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
+ {
++ struct bcma_bus *bus = pci_get_drvdata(dev);
++
+ /* Host specific */
+ pci_save_state(dev);
+ pci_disable_device(dev);
+ pci_set_power_state(dev, pci_choose_state(dev, state));
+
++ bus->mapped_core = NULL;
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch
new file mode 100644
index 0000000..210ff01
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch
@@ -0,0 +1,36 @@
+From 1d2015b35f096926482fe3c1b5b3b84c0f8a34b3 Mon Sep 17 00:00:00 2001
+From: Miroslav Slugen <thunder.mmm at gmail.com>
+Date: Sun, 11 Dec 2011 18:57:58 -0300
+Subject: [PATCH 109/130] cx23885-dvb: check if dvb_attach() succeded
+
+commit a7c8aadad39428b64d26c3971d967f8314e2397d upstream.
+
+Fix possible null dereference for Leadtek DTV 3200H
+XC4000 tuner when no firmware file available.
+
+Signed-off-by: Miroslav Slugen <thunder.mmm at gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/media/video/cx23885/cx23885-dvb.c | 5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/media/video/cx23885/cx23885-dvb.c b/drivers/media/video/cx23885/cx23885-dvb.c
+index bcb45be..f0482b2 100644
+--- a/drivers/media/video/cx23885/cx23885-dvb.c
++++ b/drivers/media/video/cx23885/cx23885-dvb.c
+@@ -940,6 +940,11 @@ static int dvb_register(struct cx23885_tsport *port)
+
+ fe = dvb_attach(xc4000_attach, fe0->dvb.frontend,
+ &dev->i2c_bus[1].i2c_adap, &cfg);
++ if (!fe) {
++ printk(KERN_ERR "%s/2: xc4000 attach failed\n",
++ dev->name);
++ goto frontend_detach;
++ }
+ }
+ break;
+ case CX23885_BOARD_TBS_6920:
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch
new file mode 100644
index 0000000..20dd5ec
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch
@@ -0,0 +1,95 @@
+From 62b69534abbda46006d5372502ae08e2df541e58 Mon Sep 17 00:00:00 2001
+From: Miroslav Slugen <thunder.mmm at gmail.com>
+Date: Sun, 11 Dec 2011 19:00:06 -0300
+Subject: [PATCH 110/130] cx88: fix: don't duplicate xc4000 entry for radio
+
+commit b6854e3f31402476bcc9d2f41570389fa491de17 upstream.
+
+All radio tuners in cx88 driver using same address for radio and tuner,
+so there is no need to probe it twice for same tuner and we can use
+radio_type UNSET, this also fix broken radio since kernel 2.6.39-rc1
+for those tuners.
+
+Signed-off-by: Miroslav Slugen <thunder.mmm at gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/media/video/cx88/cx88-cards.c | 24 ++++++++++++------------
+ 1 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
+index 0d719fa..3929d93 100644
+--- a/drivers/media/video/cx88/cx88-cards.c
++++ b/drivers/media/video/cx88/cx88-cards.c
+@@ -1573,8 +1573,8 @@ static const struct cx88_board cx88_boards[] = {
+ .name = "Pinnacle Hybrid PCTV",
+ .tuner_type = TUNER_XC2028,
+ .tuner_addr = 0x61,
+- .radio_type = TUNER_XC2028,
+- .radio_addr = 0x61,
++ .radio_type = UNSET,
++ .radio_addr = ADDR_UNSET,
+ .input = { {
+ .type = CX88_VMUX_TELEVISION,
+ .vmux = 0,
+@@ -1611,8 +1611,8 @@ static const struct cx88_board cx88_boards[] = {
+ .name = "Leadtek TV2000 XP Global",
+ .tuner_type = TUNER_XC2028,
+ .tuner_addr = 0x61,
+- .radio_type = TUNER_XC2028,
+- .radio_addr = 0x61,
++ .radio_type = UNSET,
++ .radio_addr = ADDR_UNSET,
+ .input = { {
+ .type = CX88_VMUX_TELEVISION,
+ .vmux = 0,
+@@ -2043,8 +2043,8 @@ static const struct cx88_board cx88_boards[] = {
+ .name = "Terratec Cinergy HT PCI MKII",
+ .tuner_type = TUNER_XC2028,
+ .tuner_addr = 0x61,
+- .radio_type = TUNER_XC2028,
+- .radio_addr = 0x61,
++ .radio_type = UNSET,
++ .radio_addr = ADDR_UNSET,
+ .input = { {
+ .type = CX88_VMUX_TELEVISION,
+ .vmux = 0,
+@@ -2082,9 +2082,9 @@ static const struct cx88_board cx88_boards[] = {
+ [CX88_BOARD_WINFAST_DTV1800H] = {
+ .name = "Leadtek WinFast DTV1800 Hybrid",
+ .tuner_type = TUNER_XC2028,
+- .radio_type = TUNER_XC2028,
++ .radio_type = UNSET,
+ .tuner_addr = 0x61,
+- .radio_addr = 0x61,
++ .radio_addr = ADDR_UNSET,
+ /*
+ * GPIO setting
+ *
+@@ -2123,9 +2123,9 @@ static const struct cx88_board cx88_boards[] = {
+ [CX88_BOARD_WINFAST_DTV1800H_XC4000] = {
+ .name = "Leadtek WinFast DTV1800 H (XC4000)",
+ .tuner_type = TUNER_XC4000,
+- .radio_type = TUNER_XC4000,
++ .radio_type = UNSET,
+ .tuner_addr = 0x61,
+- .radio_addr = 0x61,
++ .radio_addr = ADDR_UNSET,
+ /*
+ * GPIO setting
+ *
+@@ -2164,9 +2164,9 @@ static const struct cx88_board cx88_boards[] = {
+ [CX88_BOARD_WINFAST_DTV2000H_PLUS] = {
+ .name = "Leadtek WinFast DTV2000 H PLUS",
+ .tuner_type = TUNER_XC4000,
+- .radio_type = TUNER_XC4000,
++ .radio_type = UNSET,
+ .tuner_addr = 0x61,
+- .radio_addr = 0x61,
++ .radio_addr = ADDR_UNSET,
+ /*
+ * GPIO
+ * 2: 1: mute audio
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch
new file mode 100644
index 0000000..8111a5a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch
@@ -0,0 +1,42 @@
+From d713ae5fcd06e723ac059ae03311b10d5508a272 Mon Sep 17 00:00:00 2001
+From: Miroslav Slugen <thunder.mmm at gmail.com>
+Date: Sun, 11 Dec 2011 18:47:32 -0300
+Subject: [PATCH 111/130] tuner: Fix numberspace conflict between xc4000 and
+ pti 5nf05 tuners
+
+commit cd4ca7afc61d3b18fcd635002459fb6b1d701099 upstream.
+
+Update xc4000 tuner definition, number 81 is already in use by
+TUNER_PARTSNIC_PTI_5NF05.
+
+Signed-off-by: Miroslav Slugen <thunder.mmm at gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ include/media/tuner.h | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/include/media/tuner.h b/include/media/tuner.h
+index 89c290b..29e1920 100644
+--- a/include/media/tuner.h
++++ b/include/media/tuner.h
+@@ -127,7 +127,6 @@
+ #define TUNER_PHILIPS_FMD1216MEX_MK3 78
+ #define TUNER_PHILIPS_FM1216MK5 79
+ #define TUNER_PHILIPS_FQ1216LME_MK3 80 /* Active loopthrough, no FM */
+-#define TUNER_XC4000 81 /* Xceive Silicon Tuner */
+
+ #define TUNER_PARTSNIC_PTI_5NF05 81
+ #define TUNER_PHILIPS_CU1216L 82
+@@ -136,6 +135,8 @@
+ #define TUNER_PHILIPS_FQ1236_MK5 85 /* NTSC, TDA9885, no FM radio */
+ #define TUNER_TENA_TNF_5337 86
+
++#define TUNER_XC4000 87 /* Xceive Silicon Tuner */
++
+ /* tv card specific */
+ #define TDA9887_PRESENT (1<<0)
+ #define TDA9887_PORT1_INACTIVE (1<<1)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch
new file mode 100644
index 0000000..d6533b7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch
@@ -0,0 +1,50 @@
+From 18a0d839d63af34c8327754de80855fe7f6d9c17 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt at redhat.com>
+Date: Fri, 13 Jan 2012 21:40:59 -0500
+Subject: [PATCH 112/130] tracepoints/module: Fix disabling tracepoints with
+ taint CRAP or OOT
+
+commit c10076c4304083af15a41f6bc5e657e781c1f9a6 upstream.
+
+Tracepoints are disabled for tainted modules, which is usually because the
+module is either proprietary or was forced, and we don't want either of them
+using kernel tracepoints.
+
+But, a module can also be tainted by being in the staging directory or
+compiled out of tree. Either is fine for use with tracepoints, no need
+to punish them. I found this out when I noticed that my sample trace event
+module, when done out of tree, stopped working.
+
+Cc: Mathieu Desnoyers <mathieu.desnoyers at efficios.com>
+Cc: Ben Hutchings <ben at decadent.org.uk>
+Cc: Dave Jones <davej at redhat.com>
+Cc: Greg Kroah-Hartman <gregkh at suse.de>
+Cc: Rusty Russell <rusty at rustcorp.com.au>
+Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ kernel/tracepoint.c | 7 ++++---
+ 1 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
+index db110b8..f1539de 100644
+--- a/kernel/tracepoint.c
++++ b/kernel/tracepoint.c
+@@ -634,10 +634,11 @@ static int tracepoint_module_coming(struct module *mod)
+ int ret = 0;
+
+ /*
+- * We skip modules that tain the kernel, especially those with different
+- * module header (for forced load), to make sure we don't cause a crash.
++ * We skip modules that taint the kernel, especially those with different
++ * module headers (for forced load), to make sure we don't cause a crash.
++ * Staging and out-of-tree GPL modules are fine.
+ */
+- if (mod->taints)
++ if (mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP)))
+ return 0;
+ mutex_lock(&tracepoints_mutex);
+ tp_mod = kmalloc(sizeof(struct tp_module), GFP_KERNEL);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch
new file mode 100644
index 0000000..4a8f8cd
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch
@@ -0,0 +1,34 @@
+From 9d4b4b0db1a41d1ec947a28c1bae7685211d934d Mon Sep 17 00:00:00 2001
+From: Alexander Aring <a.aring at phytec.de>
+Date: Thu, 8 Dec 2011 15:43:53 +0100
+Subject: [PATCH 113/130] I2C: OMAP: correct SYSC register offset for OMAP4
+
+commit 2727b1753934e154931d6b3bdf20c9b2398457a2 upstream.
+
+Correct OMAP_I2C_SYSC_REG offset in omap4 register map.
+Offset 0x20 is reserved and OMAP_I2C_SYSC_REG has 0x10 as offset.
+
+Signed-off-by: Alexander Aring <a.aring at phytec.de>
+[khilman at ti.com: minor changelog edits]
+Signed-off-by: Kevin Hilman <khilman at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/i2c/busses/i2c-omap.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
+index 82fff06..e0733b7 100644
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -235,7 +235,7 @@ static const u8 reg_map_ip_v2[] = {
+ [OMAP_I2C_BUF_REG] = 0x94,
+ [OMAP_I2C_CNT_REG] = 0x98,
+ [OMAP_I2C_DATA_REG] = 0x9c,
+- [OMAP_I2C_SYSC_REG] = 0x20,
++ [OMAP_I2C_SYSC_REG] = 0x10,
+ [OMAP_I2C_CON_REG] = 0xa4,
+ [OMAP_I2C_OA_REG] = 0xa8,
+ [OMAP_I2C_SA_REG] = 0xac,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch
new file mode 100644
index 0000000..2e48040
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch
@@ -0,0 +1,350 @@
+From 0046f18e8ee26577b8b75d678ee353a9ab31773b Mon Sep 17 00:00:00 2001
+From: Cliff Wickman <cpw at sgi.com>
+Date: Mon, 16 Jan 2012 15:17:50 -0600
+Subject: [PATCH 114/130] x86/UV2: Fix new UV2 hardware by using native UV2
+ broadcast mode
+
+commit da87c937e5a2374686edd58df06cfd5050b125fa upstream.
+
+Update the use of the Broadcast Assist Unit on SGI Altix UV2 to
+the use of native UV2 mode on new hardware (not the legacy mode).
+
+UV2 native mode has a different format for a broadcast message.
+We also need quick differentiaton between UV1 and UV2.
+
+Signed-off-by: Cliff Wickman <cpw at sgi.com>
+Link: http://lkml.kernel.org/r/20120116211750.GA5767@sgi.com
+Signed-off-by: Ingo Molnar <mingo at elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/x86/include/asm/uv/uv_bau.h | 93 +++++++++++++++++++++++++++++++++++---
+ arch/x86/platform/uv/tlb_uv.c | 88 ++++++++++++++++++++++++++---------
+ 2 files changed, 151 insertions(+), 30 deletions(-)
+
+diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
+index 8e862aa..4a46b27 100644
+--- a/arch/x86/include/asm/uv/uv_bau.h
++++ b/arch/x86/include/asm/uv/uv_bau.h
+@@ -65,7 +65,7 @@
+ * UV2: Bit 19 selects between
+ * (0): 10 microsecond timebase and
+ * (1): 80 microseconds
+- * we're using 655us, similar to UV1: 65 units of 10us
++ * we're using 560us, similar to UV1: 65 units of 10us
+ */
+ #define UV1_INTD_SOFT_ACK_TIMEOUT_PERIOD (9UL)
+ #define UV2_INTD_SOFT_ACK_TIMEOUT_PERIOD (15UL)
+@@ -235,10 +235,10 @@ struct bau_msg_payload {
+
+
+ /*
+- * Message header: 16 bytes (128 bits) (bytes 0x30-0x3f of descriptor)
++ * UV1 Message header: 16 bytes (128 bits) (bytes 0x30-0x3f of descriptor)
+ * see table 4.2.3.0.1 in broacast_assist spec.
+ */
+-struct bau_msg_header {
++struct uv1_bau_msg_header {
+ unsigned int dest_subnodeid:6; /* must be 0x10, for the LB */
+ /* bits 5:0 */
+ unsigned int base_dest_nasid:15; /* nasid of the first bit */
+@@ -318,19 +318,87 @@ struct bau_msg_header {
+ };
+
+ /*
++ * UV2 Message header: 16 bytes (128 bits) (bytes 0x30-0x3f of descriptor)
++ * see figure 9-2 of harp_sys.pdf
++ */
++struct uv2_bau_msg_header {
++ unsigned int base_dest_nasid:15; /* nasid of the first bit */
++ /* bits 14:0 */ /* in uvhub map */
++ unsigned int dest_subnodeid:5; /* must be 0x10, for the LB */
++ /* bits 19:15 */
++ unsigned int rsvd_1:1; /* must be zero */
++ /* bit 20 */
++ /* Address bits 59:21 */
++ /* bits 25:2 of address (44:21) are payload */
++ /* these next 24 bits become bytes 12-14 of msg */
++ /* bits 28:21 land in byte 12 */
++ unsigned int replied_to:1; /* sent as 0 by the source to
++ byte 12 */
++ /* bit 21 */
++ unsigned int msg_type:3; /* software type of the
++ message */
++ /* bits 24:22 */
++ unsigned int canceled:1; /* message canceled, resource
++ is to be freed*/
++ /* bit 25 */
++ unsigned int payload_1:3; /* not currently used */
++ /* bits 28:26 */
++
++ /* bits 36:29 land in byte 13 */
++ unsigned int payload_2a:3; /* not currently used */
++ unsigned int payload_2b:5; /* not currently used */
++ /* bits 36:29 */
++
++ /* bits 44:37 land in byte 14 */
++ unsigned int payload_3:8; /* not currently used */
++ /* bits 44:37 */
++
++ unsigned int rsvd_2:7; /* reserved */
++ /* bits 51:45 */
++ unsigned int swack_flag:1; /* software acknowledge flag */
++ /* bit 52 */
++ unsigned int rsvd_3a:3; /* must be zero */
++ unsigned int rsvd_3b:8; /* must be zero */
++ unsigned int rsvd_3c:8; /* must be zero */
++ unsigned int rsvd_3d:3; /* must be zero */
++ /* bits 74:53 */
++ unsigned int fairness:3; /* usually zero */
++ /* bits 77:75 */
++
++ unsigned int sequence:16; /* message sequence number */
++ /* bits 93:78 Suppl_A */
++ unsigned int chaining:1; /* next descriptor is part of
++ this activation*/
++ /* bit 94 */
++ unsigned int multilevel:1; /* multi-level multicast
++ format */
++ /* bit 95 */
++ unsigned int rsvd_4:24; /* ordered / source node /
++ source subnode / aging
++ must be zero */
++ /* bits 119:96 */
++ unsigned int command:8; /* message type */
++ /* bits 127:120 */
++};
++
++/*
+ * The activation descriptor:
+ * The format of the message to send, plus all accompanying control
+ * Should be 64 bytes
+ */
+ struct bau_desc {
+- struct pnmask distribution;
++ struct pnmask distribution;
+ /*
+ * message template, consisting of header and payload:
+ */
+- struct bau_msg_header header;
+- struct bau_msg_payload payload;
++ union bau_msg_header {
++ struct uv1_bau_msg_header uv1_hdr;
++ struct uv2_bau_msg_header uv2_hdr;
++ } header;
++
++ struct bau_msg_payload payload;
+ };
+-/*
++/* UV1:
+ * -payload-- ---------header------
+ * bytes 0-11 bits 41-56 bits 58-81
+ * A B (2) C (3)
+@@ -340,6 +408,16 @@ struct bau_desc {
+ * bytes 0-11 bytes 12-14 bytes 16-17 (byte 15 filled in by hw as vector)
+ * ------------payload queue-----------
+ */
++/* UV2:
++ * -payload-- ---------header------
++ * bytes 0-11 bits 70-78 bits 21-44
++ * A B (2) C (3)
++ *
++ * A/B/C are moved to:
++ * A C B
++ * bytes 0-11 bytes 12-14 bytes 16-17 (byte 15 filled in by hw as vector)
++ * ------------payload queue-----------
++ */
+
+ /*
+ * The payload queue on the destination side is an array of these.
+@@ -511,6 +589,7 @@ struct bau_control {
+ short osnode;
+ short uvhub_cpu;
+ short uvhub;
++ short uvhub_version;
+ short cpus_in_socket;
+ short cpus_in_uvhub;
+ short partition_base_pnode;
+diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
+index 5b55219..1341a2e 100644
+--- a/arch/x86/platform/uv/tlb_uv.c
++++ b/arch/x86/platform/uv/tlb_uv.c
+@@ -573,7 +573,7 @@ static int wait_completion(struct bau_desc *bau_desc,
+ right_shift = ((cpu - UV_CPUS_PER_AS) * UV_ACT_STATUS_SIZE);
+ }
+
+- if (is_uv1_hub())
++ if (bcp->uvhub_version == 1)
+ return uv1_wait_completion(bau_desc, mmr_offset, right_shift,
+ bcp, try);
+ else
+@@ -757,15 +757,22 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+ {
+ int seq_number = 0;
+ int completion_stat = 0;
++ int uv1 = 0;
+ long try = 0;
+ unsigned long index;
+ cycles_t time1;
+ cycles_t time2;
+ struct ptc_stats *stat = bcp->statp;
+ struct bau_control *hmaster = bcp->uvhub_master;
++ struct uv1_bau_msg_header *uv1_hdr = NULL;
++ struct uv2_bau_msg_header *uv2_hdr = NULL;
+
+- if (is_uv1_hub())
++ if (bcp->uvhub_version == 1) {
++ uv1 = 1;
+ uv1_throttle(hmaster, stat);
++ uv1_hdr = &bau_desc->header.uv1_hdr;
++ } else
++ uv2_hdr = &bau_desc->header.uv2_hdr;
+
+ while (hmaster->uvhub_quiesce)
+ cpu_relax();
+@@ -773,14 +780,23 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+ time1 = get_cycles();
+ do {
+ if (try == 0) {
+- bau_desc->header.msg_type = MSG_REGULAR;
++ if (uv1)
++ uv1_hdr->msg_type = MSG_REGULAR;
++ else
++ uv2_hdr->msg_type = MSG_REGULAR;
+ seq_number = bcp->message_number++;
+ } else {
+- bau_desc->header.msg_type = MSG_RETRY;
++ if (uv1)
++ uv1_hdr->msg_type = MSG_RETRY;
++ else
++ uv2_hdr->msg_type = MSG_RETRY;
+ stat->s_retry_messages++;
+ }
+
+- bau_desc->header.sequence = seq_number;
++ if (uv1)
++ uv1_hdr->sequence = seq_number;
++ else
++ uv2_hdr->sequence = seq_number;
+ index = (1UL << AS_PUSH_SHIFT) | bcp->uvhub_cpu;
+ bcp->send_message = get_cycles();
+
+@@ -967,7 +983,7 @@ const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
+ stat->s_ntargself++;
+
+ bau_desc = bcp->descriptor_base;
+- bau_desc += ITEMS_PER_DESC * bcp->uvhub_cpu;
++ bau_desc += (ITEMS_PER_DESC * bcp->uvhub_cpu);
+ bau_uvhubs_clear(&bau_desc->distribution, UV_DISTRIBUTION_SIZE);
+ if (set_distrib_bits(flush_mask, bcp, bau_desc, &locals, &remotes))
+ return NULL;
+@@ -1083,7 +1099,7 @@ static void __init enable_timeouts(void)
+ */
+ mmr_image |= (1L << SOFTACK_MSHIFT);
+ if (is_uv2_hub()) {
+- mmr_image |= (1L << UV2_LEG_SHFT);
++ mmr_image &= ~(1L << UV2_LEG_SHFT);
+ mmr_image |= (1L << UV2_EXT_SHFT);
+ }
+ write_mmr_misc_control(pnode, mmr_image);
+@@ -1432,12 +1448,15 @@ static void activation_descriptor_init(int node, int pnode, int base_pnode)
+ {
+ int i;
+ int cpu;
++ int uv1 = 0;
+ unsigned long gpa;
+ unsigned long m;
+ unsigned long n;
+ size_t dsize;
+ struct bau_desc *bau_desc;
+ struct bau_desc *bd2;
++ struct uv1_bau_msg_header *uv1_hdr;
++ struct uv2_bau_msg_header *uv2_hdr;
+ struct bau_control *bcp;
+
+ /*
+@@ -1451,6 +1470,8 @@ static void activation_descriptor_init(int node, int pnode, int base_pnode)
+ gpa = uv_gpa(bau_desc);
+ n = uv_gpa_to_gnode(gpa);
+ m = uv_gpa_to_offset(gpa);
++ if (is_uv1_hub())
++ uv1 = 1;
+
+ /* the 14-bit pnode */
+ write_mmr_descriptor_base(pnode, (n << UV_DESC_PSHIFT | m));
+@@ -1461,21 +1482,33 @@ static void activation_descriptor_init(int node, int pnode, int base_pnode)
+ */
+ for (i = 0, bd2 = bau_desc; i < (ADP_SZ * ITEMS_PER_DESC); i++, bd2++) {
+ memset(bd2, 0, sizeof(struct bau_desc));
+- bd2->header.swack_flag = 1;
+- /*
+- * The base_dest_nasid set in the message header is the nasid
+- * of the first uvhub in the partition. The bit map will
+- * indicate destination pnode numbers relative to that base.
+- * They may not be consecutive if nasid striding is being used.
+- */
+- bd2->header.base_dest_nasid = UV_PNODE_TO_NASID(base_pnode);
+- bd2->header.dest_subnodeid = UV_LB_SUBNODEID;
+- bd2->header.command = UV_NET_ENDPOINT_INTD;
+- bd2->header.int_both = 1;
+- /*
+- * all others need to be set to zero:
+- * fairness chaining multilevel count replied_to
+- */
++ if (uv1) {
++ uv1_hdr = &bd2->header.uv1_hdr;
++ uv1_hdr->swack_flag = 1;
++ /*
++ * The base_dest_nasid set in the message header
++ * is the nasid of the first uvhub in the partition.
++ * The bit map will indicate destination pnode numbers
++ * relative to that base. They may not be consecutive
++ * if nasid striding is being used.
++ */
++ uv1_hdr->base_dest_nasid =
++ UV_PNODE_TO_NASID(base_pnode);
++ uv1_hdr->dest_subnodeid = UV_LB_SUBNODEID;
++ uv1_hdr->command = UV_NET_ENDPOINT_INTD;
++ uv1_hdr->int_both = 1;
++ /*
++ * all others need to be set to zero:
++ * fairness chaining multilevel count replied_to
++ */
++ } else {
++ uv2_hdr = &bd2->header.uv2_hdr;
++ uv2_hdr->swack_flag = 1;
++ uv2_hdr->base_dest_nasid =
++ UV_PNODE_TO_NASID(base_pnode);
++ uv2_hdr->dest_subnodeid = UV_LB_SUBNODEID;
++ uv2_hdr->command = UV_NET_ENDPOINT_INTD;
++ }
+ }
+ for_each_present_cpu(cpu) {
+ if (pnode != uv_blade_to_pnode(uv_cpu_to_blade_id(cpu)))
+@@ -1728,6 +1761,14 @@ static int scan_sock(struct socket_desc *sdp, struct uvhub_desc *bdp,
+ bcp->cpus_in_socket = sdp->num_cpus;
+ bcp->socket_master = *smasterp;
+ bcp->uvhub = bdp->uvhub;
++ if (is_uv1_hub())
++ bcp->uvhub_version = 1;
++ else if (is_uv2_hub())
++ bcp->uvhub_version = 2;
++ else {
++ printk(KERN_EMERG "uvhub version not 1 or 2\n");
++ return 1;
++ }
+ bcp->uvhub_master = *hmasterp;
+ bcp->uvhub_cpu = uv_cpu_hub_info(cpu)->blade_processor_id;
+ if (bcp->uvhub_cpu >= MAX_CPUS_PER_UVHUB) {
+@@ -1867,7 +1908,8 @@ static int __init uv_bau_init(void)
+ val = 1L << 63;
+ write_gmmr_activation(pnode, val);
+ mmr = 1; /* should be 1 to broadcast to both sockets */
+- write_mmr_data_broadcast(pnode, mmr);
++ if (!is_uv1_hub())
++ write_mmr_data_broadcast(pnode, mmr);
+ }
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch
new file mode 100644
index 0000000..0a00db8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch
@@ -0,0 +1,66 @@
+From 84ceb690db1ed535deb88880d45fa193a65ac637 Mon Sep 17 00:00:00 2001
+From: Cliff Wickman <cpw at sgi.com>
+Date: Mon, 16 Jan 2012 15:18:48 -0600
+Subject: [PATCH 115/130] x86/UV2: Fix BAU destination timeout initialization
+
+commit d059f9fa84a30e04279c6ff615e9e2cf3b260191 upstream.
+
+Move the call to enable_timeouts() forward so that
+BAU_MISC_CONTROL is initialized before using it in
+calculate_destination_timeout().
+
+Fix the calculation of a BAU destination timeout
+for UV2 (in calculate_destination_timeout()).
+
+Signed-off-by: Cliff Wickman <cpw at sgi.com>
+Link: http://lkml.kernel.org/r/20120116211848.GB5767@sgi.com
+Signed-off-by: Ingo Molnar <mingo at elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/x86/platform/uv/tlb_uv.c | 13 +++++++------
+ 1 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
+index 1341a2e..c425ff1 100644
+--- a/arch/x86/platform/uv/tlb_uv.c
++++ b/arch/x86/platform/uv/tlb_uv.c
+@@ -1617,14 +1617,14 @@ static int calculate_destination_timeout(void)
+ ts_ns = base * mult1 * mult2;
+ ret = ts_ns / 1000;
+ } else {
+- /* 4 bits 0/1 for 10/80us, 3 bits of multiplier */
+- mmr_image = uv_read_local_mmr(UVH_AGING_PRESCALE_SEL);
++ /* 4 bits 0/1 for 10/80us base, 3 bits of multiplier */
++ mmr_image = uv_read_local_mmr(UVH_LB_BAU_MISC_CONTROL);
+ mmr_image = (mmr_image & UV_SA_MASK) >> UV_SA_SHFT;
+ if (mmr_image & (1L << UV2_ACK_UNITS_SHFT))
+- mult1 = 80;
++ base = 80;
+ else
+- mult1 = 10;
+- base = mmr_image & UV2_ACK_MASK;
++ base = 10;
++ mult1 = mmr_image & UV2_ACK_MASK;
+ ret = mult1 * base;
+ }
+ return ret;
+@@ -1886,6 +1886,8 @@ static int __init uv_bau_init(void)
+ uv_base_pnode = uv_blade_to_pnode(uvhub);
+ }
+
++ enable_timeouts();
++
+ if (init_per_cpu(nuvhubs, uv_base_pnode)) {
+ nobau = 1;
+ return 0;
+@@ -1896,7 +1898,6 @@ static int __init uv_bau_init(void)
+ if (uv_blade_nr_possible_cpus(uvhub))
+ init_uvhub(uvhub, vector, uv_base_pnode);
+
+- enable_timeouts();
+ alloc_intr_gate(vector, uv_bau_message_intr1);
+
+ for_each_possible_blade(uvhub) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch
new file mode 100644
index 0000000..a729b18
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch
@@ -0,0 +1,570 @@
+From da205d30c924b3f41e37510f9a3727741ebfbc44 Mon Sep 17 00:00:00 2001
+From: Cliff Wickman <cpw at sgi.com>
+Date: Mon, 16 Jan 2012 15:19:47 -0600
+Subject: [PATCH 116/130] x86/UV2: Work around BAU bug
+
+commit c5d35d399e685acccc85a675e8765c26b2a9813a upstream.
+
+This patch implements a workaround for a UV2 hardware bug.
+The bug is a non-atomic update of a memory-mapped register. When
+hardware message delivery and software message acknowledge occur
+simultaneously the pending message acknowledge for the arriving
+message may be lost. This causes the sender's message status to
+stay busy.
+
+Part of the workaround is to not acknowledge a completed message
+until it is verified that no other message is actually using the
+resource that is mistakenly recorded in the completed message.
+
+Part of the workaround is to test for long elapsed time in such
+a busy condition, then handle it by using a spare sending
+descriptor. The stay-busy condition is eventually timed out by
+hardware, and then the original sending descriptor can be
+re-used. Most of that logic change is in keeping track of the
+current descriptor and the state of the spares.
+
+The occurrences of the workaround are added to the BAU
+statistics.
+
+Signed-off-by: Cliff Wickman <cpw at sgi.com>
+Link: http://lkml.kernel.org/r/20120116211947.GC5767@sgi.com
+Signed-off-by: Ingo Molnar <mingo at elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/x86/include/asm/uv/uv_bau.h | 13 ++-
+ arch/x86/platform/uv/tlb_uv.c | 274 +++++++++++++++++++++++++++++++++-----
+ 2 files changed, 254 insertions(+), 33 deletions(-)
+
+diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
+index 4a46b27..1b82f7e 100644
+--- a/arch/x86/include/asm/uv/uv_bau.h
++++ b/arch/x86/include/asm/uv/uv_bau.h
+@@ -167,6 +167,7 @@
+ #define FLUSH_RETRY_TIMEOUT 2
+ #define FLUSH_GIVEUP 3
+ #define FLUSH_COMPLETE 4
++#define FLUSH_RETRY_BUSYBUG 5
+
+ /*
+ * tuning the action when the numalink network is extremely delayed
+@@ -463,7 +464,6 @@ struct bau_pq_entry {
+ struct msg_desc {
+ struct bau_pq_entry *msg;
+ int msg_slot;
+- int swack_slot;
+ struct bau_pq_entry *queue_first;
+ struct bau_pq_entry *queue_last;
+ };
+@@ -517,6 +517,9 @@ struct ptc_stats {
+ unsigned long s_retry_messages; /* retry broadcasts */
+ unsigned long s_bau_reenabled; /* for bau enable/disable */
+ unsigned long s_bau_disabled; /* for bau enable/disable */
++ unsigned long s_uv2_wars; /* uv2 workaround, perm. busy */
++ unsigned long s_uv2_wars_hw; /* uv2 workaround, hiwater */
++ unsigned long s_uv2_war_waits; /* uv2 workaround, long waits */
+ /* destination statistics */
+ unsigned long d_alltlb; /* times all tlb's on this
+ cpu were flushed */
+@@ -593,6 +596,8 @@ struct bau_control {
+ short cpus_in_socket;
+ short cpus_in_uvhub;
+ short partition_base_pnode;
++ short using_desc; /* an index, like uvhub_cpu */
++ unsigned int inuse_map;
+ unsigned short message_number;
+ unsigned short uvhub_quiesce;
+ short socket_acknowledge_count[DEST_Q_SIZE];
+@@ -610,6 +615,7 @@ struct bau_control {
+ int cong_response_us;
+ int cong_reps;
+ int cong_period;
++ unsigned long clocks_per_100_usec;
+ cycles_t period_time;
+ long period_requests;
+ struct hub_and_pnode *thp;
+@@ -670,6 +676,11 @@ static inline void write_mmr_sw_ack(unsigned long mr)
+ uv_write_local_mmr(UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE_ALIAS, mr);
+ }
+
++static inline void write_gmmr_sw_ack(int pnode, unsigned long mr)
++{
++ write_gmmr(pnode, UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE_ALIAS, mr);
++}
++
+ static inline unsigned long read_mmr_sw_ack(void)
+ {
+ return read_lmmr(UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE);
+diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
+index c425ff1..9010ca7 100644
+--- a/arch/x86/platform/uv/tlb_uv.c
++++ b/arch/x86/platform/uv/tlb_uv.c
+@@ -157,13 +157,14 @@ static int __init uvhub_to_first_apicid(int uvhub)
+ * clear of the Timeout bit (as well) will free the resource. No reply will
+ * be sent (the hardware will only do one reply per message).
+ */
+-static void reply_to_message(struct msg_desc *mdp, struct bau_control *bcp)
++static void reply_to_message(struct msg_desc *mdp, struct bau_control *bcp,
++ int do_acknowledge)
+ {
+ unsigned long dw;
+ struct bau_pq_entry *msg;
+
+ msg = mdp->msg;
+- if (!msg->canceled) {
++ if (!msg->canceled && do_acknowledge) {
+ dw = (msg->swack_vec << UV_SW_ACK_NPENDING) | msg->swack_vec;
+ write_mmr_sw_ack(dw);
+ }
+@@ -212,8 +213,8 @@ static void bau_process_retry_msg(struct msg_desc *mdp,
+ if (mmr & (msg_res << UV_SW_ACK_NPENDING)) {
+ unsigned long mr;
+ /*
+- * is the resource timed out?
+- * make everyone ignore the cancelled message.
++ * Is the resource timed out?
++ * Make everyone ignore the cancelled message.
+ */
+ msg2->canceled = 1;
+ stat->d_canceled++;
+@@ -231,8 +232,8 @@ static void bau_process_retry_msg(struct msg_desc *mdp,
+ * Do all the things a cpu should do for a TLB shootdown message.
+ * Other cpu's may come here at the same time for this message.
+ */
+-static void bau_process_message(struct msg_desc *mdp,
+- struct bau_control *bcp)
++static void bau_process_message(struct msg_desc *mdp, struct bau_control *bcp,
++ int do_acknowledge)
+ {
+ short socket_ack_count = 0;
+ short *sp;
+@@ -284,8 +285,9 @@ static void bau_process_message(struct msg_desc *mdp,
+ if (msg_ack_count == bcp->cpus_in_uvhub) {
+ /*
+ * All cpus in uvhub saw it; reply
++ * (unless we are in the UV2 workaround)
+ */
+- reply_to_message(mdp, bcp);
++ reply_to_message(mdp, bcp, do_acknowledge);
+ }
+ }
+
+@@ -491,27 +493,138 @@ static int uv1_wait_completion(struct bau_desc *bau_desc,
+ /*
+ * UV2 has an extra bit of status in the ACTIVATION_STATUS_2 register.
+ */
+-static unsigned long uv2_read_status(unsigned long offset, int rshft, int cpu)
++static unsigned long uv2_read_status(unsigned long offset, int rshft, int desc)
+ {
+ unsigned long descriptor_status;
+ unsigned long descriptor_status2;
+
+ descriptor_status = ((read_lmmr(offset) >> rshft) & UV_ACT_STATUS_MASK);
+- descriptor_status2 = (read_mmr_uv2_status() >> cpu) & 0x1UL;
++ descriptor_status2 = (read_mmr_uv2_status() >> desc) & 0x1UL;
+ descriptor_status = (descriptor_status << 1) | descriptor_status2;
+ return descriptor_status;
+ }
+
++/*
++ * Return whether the status of the descriptor that is normally used for this
++ * cpu (the one indexed by its hub-relative cpu number) is busy.
++ * The status of the original 32 descriptors is always reflected in the 64
++ * bits of UVH_LB_BAU_SB_ACTIVATION_STATUS_0.
++ * The bit provided by the activation_status_2 register is irrelevant to
++ * the status if it is only being tested for busy or not busy.
++ */
++int normal_busy(struct bau_control *bcp)
++{
++ int cpu = bcp->uvhub_cpu;
++ int mmr_offset;
++ int right_shift;
++
++ mmr_offset = UVH_LB_BAU_SB_ACTIVATION_STATUS_0;
++ right_shift = cpu * UV_ACT_STATUS_SIZE;
++ return (((((read_lmmr(mmr_offset) >> right_shift) &
++ UV_ACT_STATUS_MASK)) << 1) == UV2H_DESC_BUSY);
++}
++
++/*
++ * Entered when a bau descriptor has gone into a permanent busy wait because
++ * of a hardware bug.
++ * Workaround the bug.
++ */
++int handle_uv2_busy(struct bau_control *bcp)
++{
++ int busy_one = bcp->using_desc;
++ int normal = bcp->uvhub_cpu;
++ int selected = -1;
++ int i;
++ unsigned long descriptor_status;
++ unsigned long status;
++ int mmr_offset;
++ struct bau_desc *bau_desc_old;
++ struct bau_desc *bau_desc_new;
++ struct bau_control *hmaster = bcp->uvhub_master;
++ struct ptc_stats *stat = bcp->statp;
++ cycles_t ttm;
++
++ stat->s_uv2_wars++;
++ spin_lock(&hmaster->uvhub_lock);
++ /* try for the original first */
++ if (busy_one != normal) {
++ if (!normal_busy(bcp))
++ selected = normal;
++ }
++ if (selected < 0) {
++ /* can't use the normal, select an alternate */
++ mmr_offset = UVH_LB_BAU_SB_ACTIVATION_STATUS_1;
++ descriptor_status = read_lmmr(mmr_offset);
++
++ /* scan available descriptors 32-63 */
++ for (i = 0; i < UV_CPUS_PER_AS; i++) {
++ if ((hmaster->inuse_map & (1 << i)) == 0) {
++ status = ((descriptor_status >>
++ (i * UV_ACT_STATUS_SIZE)) &
++ UV_ACT_STATUS_MASK) << 1;
++ if (status != UV2H_DESC_BUSY) {
++ selected = i + UV_CPUS_PER_AS;
++ break;
++ }
++ }
++ }
++ }
++
++ if (busy_one != normal)
++ /* mark the busy alternate as not in-use */
++ hmaster->inuse_map &= ~(1 << (busy_one - UV_CPUS_PER_AS));
++
++ if (selected >= 0) {
++ /* switch to the selected descriptor */
++ if (selected != normal) {
++ /* set the selected alternate as in-use */
++ hmaster->inuse_map |=
++ (1 << (selected - UV_CPUS_PER_AS));
++ if (selected > stat->s_uv2_wars_hw)
++ stat->s_uv2_wars_hw = selected;
++ }
++ bau_desc_old = bcp->descriptor_base;
++ bau_desc_old += (ITEMS_PER_DESC * busy_one);
++ bcp->using_desc = selected;
++ bau_desc_new = bcp->descriptor_base;
++ bau_desc_new += (ITEMS_PER_DESC * selected);
++ *bau_desc_new = *bau_desc_old;
++ } else {
++ /*
++ * All are busy. Wait for the normal one for this cpu to
++ * free up.
++ */
++ stat->s_uv2_war_waits++;
++ spin_unlock(&hmaster->uvhub_lock);
++ ttm = get_cycles();
++ do {
++ cpu_relax();
++ } while (normal_busy(bcp));
++ spin_lock(&hmaster->uvhub_lock);
++ /* switch to the original descriptor */
++ bcp->using_desc = normal;
++ bau_desc_old = bcp->descriptor_base;
++ bau_desc_old += (ITEMS_PER_DESC * bcp->using_desc);
++ bcp->using_desc = (ITEMS_PER_DESC * normal);
++ bau_desc_new = bcp->descriptor_base;
++ bau_desc_new += (ITEMS_PER_DESC * normal);
++ *bau_desc_new = *bau_desc_old; /* copy the entire descriptor */
++ }
++ spin_unlock(&hmaster->uvhub_lock);
++ return FLUSH_RETRY_BUSYBUG;
++}
++
+ static int uv2_wait_completion(struct bau_desc *bau_desc,
+ unsigned long mmr_offset, int right_shift,
+ struct bau_control *bcp, long try)
+ {
+ unsigned long descriptor_stat;
+ cycles_t ttm;
+- int cpu = bcp->uvhub_cpu;
++ int desc = bcp->using_desc;
++ long busy_reps = 0;
+ struct ptc_stats *stat = bcp->statp;
+
+- descriptor_stat = uv2_read_status(mmr_offset, right_shift, cpu);
++ descriptor_stat = uv2_read_status(mmr_offset, right_shift, desc);
+
+ /* spin on the status MMR, waiting for it to go idle */
+ while (descriptor_stat != UV2H_DESC_IDLE) {
+@@ -542,12 +655,23 @@ static int uv2_wait_completion(struct bau_desc *bau_desc,
+ bcp->conseccompletes = 0;
+ return FLUSH_RETRY_TIMEOUT;
+ } else {
++ busy_reps++;
++ if (busy_reps > 1000000) {
++ /* not to hammer on the clock */
++ busy_reps = 0;
++ ttm = get_cycles();
++ if ((ttm - bcp->send_message) >
++ (bcp->clocks_per_100_usec)) {
++ return handle_uv2_busy(bcp);
++ }
++ }
+ /*
+ * descriptor_stat is still BUSY
+ */
+ cpu_relax();
+ }
+- descriptor_stat = uv2_read_status(mmr_offset, right_shift, cpu);
++ descriptor_stat = uv2_read_status(mmr_offset, right_shift,
++ desc);
+ }
+ bcp->conseccompletes++;
+ return FLUSH_COMPLETE;
+@@ -563,14 +687,14 @@ static int wait_completion(struct bau_desc *bau_desc,
+ {
+ int right_shift;
+ unsigned long mmr_offset;
+- int cpu = bcp->uvhub_cpu;
++ int desc = bcp->using_desc;
+
+- if (cpu < UV_CPUS_PER_AS) {
++ if (desc < UV_CPUS_PER_AS) {
+ mmr_offset = UVH_LB_BAU_SB_ACTIVATION_STATUS_0;
+- right_shift = cpu * UV_ACT_STATUS_SIZE;
++ right_shift = desc * UV_ACT_STATUS_SIZE;
+ } else {
+ mmr_offset = UVH_LB_BAU_SB_ACTIVATION_STATUS_1;
+- right_shift = ((cpu - UV_CPUS_PER_AS) * UV_ACT_STATUS_SIZE);
++ right_shift = ((desc - UV_CPUS_PER_AS) * UV_ACT_STATUS_SIZE);
+ }
+
+ if (bcp->uvhub_version == 1)
+@@ -752,8 +876,7 @@ static void handle_cmplt(int completion_status, struct bau_desc *bau_desc,
+ * Returns 1 if it gives up entirely and the original cpu mask is to be
+ * returned to the kernel.
+ */
+-int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+- struct cpumask *flush_mask, struct bau_control *bcp)
++int uv_flush_send_and_wait(struct cpumask *flush_mask, struct bau_control *bcp)
+ {
+ int seq_number = 0;
+ int completion_stat = 0;
+@@ -766,20 +889,24 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+ struct bau_control *hmaster = bcp->uvhub_master;
+ struct uv1_bau_msg_header *uv1_hdr = NULL;
+ struct uv2_bau_msg_header *uv2_hdr = NULL;
++ struct bau_desc *bau_desc;
+
+- if (bcp->uvhub_version == 1) {
+- uv1 = 1;
++ if (bcp->uvhub_version == 1)
+ uv1_throttle(hmaster, stat);
+- uv1_hdr = &bau_desc->header.uv1_hdr;
+- } else
+- uv2_hdr = &bau_desc->header.uv2_hdr;
+
+ while (hmaster->uvhub_quiesce)
+ cpu_relax();
+
+ time1 = get_cycles();
+ do {
+- if (try == 0) {
++ bau_desc = bcp->descriptor_base;
++ bau_desc += (ITEMS_PER_DESC * bcp->using_desc);
++ if (bcp->uvhub_version == 1) {
++ uv1 = 1;
++ uv1_hdr = &bau_desc->header.uv1_hdr;
++ } else
++ uv2_hdr = &bau_desc->header.uv2_hdr;
++ if ((try == 0) || (completion_stat == FLUSH_RETRY_BUSYBUG)) {
+ if (uv1)
+ uv1_hdr->msg_type = MSG_REGULAR;
+ else
+@@ -797,13 +924,14 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+ uv1_hdr->sequence = seq_number;
+ else
+ uv2_hdr->sequence = seq_number;
+- index = (1UL << AS_PUSH_SHIFT) | bcp->uvhub_cpu;
++ index = (1UL << AS_PUSH_SHIFT) | bcp->using_desc;
+ bcp->send_message = get_cycles();
+
+ write_mmr_activation(index);
+
+ try++;
+ completion_stat = wait_completion(bau_desc, bcp, try);
++ /* UV2: wait_completion() may change the bcp->using_desc */
+
+ handle_cmplt(completion_stat, bau_desc, bcp, hmaster, stat);
+
+@@ -814,6 +942,7 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+ }
+ cpu_relax();
+ } while ((completion_stat == FLUSH_RETRY_PLUGGED) ||
++ (completion_stat == FLUSH_RETRY_BUSYBUG) ||
+ (completion_stat == FLUSH_RETRY_TIMEOUT));
+
+ time2 = get_cycles();
+@@ -828,6 +957,7 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+ record_send_stats(time1, time2, bcp, stat, completion_stat, try);
+
+ if (completion_stat == FLUSH_GIVEUP)
++ /* FLUSH_GIVEUP will fall back to using IPI's for tlb flush */
+ return 1;
+ return 0;
+ }
+@@ -983,7 +1113,7 @@ const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
+ stat->s_ntargself++;
+
+ bau_desc = bcp->descriptor_base;
+- bau_desc += (ITEMS_PER_DESC * bcp->uvhub_cpu);
++ bau_desc += (ITEMS_PER_DESC * bcp->using_desc);
+ bau_uvhubs_clear(&bau_desc->distribution, UV_DISTRIBUTION_SIZE);
+ if (set_distrib_bits(flush_mask, bcp, bau_desc, &locals, &remotes))
+ return NULL;
+@@ -996,13 +1126,86 @@ const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
+ * uv_flush_send_and_wait returns 0 if all cpu's were messaged,
+ * or 1 if it gave up and the original cpumask should be returned.
+ */
+- if (!uv_flush_send_and_wait(bau_desc, flush_mask, bcp))
++ if (!uv_flush_send_and_wait(flush_mask, bcp))
+ return NULL;
+ else
+ return cpumask;
+ }
+
+ /*
++ * Search the message queue for any 'other' message with the same software
++ * acknowledge resource bit vector.
++ */
++struct bau_pq_entry *find_another_by_swack(struct bau_pq_entry *msg,
++ struct bau_control *bcp, unsigned char swack_vec)
++{
++ struct bau_pq_entry *msg_next = msg + 1;
++
++ if (msg_next > bcp->queue_last)
++ msg_next = bcp->queue_first;
++ while ((msg_next->swack_vec != 0) && (msg_next != msg)) {
++ if (msg_next->swack_vec == swack_vec)
++ return msg_next;
++ msg_next++;
++ if (msg_next > bcp->queue_last)
++ msg_next = bcp->queue_first;
++ }
++ return NULL;
++}
++
++/*
++ * UV2 needs to work around a bug in which an arriving message has not
++ * set a bit in the UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE register.
++ * Such a message must be ignored.
++ */
++void process_uv2_message(struct msg_desc *mdp, struct bau_control *bcp)
++{
++ unsigned long mmr_image;
++ unsigned char swack_vec;
++ struct bau_pq_entry *msg = mdp->msg;
++ struct bau_pq_entry *other_msg;
++
++ mmr_image = read_mmr_sw_ack();
++ swack_vec = msg->swack_vec;
++
++ if ((swack_vec & mmr_image) == 0) {
++ /*
++ * This message was assigned a swack resource, but no
++ * reserved acknowlegment is pending.
++ * The bug has prevented this message from setting the MMR.
++ * And no other message has used the same sw_ack resource.
++ * Do the requested shootdown but do not reply to the msg.
++ * (the 0 means make no acknowledge)
++ */
++ bau_process_message(mdp, bcp, 0);
++ return;
++ }
++
++ /*
++ * Some message has set the MMR 'pending' bit; it might have been
++ * another message. Look for that message.
++ */
++ other_msg = find_another_by_swack(msg, bcp, msg->swack_vec);
++ if (other_msg) {
++ /* There is another. Do not ack the current one. */
++ bau_process_message(mdp, bcp, 0);
++ /*
++ * Let the natural processing of that message acknowledge
++ * it. Don't get the processing of sw_ack's out of order.
++ */
++ return;
++ }
++
++ /*
++ * There is no other message using this sw_ack, so it is safe to
++ * acknowledge it.
++ */
++ bau_process_message(mdp, bcp, 1);
++
++ return;
++}
++
++/*
+ * The BAU message interrupt comes here. (registered by set_intr_gate)
+ * See entry_64.S
+ *
+@@ -1038,9 +1241,11 @@ void uv_bau_message_interrupt(struct pt_regs *regs)
+ count++;
+
+ msgdesc.msg_slot = msg - msgdesc.queue_first;
+- msgdesc.swack_slot = ffs(msg->swack_vec) - 1;
+ msgdesc.msg = msg;
+- bau_process_message(&msgdesc, bcp);
++ if (bcp->uvhub_version == 2)
++ process_uv2_message(&msgdesc, bcp);
++ else
++ bau_process_message(&msgdesc, bcp, 1);
+
+ msg++;
+ if (msg > msgdesc.queue_last)
+@@ -1158,7 +1363,7 @@ static int ptc_seq_show(struct seq_file *file, void *data)
+ seq_printf(file,
+ "all one mult none retry canc nocan reset rcan ");
+ seq_printf(file,
+- "disable enable\n");
++ "disable enable wars warshw warwaits\n");
+ }
+ if (cpu < num_possible_cpus() && cpu_online(cpu)) {
+ stat = &per_cpu(ptcstats, cpu);
+@@ -1189,8 +1394,10 @@ static int ptc_seq_show(struct seq_file *file, void *data)
+ stat->d_nomsg, stat->d_retries, stat->d_canceled,
+ stat->d_nocanceled, stat->d_resets,
+ stat->d_rcanceled);
+- seq_printf(file, "%ld %ld\n",
+- stat->s_bau_disabled, stat->s_bau_reenabled);
++ seq_printf(file, "%ld %ld %ld %ld %ld\n",
++ stat->s_bau_disabled, stat->s_bau_reenabled,
++ stat->s_uv2_wars, stat->s_uv2_wars_hw,
++ stat->s_uv2_war_waits);
+ }
+ return 0;
+ }
+@@ -1564,6 +1771,7 @@ static void pq_init(int node, int pnode)
+ write_mmr_payload_first(pnode, pn_first);
+ write_mmr_payload_tail(pnode, first);
+ write_mmr_payload_last(pnode, last);
++ write_gmmr_sw_ack(pnode, 0xffffUL);
+
+ /* in effect, all msg_type's are set to MSG_NOOP */
+ memset(pqp, 0, sizeof(struct bau_pq_entry) * DEST_Q_SIZE);
+@@ -1651,6 +1859,7 @@ static void __init init_per_cpu_tunables(void)
+ bcp->cong_response_us = congested_respns_us;
+ bcp->cong_reps = congested_reps;
+ bcp->cong_period = congested_period;
++ bcp->clocks_per_100_usec = usec_2_cycles(100);
+ }
+ }
+
+@@ -1771,6 +1980,7 @@ static int scan_sock(struct socket_desc *sdp, struct uvhub_desc *bdp,
+ }
+ bcp->uvhub_master = *hmasterp;
+ bcp->uvhub_cpu = uv_cpu_hub_info(cpu)->blade_processor_id;
++ bcp->using_desc = bcp->uvhub_cpu;
+ if (bcp->uvhub_cpu >= MAX_CPUS_PER_UVHUB) {
+ printk(KERN_EMERG "%d cpus per uvhub invalid\n",
+ bcp->uvhub_cpu);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch
new file mode 100644
index 0000000..7545566
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch
@@ -0,0 +1,61 @@
+From 6e66c39b4394d812895bbeaa0dce566ca86a7d72 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd at openwrt.org>
+Date: Sat, 14 Jan 2012 15:08:34 +0100
+Subject: [PATCH 117/130] ath9k_hw: fix interpretation of the rx KeyMiss flag
+
+commit 7a532fe7131216a02c81a6c1b1f8632da1195a58 upstream.
+
+Documentation states that the KeyMiss flag is only valid if RxFrameOK is
+unset, however empirical evidence has shown that this is false.
+When KeyMiss is set (and RxFrameOK is 1), the hardware passes a valid frame
+which has not been decrypted. The driver then falsely marks the frame
+as decrypted, and when using CCMP this corrupts the rx CCMP PN, leading
+to connection hangs.
+
+Signed-off-by: Felix Fietkau <nbd at openwrt.org>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/ath/ath9k/ar9003_mac.c | 5 +++--
+ drivers/net/wireless/ath/ath9k/mac.c | 5 +++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+index ccde784..f5ae3c6 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+@@ -526,10 +526,11 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
+ rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+ else if (rxsp->status11 & AR_MichaelErr)
+ rxs->rs_status |= ATH9K_RXERR_MIC;
+- if (rxsp->status11 & AR_KeyMiss)
+- rxs->rs_status |= ATH9K_RXERR_KEYMISS;
+ }
+
++ if (rxsp->status11 & AR_KeyMiss)
++ rxs->rs_status |= ATH9K_RXERR_KEYMISS;
++
+ return 0;
+ }
+ EXPORT_SYMBOL(ath9k_hw_process_rxdesc_edma);
+diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
+index ecdb6fd..bbcb777 100644
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -621,10 +621,11 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
+ rs->rs_status |= ATH9K_RXERR_DECRYPT;
+ else if (ads.ds_rxstatus8 & AR_MichaelErr)
+ rs->rs_status |= ATH9K_RXERR_MIC;
+- if (ads.ds_rxstatus8 & AR_KeyMiss)
+- rs->rs_status |= ATH9K_RXERR_KEYMISS;
+ }
+
++ if (ads.ds_rxstatus8 & AR_KeyMiss)
++ rs->rs_status |= ATH9K_RXERR_KEYMISS;
++
+ return 0;
+ }
+ EXPORT_SYMBOL(ath9k_hw_rxprocdesc);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch
new file mode 100644
index 0000000..c27d03d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch
@@ -0,0 +1,86 @@
+From a72bbcd57d9b63d480ab61b5429458b10ed6595f Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka at redhat.com>
+Date: Fri, 13 Jan 2012 12:59:32 +0100
+Subject: [PATCH 118/130] rt2800pci: fix spurious interrupts generation
+
+commit dfd00c4c8f3dfa1fd7cec45f83d98b2a49743dcd upstream.
+
+Same devices can generate interrupt without properly setting bit in
+INT_SOURCE_CSR register (spurious interrupt), what will cause IRQ line
+will be disabled by interrupts controller driver.
+
+We discovered that clearing INT_MASK_CSR stops such behaviour. We
+previously first read that register, and then clear all know interrupt
+sources bits and do not touch reserved bits. After this patch, we write
+to all register content (I believe writing to reserved bits on that
+register will not cause any problems, I tested that on my rt2800pci
+device).
+
+This fix very bad performance problem, practically making device
+unusable (since worked without interrupts), reported in:
+https://bugzilla.redhat.com/show_bug.cgi?id=658451
+
+We previously tried to workaround that issue in commit
+4ba7d9997869d25bd223dea7536fc1ce9fab3b3b "rt2800pci: handle spurious
+interrupts", but it was reverted in commit
+82e5fc2a34fa9ffea38f00c4066b7e600a0ca5e6
+as thing, that will prevent to detect real spurious interrupts.
+
+Reported-and-tested-by: Amir Hedayaty <hedayaty at gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka at redhat.com>
+Acked-by: Gertjan van Wingerde <gwingerde at gmail.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/rt2x00/rt2800pci.c | 28 ++++++++--------------------
+ 1 files changed, 8 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
+index da48c8a..837b460 100644
+--- a/drivers/net/wireless/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/rt2x00/rt2800pci.c
+@@ -422,7 +422,6 @@ static int rt2800pci_init_queues(struct rt2x00_dev *rt2x00dev)
+ static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
+ enum dev_state state)
+ {
+- int mask = (state == STATE_RADIO_IRQ_ON);
+ u32 reg;
+ unsigned long flags;
+
+@@ -436,25 +435,14 @@ static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
+ }
+
+ spin_lock_irqsave(&rt2x00dev->irqmask_lock, flags);
+- rt2x00pci_register_read(rt2x00dev, INT_MASK_CSR, ®);
+- rt2x00_set_field32(®, INT_MASK_CSR_RXDELAYINT, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_TXDELAYINT, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_RX_DONE, mask);
+- rt2x00_set_field32(®, INT_MASK_CSR_AC0_DMA_DONE, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_AC1_DMA_DONE, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_AC2_DMA_DONE, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_AC3_DMA_DONE, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_HCCA_DMA_DONE, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_MGMT_DMA_DONE, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_MCU_COMMAND, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_RXTX_COHERENT, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_TBTT, mask);
+- rt2x00_set_field32(®, INT_MASK_CSR_PRE_TBTT, mask);
+- rt2x00_set_field32(®, INT_MASK_CSR_TX_FIFO_STATUS, mask);
+- rt2x00_set_field32(®, INT_MASK_CSR_AUTO_WAKEUP, mask);
+- rt2x00_set_field32(®, INT_MASK_CSR_GPTIMER, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_RX_COHERENT, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_TX_COHERENT, 0);
++ reg = 0;
++ if (state == STATE_RADIO_IRQ_ON) {
++ rt2x00_set_field32(®, INT_MASK_CSR_RX_DONE, 1);
++ rt2x00_set_field32(®, INT_MASK_CSR_TBTT, 1);
++ rt2x00_set_field32(®, INT_MASK_CSR_PRE_TBTT, 1);
++ rt2x00_set_field32(®, INT_MASK_CSR_TX_FIFO_STATUS, 1);
++ rt2x00_set_field32(®, INT_MASK_CSR_AUTO_WAKEUP, 1);
++ }
+ rt2x00pci_register_write(rt2x00dev, INT_MASK_CSR, reg);
+ spin_unlock_irqrestore(&rt2x00dev->irqmask_lock, flags);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch
new file mode 100644
index 0000000..abb918e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch
@@ -0,0 +1,45 @@
+From f245d82f78e86e6c7ac4965cfc272a8c95ab8cac Mon Sep 17 00:00:00 2001
+From: Dave Chinner <dchinner at redhat.com>
+Date: Wed, 18 Jan 2012 14:41:45 -0600
+Subject: [PATCH 119/130] xfs: fix endian conversion issue in discard code
+
+commit b1c770c273a4787069306fc82aab245e9ac72e9d upstream
+
+When finding the longest extent in an AG, we read the value directly
+out of the AGF buffer without endian conversion. This will give an
+incorrect length, resulting in FITRIM operations potentially not
+trimming everything that it should.
+
+Signed-off-by: Dave Chinner <dchinner at redhat.com>
+Reviewed-by: Christoph Hellwig <hch at lst.de>
+Signed-off-by: Ben Myers <bpm at sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/xfs/xfs_discard.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
+index 8a24f0c..286a051 100644
+--- a/fs/xfs/xfs_discard.c
++++ b/fs/xfs/xfs_discard.c
+@@ -68,7 +68,7 @@ xfs_trim_extents(
+ * Look up the longest btree in the AGF and start with it.
+ */
+ error = xfs_alloc_lookup_le(cur, 0,
+- XFS_BUF_TO_AGF(agbp)->agf_longest, &i);
++ be32_to_cpu(XFS_BUF_TO_AGF(agbp)->agf_longest), &i);
+ if (error)
+ goto out_del_cursor;
+
+@@ -84,7 +84,7 @@ xfs_trim_extents(
+ if (error)
+ goto out_del_cursor;
+ XFS_WANT_CORRUPTED_GOTO(i == 1, out_del_cursor);
+- ASSERT(flen <= XFS_BUF_TO_AGF(agbp)->agf_longest);
++ ASSERT(flen <= be32_to_cpu(XFS_BUF_TO_AGF(agbp)->agf_longest));
+
+ /*
+ * Too small? Give up.
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch
new file mode 100644
index 0000000..9b8897e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch
@@ -0,0 +1,33 @@
+From 6bbe2a11996ac0900c43c0729b2574d96d191608 Mon Sep 17 00:00:00 2001
+From: Toshiharu Okada <toshiharu-linux at dsn.okisemi.com>
+Date: Mon, 26 Sep 2011 16:16:23 +0900
+Subject: [PATCH 120/130] i2c-eg20t: modified the setting of transfer rate.
+
+commit ff35e8b18984ad2a82cbd259fc07f0be4b34b1aa upstream.
+
+This patch modified the setting value of
+I2C Bus Transfer Rate Setting Counter regisrer.
+
+Signed-off-by: Toshiharu Okada <toshiharu-linux at dsn.okisemi.com>
+Signed-off-by: Ben Dooks <ben-linux at fluff.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/i2c/busses/i2c-eg20t.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
+index 18936ac..730215e 100644
+--- a/drivers/i2c/busses/i2c-eg20t.c
++++ b/drivers/i2c/busses/i2c-eg20t.c
+@@ -243,7 +243,7 @@ static void pch_i2c_init(struct i2c_algo_pch_data *adap)
+ if (pch_clk > PCH_MAX_CLK)
+ pch_clk = 62500;
+
+- pch_i2cbc = (pch_clk + (pch_i2c_speed * 4)) / pch_i2c_speed * 8;
++ pch_i2cbc = (pch_clk + (pch_i2c_speed * 4)) / (pch_i2c_speed * 8);
+ /* Set transfer speed in I2CBC */
+ iowrite32(pch_i2cbc, p + PCH_I2CBC);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch
new file mode 100644
index 0000000..04b2480
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch
@@ -0,0 +1,46 @@
+From 51602e17c8a1318c938a53ac13af73255ddb8a25 Mon Sep 17 00:00:00 2001
+From: Dan Rosenberg <drosenberg at vsecurity.com>
+Date: Fri, 20 Jan 2012 14:34:27 -0800
+Subject: [PATCH 121/130] score: fix off-by-one index into syscall table
+
+commit c25a785d6647984505fa165b5cd84cfc9a95970b upstream.
+
+If the provided system call number is equal to __NR_syscalls, the
+current check will pass and a function pointer just after the system
+call table may be called, since sys_call_table is an array with total
+size __NR_syscalls.
+
+Whether or not this is a security bug depends on what the compiler puts
+immediately after the system call table. It's likely that this won't do
+anything bad because there is an additional NULL check on the syscall
+entry, but if there happens to be a non-NULL value immediately after the
+system call table, this may result in local privilege escalation.
+
+Signed-off-by: Dan Rosenberg <drosenberg at vsecurity.com>
+Cc: Chen Liqin <liqin.chen at sunplusct.com>
+Cc: Lennox Wu <lennox.wu at gmail.com>
+Cc: Eugene Teo <eugeneteo at kernel.sg>
+Cc: Arnd Bergmann <arnd at arndb.de>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ arch/score/kernel/entry.S | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/arch/score/kernel/entry.S b/arch/score/kernel/entry.S
+index 577abba..83bb960 100644
+--- a/arch/score/kernel/entry.S
++++ b/arch/score/kernel/entry.S
+@@ -408,7 +408,7 @@ ENTRY(handle_sys)
+ sw r9, [r0, PT_EPC]
+
+ cmpi.c r27, __NR_syscalls # check syscall number
+- bgtu illegal_syscall
++ bgeu illegal_syscall
+
+ slli r8, r27, 2 # get syscall routine
+ la r11, sys_call_table
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch
new file mode 100644
index 0000000..cd300c6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch
@@ -0,0 +1,67 @@
+From c851c03d3c252029f2d0a4b96439fb2e7baf0071 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton at redhat.com>
+Date: Tue, 17 Jan 2012 16:08:51 -0500
+Subject: [PATCH 122/130] cifs: lower default wsize when unix extensions are
+ not used
+
+commit ce91acb3acae26f4163c5a6f1f695d1a1e8d9009 upstream.
+
+We've had some reports of servers (namely, the Solaris in-kernel CIFS
+server) that don't deal properly with writes that are "too large" even
+though they set CAP_LARGE_WRITE_ANDX. Change the default to better
+mirror what windows clients do.
+
+Cc: Pavel Shilovsky <piastry at etersoft.ru>
+Reported-by: Nick Davis <phireph0x at yahoo.com>
+Signed-off-by: Jeff Layton <jlayton at redhat.com>
+Signed-off-by: Steve French <smfrench at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/cifs/connect.c | 23 +++++++++++++++++++----
+ 1 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index f3670cf..63e4be4 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2914,18 +2914,33 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
+ #define CIFS_DEFAULT_IOSIZE (1024 * 1024)
+
+ /*
+- * Windows only supports a max of 60k reads. Default to that when posix
+- * extensions aren't in force.
++ * Windows only supports a max of 60kb reads and 65535 byte writes. Default to
++ * those values when posix extensions aren't in force. In actuality here, we
++ * use 65536 to allow for a write that is a multiple of 4k. Most servers seem
++ * to be ok with the extra byte even though Windows doesn't send writes that
++ * are that large.
++ *
++ * Citation:
++ *
++ * http://blogs.msdn.com/b/openspecification/archive/2009/04/10/smb-maximum-transmit-buffer-size-and-performance-tuning.aspx
+ */
+ #define CIFS_DEFAULT_NON_POSIX_RSIZE (60 * 1024)
++#define CIFS_DEFAULT_NON_POSIX_WSIZE (65536)
+
+ static unsigned int
+ cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
+ {
+ __u64 unix_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
+ struct TCP_Server_Info *server = tcon->ses->server;
+- unsigned int wsize = pvolume_info->wsize ? pvolume_info->wsize :
+- CIFS_DEFAULT_IOSIZE;
++ unsigned int wsize;
++
++ /* start with specified wsize, or default */
++ if (pvolume_info->wsize)
++ wsize = pvolume_info->wsize;
++ else if (tcon->unix_ext && (unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
++ wsize = CIFS_DEFAULT_IOSIZE;
++ else
++ wsize = CIFS_DEFAULT_NON_POSIX_WSIZE;
+
+ /* can server support 24-bit write sizes? (via UNIX extensions) */
+ if (!tcon->unix_ext || !(unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch
new file mode 100644
index 0000000..9311e08
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch
@@ -0,0 +1,49 @@
+From 4dbd29bd7e0b2a712370f8d0c25d025d996edbc1 Mon Sep 17 00:00:00 2001
+From: Ananth N Mavinakayanahalli <ananth at in.ibm.com>
+Date: Fri, 20 Jan 2012 14:34:04 -0800
+Subject: [PATCH 123/130] kprobes: initialize before using a hlist
+
+commit d496aab567e7e52b3e974c9192a5de6e77dce32c upstream.
+
+Commit ef53d9c5e ("kprobes: improve kretprobe scalability with hashed
+locking") introduced a bug where we can potentially leak
+kretprobe_instances since we initialize a hlist head after having used
+it.
+
+Initialize the hlist head before using it.
+
+Reported by: Jim Keniston <jkenisto at us.ibm.com>
+Acked-by: Jim Keniston <jkenisto at us.ibm.com>
+Signed-off-by: Ananth N Mavinakayanahalli <ananth at in.ibm.com>
+Acked-by: Masami Hiramatsu <masami.hiramatsu.pt at hitachi.com>
+Cc: Srinivasa D S <srinivasa at in.ibm.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ kernel/kprobes.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index e5d8464..52fd049 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1077,6 +1077,7 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
+ /* Early boot. kretprobe_table_locks not yet initialized. */
+ return;
+
++ INIT_HLIST_HEAD(&empty_rp);
+ hash = hash_ptr(tk, KPROBE_HASH_BITS);
+ head = &kretprobe_inst_table[hash];
+ kretprobe_table_lock(hash, &flags);
+@@ -1085,7 +1086,6 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
+ recycle_rp_inst(ri, &empty_rp);
+ }
+ kretprobe_table_unlock(hash, &flags);
+- INIT_HLIST_HEAD(&empty_rp);
+ hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+ hlist_del(&ri->hlist);
+ kfree(ri);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch
new file mode 100644
index 0000000..c27ca94
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch
@@ -0,0 +1,64 @@
+From 6568c3dad4c19c7cfbd948fbf3f4935f0ab8d0ef Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon at arm.com>
+Date: Fri, 20 Jan 2012 14:34:09 -0800
+Subject: [PATCH 124/130] proc: clear_refs: do not clear reserved pages
+
+commit 85e72aa5384b1a614563ad63257ded0e91d1a620 upstream.
+
+/proc/pid/clear_refs is used to clear the Referenced and YOUNG bits for
+pages and corresponding page table entries of the task with PID pid, which
+includes any special mappings inserted into the page tables in order to
+provide things like vDSOs and user helper functions.
+
+On ARM this causes a problem because the vectors page is mapped as a
+global mapping and since ec706dab ("ARM: add a vma entry for the user
+accessible vector page"), a VMA is also inserted into each task for this
+page to aid unwinding through signals and syscall restarts. Since the
+vectors page is required for handling faults, clearing the YOUNG bit (and
+subsequently writing a faulting pte) means that we lose the vectors page
+*globally* and cannot fault it back in. This results in a system deadlock
+on the next exception.
+
+To see this problem in action, just run:
+
+ $ echo 1 > /proc/self/clear_refs
+
+on an ARM platform (as any user) and watch your system hang. I think this
+has been the case since 2.6.37
+
+This patch avoids clearing the aforementioned bits for reserved pages,
+therefore leaving the vectors page intact on ARM. Since reserved pages
+are not candidates for swap, this change should not have any impact on the
+usefulness of clear_refs.
+
+Signed-off-by: Will Deacon <will.deacon at arm.com>
+Reported-by: Moussa Ba <moussaba at micron.com>
+Acked-by: Hugh Dickins <hughd at google.com>
+Cc: David Rientjes <rientjes at google.com>
+Cc: Russell King <rmk at arm.linux.org.uk>
+Acked-by: Nicolas Pitre <nico at linaro.org>
+Cc: Matt Mackall <mpm at selenic.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ fs/proc/task_mmu.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index e418c5a..7dcd2a2 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -518,6 +518,9 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
+ if (!page)
+ continue;
+
++ if (PageReserved(page))
++ continue;
++
+ /* Clear accessed and referenced bits. */
+ ptep_test_and_clear_young(vma, addr, pte);
+ ClearPageReferenced(page);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch
new file mode 100644
index 0000000..752f80f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch
@@ -0,0 +1,91 @@
+From e7a0d73a0a0ba69a8969852286911f0e89a2b2dd Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko at suse.cz>
+Date: Fri, 20 Jan 2012 14:33:55 -0800
+Subject: [PATCH 125/130] mm: fix NULL ptr dereference in
+ __count_immobile_pages
+
+commit 687875fb7de4a95223af20ee024282fa9099f860 upstream.
+
+Fix the following NULL ptr dereference caused by
+
+ cat /sys/devices/system/memory/memory0/removable
+
+Pid: 13979, comm: sed Not tainted 3.0.13-0.5-default #1 IBM BladeCenter LS21 -[7971PAM]-/Server Blade
+RIP: __count_immobile_pages+0x4/0x100
+Process sed (pid: 13979, threadinfo ffff880221c36000, task ffff88022e788480)
+Call Trace:
+ is_pageblock_removable_nolock+0x34/0x40
+ is_mem_section_removable+0x74/0xf0
+ show_mem_removable+0x41/0x70
+ sysfs_read_file+0xfe/0x1c0
+ vfs_read+0xc7/0x130
+ sys_read+0x53/0xa0
+ system_call_fastpath+0x16/0x1b
+
+We are crashing because we are trying to dereference NULL zone which
+came from pfn=0 (struct page ffffea0000000000). According to the boot
+log this page is marked reserved:
+e820 update range: 0000000000000000 - 0000000000010000 (usable) ==> (reserved)
+
+and early_node_map confirms that:
+early_node_map[3] active PFN ranges
+ 1: 0x00000010 -> 0x0000009c
+ 1: 0x00000100 -> 0x000bffa3
+ 1: 0x00100000 -> 0x00240000
+
+The problem is that memory_present works in PAGE_SECTION_MASK aligned
+blocks so the reserved range sneaks into the the section as well. This
+also means that free_area_init_node will not take care of those reserved
+pages and they stay uninitialized.
+
+When we try to read the removable status we walk through all available
+sections and hope that the zone is valid for all pages in the section.
+But this is not true in this case as the zone and nid are not initialized.
+
+We have only one node in this particular case and it is marked as node=1
+(rather than 0) and that made the problem visible because page_to_nid will
+return 0 and there are no zones on the node.
+
+Let's check that the zone is valid and that the given pfn falls into its
+boundaries and mark the section not removable. This might cause some
+false positives, probably, but we do not have any sane way to find out
+whether the page is reserved by the platform or it is just not used for
+whatever other reasons.
+
+Signed-off-by: Michal Hocko <mhocko at suse.cz>
+Acked-by: Mel Gorman <mgorman at suse.de>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu at jp.fujitsu.com>
+Cc: Andrea Arcangeli <aarcange at redhat.com>
+Cc: David Rientjes <rientjes at google.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ mm/page_alloc.c | 11 +++++++++++
+ 1 files changed, 11 insertions(+), 0 deletions(-)
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 2b8ba3a..485be89 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5608,6 +5608,17 @@ __count_immobile_pages(struct zone *zone, struct page *page, int count)
+ bool is_pageblock_removable_nolock(struct page *page)
+ {
+ struct zone *zone = page_zone(page);
++ unsigned long pfn = page_to_pfn(page);
++
++ /*
++ * We have to be careful here because we are iterating over memory
++ * sections which are not zone aware so we might end up outside of
++ * the zone but still within the section.
++ */
++ if (!zone || zone->zone_start_pfn > pfn ||
++ zone->zone_start_pfn + zone->spanned_pages <= pfn)
++ return false;
++
+ return __count_immobile_pages(zone, page, 0);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0126-iwlagn-check-for-SMPS-mode.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0126-iwlagn-check-for-SMPS-mode.patch
new file mode 100644
index 0000000..8290ecd
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0126-iwlagn-check-for-SMPS-mode.patch
@@ -0,0 +1,50 @@
+From a19ea3b8cc51cbeb52d0b2e1aa7d8987f123e3ab Mon Sep 17 00:00:00 2001
+From: Wey-Yi Guy <wey-yi.w.guy at intel.com>
+Date: Thu, 10 Nov 2011 06:55:04 -0800
+Subject: [PATCH 126/130] iwlagn: check for SMPS mode
+
+commit b2ccccdca46273c7b321ecf5041c362cd950da20 upstream.
+
+Check and report WARN only when its invalid
+
+Resolves:
+https://bugzilla.kernel.org/show_bug.cgi?id=42621
+https://bugzilla.redhat.com/show_bug.cgi?id=766071
+
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy at intel.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/iwlwifi/iwl-agn-lib.c | 1 +
+ drivers/net/wireless/iwlwifi/iwl-agn-rxon.c | 3 +++
+ 2 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+index 1a52ed2..6465983 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+@@ -827,6 +827,7 @@ static int iwl_get_idle_rx_chain_count(struct iwl_priv *priv, int active_cnt)
+ case IEEE80211_SMPS_STATIC:
+ case IEEE80211_SMPS_DYNAMIC:
+ return IWL_NUM_IDLE_CHAINS_SINGLE;
++ case IEEE80211_SMPS_AUTOMATIC:
+ case IEEE80211_SMPS_OFF:
+ return active_cnt;
+ default:
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+index 5c7c17c..d552fa3 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+@@ -559,6 +559,9 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
+
+ mutex_lock(&priv->shrd->mutex);
+
++ if (test_bit(STATUS_EXIT_PENDING, &priv->shrd->status))
++ goto out;
++
+ if (unlikely(test_bit(STATUS_SCANNING, &priv->shrd->status))) {
+ IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
+ goto out;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch
new file mode 100644
index 0000000..8c1b597
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch
@@ -0,0 +1,60 @@
+From 8662eba088f07fc218cd70a54eb75f19dd89121b Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka at redhat.com>
+Date: Fri, 23 Dec 2011 08:13:50 +0100
+Subject: [PATCH 127/130] iwlegacy: 3945: fix hw passive scan on radar
+ channels
+
+commit 68acc4afb040d98ddfd2cae0de09e2f4e1ee127f upstream.
+
+Patch fix firmware error on "iw dev wlan0 scan passive" for
+hardware scanning (with disable_hw_scan=0 module parameter).
+
+ iwl3945 0000:03:00.0: Microcode SW error detected. Restarting 0x82000008.
+ iwl3945 0000:03:00.0: Loaded firmware version: 15.32.2.9
+ iwl3945 0000:03:00.0: Start IWL Error Log Dump:
+ iwl3945 0000:03:00.0: Status: 0x0002A2E4, count: 1
+ iwl3945 0000:03:00.0: Desc Time asrtPC blink2 ilink1 nmiPC Line
+ iwl3945 0000:03:00.0: SYSASSERT (0x5) 0041263900 0x13756 0x0031C 0x00000 764
+ iwl3945 0000:03:00.0: Error Reply type 0x000002FC cmd C_SCAN (0x80) seq 0x443E ser 0x00340000
+ iwl3945 0000:03:00.0: Command C_SCAN failed: FW Error
+ iwl3945 0000:03:00.0: Can't stop Rx DMA.
+
+We have disable ability to change passive scanning to active on
+particular channel when traffic is detected on that channel. Otherwise
+firmware will report error, when we try to do passive scan on radar
+channels.
+
+Reported-and-debugged-by: Pedro Francisco <pedrogfrancisco at gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka at redhat.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ drivers/net/wireless/iwlegacy/iwl3945-base.c | 9 ++++-----
+ 1 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
+index b282d86..05f2ad1 100644
+--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
++++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
+@@ -2656,14 +2656,13 @@ int iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
+ IWL_WARN(priv, "Invalid scan band\n");
+ return -EIO;
+ }
+-
+ /*
+- * If active scaning is requested but a certain channel
+- * is marked passive, we can do active scanning if we
+- * detect transmissions.
++ * If active scaning is requested but a certain channel is marked
++ * passive, we can do active scanning if we detect transmissions. For
++ * passive only scanning disable switching to active on any channel.
+ */
+ scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+- IWL_GOOD_CRC_TH_DISABLED;
++ IWL_GOOD_CRC_TH_NEVER;
+
+ len = iwl_legacy_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data,
+ vif->addr, priv->scan_request->ie,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch
new file mode 100644
index 0000000..f6c0efd
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch
@@ -0,0 +1,186 @@
+From 1dc1d2ffffa4b2e00e43573abdb5db9ad08ce53f Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd at google.com>
+Date: Fri, 20 Jan 2012 14:34:19 -0800
+Subject: [PATCH 128/130] SHM_UNLOCK: fix long unpreemptible section
+
+commit 85046579bde15e532983438f86b36856e358f417 upstream.
+
+scan_mapping_unevictable_pages() is used to make SysV SHM_LOCKed pages
+evictable again once the shared memory is unlocked. It does this with
+pagevec_lookup()s across the whole object (which might occupy most of
+memory), and takes 300ms to unlock 7GB here. A cond_resched() every
+PAGEVEC_SIZE pages would be good.
+
+However, KOSAKI-san points out that this is called under shmem.c's
+info->lock, and it's also under shm.c's shm_lock(), both spinlocks.
+There is no strong reason for that: we need to take these pages off the
+unevictable list soonish, but those locks are not required for it.
+
+So move the call to scan_mapping_unevictable_pages() from shmem.c's
+unlock handling up to shm.c's unlock handling. Remove the recently
+added barrier, not needed now we have spin_unlock() before the scan.
+
+Use get_file(), with subsequent fput(), to make sure we have a reference
+to mapping throughout scan_mapping_unevictable_pages(): that's something
+that was previously guaranteed by the shm_lock().
+
+Remove shmctl's lru_add_drain_all(): we don't fault in pages at SHM_LOCK
+time, and we lazily discover them to be Unevictable later, so it serves
+no purpose for SHM_LOCK; and serves no purpose for SHM_UNLOCK, since
+pages still on pagevec are not marked Unevictable.
+
+The original code avoided redundant rescans by checking VM_LOCKED flag
+at its level: now avoid them by checking shp's SHM_LOCKED.
+
+The original code called scan_mapping_unevictable_pages() on a locked
+area at shm_destroy() time: perhaps we once had accounting cross-checks
+which required that, but not now, so skip the overhead and just let
+inode eviction deal with them.
+
+Put check_move_unevictable_page() and scan_mapping_unevictable_pages()
+under CONFIG_SHMEM (with stub for the TINY case when ramfs is used),
+more as comment than to save space; comment them used for SHM_UNLOCK.
+
+Signed-off-by: Hugh Dickins <hughd at google.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro at jp.fujitsu.com>
+Cc: Minchan Kim <minchan.kim at gmail.com>
+Cc: Rik van Riel <riel at redhat.com>
+Cc: Shaohua Li <shaohua.li at intel.com>
+Cc: Eric Dumazet <eric.dumazet at gmail.com>
+Cc: Johannes Weiner <hannes at cmpxchg.org>
+Cc: Michel Lespinasse <walken at google.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ ipc/shm.c | 37 ++++++++++++++++++++++---------------
+ mm/shmem.c | 7 -------
+ mm/vmscan.c | 12 +++++++++++-
+ 3 files changed, 33 insertions(+), 23 deletions(-)
+
+diff --git a/ipc/shm.c b/ipc/shm.c
+index 02ecf2c..854ab58 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -870,9 +870,7 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
+ case SHM_LOCK:
+ case SHM_UNLOCK:
+ {
+- struct file *uninitialized_var(shm_file);
+-
+- lru_add_drain_all(); /* drain pagevecs to lru lists */
++ struct file *shm_file;
+
+ shp = shm_lock_check(ns, shmid);
+ if (IS_ERR(shp)) {
+@@ -895,22 +893,31 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
+ err = security_shm_shmctl(shp, cmd);
+ if (err)
+ goto out_unlock;
+-
+- if(cmd==SHM_LOCK) {
++
++ shm_file = shp->shm_file;
++ if (is_file_hugepages(shm_file))
++ goto out_unlock;
++
++ if (cmd == SHM_LOCK) {
+ struct user_struct *user = current_user();
+- if (!is_file_hugepages(shp->shm_file)) {
+- err = shmem_lock(shp->shm_file, 1, user);
+- if (!err && !(shp->shm_perm.mode & SHM_LOCKED)){
+- shp->shm_perm.mode |= SHM_LOCKED;
+- shp->mlock_user = user;
+- }
++ err = shmem_lock(shm_file, 1, user);
++ if (!err && !(shp->shm_perm.mode & SHM_LOCKED)) {
++ shp->shm_perm.mode |= SHM_LOCKED;
++ shp->mlock_user = user;
+ }
+- } else if (!is_file_hugepages(shp->shm_file)) {
+- shmem_lock(shp->shm_file, 0, shp->mlock_user);
+- shp->shm_perm.mode &= ~SHM_LOCKED;
+- shp->mlock_user = NULL;
++ goto out_unlock;
+ }
++
++ /* SHM_UNLOCK */
++ if (!(shp->shm_perm.mode & SHM_LOCKED))
++ goto out_unlock;
++ shmem_lock(shm_file, 0, shp->mlock_user);
++ shp->shm_perm.mode &= ~SHM_LOCKED;
++ shp->mlock_user = NULL;
++ get_file(shm_file);
+ shm_unlock(shp);
++ scan_mapping_unevictable_pages(shm_file->f_mapping);
++ fput(shm_file);
+ goto out;
+ }
+ case IPC_RMID:
+diff --git a/mm/shmem.c b/mm/shmem.c
+index d672250..cc6d40b2 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1068,13 +1068,6 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
+ user_shm_unlock(inode->i_size, user);
+ info->flags &= ~VM_LOCKED;
+ mapping_clear_unevictable(file->f_mapping);
+- /*
+- * Ensure that a racing putback_lru_page() can see
+- * the pages of this mapping are evictable when we
+- * skip them due to !PageLRU during the scan.
+- */
+- smp_mb__after_clear_bit();
+- scan_mapping_unevictable_pages(file->f_mapping);
+ }
+ retval = 0;
+
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index f54a05b..824676a 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3353,6 +3353,7 @@ int page_evictable(struct page *page, struct vm_area_struct *vma)
+ return 1;
+ }
+
++#ifdef CONFIG_SHMEM
+ /**
+ * check_move_unevictable_page - check page for evictability and move to appropriate zone lru list
+ * @page: page to check evictability and move to appropriate lru list
+@@ -3363,6 +3364,8 @@ int page_evictable(struct page *page, struct vm_area_struct *vma)
+ *
+ * Restrictions: zone->lru_lock must be held, page must be on LRU and must
+ * have PageUnevictable set.
++ *
++ * This function is only used for SysV IPC SHM_UNLOCK.
+ */
+ static void check_move_unevictable_page(struct page *page, struct zone *zone)
+ {
+@@ -3396,6 +3399,8 @@ retry:
+ *
+ * Scan all pages in mapping. Check unevictable pages for
+ * evictability and move them to the appropriate zone lru list.
++ *
++ * This function is only used for SysV IPC SHM_UNLOCK.
+ */
+ void scan_mapping_unevictable_pages(struct address_space *mapping)
+ {
+@@ -3441,9 +3446,14 @@ void scan_mapping_unevictable_pages(struct address_space *mapping)
+ pagevec_release(&pvec);
+
+ count_vm_events(UNEVICTABLE_PGSCANNED, pg_scanned);
++ cond_resched();
+ }
+-
+ }
++#else
++void scan_mapping_unevictable_pages(struct address_space *mapping)
++{
++}
++#endif /* CONFIG_SHMEM */
+
+ static void warn_scan_unevictable_pages(void)
+ {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch
new file mode 100644
index 0000000..bc38964
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch
@@ -0,0 +1,342 @@
+From 0a86d03f1b440a70e86f9ba390c1a1240d963927 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd at google.com>
+Date: Fri, 20 Jan 2012 14:34:21 -0800
+Subject: [PATCH 129/130] SHM_UNLOCK: fix Unevictable pages stranded after
+ swap
+
+commit 245132643e1cfcd145bbc86a716c1818371fcb93 upstream.
+
+Commit cc39c6a9bbde ("mm: account skipped entries to avoid looping in
+find_get_pages") correctly fixed an infinite loop; but left a problem
+that find_get_pages() on shmem would return 0 (appearing to callers to
+mean end of tree) when it meets a run of nr_pages swap entries.
+
+The only uses of find_get_pages() on shmem are via pagevec_lookup(),
+called from invalidate_mapping_pages(), and from shmctl SHM_UNLOCK's
+scan_mapping_unevictable_pages(). The first is already commented, and
+not worth worrying about; but the second can leave pages on the
+Unevictable list after an unusual sequence of swapping and locking.
+
+Fix that by using shmem_find_get_pages_and_swap() (then ignoring the
+swap) instead of pagevec_lookup().
+
+But I don't want to contaminate vmscan.c with shmem internals, nor
+shmem.c with LRU locking. So move scan_mapping_unevictable_pages() into
+shmem.c, renaming it shmem_unlock_mapping(); and rename
+check_move_unevictable_page() to check_move_unevictable_pages(), looping
+down an array of pages, oftentimes under the same lock.
+
+Leave out the "rotate unevictable list" block: that's a leftover from
+when this was used for /proc/sys/vm/scan_unevictable_pages, whose flawed
+handling involved looking at pages at tail of LRU.
+
+Was there significance to the sequence first ClearPageUnevictable, then
+test page_evictable, then SetPageUnevictable here? I think not, we're
+under LRU lock, and have no barriers between those.
+
+Signed-off-by: Hugh Dickins <hughd at google.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro at jp.fujitsu.com>
+Cc: Minchan Kim <minchan.kim at gmail.com>
+Cc: Rik van Riel <riel at redhat.com>
+Cc: Shaohua Li <shaohua.li at intel.com>
+Cc: Eric Dumazet <eric.dumazet at gmail.com>
+Cc: Johannes Weiner <hannes at cmpxchg.org>
+Cc: Michel Lespinasse <walken at google.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+ include/linux/shmem_fs.h | 1 +
+ include/linux/swap.h | 2 +-
+ ipc/shm.c | 2 +-
+ mm/shmem.c | 46 +++++++++++++++--
+ mm/vmscan.c | 122 ++++++++++++++--------------------------------
+ 5 files changed, 81 insertions(+), 92 deletions(-)
+
+diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
+index 9291ac3..6f10c9c 100644
+--- a/include/linux/shmem_fs.h
++++ b/include/linux/shmem_fs.h
+@@ -48,6 +48,7 @@ extern struct file *shmem_file_setup(const char *name,
+ loff_t size, unsigned long flags);
+ extern int shmem_zero_setup(struct vm_area_struct *);
+ extern int shmem_lock(struct file *file, int lock, struct user_struct *user);
++extern void shmem_unlock_mapping(struct address_space *mapping);
+ extern struct page *shmem_read_mapping_page_gfp(struct address_space *mapping,
+ pgoff_t index, gfp_t gfp_mask);
+ extern void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end);
+diff --git a/include/linux/swap.h b/include/linux/swap.h
+index 1e22e12..67b3fa3 100644
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -272,7 +272,7 @@ static inline int zone_reclaim(struct zone *z, gfp_t mask, unsigned int order)
+ #endif
+
+ extern int page_evictable(struct page *page, struct vm_area_struct *vma);
+-extern void scan_mapping_unevictable_pages(struct address_space *);
++extern void check_move_unevictable_pages(struct page **, int nr_pages);
+
+ extern unsigned long scan_unevictable_pages;
+ extern int scan_unevictable_handler(struct ctl_table *, int,
+diff --git a/ipc/shm.c b/ipc/shm.c
+index 854ab58..b76be5b 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -916,7 +916,7 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
+ shp->mlock_user = NULL;
+ get_file(shm_file);
+ shm_unlock(shp);
+- scan_mapping_unevictable_pages(shm_file->f_mapping);
++ shmem_unlock_mapping(shm_file->f_mapping);
+ fput(shm_file);
+ goto out;
+ }
+diff --git a/mm/shmem.c b/mm/shmem.c
+index cc6d40b2..6c253f7 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -379,7 +379,7 @@ static int shmem_free_swap(struct address_space *mapping,
+ /*
+ * Pagevec may contain swap entries, so shuffle up pages before releasing.
+ */
+-static void shmem_pagevec_release(struct pagevec *pvec)
++static void shmem_deswap_pagevec(struct pagevec *pvec)
+ {
+ int i, j;
+
+@@ -389,7 +389,36 @@ static void shmem_pagevec_release(struct pagevec *pvec)
+ pvec->pages[j++] = page;
+ }
+ pvec->nr = j;
+- pagevec_release(pvec);
++}
++
++/*
++ * SysV IPC SHM_UNLOCK restore Unevictable pages to their evictable lists.
++ */
++void shmem_unlock_mapping(struct address_space *mapping)
++{
++ struct pagevec pvec;
++ pgoff_t indices[PAGEVEC_SIZE];
++ pgoff_t index = 0;
++
++ pagevec_init(&pvec, 0);
++ /*
++ * Minor point, but we might as well stop if someone else SHM_LOCKs it.
++ */
++ while (!mapping_unevictable(mapping)) {
++ /*
++ * Avoid pagevec_lookup(): find_get_pages() returns 0 as if it
++ * has finished, if it hits a row of PAGEVEC_SIZE swap entries.
++ */
++ pvec.nr = shmem_find_get_pages_and_swap(mapping, index,
++ PAGEVEC_SIZE, pvec.pages, indices);
++ if (!pvec.nr)
++ break;
++ index = indices[pvec.nr - 1] + 1;
++ shmem_deswap_pagevec(&pvec);
++ check_move_unevictable_pages(pvec.pages, pvec.nr);
++ pagevec_release(&pvec);
++ cond_resched();
++ }
+ }
+
+ /*
+@@ -440,7 +469,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ }
+ unlock_page(page);
+ }
+- shmem_pagevec_release(&pvec);
++ shmem_deswap_pagevec(&pvec);
++ pagevec_release(&pvec);
+ mem_cgroup_uncharge_end();
+ cond_resched();
+ index++;
+@@ -470,7 +500,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ continue;
+ }
+ if (index == start && indices[0] > end) {
+- shmem_pagevec_release(&pvec);
++ shmem_deswap_pagevec(&pvec);
++ pagevec_release(&pvec);
+ break;
+ }
+ mem_cgroup_uncharge_start();
+@@ -494,7 +525,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ }
+ unlock_page(page);
+ }
+- shmem_pagevec_release(&pvec);
++ shmem_deswap_pagevec(&pvec);
++ pagevec_release(&pvec);
+ mem_cgroup_uncharge_end();
+ index++;
+ }
+@@ -2439,6 +2471,10 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
+ return 0;
+ }
+
++void shmem_unlock_mapping(struct address_space *mapping)
++{
++}
++
+ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ {
+ truncate_inode_pages_range(inode->i_mapping, lstart, lend);
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 824676a..cb33d9c 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -636,7 +636,7 @@ redo:
+ * When racing with an mlock or AS_UNEVICTABLE clearing
+ * (page is unlocked) make sure that if the other thread
+ * does not observe our setting of PG_lru and fails
+- * isolation/check_move_unevictable_page,
++ * isolation/check_move_unevictable_pages,
+ * we see PG_mlocked/AS_UNEVICTABLE cleared below and move
+ * the page back to the evictable list.
+ *
+@@ -3355,104 +3355,56 @@ int page_evictable(struct page *page, struct vm_area_struct *vma)
+
+ #ifdef CONFIG_SHMEM
+ /**
+- * check_move_unevictable_page - check page for evictability and move to appropriate zone lru list
+- * @page: page to check evictability and move to appropriate lru list
+- * @zone: zone page is in
++ * check_move_unevictable_pages - check pages for evictability and move to appropriate zone lru list
++ * @pages: array of pages to check
++ * @nr_pages: number of pages to check
+ *
+- * Checks a page for evictability and moves the page to the appropriate
+- * zone lru list.
+- *
+- * Restrictions: zone->lru_lock must be held, page must be on LRU and must
+- * have PageUnevictable set.
++ * Checks pages for evictability and moves them to the appropriate lru list.
+ *
+ * This function is only used for SysV IPC SHM_UNLOCK.
+ */
+-static void check_move_unevictable_page(struct page *page, struct zone *zone)
++void check_move_unevictable_pages(struct page **pages, int nr_pages)
+ {
+- VM_BUG_ON(PageActive(page));
++ struct zone *zone = NULL;
++ int pgscanned = 0;
++ int pgrescued = 0;
++ int i;
+
+-retry:
+- ClearPageUnevictable(page);
+- if (page_evictable(page, NULL)) {
+- enum lru_list l = page_lru_base_type(page);
++ for (i = 0; i < nr_pages; i++) {
++ struct page *page = pages[i];
++ struct zone *pagezone;
+
+- __dec_zone_state(zone, NR_UNEVICTABLE);
+- list_move(&page->lru, &zone->lru[l].list);
+- mem_cgroup_move_lists(page, LRU_UNEVICTABLE, l);
+- __inc_zone_state(zone, NR_INACTIVE_ANON + l);
+- __count_vm_event(UNEVICTABLE_PGRESCUED);
+- } else {
+- /*
+- * rotate unevictable list
+- */
+- SetPageUnevictable(page);
+- list_move(&page->lru, &zone->lru[LRU_UNEVICTABLE].list);
+- mem_cgroup_rotate_lru_list(page, LRU_UNEVICTABLE);
+- if (page_evictable(page, NULL))
+- goto retry;
+- }
+-}
+-
+-/**
+- * scan_mapping_unevictable_pages - scan an address space for evictable pages
+- * @mapping: struct address_space to scan for evictable pages
+- *
+- * Scan all pages in mapping. Check unevictable pages for
+- * evictability and move them to the appropriate zone lru list.
+- *
+- * This function is only used for SysV IPC SHM_UNLOCK.
+- */
+-void scan_mapping_unevictable_pages(struct address_space *mapping)
+-{
+- pgoff_t next = 0;
+- pgoff_t end = (i_size_read(mapping->host) + PAGE_CACHE_SIZE - 1) >>
+- PAGE_CACHE_SHIFT;
+- struct zone *zone;
+- struct pagevec pvec;
++ pgscanned++;
++ pagezone = page_zone(page);
++ if (pagezone != zone) {
++ if (zone)
++ spin_unlock_irq(&zone->lru_lock);
++ zone = pagezone;
++ spin_lock_irq(&zone->lru_lock);
++ }
+
+- if (mapping->nrpages == 0)
+- return;
++ if (!PageLRU(page) || !PageUnevictable(page))
++ continue;
+
+- pagevec_init(&pvec, 0);
+- while (next < end &&
+- pagevec_lookup(&pvec, mapping, next, PAGEVEC_SIZE)) {
+- int i;
+- int pg_scanned = 0;
+-
+- zone = NULL;
+-
+- for (i = 0; i < pagevec_count(&pvec); i++) {
+- struct page *page = pvec.pages[i];
+- pgoff_t page_index = page->index;
+- struct zone *pagezone = page_zone(page);
+-
+- pg_scanned++;
+- if (page_index > next)
+- next = page_index;
+- next++;
+-
+- if (pagezone != zone) {
+- if (zone)
+- spin_unlock_irq(&zone->lru_lock);
+- zone = pagezone;
+- spin_lock_irq(&zone->lru_lock);
+- }
++ if (page_evictable(page, NULL)) {
++ enum lru_list lru = page_lru_base_type(page);
+
+- if (PageLRU(page) && PageUnevictable(page))
+- check_move_unevictable_page(page, zone);
++ VM_BUG_ON(PageActive(page));
++ ClearPageUnevictable(page);
++ __dec_zone_state(zone, NR_UNEVICTABLE);
++ list_move(&page->lru, &zone->lru[lru].list);
++ mem_cgroup_move_lists(page, LRU_UNEVICTABLE, lru);
++ __inc_zone_state(zone, NR_INACTIVE_ANON + lru);
++ pgrescued++;
+ }
+- if (zone)
+- spin_unlock_irq(&zone->lru_lock);
+- pagevec_release(&pvec);
++ }
+
+- count_vm_events(UNEVICTABLE_PGSCANNED, pg_scanned);
+- cond_resched();
++ if (zone) {
++ __count_vm_events(UNEVICTABLE_PGRESCUED, pgrescued);
++ __count_vm_events(UNEVICTABLE_PGSCANNED, pgscanned);
++ spin_unlock_irq(&zone->lru_lock);
+ }
+ }
+-#else
+-void scan_mapping_unevictable_pages(struct address_space *mapping)
+-{
+-}
+ #endif /* CONFIG_SHMEM */
+
+ static void warn_scan_unevictable_pages(void)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0130-Linux-3.2.2.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0130-Linux-3.2.2.patch
new file mode 100644
index 0000000..3a8e28a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0130-Linux-3.2.2.patch
@@ -0,0 +1,24 @@
+From ba50be5b9e68e504f1cb2c3042ee64b9c14a2aa9 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh at suse.de>
+Date: Wed, 25 Jan 2012 16:39:32 -0800
+Subject: [PATCH 130/130] Linux 3.2.2
+
+---
+ Makefile | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index c5edffa..2f684da 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 1
++SUBLEVEL = 2
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch
new file mode 100644
index 0000000..910b347
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch
@@ -0,0 +1,62 @@
+From f0cf0a9c9ff7883ccebb09e7b84000f1c3f8a9b6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai at suse.de>
+Date: Mon, 23 Jan 2012 17:10:24 +0100
+Subject: [PATCH 01/90] ALSA: hda - Fix buffer-alignment regression with
+ Nvidia HDMI
+
+commit 52409aa6a0e96337da137c069856298f4dd825a0 upstream.
+
+The commit 2ae66c26550cd94b0e2606a9275eb0ab7070ad0e
+ ALSA: hda: option to enable arbitrary buffer/period sizes
+introduced a regression on machines with Intel controller and Nvidia
+HDMI. The reason is that the driver modifies the global variable
+align_buffer_size when an Intel controller is found, and the Nvidia
+HDMI controller is probed after Intel although Nvidia chips require
+the aligned buffers.
+
+This patch fixes the problem by moving the flag into the local struct
+so that it's not affected by other controllers.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42567
+
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ sound/pci/hda/hda_intel.c | 6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 5b2b75b..192e6c0 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -461,6 +461,7 @@ struct azx {
+ unsigned int irq_pending_warned :1;
+ unsigned int probing :1; /* codec probing phase */
+ unsigned int snoop:1;
++ unsigned int align_buffer_size:1;
+
+ /* for debugging */
+ unsigned int last_cmd[AZX_MAX_CODECS];
+@@ -1697,7 +1698,7 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
+ runtime->hw.rates = hinfo->rates;
+ snd_pcm_limit_hw_rates(runtime);
+ snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS);
+- if (align_buffer_size)
++ if (chip->align_buffer_size)
+ /* constrain buffer sizes to be multiple of 128
+ bytes. This is more efficient in terms of memory
+ access but isn't required by the HDA spec and
+@@ -2753,8 +2754,9 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
+ }
+
+ /* disable buffer size rounding to 128-byte multiples if supported */
++ chip->align_buffer_size = align_buffer_size;
+ if (chip->driver_caps & AZX_DCAPS_BUFSIZE)
+- align_buffer_size = 0;
++ chip->align_buffer_size = 0;
+
+ /* allow 64bit DMA address if supported by H/W */
+ if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch
new file mode 100644
index 0000000..cdffe06
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch
@@ -0,0 +1,64 @@
+From b7b74418ff425c3ae197317ae839ff692b36bc44 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai at suse.de>
+Date: Mon, 23 Jan 2012 18:23:36 +0100
+Subject: [PATCH 02/90] ALSA: hda - Fix silent outputs from docking-station
+ jacks of Dell laptops
+
+commit b4ead019afc201f71c39cd0dfcaafed4a97b3dd2 upstream.
+
+The recent change of the power-widget handling for IDT codecs caused
+the silent output from the docking-station line-out jack. This was
+partially fixed by the commit f2cbba7602383cd9cdd21f0a5d0b8bd1aad47b33
+"ALSA: hda - Fix the lost power-setup of seconary pins after PM resume".
+But the line-out on the docking-station is still silent when booted
+with the jack plugged even by this fix.
+
+The remainig bug is that the power-widget is set off in stac92xx_init()
+because the pins in cfg->line_out_pins[] aren't checked there properly
+but only hp_pins[] are checked in is_nid_hp_pin().
+
+This patch fixes the problem by checking both HP and line-out pins
+and leaving the power-map correctly.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42637
+
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ sound/pci/hda/patch_sigmatel.c | 8 +++++---
+ 1 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index f3c73a9..2141cab 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4253,13 +4253,15 @@ static int enable_pin_detect(struct hda_codec *codec, hda_nid_t nid,
+ return 1;
+ }
+
+-static int is_nid_hp_pin(struct auto_pin_cfg *cfg, hda_nid_t nid)
++static int is_nid_out_jack_pin(struct auto_pin_cfg *cfg, hda_nid_t nid)
+ {
+ int i;
+ for (i = 0; i < cfg->hp_outs; i++)
+ if (cfg->hp_pins[i] == nid)
+ return 1; /* nid is a HP-Out */
+-
++ for (i = 0; i < cfg->line_outs; i++)
++ if (cfg->line_out_pins[i] == nid)
++ return 1; /* nid is a line-Out */
+ return 0; /* nid is not a HP-Out */
+ };
+
+@@ -4465,7 +4467,7 @@ static int stac92xx_init(struct hda_codec *codec)
+ continue;
+ }
+
+- if (is_nid_hp_pin(cfg, nid))
++ if (is_nid_out_jack_pin(cfg, nid))
+ continue; /* already has an unsol event */
+
+ pinctl = snd_hda_codec_read(codec, nid, 0,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch
new file mode 100644
index 0000000..5ce6c2c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch
@@ -0,0 +1,103 @@
+From 07750bbe6fff3f00487746556c6b4914ad3270f0 Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks at canonical.com>
+Date: Thu, 12 Jan 2012 11:30:44 +0100
+Subject: [PATCH 03/90] eCryptfs: Sanitize write counts of /dev/ecryptfs
+
+commit db10e556518eb9d21ee92ff944530d84349684f4 upstream.
+
+A malicious count value specified when writing to /dev/ecryptfs may
+result in a a very large kernel memory allocation.
+
+This patch peeks at the specified packet payload size, adds that to the
+size of the packet headers and compares the result with the write count
+value. The resulting maximum memory allocation size is approximately 532
+bytes.
+
+Signed-off-by: Tyler Hicks <tyhicks at canonical.com>
+Reported-by: Sasha Levin <levinsasha928 at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ fs/ecryptfs/miscdev.c | 56 +++++++++++++++++++++++++++++++++---------------
+ 1 files changed, 38 insertions(+), 18 deletions(-)
+
+diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
+index 940a82e..0dc5a3d 100644
+--- a/fs/ecryptfs/miscdev.c
++++ b/fs/ecryptfs/miscdev.c
+@@ -409,11 +409,47 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
+ ssize_t sz = 0;
+ char *data;
+ uid_t euid = current_euid();
++ unsigned char packet_size_peek[3];
+ int rc;
+
+- if (count == 0)
++ if (count == 0) {
+ goto out;
++ } else if (count == (1 + 4)) {
++ /* Likely a harmless MSG_HELO or MSG_QUIT - no packet length */
++ goto memdup;
++ } else if (count < (1 + 4 + 1)
++ || count > (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
++ + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES)) {
++ printk(KERN_WARNING "%s: Acceptable packet size range is "
++ "[%d-%lu], but amount of data written is [%zu].",
++ __func__, (1 + 4 + 1),
++ (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
++ + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES), count);
++ return -EINVAL;
++ }
++
++ if (copy_from_user(packet_size_peek, (buf + 1 + 4),
++ sizeof(packet_size_peek))) {
++ printk(KERN_WARNING "%s: Error while inspecting packet size\n",
++ __func__);
++ return -EFAULT;
++ }
++
++ rc = ecryptfs_parse_packet_length(packet_size_peek, &packet_size,
++ &packet_size_length);
++ if (rc) {
++ printk(KERN_WARNING "%s: Error parsing packet length; "
++ "rc = [%d]\n", __func__, rc);
++ return rc;
++ }
++
++ if ((1 + 4 + packet_size_length + packet_size) != count) {
++ printk(KERN_WARNING "%s: Invalid packet size [%zu]\n", __func__,
++ packet_size);
++ return -EINVAL;
++ }
+
++memdup:
+ data = memdup_user(buf, count);
+ if (IS_ERR(data)) {
+ printk(KERN_ERR "%s: memdup_user returned error [%ld]\n",
+@@ -435,23 +471,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
+ }
+ memcpy(&counter_nbo, &data[i], 4);
+ seq = be32_to_cpu(counter_nbo);
+- i += 4;
+- rc = ecryptfs_parse_packet_length(&data[i], &packet_size,
+- &packet_size_length);
+- if (rc) {
+- printk(KERN_WARNING "%s: Error parsing packet length; "
+- "rc = [%d]\n", __func__, rc);
+- goto out_free;
+- }
+- i += packet_size_length;
+- if ((1 + 4 + packet_size_length + packet_size) != count) {
+- printk(KERN_WARNING "%s: (1 + packet_size_length([%zd])"
+- " + packet_size([%zd]))([%zd]) != "
+- "count([%zd]). Invalid packet format.\n",
+- __func__, packet_size_length, packet_size,
+- (1 + packet_size_length + packet_size), count);
+- goto out_free;
+- }
++ i += 4 + packet_size_length;
+ rc = ecryptfs_miscdev_response(&data[i], packet_size,
+ euid, current_user_ns(),
+ task_pid(current), seq);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch
new file mode 100644
index 0000000..edb48da
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch
@@ -0,0 +1,58 @@
+From f5b95f7b4ba8b33f149c045528a030c9e43be2d1 Mon Sep 17 00:00:00 2001
+From: Tim Gardner <tim.gardner at canonical.com>
+Date: Thu, 12 Jan 2012 16:31:55 +0100
+Subject: [PATCH 04/90] ecryptfs: Improve metadata read failure logging
+
+commit 30373dc0c87ffef68d5628e77d56ffb1fa22e1ee upstream.
+
+Print inode on metadata read failure. The only real
+way of dealing with metadata read failures is to delete
+the underlying file system file. Having the inode
+allows one to 'find . -inum INODE`.
+
+[tyhicks at canonical.com: Removed some minor not-for-stable parts]
+Signed-off-by: Tim Gardner <tim.gardner at canonical.com>
+Reviewed-by: Kees Cook <keescook at chromium.org>
+Signed-off-by: Tyler Hicks <tyhicks at canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ fs/ecryptfs/crypto.c | 9 ++++++---
+ 1 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index 2a83425..2bf5203 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -1620,7 +1620,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
+ rc = ecryptfs_read_xattr_region(page_virt, ecryptfs_inode);
+ if (rc) {
+ printk(KERN_DEBUG "Valid eCryptfs headers not found in "
+- "file header region or xattr region\n");
++ "file header region or xattr region, inode %lu\n",
++ ecryptfs_inode->i_ino);
+ rc = -EINVAL;
+ goto out;
+ }
+@@ -1629,7 +1630,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
+ ECRYPTFS_DONT_VALIDATE_HEADER_SIZE);
+ if (rc) {
+ printk(KERN_DEBUG "Valid eCryptfs headers not found in "
+- "file xattr region either\n");
++ "file xattr region either, inode %lu\n",
++ ecryptfs_inode->i_ino);
+ rc = -EINVAL;
+ }
+ if (crypt_stat->mount_crypt_stat->flags
+@@ -1640,7 +1642,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
+ "crypto metadata only in the extended attribute "
+ "region, but eCryptfs was mounted without "
+ "xattr support enabled. eCryptfs will not treat "
+- "this like an encrypted file.\n");
++ "this like an encrypted file, inode %lu\n",
++ ecryptfs_inode->i_ino);
+ rc = -EINVAL;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch
new file mode 100644
index 0000000..aeefee1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch
@@ -0,0 +1,71 @@
+From 45320992a2d473d6e518e80ce501cc083c15a54e Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks at canonical.com>
+Date: Wed, 18 Jan 2012 18:30:04 -0600
+Subject: [PATCH 05/90] eCryptfs: Make truncate path killable
+
+commit 5e6f0d769017cc49207ef56996e42363ec26c1f0 upstream.
+
+ecryptfs_write() handles the truncation of eCryptfs inodes. It grabs a
+page, zeroes out the appropriate portions, and then encrypts the page
+before writing it to the lower filesystem. It was unkillable and due to
+the lack of sparse file support could result in tying up a large portion
+of system resources, while encrypting pages of zeros, with no way for
+the truncate operation to be stopped from userspace.
+
+This patch adds the ability for ecryptfs_write() to detect a pending
+fatal signal and return as gracefully as possible. The intent is to
+leave the lower file in a useable state, while still allowing a user to
+break out of the encryption loop. If a pending fatal signal is detected,
+the eCryptfs inode size is updated to reflect the modified inode size
+and then -EINTR is returned.
+
+Signed-off-by: Tyler Hicks <tyhicks at canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ fs/ecryptfs/read_write.c | 19 ++++++++++++++-----
+ 1 files changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
+index 3745f7c..54eb14c 100644
+--- a/fs/ecryptfs/read_write.c
++++ b/fs/ecryptfs/read_write.c
+@@ -132,6 +132,11 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
+ size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
+ size_t total_remaining_bytes = ((offset + size) - pos);
+
++ if (fatal_signal_pending(current)) {
++ rc = -EINTR;
++ break;
++ }
++
+ if (num_bytes > total_remaining_bytes)
+ num_bytes = total_remaining_bytes;
+ if (pos < offset) {
+@@ -193,15 +198,19 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
+ }
+ pos += num_bytes;
+ }
+- if ((offset + size) > ecryptfs_file_size) {
+- i_size_write(ecryptfs_inode, (offset + size));
++ if (pos > ecryptfs_file_size) {
++ i_size_write(ecryptfs_inode, pos);
+ if (crypt_stat->flags & ECRYPTFS_ENCRYPTED) {
+- rc = ecryptfs_write_inode_size_to_metadata(
++ int rc2;
++
++ rc2 = ecryptfs_write_inode_size_to_metadata(
+ ecryptfs_inode);
+- if (rc) {
++ if (rc2) {
+ printk(KERN_ERR "Problem with "
+ "ecryptfs_write_inode_size_to_metadata; "
+- "rc = [%d]\n", rc);
++ "rc = [%d]\n", rc2);
++ if (!rc)
++ rc = rc2;
+ goto out;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch
new file mode 100644
index 0000000..04f130b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch
@@ -0,0 +1,122 @@
+From 86977fde23e2c2b4915634d519565a2007b8d339 Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks at canonical.com>
+Date: Thu, 19 Jan 2012 20:33:44 -0600
+Subject: [PATCH 06/90] eCryptfs: Check inode changes in setattr
+
+commit a261a03904849c3df50bd0300efb7fb3f865137d upstream.
+
+Most filesystems call inode_change_ok() very early in ->setattr(), but
+eCryptfs didn't call it at all. It allowed the lower filesystem to make
+the call in its ->setattr() function. Then, eCryptfs would copy the
+appropriate inode attributes from the lower inode to the eCryptfs inode.
+
+This patch changes that and actually calls inode_change_ok() on the
+eCryptfs inode, fairly early in ecryptfs_setattr(). Ideally, the call
+would happen earlier in ecryptfs_setattr(), but there are some possible
+inode initialization steps that must happen first.
+
+Since the call was already being made on the lower inode, the change in
+functionality should be minimal, except for the case of a file extending
+truncate call. In that case, inode_newsize_ok() was never being
+called on the eCryptfs inode. Rather than inode_newsize_ok() catching
+maximum file size errors early on, eCryptfs would encrypt zeroed pages
+and write them to the lower filesystem until the lower filesystem's
+write path caught the error in generic_write_checks(). This patch
+introduces a new function, called ecryptfs_inode_newsize_ok(), which
+checks if the new lower file size is within the appropriate limits when
+the truncate operation will be growing the lower file.
+
+In summary this change prevents eCryptfs truncate operations (and the
+resulting page encryptions), which would exceed the lower filesystem
+limits or FSIZE rlimits, from ever starting.
+
+Signed-off-by: Tyler Hicks <tyhicks at canonical.com>
+Reviewed-by: Li Wang <liwang at nudt.edu.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ fs/ecryptfs/inode.c | 48 ++++++++++++++++++++++++++++++++++++------------
+ 1 files changed, 36 insertions(+), 12 deletions(-)
+
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index 32f90a3..d2039ca 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -841,18 +841,6 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
+ size_t num_zeros = (PAGE_CACHE_SIZE
+ - (ia->ia_size & ~PAGE_CACHE_MASK));
+
+-
+- /*
+- * XXX(truncate) this should really happen at the begginning
+- * of ->setattr. But the code is too messy to that as part
+- * of a larger patch. ecryptfs is also totally missing out
+- * on the inode_change_ok check at the beginning of
+- * ->setattr while would include this.
+- */
+- rc = inode_newsize_ok(inode, ia->ia_size);
+- if (rc)
+- goto out;
+-
+ if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
+ truncate_setsize(inode, ia->ia_size);
+ lower_ia->ia_size = ia->ia_size;
+@@ -902,6 +890,28 @@ out:
+ return rc;
+ }
+
++static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)
++{
++ struct ecryptfs_crypt_stat *crypt_stat;
++ loff_t lower_oldsize, lower_newsize;
++
++ crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
++ lower_oldsize = upper_size_to_lower_size(crypt_stat,
++ i_size_read(inode));
++ lower_newsize = upper_size_to_lower_size(crypt_stat, offset);
++ if (lower_newsize > lower_oldsize) {
++ /*
++ * The eCryptfs inode and the new *lower* size are mixed here
++ * because we may not have the lower i_mutex held and/or it may
++ * not be appropriate to call inode_newsize_ok() with inodes
++ * from other filesystems.
++ */
++ return inode_newsize_ok(inode, lower_newsize);
++ }
++
++ return 0;
++}
++
+ /**
+ * ecryptfs_truncate
+ * @dentry: The ecryptfs layer dentry
+@@ -918,6 +928,10 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
+ struct iattr lower_ia = { .ia_valid = 0 };
+ int rc;
+
++ rc = ecryptfs_inode_newsize_ok(dentry->d_inode, new_length);
++ if (rc)
++ return rc;
++
+ rc = truncate_upper(dentry, &ia, &lower_ia);
+ if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
+ struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
+@@ -997,6 +1011,16 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
+ }
+ }
+ mutex_unlock(&crypt_stat->cs_mutex);
++
++ rc = inode_change_ok(inode, ia);
++ if (rc)
++ goto out;
++ if (ia->ia_valid & ATTR_SIZE) {
++ rc = ecryptfs_inode_newsize_ok(inode, ia->ia_size);
++ if (rc)
++ goto out;
++ }
++
+ if (S_ISREG(inode->i_mode)) {
+ rc = filemap_write_and_wait(inode->i_mapping);
+ if (rc)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch
new file mode 100644
index 0000000..2125487
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch
@@ -0,0 +1,103 @@
+From ac8cdf4aded6810a3a8a331ad9fe0ffff119323a Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks at canonical.com>
+Date: Tue, 24 Jan 2012 10:02:22 -0600
+Subject: [PATCH 07/90] eCryptfs: Fix oops when printing debug info in extent
+ crypto functions
+
+commit 58ded24f0fcb85bddb665baba75892f6ad0f4b8a upstream.
+
+If pages passed to the eCryptfs extent-based crypto functions are not
+mapped and the module parameter ecryptfs_verbosity=1 was specified at
+loading time, a NULL pointer dereference will occur.
+
+Note that this wouldn't happen on a production system, as you wouldn't
+pass ecryptfs_verbosity=1 on a production system. It leaks private
+information to the system logs and is for debugging only.
+
+The debugging info printed in these messages is no longer very useful
+and rather than doing a kmap() in these debugging paths, it will be
+better to simply remove the debugging paths completely.
+
+https://launchpad.net/bugs/913651
+
+Signed-off-by: Tyler Hicks <tyhicks at canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ fs/ecryptfs/crypto.c | 40 ----------------------------------------
+ 1 files changed, 0 insertions(+), 40 deletions(-)
+
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index 2bf5203..68b19ab 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -417,17 +417,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
+ (unsigned long long)(extent_base + extent_offset), rc);
+ goto out;
+ }
+- if (unlikely(ecryptfs_verbosity > 0)) {
+- ecryptfs_printk(KERN_DEBUG, "Encrypting extent "
+- "with iv:\n");
+- ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
+- ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
+- "encryption:\n");
+- ecryptfs_dump_hex((char *)
+- (page_address(page)
+- + (extent_offset * crypt_stat->extent_size)),
+- 8);
+- }
+ rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page, 0,
+ page, (extent_offset
+ * crypt_stat->extent_size),
+@@ -440,14 +429,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
+ goto out;
+ }
+ rc = 0;
+- if (unlikely(ecryptfs_verbosity > 0)) {
+- ecryptfs_printk(KERN_DEBUG, "Encrypt extent [0x%.16llx]; "
+- "rc = [%d]\n",
+- (unsigned long long)(extent_base + extent_offset), rc);
+- ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
+- "encryption:\n");
+- ecryptfs_dump_hex((char *)(page_address(enc_extent_page)), 8);
+- }
+ out:
+ return rc;
+ }
+@@ -543,17 +524,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
+ (unsigned long long)(extent_base + extent_offset), rc);
+ goto out;
+ }
+- if (unlikely(ecryptfs_verbosity > 0)) {
+- ecryptfs_printk(KERN_DEBUG, "Decrypting extent "
+- "with iv:\n");
+- ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
+- ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
+- "decryption:\n");
+- ecryptfs_dump_hex((char *)
+- (page_address(enc_extent_page)
+- + (extent_offset * crypt_stat->extent_size)),
+- 8);
+- }
+ rc = ecryptfs_decrypt_page_offset(crypt_stat, page,
+ (extent_offset
+ * crypt_stat->extent_size),
+@@ -567,16 +537,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
+ goto out;
+ }
+ rc = 0;
+- if (unlikely(ecryptfs_verbosity > 0)) {
+- ecryptfs_printk(KERN_DEBUG, "Decrypt extent [0x%.16llx]; "
+- "rc = [%d]\n",
+- (unsigned long long)(extent_base + extent_offset), rc);
+- ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
+- "decryption:\n");
+- ecryptfs_dump_hex((char *)(page_address(page)
+- + (extent_offset
+- * crypt_stat->extent_size)), 8);
+- }
+ out:
+ return rc;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch
new file mode 100644
index 0000000..21b4761
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch
@@ -0,0 +1,38 @@
+From b838f82f8bc3ece8e4f2f8710629b4900949df28 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher at amd.com>
+Date: Sun, 15 Jan 2012 08:51:12 -0500
+Subject: [PATCH 08/90] drm/radeon/kms: Add an MSI quirk for Dell RS690
+
+commit 44517c44496062180a6376cc704b33129441ce60 upstream.
+
+Interrupts only work with MSIs.
+https://bugs.freedesktop.org/show_bug.cgi?id=37679
+
+Reported-by: Dmitry Podgorny <pasis.uax at gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
+Signed-off-by: Dave Airlie <airlied at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/radeon_irq_kms.c | 6 ++++++
+ 1 files changed, 6 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+index 8f86aeb..e7ddb49 100644
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -134,6 +134,12 @@ static bool radeon_msi_ok(struct radeon_device *rdev)
+ /* Dell RS690 only seems to work with MSIs. */
+ if ((rdev->pdev->device == 0x791f) &&
+ (rdev->pdev->subsystem_vendor == 0x1028) &&
++ (rdev->pdev->subsystem_device == 0x01fc))
++ return true;
++
++ /* Dell RS690 only seems to work with MSIs. */
++ if ((rdev->pdev->device == 0x791f) &&
++ (rdev->pdev->subsystem_vendor == 0x1028) &&
+ (rdev->pdev->subsystem_device == 0x01fd))
+ return true;
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch
new file mode 100644
index 0000000..288c4f9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch
@@ -0,0 +1,130 @@
+From 4a44e7de68c61737b17954db3cadc632db685ed6 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher at amd.com>
+Date: Fri, 20 Jan 2012 15:01:29 -0500
+Subject: [PATCH 09/90] drm/radeon/kms: move panel mode setup into encoder
+ mode set
+
+commit 386d4d751e8e0b4b693bb724f09aae064ee5297d upstream.
+
+Needs to happen earlier in the mode set.
+
+Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
+Signed-off-by: Dave Airlie <airlied at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/atombios_dp.c | 22 ++++++++++------------
+ drivers/gpu/drm/radeon/atombios_encoders.c | 11 +++++++++++
+ drivers/gpu/drm/radeon/radeon_mode.h | 3 +++
+ 3 files changed, 24 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index 6fb335a..a71557c 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -549,8 +549,8 @@ bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector)
+ return false;
+ }
+
+-static void radeon_dp_set_panel_mode(struct drm_encoder *encoder,
+- struct drm_connector *connector)
++int radeon_dp_get_panel_mode(struct drm_encoder *encoder,
++ struct drm_connector *connector)
+ {
+ struct drm_device *dev = encoder->dev;
+ struct radeon_device *rdev = dev->dev_private;
+@@ -558,7 +558,7 @@ static void radeon_dp_set_panel_mode(struct drm_encoder *encoder,
+ int panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
+
+ if (!ASIC_IS_DCE4(rdev))
+- return;
++ return panel_mode;
+
+ if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) ==
+ ENCODER_OBJECT_ID_NUTMEG)
+@@ -572,14 +572,7 @@ static void radeon_dp_set_panel_mode(struct drm_encoder *encoder,
+ panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
+ }
+
+- atombios_dig_encoder_setup(encoder,
+- ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
+- panel_mode);
+-
+- if ((connector->connector_type == DRM_MODE_CONNECTOR_eDP) &&
+- (panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)) {
+- radeon_write_dpcd_reg(radeon_connector, DP_EDP_CONFIGURATION_SET, 1);
+- }
++ return panel_mode;
+ }
+
+ void radeon_dp_set_link_config(struct drm_connector *connector,
+@@ -717,6 +710,8 @@ static void radeon_dp_set_tp(struct radeon_dp_link_train_info *dp_info, int tp)
+
+ static int radeon_dp_link_train_init(struct radeon_dp_link_train_info *dp_info)
+ {
++ struct radeon_encoder *radeon_encoder = to_radeon_encoder(dp_info->encoder);
++ struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+ u8 tmp;
+
+ /* power up the sink */
+@@ -732,7 +727,10 @@ static int radeon_dp_link_train_init(struct radeon_dp_link_train_info *dp_info)
+ radeon_write_dpcd_reg(dp_info->radeon_connector,
+ DP_DOWNSPREAD_CTRL, 0);
+
+- radeon_dp_set_panel_mode(dp_info->encoder, dp_info->connector);
++ if ((dp_info->connector->connector_type == DRM_MODE_CONNECTOR_eDP) &&
++ (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)) {
++ radeon_write_dpcd_reg(dp_info->radeon_connector, DP_EDP_CONFIGURATION_SET, 1);
++ }
+
+ /* set the lane count on the sink */
+ tmp = dp_info->dp_lane_count;
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index 39c04c1..9dcfba0 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -1822,10 +1822,21 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+ case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+ if (ASIC_IS_DCE4(rdev)) {
++ struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
++ struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
++
++ if (!connector)
++ dig->panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
++ else
++ dig->panel_mode = radeon_dp_get_panel_mode(encoder, connector);
++
+ /* disable the transmitter */
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
+ /* setup and enable the encoder */
+ atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
++ atombios_dig_encoder_setup(encoder,
++ ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
++ dig->panel_mode);
+
+ /* enable the transmitter */
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
+index 2c2e75e..8254d5a 100644
+--- a/drivers/gpu/drm/radeon/radeon_mode.h
++++ b/drivers/gpu/drm/radeon/radeon_mode.h
+@@ -362,6 +362,7 @@ struct radeon_encoder_atom_dig {
+ struct backlight_device *bl_dev;
+ int dpms_mode;
+ uint8_t backlight_level;
++ int panel_mode;
+ };
+
+ struct radeon_encoder_atom_dac {
+@@ -482,6 +483,8 @@ extern void radeon_dp_link_train(struct drm_encoder *encoder,
+ extern bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector);
+ extern u8 radeon_dp_getsinktype(struct radeon_connector *radeon_connector);
+ extern bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector);
++extern int radeon_dp_get_panel_mode(struct drm_encoder *encoder,
++ struct drm_connector *connector);
+ extern void atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mode);
+ extern void radeon_atom_encoder_init(struct radeon_device *rdev);
+ extern void atombios_dig_transmitter_setup(struct drm_encoder *encoder,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch
new file mode 100644
index 0000000..0cf4bb0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch
@@ -0,0 +1,87 @@
+From 053fc3b3f7c773c8fbd7c95887b333deddac4ab5 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher at amd.com>
+Date: Fri, 20 Jan 2012 15:01:30 -0500
+Subject: [PATCH 10/90] drm/radeon/kms: rework modeset sequence for DCE41 and
+ DCE5
+
+commit 3a47824d85eeca122895646f027dc63480994199 upstream.
+
+dig transmitter control table only has ENABLE/DISABLE actions
+on DCE4.1/DCE5.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=44955
+
+Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
+Signed-off-by: Dave Airlie <airlied at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/atombios_encoders.c | 19 ++++++++++++-------
+ 1 files changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index 9dcfba0..0f8eb48 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -1352,7 +1352,8 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
+ switch (mode) {
+ case DRM_MODE_DPMS_ON:
+ /* some early dce3.2 boards have a bug in their transmitter control table */
+- if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730))
++ if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730) ||
++ ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev))
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+ else
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+@@ -1362,8 +1363,6 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
+ ATOM_TRANSMITTER_ACTION_POWER_ON);
+ radeon_dig_connector->edp_on = true;
+ }
+- if (ASIC_IS_DCE4(rdev))
+- atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_OFF, 0);
+ radeon_dp_link_train(encoder, connector);
+ if (ASIC_IS_DCE4(rdev))
+ atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_ON, 0);
+@@ -1374,7 +1373,10 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
+ case DRM_MODE_DPMS_STANDBY:
+ case DRM_MODE_DPMS_SUSPEND:
+ case DRM_MODE_DPMS_OFF:
+- atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
++ if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev))
++ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
++ else
++ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
+ if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
+ if (ASIC_IS_DCE4(rdev))
+ atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_OFF, 0);
+@@ -1821,7 +1823,7 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+ case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+- if (ASIC_IS_DCE4(rdev)) {
++ if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
+ struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+ struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+
+@@ -1830,13 +1832,16 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
+ else
+ dig->panel_mode = radeon_dp_get_panel_mode(encoder, connector);
+
+- /* disable the transmitter */
+- atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
+ /* setup and enable the encoder */
+ atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
+ atombios_dig_encoder_setup(encoder,
+ ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
+ dig->panel_mode);
++ } else if (ASIC_IS_DCE4(rdev)) {
++ /* disable the transmitter */
++ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
++ /* setup and enable the encoder */
++ atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
+
+ /* enable the transmitter */
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0011-drm-Fix-authentication-kernel-crash.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0011-drm-Fix-authentication-kernel-crash.patch
new file mode 100644
index 0000000..85f719e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0011-drm-Fix-authentication-kernel-crash.patch
@@ -0,0 +1,91 @@
+From eb46186bf6a5226ef40a011986bd206874a940b6 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom at vmware.com>
+Date: Tue, 24 Jan 2012 18:54:21 +0100
+Subject: [PATCH 11/90] drm: Fix authentication kernel crash
+
+commit 598781d71119827b454fd75d46f84755bca6f0c6 upstream.
+
+If the master tries to authenticate a client using drm_authmagic and
+that client has already closed its drm file descriptor,
+either wilfully or because it was terminated, the
+call to drm_authmagic will dereference a stale pointer into kmalloc'ed memory
+and corrupt it.
+
+Typically this results in a hard system hang.
+
+This patch fixes that problem by removing any authentication tokens
+(struct drm_magic_entry) open for a file descriptor when that file
+descriptor is closed.
+
+Signed-off-by: Thomas Hellstrom <thellstrom at vmware.com>
+Reviewed-by: Daniel Vetter <daniel.vetter at ffwll.ch>
+Signed-off-by: Dave Airlie <airlied at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_auth.c | 6 +++++-
+ drivers/gpu/drm/drm_fops.c | 5 +++++
+ include/drm/drmP.h | 1 +
+ 3 files changed, 11 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
+index 3f46772..ba23790 100644
+--- a/drivers/gpu/drm/drm_auth.c
++++ b/drivers/gpu/drm/drm_auth.c
+@@ -101,7 +101,7 @@ static int drm_add_magic(struct drm_master *master, struct drm_file *priv,
+ * Searches and unlinks the entry in drm_device::magiclist with the magic
+ * number hash key, while holding the drm_device::struct_mutex lock.
+ */
+-static int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
++int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
+ {
+ struct drm_magic_entry *pt;
+ struct drm_hash_item *hash;
+@@ -136,6 +136,8 @@ static int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
+ * If there is a magic number in drm_file::magic then use it, otherwise
+ * searches an unique non-zero magic number and add it associating it with \p
+ * file_priv.
++ * This ioctl needs protection by the drm_global_mutex, which protects
++ * struct drm_file::magic and struct drm_magic_entry::priv.
+ */
+ int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
+ {
+@@ -173,6 +175,8 @@ int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
+ * \return zero if authentication successed, or a negative number otherwise.
+ *
+ * Checks if \p file_priv is associated with the magic number passed in \arg.
++ * This ioctl needs protection by the drm_global_mutex, which protects
++ * struct drm_file::magic and struct drm_magic_entry::priv.
+ */
+ int drm_authmagic(struct drm_device *dev, void *data,
+ struct drm_file *file_priv)
+diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
+index 4911e1d..828bf65 100644
+--- a/drivers/gpu/drm/drm_fops.c
++++ b/drivers/gpu/drm/drm_fops.c
+@@ -487,6 +487,11 @@ int drm_release(struct inode *inode, struct file *filp)
+ (long)old_encode_dev(file_priv->minor->device),
+ dev->open_count);
+
++ /* Release any auth tokens that might point to this file_priv,
++ (do that under the drm_global_mutex) */
++ if (file_priv->magic)
++ (void) drm_remove_magic(file_priv->master, file_priv->magic);
++
+ /* if the master has gone away we can't do anything with the lock */
+ if (file_priv->minor->master)
+ drm_master_release(dev, filp);
+diff --git a/include/drm/drmP.h b/include/drm/drmP.h
+index 1f9e951..bf4b2dc 100644
+--- a/include/drm/drmP.h
++++ b/include/drm/drmP.h
+@@ -1328,6 +1328,7 @@ extern int drm_getmagic(struct drm_device *dev, void *data,
+ struct drm_file *file_priv);
+ extern int drm_authmagic(struct drm_device *dev, void *data,
+ struct drm_file *file_priv);
++extern int drm_remove_magic(struct drm_master *master, drm_magic_t magic);
+
+ /* Cache management (drm_cache.c) */
+ void drm_clflush_pages(struct page *pages[], unsigned long num_pages);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch
new file mode 100644
index 0000000..87c0bce
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch
@@ -0,0 +1,38 @@
+From 2f455c0d809c7c2b9e340feb0e4db1a4a3580762 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack at suse.cz>
+Date: Wed, 11 Jan 2012 18:52:10 +0000
+Subject: [PATCH 12/90] xfs: Fix missing xfs_iunlock() on error recovery path
+ in xfs_readlink()
+
+commit 9b025eb3a89e041bab6698e3858706be2385d692 upstream.
+
+Commit b52a360b forgot to call xfs_iunlock() when it detected corrupted
+symplink and bailed out. Fix it by jumping to 'out' instead of doing return.
+
+CC: Carlos Maiolino <cmaiolino at redhat.com>
+Signed-off-by: Jan Kara <jack at suse.cz>
+Reviewed-by: Alex Elder <elder at kernel.org>
+Reviewed-by: Dave Chinner <dchinner at redhat.com>
+Signed-off-by: Ben Myers <bpm at sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ fs/xfs/xfs_vnodeops.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
+index ce9268a..ee98d0b 100644
+--- a/fs/xfs/xfs_vnodeops.c
++++ b/fs/xfs/xfs_vnodeops.c
+@@ -131,7 +131,8 @@ xfs_readlink(
+ __func__, (unsigned long long) ip->i_ino,
+ (long long) pathlen);
+ ASSERT(0);
+- return XFS_ERROR(EFSCORRUPTED);
++ error = XFS_ERROR(EFSCORRUPTED);
++ goto out;
+ }
+
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch
new file mode 100644
index 0000000..41352ce
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch
@@ -0,0 +1,32 @@
+From b65a7dc8f10d4f4636b29c0cbaa7528941ccf78c Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Date: Wed, 18 Jan 2012 20:02:38 +0000
+Subject: [PATCH 13/90] ASoC: Mark WM5100 register map cache only when going
+ into BIAS_OFF
+
+commit e53e417331c57b9b97e3f8be870214a02c99265c upstream.
+
+Writing to the registers won't work if we do actually manage to hit a fully
+powered off state.
+
+Signed-off-by: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ sound/soc/codecs/wm5100.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
+index 42d9039..19c26d2 100644
+--- a/sound/soc/codecs/wm5100.c
++++ b/sound/soc/codecs/wm5100.c
+@@ -1404,6 +1404,7 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
+ break;
+
+ case SND_SOC_BIAS_OFF:
++ regcache_cache_only(wm5100->regmap, true);
+ if (wm5100->pdata.ldo_ena)
+ gpio_set_value_cansleep(wm5100->pdata.ldo_ena, 0);
+ regulator_bulk_disable(ARRAY_SIZE(wm5100->core_supplies),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch
new file mode 100644
index 0000000..e3fd411
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch
@@ -0,0 +1,66 @@
+From bcc1fc25bf8a5de125e92da576db7c59550e5df7 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Date: Wed, 18 Jan 2012 19:17:06 +0000
+Subject: [PATCH 14/90] ASoC: Disable register synchronisation for low
+ frequency WM8996 SYSCLK
+
+commit fed22007113cb857e917913ce016d9b539dc3a80 upstream.
+
+With a low frequency SYSCLK and a fast I2C clock register synchronisation
+may occasionally take too long to take effect, causing I/O issues. Disable
+synchronisation in order to avoid any issues.
+
+Signed-off-by: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ sound/soc/codecs/wm8996.c | 4 ++++
+ sound/soc/codecs/wm8996.h | 4 ++++
+ 2 files changed, 8 insertions(+), 0 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8996.c b/sound/soc/codecs/wm8996.c
+index a33b04d..e2afc05 100644
+--- a/sound/soc/codecs/wm8996.c
++++ b/sound/soc/codecs/wm8996.c
+@@ -1932,6 +1932,7 @@ static int wm8996_set_sysclk(struct snd_soc_dai *dai,
+ struct wm8996_priv *wm8996 = snd_soc_codec_get_drvdata(codec);
+ int lfclk = 0;
+ int ratediv = 0;
++ int sync = WM8996_REG_SYNC;
+ int src;
+ int old;
+
+@@ -1976,6 +1977,7 @@ static int wm8996_set_sysclk(struct snd_soc_dai *dai,
+ case 32000:
+ case 32768:
+ lfclk = WM8996_LFCLK_ENA;
++ sync = 0;
+ break;
+ default:
+ dev_warn(codec->dev, "Unsupported clock rate %dHz\n",
+@@ -1989,6 +1991,8 @@ static int wm8996_set_sysclk(struct snd_soc_dai *dai,
+ WM8996_SYSCLK_SRC_MASK | WM8996_SYSCLK_DIV_MASK,
+ src << WM8996_SYSCLK_SRC_SHIFT | ratediv);
+ snd_soc_update_bits(codec, WM8996_CLOCKING_1, WM8996_LFCLK_ENA, lfclk);
++ snd_soc_update_bits(codec, WM8996_CONTROL_INTERFACE_1,
++ WM8996_REG_SYNC, sync);
+ snd_soc_update_bits(codec, WM8996_AIF_CLOCKING_1,
+ WM8996_SYSCLK_ENA, old);
+
+diff --git a/sound/soc/codecs/wm8996.h b/sound/soc/codecs/wm8996.h
+index 0fde643..de9ac3e 100644
+--- a/sound/soc/codecs/wm8996.h
++++ b/sound/soc/codecs/wm8996.h
+@@ -1567,6 +1567,10 @@ int wm8996_detect(struct snd_soc_codec *codec, struct snd_soc_jack *jack,
+ /*
+ * R257 (0x101) - Control Interface (1)
+ */
++#define WM8996_REG_SYNC 0x8000 /* REG_SYNC */
++#define WM8996_REG_SYNC_MASK 0x8000 /* REG_SYNC */
++#define WM8996_REG_SYNC_SHIFT 15 /* REG_SYNC */
++#define WM8996_REG_SYNC_WIDTH 1 /* REG_SYNC */
+ #define WM8996_AUTO_INC 0x0004 /* AUTO_INC */
+ #define WM8996_AUTO_INC_MASK 0x0004 /* AUTO_INC */
+ #define WM8996_AUTO_INC_SHIFT 2 /* AUTO_INC */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch
new file mode 100644
index 0000000..0a55c9b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch
@@ -0,0 +1,41 @@
+From 0930fd68ed08367e18eac171909efe0b6f66ea4a Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Date: Thu, 19 Jan 2012 11:16:37 +0000
+Subject: [PATCH 15/90] ASoC: Don't go through cache when applying WM5100 rev
+ A updates
+
+commit 495174a8ffbaa0d15153d855cf206cdc46d51cf4 upstream.
+
+These are all to either uncached registers or fixes to register defaults,
+in the former case the cache won't do anything and in the latter case
+we're fixing things so the cache sync will do the right thing.
+
+Signed-off-by: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ sound/soc/codecs/wm5100.c | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
+index 19c26d2..d0beeec 100644
+--- a/sound/soc/codecs/wm5100.c
++++ b/sound/soc/codecs/wm5100.c
+@@ -1379,6 +1379,7 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
+
+ switch (wm5100->rev) {
+ case 0:
++ regcache_cache_bypass(wm5100->regmap, true);
+ snd_soc_write(codec, 0x11, 0x3);
+ snd_soc_write(codec, 0x203, 0xc);
+ snd_soc_write(codec, 0x206, 0);
+@@ -1394,6 +1395,7 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
+ snd_soc_write(codec,
+ wm5100_reva_patches[i].reg,
+ wm5100_reva_patches[i].val);
++ regcache_cache_bypass(wm5100->regmap, false);
+ break;
+ default:
+ break;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch
new file mode 100644
index 0000000..ceaf673
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch
@@ -0,0 +1,33 @@
+From b071dfcd22b8e8142129b7aa8da38c6649e9d7dc Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Date: Sat, 21 Jan 2012 21:48:53 +0000
+Subject: [PATCH 16/90] ASoC: wm8996: Call _POST_PMU callback for CPVDD
+
+commit a14304edcd5e8323205db34b08f709feb5357e64 upstream.
+
+We should be allowing a 5ms delay after the charge pump is started in
+order to ensure it has finished ramping.
+
+Signed-off-by: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ sound/soc/codecs/wm8996.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8996.c b/sound/soc/codecs/wm8996.c
+index e2afc05..6d98a57 100644
+--- a/sound/soc/codecs/wm8996.c
++++ b/sound/soc/codecs/wm8996.c
+@@ -1049,7 +1049,8 @@ SND_SOC_DAPM_SUPPLY_S("SYSCLK", 1, WM8996_AIF_CLOCKING_1, 0, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY_S("SYSDSPCLK", 2, WM8996_CLOCKING_1, 1, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY_S("AIFCLK", 2, WM8996_CLOCKING_1, 2, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY_S("Charge Pump", 2, WM8996_CHARGE_PUMP_1, 15, 0, cp_event,
+- SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
++ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
++ SND_SOC_DAPM_POST_PMD),
+ SND_SOC_DAPM_SUPPLY("Bandgap", SND_SOC_NOPM, 0, 0, bg_event,
+ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+ SND_SOC_DAPM_SUPPLY("LDO2", WM8996_POWER_MANAGEMENT_2, 1, 0, NULL, 0),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch
new file mode 100644
index 0000000..78e2557
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch
@@ -0,0 +1,53 @@
+From 786a655cc87f51dcedae8b03d880d3b507aeffc3 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka at redhat.com>
+Date: Tue, 17 Jan 2012 12:38:50 +0100
+Subject: [PATCH 17/90] brcmsmac: fix tx queue flush infinite loop
+
+commit f96b08a7e6f69c0f0a576554df3df5b1b519c479 upstream.
+
+This patch workaround live deadlock problem caused by infinite loop
+in brcms_c_wait_for_tx_completion(). I do not consider the patch as
+the proper fix, which should fix the real reason of tx queue flush
+failure, but patch helps with system lockup.
+
+Reference:
+https://bugzilla.kernel.org/show_bug.cgi?id=42576
+
+Reported-and-tested-by: Patrick <ragamuffin at datacomm.ch>
+Signed-off-by: Stanislaw Gruszka <sgruszka at redhat.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/net/wireless/brcm80211/brcmsmac/main.c | 10 +++++++++-
+ 1 files changed, 9 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+index 510e9bb..453f58e 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+@@ -8217,13 +8217,21 @@ int brcms_c_get_curband(struct brcms_c_info *wlc)
+
+ void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop)
+ {
++ int timeout = 20;
++
+ /* flush packet queue when requested */
+ if (drop)
+ brcmu_pktq_flush(&wlc->pkt_queue->q, false, NULL, NULL);
+
+ /* wait for queue and DMA fifos to run dry */
+- while (!pktq_empty(&wlc->pkt_queue->q) || brcms_txpktpendtot(wlc) > 0)
++ while (!pktq_empty(&wlc->pkt_queue->q) || brcms_txpktpendtot(wlc) > 0) {
+ brcms_msleep(wlc->wl, 1);
++
++ if (--timeout == 0)
++ break;
++ }
++
++ WARN_ON_ONCE(timeout == 0);
+ }
+
+ void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch
new file mode 100644
index 0000000..5d0ea85
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch
@@ -0,0 +1,111 @@
+From f9792a6e4ff3605b5821ddbca89ceb4d425a49b7 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg at intel.com>
+Date: Wed, 18 Jan 2012 14:10:25 +0100
+Subject: [PATCH 18/90] mac80211: fix work removal on deauth request
+
+commit bc4934bc61d0a11fd62c5187ff83645628f8be8b upstream.
+
+When deauth is requested while an auth or assoc
+work item is in progress, we currently delete it
+without regard for any state it might need to
+clean up. Fix it by cleaning up for those items.
+
+In the case Pontus found, the problem manifested
+itself as such:
+
+authenticate with 00:23:69:aa:dd:7b (try 1)
+authenticated
+failed to insert Dummy STA entry for the AP (error -17)
+deauthenticating from 00:23:69:aa:dd:7b by local choice (reason=2)
+
+It could also happen differently if the driver
+uses the tx_sync callback.
+
+We can't just call the ->done() method of the work
+items because that will lock up due to the locking
+in cfg80211. This fix isn't very clean, but that
+seems acceptable since I have patches pending to
+remove this code completely.
+
+Reported-by: Pontus Fuchs <pontus.fuchs at gmail.com>
+Tested-by: Pontus Fuchs <pontus.fuchs at gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg at intel.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/mac80211/mlme.c | 38 +++++++++++++++++++++++++++-----------
+ 1 files changed, 27 insertions(+), 11 deletions(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index b1b1bb3..9da8626 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2719,7 +2719,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
+ {
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+- struct ieee80211_work *wk;
+ u8 bssid[ETH_ALEN];
+ bool assoc_bss = false;
+
+@@ -2732,30 +2731,47 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
+ assoc_bss = true;
+ } else {
+ bool not_auth_yet = false;
++ struct ieee80211_work *tmp, *wk = NULL;
+
+ mutex_unlock(&ifmgd->mtx);
+
+ mutex_lock(&local->mtx);
+- list_for_each_entry(wk, &local->work_list, list) {
+- if (wk->sdata != sdata)
++ list_for_each_entry(tmp, &local->work_list, list) {
++ if (tmp->sdata != sdata)
+ continue;
+
+- if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
+- wk->type != IEEE80211_WORK_AUTH &&
+- wk->type != IEEE80211_WORK_ASSOC &&
+- wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
++ if (tmp->type != IEEE80211_WORK_DIRECT_PROBE &&
++ tmp->type != IEEE80211_WORK_AUTH &&
++ tmp->type != IEEE80211_WORK_ASSOC &&
++ tmp->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
+ continue;
+
+- if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
++ if (memcmp(req->bss->bssid, tmp->filter_ta, ETH_ALEN))
+ continue;
+
+- not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE;
+- list_del_rcu(&wk->list);
+- free_work(wk);
++ not_auth_yet = tmp->type == IEEE80211_WORK_DIRECT_PROBE;
++ list_del_rcu(&tmp->list);
++ synchronize_rcu();
++ wk = tmp;
+ break;
+ }
+ mutex_unlock(&local->mtx);
+
++ if (wk && wk->type == IEEE80211_WORK_ASSOC) {
++ /* clean up dummy sta & TX sync */
++ sta_info_destroy_addr(wk->sdata, wk->filter_ta);
++ if (wk->assoc.synced)
++ drv_finish_tx_sync(local, wk->sdata,
++ wk->filter_ta,
++ IEEE80211_TX_SYNC_ASSOC);
++ } else if (wk && wk->type == IEEE80211_WORK_AUTH) {
++ if (wk->probe_auth.synced)
++ drv_finish_tx_sync(local, wk->sdata,
++ wk->filter_ta,
++ IEEE80211_TX_SYNC_AUTH);
++ }
++ kfree(wk);
++
+ /*
+ * If somebody requests authentication and we haven't
+ * sent out an auth frame yet there's no need to send
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch
new file mode 100644
index 0000000..59836c7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch
@@ -0,0 +1,118 @@
+From f656782d935b7d59fa7bec23751e5bfb8a22d6e0 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack at suse.cz>
+Date: Sat, 26 Nov 2011 00:35:39 +0100
+Subject: [PATCH 19/90] jbd: Issue cache flush after checkpointing
+
+commit 353b67d8ced4dc53281c88150ad295e24bc4b4c5 upstream.
+
+When we reach cleanup_journal_tail(), there is no guarantee that
+checkpointed buffers are on a stable storage - especially if buffers were
+written out by log_do_checkpoint(), they are likely to be only in disk's
+caches. Thus when we update journal superblock, effectively removing old
+transaction from journal, this write of superblock can get to stable storage
+before those checkpointed buffers which can result in filesystem corruption
+after a crash.
+
+A similar problem can happen if we replay the journal and wipe it before
+flushing disk's caches.
+
+Thus we must unconditionally issue a cache flush before we update journal
+superblock in these cases. The fix is slightly complicated by the fact that we
+have to get log tail before we issue cache flush but we can store it in the
+journal superblock only after the cache flush. Otherwise we risk races where
+new tail is written before appropriate cache flush is finished.
+
+I managed to reproduce the corruption using somewhat tweaked Chris Mason's
+barrier-test scheduler. Also this should fix occasional reports of 'Bit already
+freed' filesystem errors which are totally unreproducible but inspection of
+several fs images I've gathered over time points to a problem like this.
+
+Signed-off-by: Jan Kara <jack at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ fs/jbd/checkpoint.c | 27 ++++++++++++++++++++++-----
+ fs/jbd/recovery.c | 4 ++++
+ 2 files changed, 26 insertions(+), 5 deletions(-)
+
+diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
+index 5d1a00a..05f0754 100644
+--- a/fs/jbd/checkpoint.c
++++ b/fs/jbd/checkpoint.c
+@@ -453,8 +453,6 @@ out:
+ *
+ * Return <0 on error, 0 on success, 1 if there was nothing to clean up.
+ *
+- * Called with the journal lock held.
+- *
+ * This is the only part of the journaling code which really needs to be
+ * aware of transaction aborts. Checkpointing involves writing to the
+ * main filesystem area rather than to the journal, so it can proceed
+@@ -472,13 +470,14 @@ int cleanup_journal_tail(journal_t *journal)
+ if (is_journal_aborted(journal))
+ return 1;
+
+- /* OK, work out the oldest transaction remaining in the log, and
++ /*
++ * OK, work out the oldest transaction remaining in the log, and
+ * the log block it starts at.
+ *
+ * If the log is now empty, we need to work out which is the
+ * next transaction ID we will write, and where it will
+- * start. */
+-
++ * start.
++ */
+ spin_lock(&journal->j_state_lock);
+ spin_lock(&journal->j_list_lock);
+ transaction = journal->j_checkpoint_transactions;
+@@ -504,7 +503,25 @@ int cleanup_journal_tail(journal_t *journal)
+ spin_unlock(&journal->j_state_lock);
+ return 1;
+ }
++ spin_unlock(&journal->j_state_lock);
++
++ /*
++ * We need to make sure that any blocks that were recently written out
++ * --- perhaps by log_do_checkpoint() --- are flushed out before we
++ * drop the transactions from the journal. It's unlikely this will be
++ * necessary, especially with an appropriately sized journal, but we
++ * need this to guarantee correctness. Fortunately
++ * cleanup_journal_tail() doesn't get called all that often.
++ */
++ if (journal->j_flags & JFS_BARRIER)
++ blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+
++ spin_lock(&journal->j_state_lock);
++ if (!tid_gt(first_tid, journal->j_tail_sequence)) {
++ spin_unlock(&journal->j_state_lock);
++ /* Someone else cleaned up journal so return 0 */
++ return 0;
++ }
+ /* OK, update the superblock to recover the freed space.
+ * Physical blocks come first: have we wrapped beyond the end of
+ * the log? */
+diff --git a/fs/jbd/recovery.c b/fs/jbd/recovery.c
+index 5b43e96..008bf06 100644
+--- a/fs/jbd/recovery.c
++++ b/fs/jbd/recovery.c
+@@ -20,6 +20,7 @@
+ #include <linux/fs.h>
+ #include <linux/jbd.h>
+ #include <linux/errno.h>
++#include <linux/blkdev.h>
+ #endif
+
+ /*
+@@ -263,6 +264,9 @@ int journal_recover(journal_t *journal)
+ err2 = sync_blockdev(journal->j_fs_dev);
+ if (!err)
+ err = err2;
++ /* Flush disk caches to get replayed data on the permanent storage */
++ if (journal->j_flags & JFS_BARRIER)
++ blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+
+ return err;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch
new file mode 100644
index 0000000..de8599a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch
@@ -0,0 +1,78 @@
+From e10bfbc1d5cea0f1fe47ae12a9ecdb83b70947e1 Mon Sep 17 00:00:00 2001
+From: Alexey Dobriyan <adobriyan at gmail.com>
+Date: Sat, 14 Jan 2012 21:27:37 +0300
+Subject: [PATCH 20/90] crypto: sha512 - make it work, undo percpu message
+ schedule
+
+commit 84e31fdb7c797a7303e0cc295cb9bc8b73fb872d upstream.
+
+commit f9e2bca6c22d75a289a349f869701214d63b5060
+aka "crypto: sha512 - Move message schedule W[80] to static percpu area"
+created global message schedule area.
+
+If sha512_update will ever be entered twice, hash will be silently
+calculated incorrectly.
+
+Probably the easiest way to notice incorrect hashes being calculated is
+to run 2 ping floods over AH with hmac(sha512):
+
+ #!/usr/sbin/setkey -f
+ flush;
+ spdflush;
+ add IP1 IP2 ah 25 -A hmac-sha512 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025;
+ add IP2 IP1 ah 52 -A hmac-sha512 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052;
+ spdadd IP1 IP2 any -P out ipsec ah/transport//require;
+ spdadd IP2 IP1 any -P in ipsec ah/transport//require;
+
+XfrmInStateProtoError will start ticking with -EBADMSG being returned
+from ah_input(). This never happens with, say, hmac(sha1).
+
+With patch applied (on BOTH sides), XfrmInStateProtoError does not tick
+with multiple bidirectional ping flood streams like it doesn't tick
+with SHA-1.
+
+After this patch sha512_transform() will start using ~750 bytes of stack on x86_64.
+This is OK for simple loads, for something more heavy, stack reduction will be done
+separatedly.
+
+Signed-off-by: Alexey Dobriyan <adobriyan at gmail.com>
+Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ crypto/sha512_generic.c | 6 +-----
+ 1 files changed, 1 insertions(+), 5 deletions(-)
+
+diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
+index 9ed9f60..8b9035b 100644
+--- a/crypto/sha512_generic.c
++++ b/crypto/sha512_generic.c
+@@ -21,8 +21,6 @@
+ #include <linux/percpu.h>
+ #include <asm/byteorder.h>
+
+-static DEFINE_PER_CPU(u64[80], msg_schedule);
+-
+ static inline u64 Ch(u64 x, u64 y, u64 z)
+ {
+ return z ^ (x & (y ^ z));
+@@ -89,7 +87,7 @@ sha512_transform(u64 *state, const u8 *input)
+ u64 a, b, c, d, e, f, g, h, t1, t2;
+
+ int i;
+- u64 *W = get_cpu_var(msg_schedule);
++ u64 W[80];
+
+ /* load the input */
+ for (i = 0; i < 16; i++)
+@@ -128,8 +126,6 @@ sha512_transform(u64 *state, const u8 *input)
+
+ /* erase our data */
+ a = b = c = d = e = f = g = h = t1 = t2 = 0;
+- memset(W, 0, sizeof(__get_cpu_var(msg_schedule)));
+- put_cpu_var(msg_schedule);
+ }
+
+ static int
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch
new file mode 100644
index 0000000..720c3e1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch
@@ -0,0 +1,129 @@
+From fed2a3f1c1ae549460ec39ba6492854e066c83d0 Mon Sep 17 00:00:00 2001
+From: Alexey Dobriyan <adobriyan at gmail.com>
+Date: Sat, 14 Jan 2012 21:40:57 +0300
+Subject: [PATCH 21/90] crypto: sha512 - reduce stack usage to safe number
+
+commit 51fc6dc8f948047364f7d42a4ed89b416c6cc0a3 upstream.
+
+For rounds 16--79, W[i] only depends on W[i - 2], W[i - 7], W[i - 15] and W[i - 16].
+Consequently, keeping all W[80] array on stack is unnecessary,
+only 16 values are really needed.
+
+Using W[16] instead of W[80] greatly reduces stack usage
+(~750 bytes to ~340 bytes on x86_64).
+
+Line by line explanation:
+* BLEND_OP
+ array is "circular" now, all indexes have to be modulo 16.
+ Round number is positive, so remainder operation should be
+ without surprises.
+
+* initial full message scheduling is trimmed to first 16 values which
+ come from data block, the rest is calculated before it's needed.
+
+* original loop body is unrolled version of new SHA512_0_15 and
+ SHA512_16_79 macros, unrolling was done to not do explicit variable
+ renaming. Otherwise it's the very same code after preprocessing.
+ See sha1_transform() code which does the same trick.
+
+Patch survives in-tree crypto test and original bugreport test
+(ping flood with hmac(sha512).
+
+See FIPS 180-2 for SHA-512 definition
+http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.pdf
+
+Signed-off-by: Alexey Dobriyan <adobriyan at gmail.com>
+Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ crypto/sha512_generic.c | 58 +++++++++++++++++++++++++++-------------------
+ 1 files changed, 34 insertions(+), 24 deletions(-)
+
+diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
+index 8b9035b..88f160b 100644
+--- a/crypto/sha512_generic.c
++++ b/crypto/sha512_generic.c
+@@ -78,7 +78,7 @@ static inline void LOAD_OP(int I, u64 *W, const u8 *input)
+
+ static inline void BLEND_OP(int I, u64 *W)
+ {
+- W[I] = s1(W[I-2]) + W[I-7] + s0(W[I-15]) + W[I-16];
++ W[I % 16] += s1(W[(I-2) % 16]) + W[(I-7) % 16] + s0(W[(I-15) % 16]);
+ }
+
+ static void
+@@ -87,38 +87,48 @@ sha512_transform(u64 *state, const u8 *input)
+ u64 a, b, c, d, e, f, g, h, t1, t2;
+
+ int i;
+- u64 W[80];
++ u64 W[16];
+
+ /* load the input */
+ for (i = 0; i < 16; i++)
+ LOAD_OP(i, W, input);
+
+- for (i = 16; i < 80; i++) {
+- BLEND_OP(i, W);
+- }
+-
+ /* load the state into our registers */
+ a=state[0]; b=state[1]; c=state[2]; d=state[3];
+ e=state[4]; f=state[5]; g=state[6]; h=state[7];
+
+- /* now iterate */
+- for (i=0; i<80; i+=8) {
+- t1 = h + e1(e) + Ch(e,f,g) + sha512_K[i ] + W[i ];
+- t2 = e0(a) + Maj(a,b,c); d+=t1; h=t1+t2;
+- t1 = g + e1(d) + Ch(d,e,f) + sha512_K[i+1] + W[i+1];
+- t2 = e0(h) + Maj(h,a,b); c+=t1; g=t1+t2;
+- t1 = f + e1(c) + Ch(c,d,e) + sha512_K[i+2] + W[i+2];
+- t2 = e0(g) + Maj(g,h,a); b+=t1; f=t1+t2;
+- t1 = e + e1(b) + Ch(b,c,d) + sha512_K[i+3] + W[i+3];
+- t2 = e0(f) + Maj(f,g,h); a+=t1; e=t1+t2;
+- t1 = d + e1(a) + Ch(a,b,c) + sha512_K[i+4] + W[i+4];
+- t2 = e0(e) + Maj(e,f,g); h+=t1; d=t1+t2;
+- t1 = c + e1(h) + Ch(h,a,b) + sha512_K[i+5] + W[i+5];
+- t2 = e0(d) + Maj(d,e,f); g+=t1; c=t1+t2;
+- t1 = b + e1(g) + Ch(g,h,a) + sha512_K[i+6] + W[i+6];
+- t2 = e0(c) + Maj(c,d,e); f+=t1; b=t1+t2;
+- t1 = a + e1(f) + Ch(f,g,h) + sha512_K[i+7] + W[i+7];
+- t2 = e0(b) + Maj(b,c,d); e+=t1; a=t1+t2;
++#define SHA512_0_15(i, a, b, c, d, e, f, g, h) \
++ t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[i]; \
++ t2 = e0(a) + Maj(a, b, c); \
++ d += t1; \
++ h = t1 + t2
++
++#define SHA512_16_79(i, a, b, c, d, e, f, g, h) \
++ BLEND_OP(i, W); \
++ t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[(i)%16]; \
++ t2 = e0(a) + Maj(a, b, c); \
++ d += t1; \
++ h = t1 + t2
++
++ for (i = 0; i < 16; i += 8) {
++ SHA512_0_15(i, a, b, c, d, e, f, g, h);
++ SHA512_0_15(i + 1, h, a, b, c, d, e, f, g);
++ SHA512_0_15(i + 2, g, h, a, b, c, d, e, f);
++ SHA512_0_15(i + 3, f, g, h, a, b, c, d, e);
++ SHA512_0_15(i + 4, e, f, g, h, a, b, c, d);
++ SHA512_0_15(i + 5, d, e, f, g, h, a, b, c);
++ SHA512_0_15(i + 6, c, d, e, f, g, h, a, b);
++ SHA512_0_15(i + 7, b, c, d, e, f, g, h, a);
++ }
++ for (i = 16; i < 80; i += 8) {
++ SHA512_16_79(i, a, b, c, d, e, f, g, h);
++ SHA512_16_79(i + 1, h, a, b, c, d, e, f, g);
++ SHA512_16_79(i + 2, g, h, a, b, c, d, e, f);
++ SHA512_16_79(i + 3, f, g, h, a, b, c, d, e);
++ SHA512_16_79(i + 4, e, f, g, h, a, b, c, d);
++ SHA512_16_79(i + 5, d, e, f, g, h, a, b, c);
++ SHA512_16_79(i + 6, c, d, e, f, g, h, a, b);
++ SHA512_16_79(i + 7, b, c, d, e, f, g, h, a);
+ }
+
+ state[0] += a; state[1] += b; state[2] += c; state[3] += d;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch
new file mode 100644
index 0000000..bfdde80
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch
@@ -0,0 +1,37 @@
+From fcbca854dc362b6a14769b89638cda8b0bee8144 Mon Sep 17 00:00:00 2001
+From: Stefan Berger <stefanb at linux.vnet.ibm.com>
+Date: Fri, 11 Nov 2011 12:57:06 -0500
+Subject: [PATCH 22/90] tpm_tis: add delay after aborting command
+
+commit a927b8131794ee449b7f6666e7ab61301949b20f upstream.
+
+This patch adds a delay after aborting a command. Some TPMs need
+this and will not process the subsequent command correctly otherwise.
+
+It's worth noting that a TPM randomly failing to process a command,
+maps to randomly failing suspend/resume operations.
+
+Signed-off-by: Stefan Berger <stefanb at linux.vnet.ibm.com>
+Signed-off-by: Rajiv Andrade <srajiv at linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/char/tpm/tpm_tis.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index 3f4051a..c7e5282 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -432,6 +432,9 @@ static int probe_itpm(struct tpm_chip *chip)
+ out:
+ itpm = rem_itpm;
+ tpm_tis_ready(chip);
++ /* some TPMs need a break here otherwise they will not work
++ * correctly on the immediately subsequent command */
++ msleep(chip->vendor.timeout_b);
+ release_locality(chip, chip->vendor.locality, 0);
+
+ return rc;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch
new file mode 100644
index 0000000..4531752
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch
@@ -0,0 +1,58 @@
+From fc9002e18099fd51f0f120cebc4078db2a221e26 Mon Sep 17 00:00:00 2001
+From: Cliff Wickman <cpw at sgi.com>
+Date: Wed, 18 Jan 2012 09:40:47 -0600
+Subject: [PATCH 23/90] x86/uv: Fix uninitialized spinlocks
+
+commit d2ebc71d472020bc30e29afe8c4d2a85a5b41f56 upstream.
+
+Initialize two spinlocks in tlb_uv.c and also properly define/initialize
+the uv_irq_lock.
+
+The lack of explicit initialization seems to be functionally
+harmless, but it is diagnosed when these are turned on:
+
+ CONFIG_DEBUG_SPINLOCK=y
+ CONFIG_DEBUG_MUTEXES=y
+ CONFIG_DEBUG_LOCK_ALLOC=y
+ CONFIG_LOCKDEP=y
+
+Signed-off-by: Cliff Wickman <cpw at sgi.com>
+Cc: Dimitri Sivanich <sivanich at sgi.com>
+Link: http://lkml.kernel.org/r/E1RnXd1-0003wU-PM@eag09.americas.sgi.com
+[ Added the uv_irq_lock initialization fix by Dimitri Sivanich ]
+Signed-off-by: Ingo Molnar <mingo at elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ arch/x86/platform/uv/tlb_uv.c | 2 ++
+ arch/x86/platform/uv/uv_irq.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
+index 9010ca7..81aee5a 100644
+--- a/arch/x86/platform/uv/tlb_uv.c
++++ b/arch/x86/platform/uv/tlb_uv.c
+@@ -1860,6 +1860,8 @@ static void __init init_per_cpu_tunables(void)
+ bcp->cong_reps = congested_reps;
+ bcp->cong_period = congested_period;
+ bcp->clocks_per_100_usec = usec_2_cycles(100);
++ spin_lock_init(&bcp->queue_lock);
++ spin_lock_init(&bcp->uvhub_lock);
+ }
+ }
+
+diff --git a/arch/x86/platform/uv/uv_irq.c b/arch/x86/platform/uv/uv_irq.c
+index 374a05d..f25c276 100644
+--- a/arch/x86/platform/uv/uv_irq.c
++++ b/arch/x86/platform/uv/uv_irq.c
+@@ -25,7 +25,7 @@ struct uv_irq_2_mmr_pnode{
+ int irq;
+ };
+
+-static spinlock_t uv_irq_lock;
++static DEFINE_SPINLOCK(uv_irq_lock);
+ static struct rb_root uv_irq_root;
+
+ static int uv_set_irq_affinity(struct irq_data *, const struct cpumask *, bool);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch
new file mode 100644
index 0000000..76fc78e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch
@@ -0,0 +1,41 @@
+From 37927d0a4d690f30ea1e9154f05d20dbace4730b Mon Sep 17 00:00:00 2001
+From: Russ Anderson <rja at sgi.com>
+Date: Wed, 18 Jan 2012 20:07:54 -0600
+Subject: [PATCH 24/90] x86/uv: Fix uv_gpa_to_soc_phys_ram() shift
+
+commit 5a51467b146ab7948d2f6812892eac120a30529c upstream.
+
+uv_gpa_to_soc_phys_ram() was inadvertently ignoring the
+shift values. This fix takes the shift into account.
+
+Signed-off-by: Russ Anderson <rja at sgi.com>
+Link: http://lkml.kernel.org/r/20120119020753.GA7228@sgi.com
+Signed-off-by: Ingo Molnar <mingo at elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ arch/x86/include/asm/uv/uv_hub.h | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/include/asm/uv/uv_hub.h b/arch/x86/include/asm/uv/uv_hub.h
+index 54a13aa..21f7385 100644
+--- a/arch/x86/include/asm/uv/uv_hub.h
++++ b/arch/x86/include/asm/uv/uv_hub.h
+@@ -318,13 +318,13 @@ uv_gpa_in_mmr_space(unsigned long gpa)
+ /* UV global physical address --> socket phys RAM */
+ static inline unsigned long uv_gpa_to_soc_phys_ram(unsigned long gpa)
+ {
+- unsigned long paddr = gpa & uv_hub_info->gpa_mask;
++ unsigned long paddr;
+ unsigned long remap_base = uv_hub_info->lowmem_remap_base;
+ unsigned long remap_top = uv_hub_info->lowmem_remap_top;
+
+ gpa = ((gpa << uv_hub_info->m_shift) >> uv_hub_info->m_shift) |
+ ((gpa >> uv_hub_info->n_lshift) << uv_hub_info->m_val);
+- gpa = gpa & uv_hub_info->gpa_mask;
++ paddr = gpa & uv_hub_info->gpa_mask;
+ if (paddr >= remap_base && paddr < remap_base + remap_top)
+ paddr -= remap_base;
+ return paddr;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch
new file mode 100644
index 0000000..e1b0211
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch
@@ -0,0 +1,75 @@
+From eed23f18d0d070bdece03565185953abb7b03252 Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3 at amd.com>
+Date: Fri, 20 Jan 2012 17:44:12 +0100
+Subject: [PATCH 25/90] x86/microcode_amd: Add support for CPU family specific
+ container files
+
+commit 5b68edc91cdc972c46f76f85eded7ffddc3ff5c2 upstream.
+
+We've decided to provide CPU family specific container files
+(starting with CPU family 15h). E.g. for family 15h we have to
+load microcode_amd_fam15h.bin instead of microcode_amd.bin
+
+Rationale is that starting with family 15h patch size is larger
+than 2KB which was hard coded as maximum patch size in various
+microcode loaders (not just Linux).
+
+Container files which include patches larger than 2KB cause
+different kinds of trouble with such old patch loaders. Thus we
+have to ensure that the default container file provides only
+patches with size less than 2KB.
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3 at amd.com>
+Cc: Borislav Petkov <borislav.petkov at amd.com>
+Cc: <stable at kernel.org>
+Link: http://lkml.kernel.org/r/20120120164412.GD24508@alberich.amd.com
+[ documented the naming convention and tidied the code a bit. ]
+Signed-off-by: Ingo Molnar <mingo at elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ arch/x86/kernel/microcode_amd.c | 24 ++++++++++++++++++++++--
+ 1 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
+index d494799..ac52c15 100644
+--- a/arch/x86/kernel/microcode_amd.c
++++ b/arch/x86/kernel/microcode_amd.c
+@@ -300,13 +300,33 @@ free_table:
+ return state;
+ }
+
++/*
++ * AMD microcode firmware naming convention, up to family 15h they are in
++ * the legacy file:
++ *
++ * amd-ucode/microcode_amd.bin
++ *
++ * This legacy file is always smaller than 2K in size.
++ *
++ * Starting at family 15h they are in family specific firmware files:
++ *
++ * amd-ucode/microcode_amd_fam15h.bin
++ * amd-ucode/microcode_amd_fam16h.bin
++ * ...
++ *
++ * These might be larger than 2K.
++ */
+ static enum ucode_state request_microcode_amd(int cpu, struct device *device)
+ {
+- const char *fw_name = "amd-ucode/microcode_amd.bin";
++ char fw_name[36] = "amd-ucode/microcode_amd.bin";
+ const struct firmware *fw;
+ enum ucode_state ret = UCODE_NFOUND;
++ struct cpuinfo_x86 *c = &cpu_data(cpu);
++
++ if (c->x86 >= 0x15)
++ snprintf(fw_name, sizeof(fw_name), "amd-ucode/microcode_amd_fam%.2xh.bin", c->x86);
+
+- if (request_firmware(&fw, fw_name, device)) {
++ if (request_firmware(&fw, (const char *)fw_name, device)) {
+ pr_err("failed to load file %s\n", fw_name);
+ goto out;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch
new file mode 100644
index 0000000..95ef043
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch
@@ -0,0 +1,172 @@
+From cf9fd8313b77cb347cc142b4127d01646ab5f4c2 Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab at linux-m68k.org>
+Date: Mon, 9 Jan 2012 15:10:15 +0100
+Subject: [PATCH 26/90] m68k: Fix assembler constraint to prevent overeager
+ gcc optimisation
+
+commit 2a3535069e33d8b416f406c159ce924427315303 upstream.
+
+Passing the address of a variable as an operand to an asm statement
+doesn't mark the value of this variable as used, so gcc may optimize its
+initialisation away. Fix this by using the "m" constraint instead.
+
+Signed-off-by: Andreas Schwab <schwab at linux-m68k.org>
+Signed-off-by: Geert Uytterhoeven <geert at linux-m68k.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ arch/m68k/atari/config.c | 8 ++++----
+ arch/m68k/kernel/process_mm.c | 4 ++--
+ arch/m68k/kernel/process_no.c | 4 ++--
+ arch/m68k/kernel/traps.c | 36 +++++++++++++++++-------------------
+ arch/m68k/mm/cache.c | 6 +++---
+ 5 files changed, 28 insertions(+), 30 deletions(-)
+
+diff --git a/arch/m68k/atari/config.c b/arch/m68k/atari/config.c
+index 4203d10..c4ac15c 100644
+--- a/arch/m68k/atari/config.c
++++ b/arch/m68k/atari/config.c
+@@ -414,9 +414,9 @@ void __init config_atari(void)
+ * FDC val = 4 -> Supervisor only */
+ asm volatile ("\n"
+ " .chip 68030\n"
+- " pmove %0@,%/tt1\n"
++ " pmove %0,%/tt1\n"
+ " .chip 68k"
+- : : "a" (&tt1_val));
++ : : "m" (tt1_val));
+ } else {
+ asm volatile ("\n"
+ " .chip 68040\n"
+@@ -569,10 +569,10 @@ static void atari_reset(void)
+ : "d0");
+ } else
+ asm volatile ("\n"
+- " pmove %0@,%%tc\n"
++ " pmove %0,%%tc\n"
+ " jmp %1@"
+ : /* no outputs */
+- : "a" (&tc_val), "a" (reset_addr));
++ : "m" (tc_val), "a" (reset_addr));
+ }
+
+
+diff --git a/arch/m68k/kernel/process_mm.c b/arch/m68k/kernel/process_mm.c
+index 1bc223a..aa4ffb8 100644
+--- a/arch/m68k/kernel/process_mm.c
++++ b/arch/m68k/kernel/process_mm.c
+@@ -189,8 +189,8 @@ void flush_thread(void)
+ current->thread.fs = __USER_DS;
+ if (!FPU_IS_EMU)
+ asm volatile (".chip 68k/68881\n\t"
+- "frestore %0@\n\t"
+- ".chip 68k" : : "a" (&zero));
++ "frestore %0\n\t"
++ ".chip 68k" : : "m" (zero));
+ }
+
+ /*
+diff --git a/arch/m68k/kernel/process_no.c b/arch/m68k/kernel/process_no.c
+index 69c1803..5e1078c 100644
+--- a/arch/m68k/kernel/process_no.c
++++ b/arch/m68k/kernel/process_no.c
+@@ -163,8 +163,8 @@ void flush_thread(void)
+ #ifdef CONFIG_FPU
+ if (!FPU_IS_EMU)
+ asm volatile (".chip 68k/68881\n\t"
+- "frestore %0@\n\t"
+- ".chip 68k" : : "a" (&zero));
++ "frestore %0\n\t"
++ ".chip 68k" : : "m" (zero));
+ #endif
+ }
+
+diff --git a/arch/m68k/kernel/traps.c b/arch/m68k/kernel/traps.c
+index 89362f2..eb67469 100644
+--- a/arch/m68k/kernel/traps.c
++++ b/arch/m68k/kernel/traps.c
+@@ -552,13 +552,13 @@ static inline void bus_error030 (struct frame *fp)
+
+ #ifdef DEBUG
+ asm volatile ("ptestr %3,%2@,#7,%0\n\t"
+- "pmove %%psr,%1@"
+- : "=a&" (desc)
+- : "a" (&temp), "a" (addr), "d" (ssw));
++ "pmove %%psr,%1"
++ : "=a&" (desc), "=m" (temp)
++ : "a" (addr), "d" (ssw));
+ #else
+ asm volatile ("ptestr %2,%1@,#7\n\t"
+- "pmove %%psr,%0@"
+- : : "a" (&temp), "a" (addr), "d" (ssw));
++ "pmove %%psr,%0"
++ : "=m" (temp) : "a" (addr), "d" (ssw));
+ #endif
+ mmusr = temp;
+
+@@ -605,20 +605,18 @@ static inline void bus_error030 (struct frame *fp)
+ !(ssw & RW) ? "write" : "read", addr,
+ fp->ptregs.pc, ssw);
+ asm volatile ("ptestr #1,%1@,#0\n\t"
+- "pmove %%psr,%0@"
+- : /* no outputs */
+- : "a" (&temp), "a" (addr));
++ "pmove %%psr,%0"
++ : "=m" (temp)
++ : "a" (addr));
+ mmusr = temp;
+
+ printk ("level 0 mmusr is %#x\n", mmusr);
+ #if 0
+- asm volatile ("pmove %%tt0,%0@"
+- : /* no outputs */
+- : "a" (&tlong));
++ asm volatile ("pmove %%tt0,%0"
++ : "=m" (tlong));
+ printk("tt0 is %#lx, ", tlong);
+- asm volatile ("pmove %%tt1,%0@"
+- : /* no outputs */
+- : "a" (&tlong));
++ asm volatile ("pmove %%tt1,%0"
++ : "=m" (tlong));
+ printk("tt1 is %#lx\n", tlong);
+ #endif
+ #ifdef DEBUG
+@@ -668,13 +666,13 @@ static inline void bus_error030 (struct frame *fp)
+
+ #ifdef DEBUG
+ asm volatile ("ptestr #1,%2@,#7,%0\n\t"
+- "pmove %%psr,%1@"
+- : "=a&" (desc)
+- : "a" (&temp), "a" (addr));
++ "pmove %%psr,%1"
++ : "=a&" (desc), "=m" (temp)
++ : "a" (addr));
+ #else
+ asm volatile ("ptestr #1,%1@,#7\n\t"
+- "pmove %%psr,%0@"
+- : : "a" (&temp), "a" (addr));
++ "pmove %%psr,%0"
++ : "=m" (temp) : "a" (addr));
+ #endif
+ mmusr = temp;
+
+diff --git a/arch/m68k/mm/cache.c b/arch/m68k/mm/cache.c
+index 5437fff..5550aa4 100644
+--- a/arch/m68k/mm/cache.c
++++ b/arch/m68k/mm/cache.c
+@@ -52,9 +52,9 @@ static unsigned long virt_to_phys_slow(unsigned long vaddr)
+ unsigned long *descaddr;
+
+ asm volatile ("ptestr %3,%2@,#7,%0\n\t"
+- "pmove %%psr,%1@"
+- : "=a&" (descaddr)
+- : "a" (&mmusr), "a" (vaddr), "d" (get_fs().seg));
++ "pmove %%psr,%1"
++ : "=a&" (descaddr), "=m" (mmusr)
++ : "a" (vaddr), "d" (get_fs().seg));
+ if (mmusr & (MMU_I|MMU_B|MMU_L))
+ return 0;
+ descaddr = phys_to_virt((unsigned long)descaddr);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch
new file mode 100644
index 0000000..b3b84b6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch
@@ -0,0 +1,43 @@
+From 715f766173e7ebc2b5d2c84397cd0ed2ecd8073a Mon Sep 17 00:00:00 2001
+From: Gustavo Maciel Dias Vieira <gustavo at sagui.org>
+Date: Tue, 24 Jan 2012 13:27:56 -0200
+Subject: [PATCH 27/90] ALSA: hda: set mute led polarity for laptops with
+ buggy BIOS based on SSID
+
+commit a6a600d10aaddf1da38053c4c6b64f50f56176e6 upstream.
+
+HP laptop models with buggy BIOS are apparently frequent, including
+machines with different codecs. Set the polarity of the mute led based
+on the SSID and include an entry for the HP Mini 110-3100.
+
+Signed-off-by: Gustavo Maciel Dias Vieira <gustavo at sagui.org>
+Tested-by: Predrag Ivanovic <predivan at open.telekom.rs>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ sound/pci/hda/patch_sigmatel.c | 9 ++++++++-
+ 1 files changed, 8 insertions(+), 1 deletions(-)
+
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 2141cab..ccdac27 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4952,7 +4952,14 @@ static int find_mute_led_gpio(struct hda_codec *codec, int default_polarity)
+ /* BIOS bug: unfilled OEM string */
+ if (strstr(dev->name, "HP_Mute_LED_P_G")) {
+ set_hp_led_gpio(codec);
+- spec->gpio_led_polarity = 1;
++ switch (codec->subsystem_id) {
++ case 0x103c148a:
++ spec->gpio_led_polarity = 0;
++ break;
++ default:
++ spec->gpio_led_polarity = 1;
++ break;
++ }
+ return 1;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch
new file mode 100644
index 0000000..4a60383
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch
@@ -0,0 +1,55 @@
+From 14b87cff679154f199dfeaa367f781e438197215 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai at suse.de>
+Date: Wed, 25 Jan 2012 09:55:46 +0100
+Subject: [PATCH 28/90] ALSA: hda - Fix silent output on ASUS A6Rp
+
+commit 3b25eb690e8c7424eecffe1458c02b87b32aa001 upstream.
+
+The refactoring of Realtek codec driver in 3.2 kernel caused a
+regression for ASUS A6Rp laptop; it doesn't give any output.
+The reason was that this machine has a secret master mute (or EAPD)
+control via NID 0x0f VREF. Setting VREF50 on this node makes the
+sound working again.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42588
+
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 10 ++++++++++
+ 1 files changed, 10 insertions(+), 0 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1d07e8f..9a63a19 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5223,6 +5223,7 @@ static const struct hda_amp_list alc861_loopbacks[] = {
+ /* Pin config fixes */
+ enum {
+ PINFIX_FSC_AMILO_PI1505,
++ PINFIX_ASUS_A6RP,
+ };
+
+ static const struct alc_fixup alc861_fixups[] = {
+@@ -5234,9 +5235,18 @@ static const struct alc_fixup alc861_fixups[] = {
+ { }
+ }
+ },
++ [PINFIX_ASUS_A6RP] = {
++ .type = ALC_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* node 0x0f VREF seems controlling the master output */
++ { 0x0f, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF50 },
++ { }
++ },
++ },
+ };
+
+ static const struct snd_pci_quirk alc861_fixup_tbl[] = {
++ SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", PINFIX_ASUS_A6RP),
+ SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", PINFIX_FSC_AMILO_PI1505),
+ {}
+ };
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch
new file mode 100644
index 0000000..0e8e433
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch
@@ -0,0 +1,34 @@
+From 7af203863bc49229e342435baa745102849d9c79 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai at suse.de>
+Date: Thu, 26 Jan 2012 15:56:16 +0100
+Subject: [PATCH 29/90] ALSA: hda - Fix silent output on Haier W18 laptop
+
+commit b3a81520bd37a28f77cb0f7002086fb14061824d upstream.
+
+The very same problem is seen on Haier W18 laptop with ALC861 as seen
+on ASUS A6Rp, which was fixed by the commit 3b25eb69.
+Now we just need to add a new SSID entry pointing to the same fixup.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42656
+
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9a63a19..5f03c40 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5247,6 +5247,7 @@ static const struct alc_fixup alc861_fixups[] = {
+
+ static const struct snd_pci_quirk alc861_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", PINFIX_ASUS_A6RP),
++ SND_PCI_QUIRK(0x1584, 0x2b01, "Haier W18", PINFIX_ASUS_A6RP),
+ SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", PINFIX_FSC_AMILO_PI1505),
+ {}
+ };
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch
new file mode 100644
index 0000000..95e1869
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch
@@ -0,0 +1,126 @@
+From 8192adb1ac4be659f5fc3010fa53c7cb3f59a409 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter at ffwll.ch>
+Date: Fri, 14 Dec 2012 16:01:25 +0100
+Subject: [PATCH 30/90] drm/i915: paper over missed irq issues with force wake
+ voodoo
+
+commit 4cd53c0c8b01fc05c3ad5b2acdad02e37d3c2f55 upstream.
+
+Two things seem to do the trick on my ivb machine here:
+- prevent the gt from powering down while waiting for seqno
+ notification interrupts by grabbing the force_wake in get_irq (and
+ dropping it in put_irq again).
+- ordering writes from the ring's CS by reading a CS register, ACTHD
+ seems to work.
+
+Only the blt&bsd ring on ivb seem to be massively affected by this,
+but for paranoia do this dance also on the render ring and on snb
+(i.e. all gpus with forcewake).
+
+Tested with Eric's glCopyPixels loop which without this patch scores a
+missed irq every few seconds.
+
+This patch needs my forcewake rework to use a spinlock instead of
+dev->struct_mutex.
+
+After crawling through docs a lot I've found the following nugget:
+
+Internal doc "SNB GT PM Programming Guide", Section 4.3.1:
+
+"GT does not generate interrupts while in RC6 (by design)"
+
+So it looks like rc6 and irq generation are indeed related.
+
+v2: Improve the comment per Eugeni Dodonov's suggestion.
+
+v3: Add the documentation snipped. Also restrict the w/a to ivb only
+for -fixes, as suggested by Keith Packard.
+
+Cc: Eric Anholt <eric at anholt.net>
+Cc: Kenneth Graunke <kenneth at whitecape.org>
+Cc: Eugeni Dodonov <eugeni.dodonov at intel.com>
+Tested-by: Eugeni Dodonov <eugeni.dodonov at intel.com>
+Reviewed-by: Eugeni Dodonov <eugeni.dodonov at intel.com>
+Signed-Off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
+Signed-off-by: Keith Packard <keithp at keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 27 +++++++++++++++++++++++++--
+ 1 files changed, 25 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index ca70e2f..30a9af9 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -631,6 +631,19 @@ render_ring_add_request(struct intel_ring_buffer *ring,
+ }
+
+ static u32
++gen6_ring_get_seqno(struct intel_ring_buffer *ring)
++{
++ struct drm_device *dev = ring->dev;
++
++ /* Workaround to force correct ordering between irq and seqno writes on
++ * ivb (and maybe also on snb) by reading from a CS register (like
++ * ACTHD) before reading the status page. */
++ if (IS_GEN7(dev))
++ intel_ring_get_active_head(ring);
++ return intel_read_status_page(ring, I915_GEM_HWS_INDEX);
++}
++
++static u32
+ ring_get_seqno(struct intel_ring_buffer *ring)
+ {
+ return intel_read_status_page(ring, I915_GEM_HWS_INDEX);
+@@ -795,6 +808,12 @@ gen6_ring_get_irq(struct intel_ring_buffer *ring, u32 gflag, u32 rflag)
+ if (!dev->irq_enabled)
+ return false;
+
++ /* It looks like we need to prevent the gt from suspending while waiting
++ * for an notifiy irq, otherwise irqs seem to get lost on at least the
++ * blt/bsd rings on ivb. */
++ if (IS_GEN7(dev))
++ gen6_gt_force_wake_get(dev_priv);
++
+ spin_lock(&ring->irq_lock);
+ if (ring->irq_refcount++ == 0) {
+ ring->irq_mask &= ~rflag;
+@@ -819,6 +838,9 @@ gen6_ring_put_irq(struct intel_ring_buffer *ring, u32 gflag, u32 rflag)
+ ironlake_disable_irq(dev_priv, gflag);
+ }
+ spin_unlock(&ring->irq_lock);
++
++ if (IS_GEN7(dev))
++ gen6_gt_force_wake_put(dev_priv);
+ }
+
+ static bool
+@@ -1316,7 +1338,7 @@ static const struct intel_ring_buffer gen6_bsd_ring = {
+ .write_tail = gen6_bsd_ring_write_tail,
+ .flush = gen6_ring_flush,
+ .add_request = gen6_add_request,
+- .get_seqno = ring_get_seqno,
++ .get_seqno = gen6_ring_get_seqno,
+ .irq_get = gen6_bsd_ring_get_irq,
+ .irq_put = gen6_bsd_ring_put_irq,
+ .dispatch_execbuffer = gen6_ring_dispatch_execbuffer,
+@@ -1451,7 +1473,7 @@ static const struct intel_ring_buffer gen6_blt_ring = {
+ .write_tail = ring_write_tail,
+ .flush = blt_ring_flush,
+ .add_request = gen6_add_request,
+- .get_seqno = ring_get_seqno,
++ .get_seqno = gen6_ring_get_seqno,
+ .irq_get = blt_ring_get_irq,
+ .irq_put = blt_ring_put_irq,
+ .dispatch_execbuffer = gen6_ring_dispatch_execbuffer,
+@@ -1474,6 +1496,7 @@ int intel_init_render_ring_buffer(struct drm_device *dev)
+ ring->flush = gen6_render_ring_flush;
+ ring->irq_get = gen6_render_ring_get_irq;
+ ring->irq_put = gen6_render_ring_put_irq;
++ ring->get_seqno = gen6_ring_get_seqno;
+ } else if (IS_GEN5(dev)) {
+ ring->add_request = pc_render_add_request;
+ ring->get_seqno = pc_render_get_seqno;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch
new file mode 100644
index 0000000..16b018a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch
@@ -0,0 +1,52 @@
+From eeb7321204f3c1e07a8f4fe750415c0c2c991068 Mon Sep 17 00:00:00 2001
+From: Paulo Zanoni <paulo.r.zanoni at intel.com>
+Date: Fri, 6 Jan 2012 19:45:34 -0200
+Subject: [PATCH 31/90] drm/i915/sdvo: always set positive sync polarity
+
+commit ba68e086223a5f149f37bf8692c8cdbf1b0ba3ef upstream.
+
+This is a revert of 81a14b46846fea0741902e8d8dfcc6c6c78154c8.
+
+We already set the mode polarity using the SDVO commands with struct
+intel_sdvo_dtd. We have at least 3 bugs that get fixed with this patch.
+The documentation, despite not clear, can also be interpreted in a way
+that suggests this patch is needed.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=15766
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=42174
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=43333
+Reviewed-by: Eric Anholt <eric at anholt.net>
+Reviewed-by: Jesse Barnes <jbarnes at virtuousgeek.org>
+Signed-off-by: Paulo Zanoni <paulo.r.zanoni at intel.com>
+Signed-off-by: Keith Packard <keithp at keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/intel_sdvo.c | 8 +++-----
+ 1 files changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index f7b9268..e334ec3 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -1066,15 +1066,13 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
+
+ /* Set the SDVO control regs. */
+ if (INTEL_INFO(dev)->gen >= 4) {
+- sdvox = 0;
++ /* The real mode polarity is set by the SDVO commands, using
++ * struct intel_sdvo_dtd. */
++ sdvox = SDVO_VSYNC_ACTIVE_HIGH | SDVO_HSYNC_ACTIVE_HIGH;
+ if (intel_sdvo->is_hdmi)
+ sdvox |= intel_sdvo->color_range;
+ if (INTEL_INFO(dev)->gen < 5)
+ sdvox |= SDVO_BORDER_ENABLE;
+- if (adjusted_mode->flags & DRM_MODE_FLAG_PVSYNC)
+- sdvox |= SDVO_VSYNC_ACTIVE_HIGH;
+- if (adjusted_mode->flags & DRM_MODE_FLAG_PHSYNC)
+- sdvox |= SDVO_HSYNC_ACTIVE_HIGH;
+ } else {
+ sdvox = I915_READ(intel_sdvo->sdvo_reg);
+ switch (intel_sdvo->sdvo_reg) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch
new file mode 100644
index 0000000..8d02605
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch
@@ -0,0 +1,43 @@
+From a9dbe8df9f33f70904247f2e263a9647eb8e448a Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric at anholt.net>
+Date: Mon, 23 Jan 2012 16:14:06 -0800
+Subject: [PATCH 32/90] drm/i915: Re-enable gen7 RC6 and GPU turbo after
+ resume.
+
+commit 04115a9dee110b52a8eaa556c574022fa3bf4704 upstream.
+
+Signed-off-by: Eric Anholt <eric at anholt.net>
+Reviewed-by: Keith Packard <keithp at keithp.com>
+Reviewed-by: Eugeni Dodonov <eugeni.dodonov at intel.com>
+Reviewed-by: Kenneth Graunke <kenneth at whitecape.org>
+Signed-off-by: Keith Packard <keithp at keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_suspend.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
+index 7886e4f..43cbafe 100644
+--- a/drivers/gpu/drm/i915/i915_suspend.c
++++ b/drivers/gpu/drm/i915/i915_suspend.c
+@@ -822,7 +822,7 @@ int i915_save_state(struct drm_device *dev)
+
+ if (IS_IRONLAKE_M(dev))
+ ironlake_disable_drps(dev);
+- if (IS_GEN6(dev))
++ if (INTEL_INFO(dev)->gen >= 6)
+ gen6_disable_rps(dev);
+
+ /* Cache mode state */
+@@ -881,7 +881,7 @@ int i915_restore_state(struct drm_device *dev)
+ intel_init_emon(dev);
+ }
+
+- if (IS_GEN6(dev)) {
++ if (INTEL_INFO(dev)->gen >= 6) {
+ gen6_enable_rps(dev_priv);
+ gen6_update_ring_freq(dev_priv);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch
new file mode 100644
index 0000000..4667ad7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch
@@ -0,0 +1,46 @@
+From bc5829b31b25a3a6928089594fdab76017d0d622 Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre at atmel.com>
+Date: Wed, 28 Dec 2011 13:10:04 +0200
+Subject: [PATCH 33/90] ARM: at91: fix at91rm9200 soc subtype handling
+
+commit 3e90772f76010c315474bde59eaca7cc4c94d645 upstream.
+
+Currently setting it to PQFP changes subtype to BGA as subtypes are
+swapped in at91rm9200_set_type().
+
+Wrong subtype causes GPIO bank D not to work at all.
+
+After this fix, subtype is still set as unknown. But board code should
+fill it in with proper value. Another information is thus printed.
+
+Bug discovery and first implementation made by Veli-Pekka Peltola.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre at atmel.com>
+Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj at jcrosoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ arch/arm/mach-at91/setup.c | 7 +++++--
+ 1 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c
+index cf98a8f..39d8ea0 100644
+--- a/arch/arm/mach-at91/setup.c
++++ b/arch/arm/mach-at91/setup.c
+@@ -27,9 +27,12 @@ EXPORT_SYMBOL(at91_soc_initdata);
+ void __init at91rm9200_set_type(int type)
+ {
+ if (type == ARCH_REVISON_9200_PQFP)
+- at91_soc_initdata.subtype = AT91_SOC_RM9200_BGA;
+- else
+ at91_soc_initdata.subtype = AT91_SOC_RM9200_PQFP;
++ else
++ at91_soc_initdata.subtype = AT91_SOC_RM9200_BGA;
++
++ pr_info("AT91: filled in soc subtype: %s\n",
++ at91_get_soc_subtype(&at91_soc_initdata));
+ }
+
+ void __init at91_init_irq_default(void)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch
new file mode 100644
index 0000000..ea53d57
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch
@@ -0,0 +1,31 @@
+From 7e7ae7c2a3f4433e2401717a641cab1a86249f94 Mon Sep 17 00:00:00 2001
+From: Srinidhi KASAGAR <srinidhi.kasagar at stericsson.com>
+Date: Thu, 12 Jan 2012 11:07:43 +0530
+Subject: [PATCH 34/90] mach-ux500: enable ARM errata 764369
+
+commit d65015f7c5c5be9fd3f5e567889c844ba81bdc9c upstream.
+
+This applies ARM errata 764369 for all ux500 platforms.
+
+Signed-off-by: Srinidhi Kasagar <srinidhi.kasagar at stericsson.com>
+Signed-off-by: Linus Walleij <linus.walleij at linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ arch/arm/mach-ux500/Kconfig | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/arch/arm/mach-ux500/Kconfig b/arch/arm/mach-ux500/Kconfig
+index a3e0c86..52af004 100644
+--- a/arch/arm/mach-ux500/Kconfig
++++ b/arch/arm/mach-ux500/Kconfig
+@@ -7,6 +7,7 @@ config UX500_SOC_COMMON
+ select HAS_MTU
+ select ARM_ERRATA_753970
+ select ARM_ERRATA_754322
++ select ARM_ERRATA_764369
+
+ menu "Ux500 SoC"
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch
new file mode 100644
index 0000000..371ead8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch
@@ -0,0 +1,53 @@
+From edee236502d6e853eddd1ba0698aa1333126527f Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon at arm.com>
+Date: Fri, 20 Jan 2012 12:10:18 +0100
+Subject: [PATCH 35/90] ARM: 7296/1: proc-v7.S: remove HARVARD_CACHE
+ preprocessor guards
+
+commit 612539e81f655f6ac73c7af1da8701c1ee618aee upstream.
+
+On v7, we use the same cache maintenance instructions for data lines
+as for unified lines. This was not the case for v6, where HARVARD_CACHE
+was defined to indicate the L1 cache topology.
+
+This patch removes the erroneous compile-time check for HARVARD_CACHE in
+proc-v7.S, ensuring that we perform I-side invalidation at boot.
+
+Reported-and-Acked-by: Shawn Guo <shawn.guo at linaro.org>
+
+Acked-by: Catalin Marinas <Catalin.Marinas at arm.com>
+Signed-off-by: Will Deacon <will.deacon at arm.com>
+Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ arch/arm/mm/proc-v7.S | 6 ------
+ 1 files changed, 0 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
+index e70a737..40cc7aa 100644
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -271,10 +271,6 @@ ENDPROC(cpu_v7_do_resume)
+ * Initialise TLB, Caches, and MMU state ready to switch the MMU
+ * on. Return in r0 the new CP15 C1 control register setting.
+ *
+- * We automatically detect if we have a Harvard cache, and use the
+- * Harvard cache control instructions insead of the unified cache
+- * control instructions.
+- *
+ * This should be able to cover all ARMv7 cores.
+ *
+ * It is assumed that:
+@@ -373,9 +369,7 @@ __v7_setup:
+ #endif
+
+ 3: mov r10, #0
+-#ifdef HARVARD_CACHE
+ mcr p15, 0, r10, c7, c5, 0 @ I+BTB cache invalidate
+-#endif
+ dsb
+ #ifdef CONFIG_MMU
+ mcr p15, 0, r10, c8, c7, 0 @ invalidate I + D TLBs
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch
new file mode 100644
index 0000000..492cb43
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch
@@ -0,0 +1,68 @@
+From 03813e1cec3fa5d6011c9e9faefa80ad1f1b7f04 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm at xmission.com>
+Date: Fri, 13 Jan 2012 21:32:59 -0800
+Subject: [PATCH 36/90] sysfs: Complain bitterly about attempts to remove
+ files from nonexistent directories.
+
+commit ce597919361dcec97341151690e780eade2a9cf4 upstream.
+
+Recently an OOPS was observed from the usb serial io_ti driver when it tried to remove
+sysfs directories. Upon investigation it turns out this driver was always buggy
+and that a recent sysfs change had stopped guarding itself against removing attributes
+from sysfs directories that had already been removed. :(
+
+Historically we have been silent about attempting to files from nonexistent sysfs
+directories and have politely returned error codes. That has resulted in people writing
+broken code that ignores the error codes.
+
+Issue a kernel WARNING and a stack backtrace to make it clear in no uncertain
+terms that abusing sysfs is not ok, and the callers need to fix their code.
+
+This change transforms the io_ti OOPS into a more comprehensible error message
+and stack backtrace.
+
+Signed-off-by: Eric W. Biederman <ebiederm at xmission.com>
+Reported-by: Wolfgang Frisch <wfpub at roembden.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ fs/sysfs/file.c | 6 ++++++
+ fs/sysfs/inode.c | 5 ++++-
+ 2 files changed, 10 insertions(+), 1 deletions(-)
+
+diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
+index d4e6080b..779789a 100644
+--- a/fs/sysfs/file.c
++++ b/fs/sysfs/file.c
+@@ -493,6 +493,12 @@ int sysfs_attr_ns(struct kobject *kobj, const struct attribute *attr,
+ const void *ns = NULL;
+ int err;
+
++ if (!dir_sd) {
++ WARN(1, KERN_ERR "sysfs: kobject %s without dirent\n",
++ kobject_name(kobj));
++ return -ENOENT;
++ }
++
+ err = 0;
+ if (!sysfs_ns_type(dir_sd))
+ goto out;
+diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
+index c81b22f..deb804b 100644
+--- a/fs/sysfs/inode.c
++++ b/fs/sysfs/inode.c
+@@ -318,8 +318,11 @@ int sysfs_hash_and_remove(struct sysfs_dirent *dir_sd, const void *ns, const cha
+ struct sysfs_addrm_cxt acxt;
+ struct sysfs_dirent *sd;
+
+- if (!dir_sd)
++ if (!dir_sd) {
++ WARN(1, KERN_WARNING "sysfs: can not remove '%s', no directory\n",
++ name);
+ return -ENOENT;
++ }
+
+ sysfs_addrm_start(&acxt, dir_sd);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch
new file mode 100644
index 0000000..febc945
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch
@@ -0,0 +1,103 @@
+From 0ffbd056d7edbfdeb707161d3953ff65f884c92b Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel at citrix.com>
+Date: Mon, 23 Jan 2012 19:32:25 +0000
+Subject: [PATCH 37/90] x86: xen: size struct xen_spinlock to always fit in
+ arch_spinlock_t
+
+commit 7a7546b377bdaa25ac77f33d9433c59f259b9688 upstream.
+
+If NR_CPUS < 256 then arch_spinlock_t is only 16 bits wide but struct
+xen_spinlock is 32 bits. When a spin lock is contended and
+xl->spinners is modified the two bytes immediately after the spin lock
+would be corrupted.
+
+This is a regression caused by 84eb950db13ca40a0572ce9957e14723500943d6
+(x86, ticketlock: Clean up types and accessors) which reduced the size
+of arch_spinlock_t.
+
+Fix this by making xl->spinners a u8 if NR_CPUS < 256. A
+BUILD_BUG_ON() is also added to check the sizes of the two structures
+are compatible.
+
+In many cases this was not noticable as there would often be padding
+bytes after the lock (e.g., if any of CONFIG_GENERIC_LOCKBREAK,
+CONFIG_DEBUG_SPINLOCK, or CONFIG_DEBUG_LOCK_ALLOC were enabled).
+
+The bnx2 driver is affected. In struct bnx2, phy_lock and
+indirect_lock may have no padding after them. Contention on phy_lock
+would corrupt indirect_lock making it appear locked and the driver
+would deadlock.
+
+Signed-off-by: David Vrabel <david.vrabel at citrix.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy at goop.org>
+Acked-by: Ian Campbell <ian.campbell at citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk at oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ arch/x86/xen/spinlock.c | 27 ++++++++++++++++++++++-----
+ 1 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index cc9b1e1..d69cc6c 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -116,9 +116,26 @@ static inline void spin_time_accum_blocked(u64 start)
+ }
+ #endif /* CONFIG_XEN_DEBUG_FS */
+
++/*
++ * Size struct xen_spinlock so it's the same as arch_spinlock_t.
++ */
++#if NR_CPUS < 256
++typedef u8 xen_spinners_t;
++# define inc_spinners(xl) \
++ asm(LOCK_PREFIX " incb %0" : "+m" ((xl)->spinners) : : "memory");
++# define dec_spinners(xl) \
++ asm(LOCK_PREFIX " decb %0" : "+m" ((xl)->spinners) : : "memory");
++#else
++typedef u16 xen_spinners_t;
++# define inc_spinners(xl) \
++ asm(LOCK_PREFIX " incw %0" : "+m" ((xl)->spinners) : : "memory");
++# define dec_spinners(xl) \
++ asm(LOCK_PREFIX " decw %0" : "+m" ((xl)->spinners) : : "memory");
++#endif
++
+ struct xen_spinlock {
+ unsigned char lock; /* 0 -> free; 1 -> locked */
+- unsigned short spinners; /* count of waiting cpus */
++ xen_spinners_t spinners; /* count of waiting cpus */
+ };
+
+ static int xen_spin_is_locked(struct arch_spinlock *lock)
+@@ -164,8 +181,7 @@ static inline struct xen_spinlock *spinning_lock(struct xen_spinlock *xl)
+
+ wmb(); /* set lock of interest before count */
+
+- asm(LOCK_PREFIX " incw %0"
+- : "+m" (xl->spinners) : : "memory");
++ inc_spinners(xl);
+
+ return prev;
+ }
+@@ -176,8 +192,7 @@ static inline struct xen_spinlock *spinning_lock(struct xen_spinlock *xl)
+ */
+ static inline void unspinning_lock(struct xen_spinlock *xl, struct xen_spinlock *prev)
+ {
+- asm(LOCK_PREFIX " decw %0"
+- : "+m" (xl->spinners) : : "memory");
++ dec_spinners(xl);
+ wmb(); /* decrement count before restoring lock */
+ __this_cpu_write(lock_spinners, prev);
+ }
+@@ -373,6 +388,8 @@ void xen_uninit_lock_cpu(int cpu)
+
+ void __init xen_init_spinlocks(void)
+ {
++ BUILD_BUG_ON(sizeof(struct xen_spinlock) > sizeof(arch_spinlock_t));
++
+ pv_lock_ops.spin_is_locked = xen_spin_is_locked;
+ pv_lock_ops.spin_is_contended = xen_spin_is_contended;
+ pv_lock_ops.spin_lock = xen_spin_lock;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch
new file mode 100644
index 0000000..b85e209
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch
@@ -0,0 +1,96 @@
+From 00f1a14e217d9fcb2b568d56192a28d3e89e192b Mon Sep 17 00:00:00 2001
+From: "nagalakshmi.nandigama at lsi.com" <nagalakshmi.nandigama at lsi.com>
+Date: Tue, 13 Dec 2011 09:29:15 +0530
+Subject: [PATCH 38/90] mpt2sas: Removed redundant calling of
+ _scsih_probe_devices() from _scsih_probe
+
+commit 2cb6fc8c014b9b00c4487a79b8f6ed0da4121f45 upstream.
+
+Removed redundant calling of _scsih_probe_devices() from _scsih_probe as
+it is getting called from _scsih_scan_finished.
+
+Also moved the function scsi_scan_host(shost) to get called after the
+volumes on warp drive are reported to the OS. Otherwise by the time
+the (ioc->hide_drives) flags is set, the volumes on warp drive
+are reported to the OS already.
+
+Also modified the initialization of reply queues only in case of driver load
+time in the function _base_make_ioc_operational().
+
+Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama at lsi.com>
+Signed-off-by: James Bottomley <JBottomley at Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c | 20 +++++++-------------
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 3 +--
+ 2 files changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
+index 0794c72..b1ddfef 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -4033,7 +4033,8 @@ _base_make_ioc_operational(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ ioc->reply_free[i] = cpu_to_le32(reply_address);
+
+ /* initialize reply queues */
+- _base_assign_reply_queues(ioc);
++ if (ioc->is_driver_loading)
++ _base_assign_reply_queues(ioc);
+
+ /* initialize Reply Post Free Queue */
+ reply_post_free = (long)ioc->reply_post_free;
+@@ -4081,24 +4082,17 @@ _base_make_ioc_operational(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+
+
+ if (ioc->is_driver_loading) {
+-
+-
+-
+- ioc->wait_for_discovery_to_complete =
+- _base_determine_wait_on_discovery(ioc);
+- return r; /* scan_start and scan_finished support */
+- }
+-
+-
+- if (ioc->wait_for_discovery_to_complete && ioc->is_warpdrive) {
+- if (ioc->manu_pg10.OEMIdentifier == 0x80) {
++ if (ioc->is_warpdrive && ioc->manu_pg10.OEMIdentifier
++ == 0x80) {
+ hide_flag = (u8) (ioc->manu_pg10.OEMSpecificFlags0 &
+ MFG_PAGE10_HIDE_SSDS_MASK);
+ if (hide_flag != MFG_PAGE10_HIDE_SSDS_MASK)
+ ioc->mfg_pg10_hide_flag = hide_flag;
+ }
++ ioc->wait_for_discovery_to_complete =
++ _base_determine_wait_on_discovery(ioc);
++ return r; /* scan_start and scan_finished support */
+ }
+-
+ r = _base_send_port_enable(ioc, sleep_flag);
+ if (r)
+ return r;
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+index 9bc6fb2..2824a90 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -8001,7 +8001,6 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ goto out_attach_fail;
+ }
+
+- scsi_scan_host(shost);
+ if (ioc->is_warpdrive) {
+ if (ioc->mfg_pg10_hide_flag == MFG_PAGE10_EXPOSE_ALL_DISKS)
+ ioc->hide_drives = 0;
+@@ -8015,8 +8014,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ }
+ } else
+ ioc->hide_drives = 0;
++ scsi_scan_host(shost);
+
+- _scsih_probe_devices(ioc);
+ return 0;
+
+ out_attach_fail:
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch
new file mode 100644
index 0000000..bd25975
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch
@@ -0,0 +1,41 @@
+From 1b9d5491e5c2439b3e861d1612eeae258c926b34 Mon Sep 17 00:00:00 2001
+From: Kentaro Matsuyama <kentaro.matsuyama at gmail.com>
+Date: Thu, 12 Jan 2012 23:07:51 +0900
+Subject: [PATCH 39/90] USB: option: Add LG docomo L-02C
+
+commit e423d7401fd0717cb56a6cf51dd8341cc3e800d2 upstream.
+
+Add vendor and product ID for USB 3G/LTE modem of docomo L-02C
+
+Signed-off-by: Kentaro Matsuyama <kentaro.matsuyama at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index c96b6b6..2a9ed6e 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -480,6 +480,10 @@ static void option_instat_callback(struct urb *urb);
+ #define ZD_VENDOR_ID 0x0685
+ #define ZD_PRODUCT_7000 0x7000
+
++/* LG products */
++#define LG_VENDOR_ID 0x1004
++#define LG_PRODUCT_L02C 0x618f
++
+ /* some devices interfaces need special handling due to a number of reasons */
+ enum option_blacklist_reason {
+ OPTION_BLACKLIST_NONE = 0,
+@@ -1183,6 +1187,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
+ { USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) },
++ { USB_DEVICE(LG_VENDOR_ID, LG_PRODUCT_L02C) }, /* docomo L-02C modem */
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch
new file mode 100644
index 0000000..a80c231
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch
@@ -0,0 +1,41 @@
+From f4915de191cac38c002969b2a7b8ca4cda1f8ebb Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold at gmail.com>
+Date: Tue, 10 Jan 2012 23:33:37 +0100
+Subject: [PATCH 40/90] USB: ftdi_sio: fix TIOCSSERIAL baud_base handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit eb833a9e0972f60beb4ab8104ad7ef6bf30f02fc upstream.
+
+Return EINVAL if new baud_base does not match the current one.
+
+The baud_base is device specific and can not be changed. This restores
+the old (pre-2005) behaviour which was changed due to a
+misunderstanding regarding this fact (see
+https://lkml.org/lkml/2005/1/20/84).
+
+Reported-by: Torbjörn Lofterud <torbjorn at pi.nxs.se>
+Signed-off-by: Johan Hovold <jhovold at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index ff3db5d..6a034b3 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1333,8 +1333,7 @@ static int set_serial_info(struct tty_struct *tty,
+ goto check_and_exit;
+ }
+
+- if ((new_serial.baud_base != priv->baud_base) &&
+- (new_serial.baud_base < 9600)) {
++ if (new_serial.baud_base != priv->baud_base) {
+ mutex_unlock(&priv->cfg_lock);
+ return -EINVAL;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch
new file mode 100644
index 0000000..f1c1e75
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch
@@ -0,0 +1,49 @@
+From 6ca78fe06bc778d2a4d82af2fd438bf0ddfc2a2c Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold at gmail.com>
+Date: Wed, 18 Jan 2012 01:46:00 +0100
+Subject: [PATCH 41/90] USB: ftdi_sio: fix initial baud rate
+
+commit 108e02b12921078a59dcacd048079ece48a4a983 upstream.
+
+Fix regression introduced by commit b1ffb4c851f1 ("USB: Fix Corruption
+issue in USB ftdi driver ftdi_sio.c") which caused the termios settings
+to no longer be initialised at open. Consequently it was no longer
+possible to set the port to the default speed of 9600 baud without first
+changing to another baud rate and back again.
+
+Reported-by: Roland Ramthun <mail at roland-ramthun.de>
+Signed-off-by: Johan Hovold <jhovold at gmail.com>
+Tested-by: Roland Ramthun <mail at roland-ramthun.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 7 +++++--
+ 1 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 6a034b3..6a40b41 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1823,6 +1823,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
+
+ static int ftdi_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
++ struct ktermios dummy;
+ struct usb_device *dev = port->serial->dev;
+ struct ftdi_private *priv = usb_get_serial_port_data(port);
+ int result;
+@@ -1841,8 +1842,10 @@ static int ftdi_open(struct tty_struct *tty, struct usb_serial_port *port)
+ This is same behaviour as serial.c/rs_open() - Kuba */
+
+ /* ftdi_set_termios will send usb control messages */
+- if (tty)
+- ftdi_set_termios(tty, port, tty->termios);
++ if (tty) {
++ memset(&dummy, 0, sizeof(dummy));
++ ftdi_set_termios(tty, port, &dummy);
++ }
+
+ /* Start reading from the device */
+ result = usb_serial_generic_open(tty, port);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch
new file mode 100644
index 0000000..1ace416
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch
@@ -0,0 +1,50 @@
+From 27fca12db10bf68fb87c3b669be952f88594376c Mon Sep 17 00:00:00 2001
+From: Peter Korsgaard <jacmet at sunsite.dk>
+Date: Wed, 18 Jan 2012 23:43:45 +0100
+Subject: [PATCH 42/90] USB: ftdi_sio: add PID for TI XDS100v2 / BeagleBone A3
+
+commit 55f13aeae0346f0c89bfface91ad9a97653dc433 upstream.
+
+Port A for JTAG, port B for serial.
+
+Signed-off-by: Peter Korsgaard <jacmet at sunsite.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 7 +++++++
+ 2 files changed, 9 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 6a40b41..952570f 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -805,6 +805,8 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+ { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, TI_XDS100V2_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
+ { USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) },
+ { USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 055b64e..b67bee2 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -39,6 +39,13 @@
+ /* www.candapter.com Ewert Energy Systems CANdapter device */
+ #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
+
++/*
++ * Texas Instruments XDS100v2 JTAG / BeagleBone A3
++ * http://processors.wiki.ti.com/index.php/XDS100
++ * http://beagleboard.org/bone
++ */
++#define TI_XDS100V2_PID 0xa6d0
++
+ #define FTDI_NXTCAM_PID 0xABB8 /* NXTCam for Mindstorms NXT */
+
+ /* US Interface Navigator (http://www.usinterface.com/) */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0043-USB-serial-ftdi-additional-IDs.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0043-USB-serial-ftdi-additional-IDs.patch
new file mode 100644
index 0000000..6986c72
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0043-USB-serial-ftdi-additional-IDs.patch
@@ -0,0 +1,49 @@
+From 49b8a8464f7e327e044623da5ba2aa6aaa43b77c Mon Sep 17 00:00:00 2001
+From: Peter Naulls <peter at chocky.org>
+Date: Tue, 17 Jan 2012 18:27:09 -0800
+Subject: [PATCH 43/90] USB: serial: ftdi additional IDs
+
+commit fc216ec363f4d174932df90bbf35c77d0540e561 upstream.
+
+I tested this against 2.6.39 in the Ubuntu kernel, however I see the IDs
+are not in latest 3.2 git.
+
+This adds IDs for the FTDI controller in the Rainforest Automation
+Zigbee dongle.
+
+Signed-off-by: Peter Naulls <peter at chocky.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
+ 2 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 952570f..abd5bd7 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -843,6 +843,7 @@ static struct usb_device_id id_table_combined [] = {
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(ST_VID, ST_STMCLT1030_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk },
++ { USB_DEVICE(FTDI_VID, FTDI_RF_R106) },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index b67bee2..79c5967 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1175,3 +1175,9 @@
+ */
+ /* TagTracer MIFARE*/
+ #define FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID 0xF7C0
++
++/*
++ * Rainforest Automation
++ */
++/* ZigBee controller */
++#define FTDI_RF_R106 0x8A28
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch
new file mode 100644
index 0000000..a856f0c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch
@@ -0,0 +1,48 @@
+From cea8765145bdf3a814070e52c7f348a5e69c76ce Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan at linux.intel.com>
+Date: Thu, 26 Jan 2012 17:41:34 +0000
+Subject: [PATCH 44/90] USB: ftdi_sio: Add more identifiers
+
+commit 2353f806c97020d4c7709f15eebb49b591f7306d upstream.
+
+0x04d8, 0x000a: Hornby Elite
+
+Signed-off-by: Alan Cox <alan at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
+ 2 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index abd5bd7..058b92c 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -797,6 +797,7 @@ static struct usb_device_id id_table_combined [] = {
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(HORNBY_VID, HORNBY_ELITE_PID) },
+ { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
+ { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 79c5967..76d4f31 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -532,6 +532,12 @@
+ #define ADI_GNICEPLUS_PID 0xF001
+
+ /*
++ * Hornby Elite
++ */
++#define HORNBY_VID 0x04D8
++#define HORNBY_ELITE_PID 0x000A
++
++/*
+ * RATOC REX-USB60F
+ */
+ #define RATOC_VENDOR_ID 0x0584
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch
new file mode 100644
index 0000000..a090a1c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch
@@ -0,0 +1,37 @@
+From 54e1d6f4d4781af0b70c3e36d5c6611b5c3d8272 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn at mork.no>
+Date: Mon, 16 Jan 2012 12:41:47 +0100
+Subject: [PATCH 45/90] USB: cdc-wdm: updating desc->length must be protected
+ by spin_lock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit c428b70c1e115c5649707a602742e34130d19428 upstream.
+
+wdm_in_callback() will also touch this field, so we cannot change it without locking
+
+Signed-off-by: Bjørn Mork <bjorn at mork.no>
+Acked-by: Oliver Neukum <oneukum at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/class/cdc-wdm.c | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index efe6849..7e5e822 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -467,7 +467,9 @@ retry:
+ for (i = 0; i < desc->length - cntr; i++)
+ desc->ubuf[i] = desc->ubuf[i + cntr];
+
++ spin_lock_irq(&desc->iuspin);
+ desc->length -= cntr;
++ spin_unlock_irq(&desc->iuspin);
+ /* in case we had outstanding data */
+ if (!desc->length)
+ clear_bit(WDM_READ, &desc->flags);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch
new file mode 100644
index 0000000..544450e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch
@@ -0,0 +1,178 @@
+From 9d6f338f1fe382275fbd4fee94c0d5a55ed601de Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn at mork.no>
+Date: Mon, 16 Jan 2012 12:41:48 +0100
+Subject: [PATCH 46/90] USB: cdc-wdm: use two mutexes to allow simultaneous
+ read and write
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit e8537bd2c4f325a4796da33564ddcef9489b7feb upstream.
+
+using a separate read and write mutex for locking is sufficient to make the
+driver accept simultaneous read and write. This improves useability a lot.
+
+Signed-off-by: Bjørn Mork <bjorn at mork.no>
+Cc: Oliver Neukum <oneukum at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/class/cdc-wdm.c | 49 +++++++++++++++++++++++++++---------------
+ 1 files changed, 31 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 7e5e822..4a29a80 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -88,7 +88,8 @@ struct wdm_device {
+ int count;
+ dma_addr_t shandle;
+ dma_addr_t ihandle;
+- struct mutex lock;
++ struct mutex wlock;
++ struct mutex rlock;
+ wait_queue_head_t wait;
+ struct work_struct rxwork;
+ int werr;
+@@ -323,7 +324,7 @@ static ssize_t wdm_write
+ }
+
+ /* concurrent writes and disconnect */
+- r = mutex_lock_interruptible(&desc->lock);
++ r = mutex_lock_interruptible(&desc->wlock);
+ rv = -ERESTARTSYS;
+ if (r) {
+ kfree(buf);
+@@ -386,7 +387,7 @@ static ssize_t wdm_write
+ out:
+ usb_autopm_put_interface(desc->intf);
+ outnp:
+- mutex_unlock(&desc->lock);
++ mutex_unlock(&desc->wlock);
+ outnl:
+ return rv < 0 ? rv : count;
+ }
+@@ -399,7 +400,7 @@ static ssize_t wdm_read
+ struct wdm_device *desc = file->private_data;
+
+
+- rv = mutex_lock_interruptible(&desc->lock); /*concurrent reads */
++ rv = mutex_lock_interruptible(&desc->rlock); /*concurrent reads */
+ if (rv < 0)
+ return -ERESTARTSYS;
+
+@@ -476,7 +477,7 @@ retry:
+ rv = cntr;
+
+ err:
+- mutex_unlock(&desc->lock);
++ mutex_unlock(&desc->rlock);
+ return rv;
+ }
+
+@@ -542,7 +543,8 @@ static int wdm_open(struct inode *inode, struct file *file)
+ }
+ intf->needs_remote_wakeup = 1;
+
+- mutex_lock(&desc->lock);
++ /* using write lock to protect desc->count */
++ mutex_lock(&desc->wlock);
+ if (!desc->count++) {
+ desc->werr = 0;
+ desc->rerr = 0;
+@@ -555,7 +557,7 @@ static int wdm_open(struct inode *inode, struct file *file)
+ } else {
+ rv = 0;
+ }
+- mutex_unlock(&desc->lock);
++ mutex_unlock(&desc->wlock);
+ usb_autopm_put_interface(desc->intf);
+ out:
+ mutex_unlock(&wdm_mutex);
+@@ -567,9 +569,11 @@ static int wdm_release(struct inode *inode, struct file *file)
+ struct wdm_device *desc = file->private_data;
+
+ mutex_lock(&wdm_mutex);
+- mutex_lock(&desc->lock);
++
++ /* using write lock to protect desc->count */
++ mutex_lock(&desc->wlock);
+ desc->count--;
+- mutex_unlock(&desc->lock);
++ mutex_unlock(&desc->wlock);
+
+ if (!desc->count) {
+ dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
+@@ -667,7 +671,8 @@ next_desc:
+ desc = kzalloc(sizeof(struct wdm_device), GFP_KERNEL);
+ if (!desc)
+ goto out;
+- mutex_init(&desc->lock);
++ mutex_init(&desc->rlock);
++ mutex_init(&desc->wlock);
+ spin_lock_init(&desc->iuspin);
+ init_waitqueue_head(&desc->wait);
+ desc->wMaxCommand = maxcom;
+@@ -781,10 +786,12 @@ static void wdm_disconnect(struct usb_interface *intf)
+ /* to terminate pending flushes */
+ clear_bit(WDM_IN_USE, &desc->flags);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+- mutex_lock(&desc->lock);
++ mutex_lock(&desc->rlock);
++ mutex_lock(&desc->wlock);
+ kill_urbs(desc);
+ cancel_work_sync(&desc->rxwork);
+- mutex_unlock(&desc->lock);
++ mutex_unlock(&desc->wlock);
++ mutex_unlock(&desc->rlock);
+ wake_up_all(&desc->wait);
+ if (!desc->count)
+ cleanup(desc);
+@@ -800,8 +807,10 @@ static int wdm_suspend(struct usb_interface *intf, pm_message_t message)
+ dev_dbg(&desc->intf->dev, "wdm%d_suspend\n", intf->minor);
+
+ /* if this is an autosuspend the caller does the locking */
+- if (!PMSG_IS_AUTO(message))
+- mutex_lock(&desc->lock);
++ if (!PMSG_IS_AUTO(message)) {
++ mutex_lock(&desc->rlock);
++ mutex_lock(&desc->wlock);
++ }
+ spin_lock_irq(&desc->iuspin);
+
+ if (PMSG_IS_AUTO(message) &&
+@@ -817,8 +826,10 @@ static int wdm_suspend(struct usb_interface *intf, pm_message_t message)
+ kill_urbs(desc);
+ cancel_work_sync(&desc->rxwork);
+ }
+- if (!PMSG_IS_AUTO(message))
+- mutex_unlock(&desc->lock);
++ if (!PMSG_IS_AUTO(message)) {
++ mutex_unlock(&desc->wlock);
++ mutex_unlock(&desc->rlock);
++ }
+
+ return rv;
+ }
+@@ -856,7 +867,8 @@ static int wdm_pre_reset(struct usb_interface *intf)
+ {
+ struct wdm_device *desc = usb_get_intfdata(intf);
+
+- mutex_lock(&desc->lock);
++ mutex_lock(&desc->rlock);
++ mutex_lock(&desc->wlock);
+ kill_urbs(desc);
+
+ /*
+@@ -878,7 +890,8 @@ static int wdm_post_reset(struct usb_interface *intf)
+ int rv;
+
+ rv = recover_from_urb_loss(desc);
+- mutex_unlock(&desc->lock);
++ mutex_unlock(&desc->wlock);
++ mutex_unlock(&desc->rlock);
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch
new file mode 100644
index 0000000..19b4c3e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch
@@ -0,0 +1,43 @@
+From 06053e0177cddb8ac7d4539e69012ef479089126 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw at redhat.com>
+Date: Tue, 24 Jan 2012 17:16:54 -0600
+Subject: [PATCH 47/90] qcaux: add more Pantech UML190 and UML290 ports
+
+commit 074cc73506f529f39fef32ad1c9e1d4cdd8acf6c upstream.
+
+More ports we now know how to talk to.
+
+Signed-off-by: Dan Williams <dcbw at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/qcaux.c | 7 ++++++-
+ 1 files changed, 6 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/serial/qcaux.c b/drivers/usb/serial/qcaux.c
+index 30b73e6..a348198 100644
+--- a/drivers/usb/serial/qcaux.c
++++ b/drivers/usb/serial/qcaux.c
+@@ -36,6 +36,7 @@
+ #define UTSTARCOM_PRODUCT_UM175_V1 0x3712
+ #define UTSTARCOM_PRODUCT_UM175_V2 0x3714
+ #define UTSTARCOM_PRODUCT_UM175_ALLTEL 0x3715
++#define PANTECH_PRODUCT_UML190_VZW 0x3716
+ #define PANTECH_PRODUCT_UML290_VZW 0x3718
+
+ /* CMOTECH devices */
+@@ -67,7 +68,11 @@ static struct usb_device_id id_table[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_U520, 0xff, 0x00, 0x00) },
+- { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML190_VZW, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML190_VZW, 0xff, 0xfe, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xfd, 0xff) }, /* NMEA */
++ { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xfe, 0xff) }, /* WMC */
++ { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) }, /* DIAG */
+ { },
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch
new file mode 100644
index 0000000..0d6a5e1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch
@@ -0,0 +1,54 @@
+From cfb67a1e191fa6c59b9d29b5d78fe4bb27a08c5c Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi at ti.com>
+Date: Thu, 29 Dec 2011 06:32:29 +0200
+Subject: [PATCH 48/90] usb: dwc3: ep0: tidy up Pending Request handling
+
+commit 68d8a781575d7be490f97eb2c403fb13b083da6a upstream.
+
+The way our code was written, we should never have
+a DWC3_EP_PENDING_REQUEST flag set out of a Data Phase
+and the code in __dwc3_gadget_ep0_queue() did not
+reflect that situation properly.
+
+Tidy up that case to avoid any possible mistakes
+when starting requests for IRQs which are long
+gone.
+
+Signed-off-by: Felipe Balbi <balbi at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/dwc3/ep0.c | 14 ++++----------
+ 1 files changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index 69a4e43..27bd50a 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -149,20 +149,14 @@ static int __dwc3_gadget_ep0_queue(struct dwc3_ep *dep,
+
+ direction = !!(dep->flags & DWC3_EP0_DIR_IN);
+
+- if (dwc->ep0state == EP0_STATUS_PHASE) {
+- type = dwc->three_stage_setup
+- ? DWC3_TRBCTL_CONTROL_STATUS3
+- : DWC3_TRBCTL_CONTROL_STATUS2;
+- } else if (dwc->ep0state == EP0_DATA_PHASE) {
+- type = DWC3_TRBCTL_CONTROL_DATA;
+- } else {
+- /* should never happen */
+- WARN_ON(1);
++ if (dwc->ep0state != EP0_DATA_PHASE) {
++ dev_WARN(dwc->dev, "Unexpected pending request\n");
+ return 0;
+ }
+
+ ret = dwc3_ep0_start_trans(dwc, direction,
+- req->request.dma, req->request.length, type);
++ req->request.dma, req->request.length,
++ DWC3_TRBCTL_CONTROL_DATA);
+ dep->flags &= ~(DWC3_EP_PENDING_REQUEST |
+ DWC3_EP0_DIR_IN);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch
new file mode 100644
index 0000000..e8508ba
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch
@@ -0,0 +1,60 @@
+From 07f90680975c8ca1d35f7f30f9aee6b832578469 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm at xmission.com>
+Date: Fri, 13 Jan 2012 21:32:06 -0800
+Subject: [PATCH 49/90] usb: io_ti: Make edge_remove_sysfs_attrs the
+ port_remove method.
+
+commit 6d443d8499e4e59ffb949759cdded32730f8d2f6 upstream.
+
+Calling edge_remove_sysfs_attrs from edge_disconnect is too late
+as the device has already been removed from sysfs.
+
+Do the simple and obvious thing and make edge_remove_sysfs_attrs
+the port_remove method.
+
+Signed-off-by: Eric W. Biederman <ebiederm at xmission.com>
+Reported-by: Wolfgang Frisch <wfpub at roembden.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/io_ti.c | 10 ++--------
+ 1 files changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index 0aac00a..8a90d58 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -2677,15 +2677,7 @@ cleanup:
+
+ static void edge_disconnect(struct usb_serial *serial)
+ {
+- int i;
+- struct edgeport_port *edge_port;
+-
+ dbg("%s", __func__);
+-
+- for (i = 0; i < serial->num_ports; ++i) {
+- edge_port = usb_get_serial_port_data(serial->port[i]);
+- edge_remove_sysfs_attrs(edge_port->port);
+- }
+ }
+
+ static void edge_release(struct usb_serial *serial)
+@@ -2764,6 +2756,7 @@ static struct usb_serial_driver edgeport_1port_device = {
+ .disconnect = edge_disconnect,
+ .release = edge_release,
+ .port_probe = edge_create_sysfs_attrs,
++ .port_remove = edge_remove_sysfs_attrs,
+ .ioctl = edge_ioctl,
+ .set_termios = edge_set_termios,
+ .tiocmget = edge_tiocmget,
+@@ -2795,6 +2788,7 @@ static struct usb_serial_driver edgeport_2port_device = {
+ .disconnect = edge_disconnect,
+ .release = edge_release,
+ .port_probe = edge_create_sysfs_attrs,
++ .port_remove = edge_remove_sysfs_attrs,
+ .ioctl = edge_ioctl,
+ .set_termios = edge_set_termios,
+ .tiocmget = edge_tiocmget,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0050-TTY-fix-UV-serial-console-regression.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0050-TTY-fix-UV-serial-console-regression.patch
new file mode 100644
index 0000000..54b2abc
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0050-TTY-fix-UV-serial-console-regression.patch
@@ -0,0 +1,72 @@
+From 40e6ddc8744318ca278e19d1de4772b590fcc38c Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby at suse.cz>
+Date: Thu, 12 Jan 2012 22:55:15 +0100
+Subject: [PATCH 50/90] TTY: fix UV serial console regression
+
+commit 0eee50af5b13e00b3fb7a5fe8480419a71b8235d upstream.
+
+Commit 74c2107759d (serial: Use block_til_ready helper) and its fixup
+3f582b8c110 (serial: fix termios settings in open) introduced a
+regression on UV systems. The serial eventually freezes while being
+used. It's completely unpredictable and sometimes needs a heap of
+traffic to happen first.
+
+To reproduce this, yast installation was used as it turned out to be
+pretty reliable in reproducing. Especially during installation process
+where one doesn't have an SSH daemon running. And no monitor as the HW
+is completely headless. So this was fun to find. Given the machine
+doesn't boot on vanilla before 2.6.36 final. (And the commits above
+are older.)
+
+Unless there is some bad race in the code, the hardware seems to be
+pretty broken. Otherwise pure MSR read should not cause such a bug,
+or?
+
+So to prevent the bug, revert to the old behavior. I.e. read modem
+status only if we really have to -- for non-CLOCAL set serials.
+Non-CLOCAL works on this hardware OK, I tried. See? I don't.
+
+And document that shit.
+
+Signed-off-by: Jiri Slaby <jslaby at suse.cz>
+References: https://lkml.org/lkml/2011/12/6/573
+References: https://bugzilla.novell.com/show_bug.cgi?id=718518
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/tty/tty_port.c | 12 +++++++-----
+ 1 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
+index ef9dd62..bf6e238 100644
+--- a/drivers/tty/tty_port.c
++++ b/drivers/tty/tty_port.c
+@@ -227,7 +227,6 @@ int tty_port_block_til_ready(struct tty_port *port,
+ int do_clocal = 0, retval;
+ unsigned long flags;
+ DEFINE_WAIT(wait);
+- int cd;
+
+ /* block if port is in the process of being closed */
+ if (tty_hung_up_p(filp) || port->flags & ASYNC_CLOSING) {
+@@ -284,11 +283,14 @@ int tty_port_block_til_ready(struct tty_port *port,
+ retval = -ERESTARTSYS;
+ break;
+ }
+- /* Probe the carrier. For devices with no carrier detect this
+- will always return true */
+- cd = tty_port_carrier_raised(port);
++ /*
++ * Probe the carrier. For devices with no carrier detect
++ * tty_port_carrier_raised will always return true.
++ * Never ask drivers if CLOCAL is set, this causes troubles
++ * on some hardware.
++ */
+ if (!(port->flags & ASYNC_CLOSING) &&
+- (do_clocal || cd))
++ (do_clocal || tty_port_carrier_raised(port)))
+ break;
+ if (signal_pending(current)) {
+ retval = -ERESTARTSYS;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch
new file mode 100644
index 0000000..c1a5eb2
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch
@@ -0,0 +1,67 @@
+From de3853e197be72552027661297ae663e2eb66ef1 Mon Sep 17 00:00:00 2001
+From: Rabin Vincent <rabin.vincent at stericsson.com>
+Date: Tue, 17 Jan 2012 11:52:28 +0100
+Subject: [PATCH 51/90] serial: amba-pl011: lock console writes against
+ interrupts
+
+commit ef605fdb33883d687cff5ba75095a91b313b4966 upstream.
+
+Protect against pl011_console_write() and the interrupt for
+the console UART running concurrently on different CPUs.
+
+Otherwise the console_write could spin for a long time
+waiting for the UART to become not busy, while the other
+CPU continuously services UART interrupts and keeps the
+UART busy.
+
+The checks for sysrq and oops_in_progress are taken
+from 8250.c.
+
+Signed-off-by: Rabin Vincent <rabin.vincent at stericsson.com>
+Reviewed-by: Srinidhi Kasagar <srinidhi.kasagar at stericsson.com>
+Reviewed-by: Bibek Basu <bibek.basu at stericsson.com>
+Reviewed-by: Shreshtha Kumar Sahu <shreshthakumar.sahu at stericsson.com>
+Signed-off-by: Linus Walleij <linus.walleij at linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/tty/serial/amba-pl011.c | 14 ++++++++++++++
+ 1 files changed, 14 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index 00233af..8e00926 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1740,9 +1740,19 @@ pl011_console_write(struct console *co, const char *s, unsigned int count)
+ {
+ struct uart_amba_port *uap = amba_ports[co->index];
+ unsigned int status, old_cr, new_cr;
++ unsigned long flags;
++ int locked = 1;
+
+ clk_enable(uap->clk);
+
++ local_irq_save(flags);
++ if (uap->port.sysrq)
++ locked = 0;
++ else if (oops_in_progress)
++ locked = spin_trylock(&uap->port.lock);
++ else
++ spin_lock(&uap->port.lock);
++
+ /*
+ * First save the CR then disable the interrupts
+ */
+@@ -1762,6 +1772,10 @@ pl011_console_write(struct console *co, const char *s, unsigned int count)
+ } while (status & UART01x_FR_BUSY);
+ writew(old_cr, uap->port.membase + UART011_CR);
+
++ if (locked)
++ spin_unlock(&uap->port.lock);
++ local_irq_restore(flags);
++
+ clk_disable(uap->clk);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch
new file mode 100644
index 0000000..4836cc1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch
@@ -0,0 +1,53 @@
+From a4bb82f827dd715b666d2cdf9cae6643da638974 Mon Sep 17 00:00:00 2001
+From: Lucas Kannebley Tavares <lucaskt at linux.vnet.ibm.com>
+Date: Mon, 9 Jan 2012 10:58:06 -0200
+Subject: [PATCH 52/90] jsm: Fixed EEH recovery error
+
+commit 26aa38cafae0dbef3b2fe75ea487c83313c36d45 upstream.
+
+There was an error on the jsm driver that would cause it to be unable to
+recover after a second error is detected.
+
+At the first error, the device recovers properly:
+
+[72521.485691] EEH: Detected PCI bus error on device 0003:02:00.0
+[72521.485695] EEH: This PCI device has failed 1 times in the last hour:
+...
+[72532.035693] ttyn3 at MMIO 0x0 (irq = 49) is a jsm
+[72532.105689] jsm: Port 3 added
+
+However, at the second error, it cascades until EEH disables the device:
+
+[72631.229549] Call Trace:
+...
+[72641.725687] jsm: Port 3 added
+[72641.725695] EEH: Detected PCI bus error on device 0003:02:00.0
+[72641.725698] EEH: This PCI device has failed 3 times in the last hour:
+
+It was caused because the PCI state was not being saved after the first
+restore. Therefore, at the second recovery the PCI state would not be
+restored.
+
+Signed-off-by: Lucas Kannebley Tavares <lucaskt at linux.vnet.ibm.com>
+Signed-off-by: Breno Leitao <brenohl at br.ibm.com>
+Acked-by: Thadeu Lima de Souza Cascardo <cascardo at linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/tty/serial/jsm/jsm_driver.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/tty/serial/jsm/jsm_driver.c b/drivers/tty/serial/jsm/jsm_driver.c
+index 7c867a0..7545fe1 100644
+--- a/drivers/tty/serial/jsm/jsm_driver.c
++++ b/drivers/tty/serial/jsm/jsm_driver.c
+@@ -251,6 +251,7 @@ static void jsm_io_resume(struct pci_dev *pdev)
+ struct jsm_board *brd = pci_get_drvdata(pdev);
+
+ pci_restore_state(pdev);
++ pci_save_state(pdev);
+
+ jsm_uart_port_init(brd);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch
new file mode 100644
index 0000000..b272ea6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch
@@ -0,0 +1,53 @@
+From 0d33ba8639e38e3d78f9dbeb8fac20ea28684cef Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg at intel.com>
+Date: Thu, 19 Jan 2012 08:20:57 -0800
+Subject: [PATCH 53/90] iwlwifi: fix PCI-E transport "inta" race
+
+commit b49ba04a3a0382e7314d990707c21094c410425a upstream.
+
+When an interrupt comes in, we read the reason
+bits and collect them into "trans_pcie->inta".
+This happens with the spinlock held. However,
+there's a bug resetting this variable -- that
+happens after the spinlock has been released.
+This means that it is possible for interrupts
+to be missed if the reset happens after some
+other interrupt reasons were already added to
+the variable.
+
+I found this by code inspection, looking for a
+reason that we sometimes see random commands
+time out. It seems possible that this causes
+such behaviour, but I can't say for sure right
+now since it happens extremely infrequently on
+my test systems.
+
+Signed-off-by: Johannes Berg <johannes.berg at intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy at intel.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+index 1920237..1daf01e 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+@@ -957,11 +957,11 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
+ }
+ #endif
+
+- spin_unlock_irqrestore(&trans->shrd->lock, flags);
+-
+ /* saved interrupt in inta variable now we can reset trans_pcie->inta */
+ trans_pcie->inta = 0;
+
++ spin_unlock_irqrestore(&trans->shrd->lock, flags);
++
+ /* Now service all interrupt bits discovered above. */
+ if (inta & CSR_INT_BIT_HW_ERR) {
+ IWL_ERR(trans, "Hardware error detected. Restarting.\n");
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch
new file mode 100644
index 0000000..a502bc6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch
@@ -0,0 +1,34 @@
+From 8f71848d8e5ac400a72eeade1898ecbd99145261 Mon Sep 17 00:00:00 2001
+From: Ryan Mallon <rmallon at gmail.com>
+Date: Sat, 28 Jan 2012 08:51:40 +1100
+Subject: [PATCH 54/90] vmwgfx: Fix assignment in
+ vmw_framebuffer_create_handle
+
+commit bf9c05d5b6d19b3e4c9fe21047694e94f48db89b upstream.
+
+The assignment of handle in vmw_framebuffer_create_handle doesn't actually do anything useful and is incorrectly assigning an integer value to a pointer argument. It appears that this is a typo and should be dereferencing handle rather than assigning to it directly. This fixes a bug where an undefined handle value is potentially returned to user-space.
+
+Signed-off-by: Ryan Mallon <rmallon at gmail.com>
+Reviewed-by: Jakob Bornecrantz<jakob at vmware.com>
+Signed-off-by: Dave Airlie <airlied at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index f94b33a..7c88f1f 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -378,7 +378,7 @@ int vmw_framebuffer_create_handle(struct drm_framebuffer *fb,
+ unsigned int *handle)
+ {
+ if (handle)
+- handle = 0;
++ *handle = 0;
+
+ return 0;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch
new file mode 100644
index 0000000..9bed68e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch
@@ -0,0 +1,36 @@
+From 286cad08e0819522e35f30a9a55c8183d32b2b98 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka at redhat.com>
+Date: Thu, 26 Jan 2012 12:29:42 +0100
+Subject: [PATCH 55/90] USB: Realtek cr: fix autopm scheduling while atomic
+
+commit b3ef051db763b640d1ff724b616ffba940896b44 upstream.
+
+Resolves:
+https://bugzilla.redhat.com/show_bug.cgi?id=784345
+
+Reported-by: Francis Moreau <francis.moro at gmail.com>
+Reported-and-tested-by: Christian D <chrisudeussen at gmail.com>
+Reported-and-tested-by: Jimmy Dorff <jdorff at phy.duke.edu>
+Reported-and-tested-by: collura at ieee.org
+Signed-off-by: Stanislaw Gruszka <sgruszka at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/storage/realtek_cr.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
+index 0ce5f79..32c93d7 100644
+--- a/drivers/usb/storage/realtek_cr.c
++++ b/drivers/usb/storage/realtek_cr.c
+@@ -791,7 +791,7 @@ static void rts51x_suspend_timer_fn(unsigned long data)
+ rts51x_set_stat(chip, RTS51X_STAT_SS);
+ /* ignore mass storage interface's children */
+ pm_suspend_ignore_children(&us->pusb_intf->dev, true);
+- usb_autopm_put_interface(us->pusb_intf);
++ usb_autopm_put_interface_async(us->pusb_intf);
+ US_DEBUGP("%s: RTS51X_STAT_SS 01,"
+ "intf->pm_usage_cnt:%d, power.usage:%d\n",
+ __func__,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0056-USB-usbsevseg-fix-max-length.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0056-USB-usbsevseg-fix-max-length.patch
new file mode 100644
index 0000000..653b82e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0056-USB-usbsevseg-fix-max-length.patch
@@ -0,0 +1,34 @@
+From 3fa24c74797bced963fb71a175b49db16cac7949 Mon Sep 17 00:00:00 2001
+From: Harrison Metzger <harrisonmetz at gmail.com>
+Date: Sun, 15 Jan 2012 08:43:24 -0600
+Subject: [PATCH 56/90] USB: usbsevseg: fix max length
+
+commit 1097ccebe630170080c41df0edcf88e0626e9c75 upstream.
+
+This changes the max length for the usb seven segment delcom device to 8
+from 6. Delcom has both 6 and 8 variants and having 8 works fine with
+devices which are only 6.
+
+Signed-off-by: Harrison Metzger <harrisonmetz at gmail.com>
+Signed-off-by: Stuart Pook <stuart at acm.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/misc/usbsevseg.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/misc/usbsevseg.c b/drivers/usb/misc/usbsevseg.c
+index 417b8f2..59689fa 100644
+--- a/drivers/usb/misc/usbsevseg.c
++++ b/drivers/usb/misc/usbsevseg.c
+@@ -24,7 +24,7 @@
+
+ #define VENDOR_ID 0x0fc5
+ #define PRODUCT_ID 0x1227
+-#define MAXLEN 6
++#define MAXLEN 8
+
+ /* table of devices that work with this driver */
+ static const struct usb_device_id id_table[] = {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch
new file mode 100644
index 0000000..00eb4ac
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch
@@ -0,0 +1,94 @@
+From b19abe994096a9839b092cbf70a3948468d5fc70 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin at linux.intel.com>
+Date: Wed, 21 Dec 2011 10:19:40 +0200
+Subject: [PATCH 57/90] usb: gadget: langwell: don't call gadget's
+ disconnect()
+
+commit 37fd37108449d574da11aa9055c5c8afb39ff226 upstream.
+
+UDC core will call disconnect() and unbind() for us upon the gadget
+removal, so we should not do it ourselves. Otherwise, a composite
+gadget will explode, for example. Others might too.
+
+This was introduced during conversion to new style gadget in 2c7f0989
+(usb: gadget: langwell: convert to new style).
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin at linux.intel.com>
+Cc: Heikki Krogerus <heikki.krogerus at linux.intel.com>
+Cc: linux-usb at vger.kernel.org
+Signed-off-by: Felipe Balbi <balbi at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/gadget/langwell_udc.c | 18 ++++++++----------
+ 1 files changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/gadget/langwell_udc.c b/drivers/usb/gadget/langwell_udc.c
+index fa0fcc1..b0c5b6d 100644
+--- a/drivers/usb/gadget/langwell_udc.c
++++ b/drivers/usb/gadget/langwell_udc.c
+@@ -1522,8 +1522,7 @@ static void langwell_udc_stop(struct langwell_udc *dev)
+
+
+ /* stop all USB activities */
+-static void stop_activity(struct langwell_udc *dev,
+- struct usb_gadget_driver *driver)
++static void stop_activity(struct langwell_udc *dev)
+ {
+ struct langwell_ep *ep;
+ dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+@@ -1535,9 +1534,9 @@ static void stop_activity(struct langwell_udc *dev,
+ }
+
+ /* report disconnect; the driver is already quiesced */
+- if (driver) {
++ if (dev->driver) {
+ spin_unlock(&dev->lock);
+- driver->disconnect(&dev->gadget);
++ dev->driver->disconnect(&dev->gadget);
+ spin_lock(&dev->lock);
+ }
+
+@@ -1925,11 +1924,10 @@ static int langwell_stop(struct usb_gadget *g,
+
+ /* stop all usb activities */
+ dev->gadget.speed = USB_SPEED_UNKNOWN;
+- stop_activity(dev, driver);
+- spin_unlock_irqrestore(&dev->lock, flags);
+-
+ dev->gadget.dev.driver = NULL;
+ dev->driver = NULL;
++ stop_activity(dev);
++ spin_unlock_irqrestore(&dev->lock, flags);
+
+ device_remove_file(&dev->pdev->dev, &dev_attr_function);
+
+@@ -2733,7 +2731,7 @@ static void handle_usb_reset(struct langwell_udc *dev)
+ dev->bus_reset = 1;
+
+ /* reset all the queues, stop all USB activities */
+- stop_activity(dev, dev->driver);
++ stop_activity(dev);
+ dev->usb_state = USB_STATE_DEFAULT;
+ } else {
+ dev_vdbg(&dev->pdev->dev, "device controller reset\n");
+@@ -2741,7 +2739,7 @@ static void handle_usb_reset(struct langwell_udc *dev)
+ langwell_udc_reset(dev);
+
+ /* reset all the queues, stop all USB activities */
+- stop_activity(dev, dev->driver);
++ stop_activity(dev);
+
+ /* reset ep0 dQH and endptctrl */
+ ep0_reset(dev);
+@@ -3367,7 +3365,7 @@ static int langwell_udc_suspend(struct pci_dev *pdev, pm_message_t state)
+
+ spin_lock_irq(&dev->lock);
+ /* stop all usb activities */
+- stop_activity(dev, dev->driver);
++ stop_activity(dev);
+ spin_unlock_irq(&dev->lock);
+
+ /* free dTD dma_pool and dQH */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0058-usb-gadget-storage-endian-fix.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0058-usb-gadget-storage-endian-fix.patch
new file mode 100644
index 0000000..d3bda65
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0058-usb-gadget-storage-endian-fix.patch
@@ -0,0 +1,43 @@
+From 5e2120eb3e1016b52dbfdaf13b022617ba3252f4 Mon Sep 17 00:00:00 2001
+From: Andiry Xu <andiry.xu at amd.com>
+Date: Wed, 4 Jan 2012 15:18:27 +0800
+Subject: [PATCH 58/90] usb: gadget: storage: endian fix
+
+commit a85016390135d577c457876d0e905095600751de upstream.
+
+Fix some endian issues for storage gadgets.
+
+Signed-off-by: Andiry Xu <andiry.xu at amd.com>
+Signed-off-by: Felipe Balbi <balbi at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/gadget/storage_common.c | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/storage_common.c b/drivers/usb/gadget/storage_common.c
+index c7f291a..85ea14e 100644
+--- a/drivers/usb/gadget/storage_common.c
++++ b/drivers/usb/gadget/storage_common.c
+@@ -598,16 +598,16 @@ static __maybe_unused struct usb_ss_cap_descriptor fsg_ss_cap_desc = {
+ | USB_5GBPS_OPERATION),
+ .bFunctionalitySupport = USB_LOW_SPEED_OPERATION,
+ .bU1devExitLat = USB_DEFAULT_U1_DEV_EXIT_LAT,
+- .bU2DevExitLat = USB_DEFAULT_U2_DEV_EXIT_LAT,
++ .bU2DevExitLat = cpu_to_le16(USB_DEFAULT_U2_DEV_EXIT_LAT),
+ };
+
+ static __maybe_unused struct usb_bos_descriptor fsg_bos_desc = {
+ .bLength = USB_DT_BOS_SIZE,
+ .bDescriptorType = USB_DT_BOS,
+
+- .wTotalLength = USB_DT_BOS_SIZE
++ .wTotalLength = cpu_to_le16(USB_DT_BOS_SIZE
+ + USB_DT_USB_EXT_CAP_SIZE
+- + USB_DT_USB_SS_CAP_SIZE,
++ + USB_DT_USB_SS_CAP_SIZE),
+
+ .bNumDeviceCaps = 2,
+ };
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch
new file mode 100644
index 0000000..29650a2
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch
@@ -0,0 +1,54 @@
+From 87dd7c175531bdc9938fa7948f75619962991a27 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall at lip6.fr>
+Date: Thu, 12 Jan 2012 10:55:13 +0100
+Subject: [PATCH 59/90] drivers/usb/host/ehci-fsl.c: add missing iounmap
+
+commit 2492c6e6454ff3edb11e273b071a6ea80a199c71 upstream.
+
+Add missing iounmap in error handling code, in a case where the function
+already preforms iounmap on some other execution path.
+
+A simplified version of the semantic match that finds this problem is as
+follows: (http://coccinelle.lip6.fr/)
+
+// <smpl>
+@@
+expression e;
+statement S,S1;
+int ret;
+@@
+e = \(ioremap\|ioremap_nocache\)(...)
+... when != iounmap(e)
+if (<+...e...+>) S
+... when any
+ when != iounmap(e)
+*if (...)
+ { ... when != iounmap(e)
+ return ...; }
+... when any
+iounmap(e);
+// </smpl>
+
+Signed-off-by: Julia Lawall <Julia.Lawall at lip6.fr>
+Acked-by: Alan Stern <stern at rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/host/ehci-fsl.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
+index e90344a..b556a72 100644
+--- a/drivers/usb/host/ehci-fsl.c
++++ b/drivers/usb/host/ehci-fsl.c
+@@ -125,7 +125,7 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver,
+ */
+ if (pdata->init && pdata->init(pdev)) {
+ retval = -ENODEV;
+- goto err3;
++ goto err4;
+ }
+
+ /* Enable USB controller, 83xx or 8536 */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch
new file mode 100644
index 0000000..7113e68
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch
@@ -0,0 +1,51 @@
+From b4e67c5c309a96709491f7ac2f57d80999eba389 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp at linux.intel.com>
+Date: Mon, 14 Nov 2011 17:51:39 -0800
+Subject: [PATCH 60/90] xhci: Fix USB 3.0 device restart on resume.
+
+commit d0cd5d482b8a6dc92c6c69a5387baf72ea84f23a upstream.
+
+The xHCI hub port code gets passed a zero-based port number by the USB
+core. It then adds one to in order to find a device slot by port number
+and device speed by calling xhci_find_slot_id_by_port. That function
+clearly states it requires a one-based port number. The xHCI port
+status change event handler was using a zero-based port number that it
+got from find_faked_portnum_from_hw_portnum, not a one-based port
+number. This lead to the doorbells never being rung for a device after
+a resume, or worse, a different device with the same speed having its
+doorbell rung (which could lead to bad power management in the xHCI host
+controller).
+
+This patch should be backported to kernels as old as 2.6.39.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp at linux.intel.com>
+Acked-by: Andiry Xu <andiry.xu at amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/host/xhci-ring.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index d28c586..ee0b4d7 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1215,6 +1215,7 @@ static void handle_vendor_event(struct xhci_hcd *xhci,
+ *
+ * Returns a zero-based port number, which is suitable for indexing into each of
+ * the split roothubs' port arrays and bus state arrays.
++ * Add one to it in order to call xhci_find_slot_id_by_port.
+ */
+ static unsigned int find_faked_portnum_from_hw_portnum(struct usb_hcd *hcd,
+ struct xhci_hcd *xhci, u32 port_id)
+@@ -1335,7 +1336,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ xhci_set_link_state(xhci, port_array, faked_port_index,
+ XDEV_U0);
+ slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+- faked_port_index);
++ faked_port_index + 1);
+ if (!slot_id) {
+ xhci_dbg(xhci, "slot_id is zero\n");
+ goto cleanup;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch
new file mode 100644
index 0000000..f906f07
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch
@@ -0,0 +1,40 @@
+From 910e3e93de89b8568e3bfb1c8c08c96f2be325f2 Mon Sep 17 00:00:00 2001
+From: Andiry Xu <andiry.xu at amd.com>
+Date: Wed, 18 Jan 2012 17:47:12 +0800
+Subject: [PATCH 61/90] xHCI: Cleanup isoc transfer ring when TD length
+ mismatch found
+
+commit cf840551a884360841bd3d3ce1ad0868ff0b759a upstream.
+
+When a TD length mismatch is found during isoc TRB enqueue, it directly
+returns -EINVAL. However, isoc transfer is partially enqueued at this time,
+and the ring should be cleared.
+
+This should be backported to kernels as old as 2.6.36, which contain the
+commit 522989a27c7badb608155b1f1dea3487ed431f74 "xhci: Fix failed
+enqueue in the middle of isoch TD."
+
+Signed-off-by: Andiry Xu <andiry.xu at amd.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/host/xhci-ring.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index ee0b4d7..ae92dc4 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3373,7 +3373,8 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ /* Check TD length */
+ if (running_total != td_len) {
+ xhci_err(xhci, "ISOC TD length unmatch\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto cleanup;
+ }
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch
new file mode 100644
index 0000000..e2e4d83
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch
@@ -0,0 +1,41 @@
+From 5dc5545c987453cafa4b441522cf61bbb89e80e4 Mon Sep 17 00:00:00 2001
+From: Sekhar Nori <nsekhar at ti.com>
+Date: Wed, 28 Dec 2011 12:02:57 +0530
+Subject: [PATCH 62/90] usb: musb: davinci: fix build breakage
+
+commit 006896fc612f11bf0624db7814a75d0d5410855f upstream.
+
+Commit 0020afb369859472a461ef4af6410732e929d402 (ARM: mach-davinci:
+remove mach/memory.h) removed mach/memory.h for DaVinci which broke
+DaVinci MUSB build.
+
+mach/memory.h is not actually needed in davinci.c, so remove it.
+While at it, also remove some more machine specific inclulde
+files which are not needed for build.
+
+Tested on DM644x EVM using USB card reader.
+
+Signed-off-by: Sekhar Nori <nsekhar at ti.com>
+Signed-off-by: Felipe Balbi <balbi at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/musb/davinci.c | 3 ---
+ 1 files changed, 0 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
+index 4d365d5..3911d9a 100644
+--- a/drivers/usb/musb/davinci.c
++++ b/drivers/usb/musb/davinci.c
+@@ -33,9 +33,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/dma-mapping.h>
+
+-#include <mach/hardware.h>
+-#include <mach/memory.h>
+-#include <asm/gpio.h>
+ #include <mach/cputype.h>
+
+ #include <asm/mach-types.h>
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch
new file mode 100644
index 0000000..f00fa80
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch
@@ -0,0 +1,43 @@
+From 2f13837e2029149d661b66d510f759aac22f4748 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali at linux-fr.org>
+Date: Fri, 20 Jan 2012 10:09:23 -0500
+Subject: [PATCH 63/90] hwmon: (f71805f) Fix clamping of temperature limits
+
+commit 86b2bbfdbd1fcc4a3aa62ccd3f245c40c5ad5b85 upstream.
+
+Properly clamp temperature limits set by the user. Without this fix,
+attempts to write temperature limits above the maximum supported by
+the chip (255 degrees Celsius) would arbitrarily and unexpectedly
+result in the limit being set to 0 degree Celsius.
+
+Signed-off-by: Jean Delvare <khali at linux-fr.org>
+Signed-off-by: Guenter Roeck <guenter.roeck at ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/hwmon/f71805f.c | 10 +++++-----
+ 1 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwmon/f71805f.c b/drivers/hwmon/f71805f.c
+index 92f9497..6dbfd3e 100644
+--- a/drivers/hwmon/f71805f.c
++++ b/drivers/hwmon/f71805f.c
+@@ -283,11 +283,11 @@ static inline long temp_from_reg(u8 reg)
+
+ static inline u8 temp_to_reg(long val)
+ {
+- if (val < 0)
+- val = 0;
+- else if (val > 1000 * 0xff)
+- val = 0xff;
+- return ((val + 500) / 1000);
++ if (val <= 0)
++ return 0;
++ if (val >= 1000 * 0xff)
++ return 0xff;
++ return (val + 500) / 1000;
+ }
+
+ /*
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch
new file mode 100644
index 0000000..285534f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch
@@ -0,0 +1,46 @@
+From 99eb79f71c8d3baeb55b7584a11df76740950f22 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux at roeck-us.net>
+Date: Fri, 27 Jan 2012 17:56:06 -0800
+Subject: [PATCH 64/90] hwmon: (w83627ehf) Disable setting DC mode for pwm2,
+ pwm3 on NCT6776F
+
+commit ad77c3e1808f07fa70f707b1c92a683b7c7d3f85 upstream.
+
+NCT6776F only supports pwm mode for pwm2 and pwm3. Return error if an attempt
+is made to set those pwm channels to DC mode.
+
+Signed-off-by: Guenter Roeck <linux at roeck-us.net>
+Acked-by: Jean Delvare <khali at linux-fr.org>
+Signed-off-by: Guenter Roeck <guenter.roeck at ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/hwmon/w83627ehf.c | 6 ++++++
+ 1 files changed, 6 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
+index 93f5fc7..4b57ab6 100644
+--- a/drivers/hwmon/w83627ehf.c
++++ b/drivers/hwmon/w83627ehf.c
+@@ -1319,6 +1319,7 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr,
+ {
+ struct w83627ehf_data *data = dev_get_drvdata(dev);
+ struct sensor_device_attribute *sensor_attr = to_sensor_dev_attr(attr);
++ struct w83627ehf_sio_data *sio_data = dev->platform_data;
+ int nr = sensor_attr->index;
+ unsigned long val;
+ int err;
+@@ -1330,6 +1331,11 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr,
+
+ if (val > 1)
+ return -EINVAL;
++
++ /* On NCT67766F, DC mode is only supported for pwm1 */
++ if (sio_data->kind == nct6776 && nr && val != 1)
++ return -EINVAL;
++
+ mutex_lock(&data->update_lock);
+ reg = w83627ehf_read_value(data, W83627EHF_REG_PWM_ENABLE[nr]);
+ data->pwm_mode[nr] = val;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch
new file mode 100644
index 0000000..1ca0623
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch
@@ -0,0 +1,40 @@
+From 8e9da00da23bf9103db8bb4172a89926c58dfb03 Mon Sep 17 00:00:00 2001
+From: Vivien Didelot <vivien.didelot at savoirfairelinux.com>
+Date: Thu, 26 Jan 2012 15:59:00 -0500
+Subject: [PATCH 65/90] hwmon: (sht15) fix bad error code
+
+commit 6edf3c30af01854c416f8654d3d5d2652470afd4 upstream.
+
+When no platform data was supplied, returned error code was 0.
+
+Signed-off-by: Vivien Didelot <vivien.didelot at savoirfairelinux.com>
+Signed-off-by: Guenter Roeck <guenter.roeck at ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/hwmon/sht15.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
+index fe4104c..5357925 100644
+--- a/drivers/hwmon/sht15.c
++++ b/drivers/hwmon/sht15.c
+@@ -883,7 +883,7 @@ static int sht15_invalidate_voltage(struct notifier_block *nb,
+
+ static int __devinit sht15_probe(struct platform_device *pdev)
+ {
+- int ret = 0;
++ int ret;
+ struct sht15_data *data = kzalloc(sizeof(*data), GFP_KERNEL);
+ u8 status = 0;
+
+@@ -901,6 +901,7 @@ static int __devinit sht15_probe(struct platform_device *pdev)
+ init_waitqueue_head(&data->wait_queue);
+
+ if (pdev->dev.platform_data == NULL) {
++ ret = -EINVAL;
+ dev_err(&pdev->dev, "no platform data supplied\n");
+ goto err_free_data;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch
new file mode 100644
index 0000000..67a10cb
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch
@@ -0,0 +1,45 @@
+From 700634b182ca70f6b189ae7aa036d75111ce14f7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn at mork.no>
+Date: Mon, 16 Jan 2012 15:11:57 +0100
+Subject: [PATCH 66/90] USB: cdc-wdm: call wake_up_all to allow driver to
+ shutdown on device removal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 62aaf24dc125d7c55c93e313d15611f152b030c7 upstream.
+
+wdm_disconnect() waits for the mutex held by wdm_read() before
+calling wake_up_all(). This causes a deadlock, preventing device removal
+to complete. Do the wake_up_all() before we start waiting for the locks.
+
+Signed-off-by: Bjørn Mork <bjorn at mork.no>
+Cc: Oliver Neukum <oliver at neukum.org>
+Cc: stable <stable at vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 4a29a80..d2cda26 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -786,13 +786,13 @@ static void wdm_disconnect(struct usb_interface *intf)
+ /* to terminate pending flushes */
+ clear_bit(WDM_IN_USE, &desc->flags);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
++ wake_up_all(&desc->wait);
+ mutex_lock(&desc->rlock);
+ mutex_lock(&desc->wlock);
+ kill_urbs(desc);
+ cancel_work_sync(&desc->rxwork);
+ mutex_unlock(&desc->wlock);
+ mutex_unlock(&desc->rlock);
+- wake_up_all(&desc->wait);
+ if (!desc->count)
+ cleanup(desc);
+ mutex_unlock(&wdm_mutex);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch
new file mode 100644
index 0000000..4471b13
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch
@@ -0,0 +1,38 @@
+From 46e7b4556cd993a3bb20308498c31dabbe96aceb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn at mork.no>
+Date: Mon, 16 Jan 2012 15:11:59 +0100
+Subject: [PATCH 67/90] USB: cdc-wdm: better allocate a buffer that is at
+ least as big as we tell the USB core
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 655e247daf52b202a6c2d0f8a06dd2051e756ce4 upstream.
+
+As it turns out, there was a mismatch between the allocated inbuf size
+(desc->bMaxPacketSize0, typically something like 64) and the length we
+specified in the URB (desc->wMaxCommand, typically something like 2048)
+
+Signed-off-by: Bjørn Mork <bjorn at mork.no>
+Cc: Oliver Neukum <oliver at neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index d2cda26..f0deb9e 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -723,7 +723,7 @@ next_desc:
+ goto err;
+
+ desc->inbuf = usb_alloc_coherent(interface_to_usbdev(intf),
+- desc->bMaxPacketSize0,
++ desc->wMaxCommand,
+ GFP_KERNEL,
+ &desc->response->transfer_dma);
+ if (!desc->inbuf)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch
new file mode 100644
index 0000000..1e330f9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch
@@ -0,0 +1,53 @@
+From c7d772ceccb6b83acc2c71e0640ac5293e0b2713 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn at mork.no>
+Date: Fri, 20 Jan 2012 01:49:57 +0100
+Subject: [PATCH 68/90] USB: cdc-wdm: Avoid hanging on interface with no
+ USB_CDC_DMM_TYPE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 15699e6fafc3a90e5fdc2ef30555a04dee62286f upstream.
+
+The probe does not strictly require the USB_CDC_DMM_TYPE
+descriptor, which is a good thing as it makes the driver
+usable on non-conforming interfaces. A user could e.g.
+bind to it to a CDC ECM interface by using the new_id and
+bind sysfs files. But this would fail with a 0 buffer length
+due to the missing descriptor.
+
+Fix by defining a reasonable fallback size: The minimum
+device receive buffer size required by the CDC WMC standard,
+revision 1.1
+
+Signed-off-by: Bjørn Mork <bjorn at mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/class/cdc-wdm.c | 4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index f0deb9e..fd4aee1 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -57,6 +57,8 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
+
+ #define WDM_MAX 16
+
++/* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */
++#define WDM_DEFAULT_BUFSIZE 256
+
+ static DEFINE_MUTEX(wdm_mutex);
+
+@@ -636,7 +638,7 @@ static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ struct usb_cdc_dmm_desc *dmhd;
+ u8 *buffer = intf->altsetting->extra;
+ int buflen = intf->altsetting->extralen;
+- u16 maxcom = 0;
++ u16 maxcom = WDM_DEFAULT_BUFSIZE;
+
+ if (!buffer)
+ goto out;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0069-netns-fix-net_alloc_generic.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0069-netns-fix-net_alloc_generic.patch
new file mode 100644
index 0000000..95e6041
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0069-netns-fix-net_alloc_generic.patch
@@ -0,0 +1,120 @@
+From 0c5f77f70263e78633b63a24692dd6be6cf99732 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet at gmail.com>
+Date: Thu, 26 Jan 2012 00:41:38 +0000
+Subject: [PATCH 69/90] netns: fix net_alloc_generic()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 073862ba5d249c20bd5c49fc6d904ff0e1f6a672 ]
+
+When a new net namespace is created, we should attach to it a "struct
+net_generic" with enough slots (even empty), or we can hit the following
+BUG_ON() :
+
+[ 200.752016] kernel BUG at include/net/netns/generic.h:40!
+...
+[ 200.752016] [<ffffffff825c3cea>] ? get_cfcnfg+0x3a/0x180
+[ 200.752016] [<ffffffff821cf0b0>] ? lockdep_rtnl_is_held+0x10/0x20
+[ 200.752016] [<ffffffff825c41be>] caif_device_notify+0x2e/0x530
+[ 200.752016] [<ffffffff810d61b7>] notifier_call_chain+0x67/0x110
+[ 200.752016] [<ffffffff810d67c1>] raw_notifier_call_chain+0x11/0x20
+[ 200.752016] [<ffffffff821bae82>] call_netdevice_notifiers+0x32/0x60
+[ 200.752016] [<ffffffff821c2b26>] register_netdevice+0x196/0x300
+[ 200.752016] [<ffffffff821c2ca9>] register_netdev+0x19/0x30
+[ 200.752016] [<ffffffff81c1c67a>] loopback_net_init+0x4a/0xa0
+[ 200.752016] [<ffffffff821b5e62>] ops_init+0x42/0x180
+[ 200.752016] [<ffffffff821b600b>] setup_net+0x6b/0x100
+[ 200.752016] [<ffffffff821b6466>] copy_net_ns+0x86/0x110
+[ 200.752016] [<ffffffff810d5789>] create_new_namespaces+0xd9/0x190
+
+net_alloc_generic() should take into account the maximum index into the
+ptr array, as a subsystem might use net_generic() anytime.
+
+This also reduces number of reallocations in net_assign_generic()
+
+Reported-by: Sasha Levin <levinsasha928 at gmail.com>
+Tested-by: Sasha Levin <levinsasha928 at gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
+Cc: Sjur Brændeland <sjur.brandeland at stericsson.com>
+Cc: Eric W. Biederman <ebiederm at xmission.com>
+Cc: Pavel Emelyanov <xemul at openvz.org>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/core/net_namespace.c | 31 ++++++++++++++++---------------
+ 1 files changed, 16 insertions(+), 15 deletions(-)
+
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index aefcd7a..0e950fd 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -30,6 +30,20 @@ EXPORT_SYMBOL(init_net);
+
+ #define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */
+
++static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
++
++static struct net_generic *net_alloc_generic(void)
++{
++ struct net_generic *ng;
++ size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
++
++ ng = kzalloc(generic_size, GFP_KERNEL);
++ if (ng)
++ ng->len = max_gen_ptrs;
++
++ return ng;
++}
++
+ static int net_assign_generic(struct net *net, int id, void *data)
+ {
+ struct net_generic *ng, *old_ng;
+@@ -43,8 +57,7 @@ static int net_assign_generic(struct net *net, int id, void *data)
+ if (old_ng->len >= id)
+ goto assign;
+
+- ng = kzalloc(sizeof(struct net_generic) +
+- id * sizeof(void *), GFP_KERNEL);
++ ng = net_alloc_generic();
+ if (ng == NULL)
+ return -ENOMEM;
+
+@@ -59,7 +72,6 @@ static int net_assign_generic(struct net *net, int id, void *data)
+ * the old copy for kfree after a grace period.
+ */
+
+- ng->len = id;
+ memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
+
+ rcu_assign_pointer(net->gen, ng);
+@@ -161,18 +173,6 @@ out_undo:
+ goto out;
+ }
+
+-static struct net_generic *net_alloc_generic(void)
+-{
+- struct net_generic *ng;
+- size_t generic_size = sizeof(struct net_generic) +
+- INITIAL_NET_GEN_PTRS * sizeof(void *);
+-
+- ng = kzalloc(generic_size, GFP_KERNEL);
+- if (ng)
+- ng->len = INITIAL_NET_GEN_PTRS;
+-
+- return ng;
+-}
+
+ #ifdef CONFIG_NET_NS
+ static struct kmem_cache *net_cachep;
+@@ -483,6 +483,7 @@ again:
+ }
+ return error;
+ }
++ max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id);
+ }
+ error = __register_pernet_operations(list, ops);
+ if (error) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch
new file mode 100644
index 0000000..6b4adf3
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch
@@ -0,0 +1,42 @@
+From 8b924dd991cfa0b36c65001ff07050cf2b30bd93 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm at xmission.com>
+Date: Thu, 26 Jan 2012 14:02:55 +0000
+Subject: [PATCH 70/90] netns: Fail conspicously if someone uses net_generic
+ at an inappropriate time.
+
+[ Upstream commit 5ee4433efe99b9f39f6eff5052a177bbcfe72cea ]
+
+By definition net_generic should never be called when it can return
+NULL. Fail conspicously with a BUG_ON to make it clear when people mess
+up that a NULL return should never happen.
+
+Recently there was a bug in the CAIF subsystem where it was registered
+with register_pernet_device instead of register_pernet_subsys. It was
+erroneously concluded that net_generic could validly return NULL and
+that net_assign_generic was buggy (when it was just inefficient).
+Hopefully this BUG_ON will prevent people to coming to similar erroneous
+conclusions in the futrue.
+
+Signed-off-by: Eric W. Biederman <ebiederm at xmission.com>
+Tested-by: Sasha Levin <levinsasha928 at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ include/net/netns/generic.h | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/include/net/netns/generic.h b/include/net/netns/generic.h
+index 3419bf5..d55f434 100644
+--- a/include/net/netns/generic.h
++++ b/include/net/netns/generic.h
+@@ -41,6 +41,7 @@ static inline void *net_generic(const struct net *net, int id)
+ ptr = ng->ptr[id - 1];
+ rcu_read_unlock();
+
++ BUG_ON(!ptr);
+ return ptr;
+ }
+ #endif
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch
new file mode 100644
index 0000000..0c9d910
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch
@@ -0,0 +1,117 @@
+From 2483685b34bc96d19111c65b0629add54a29b458 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm at xmission.com>
+Date: Thu, 26 Jan 2012 14:04:53 +0000
+Subject: [PATCH 71/90] net caif: Register properly as a pernet subsystem.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 8a8ee9aff6c3077dd9c2c7a77478e8ed362b96c6 ]
+
+caif is a subsystem and as such it needs to register with
+register_pernet_subsys instead of register_pernet_device.
+
+Among other problems using register_pernet_device was resulting in
+net_generic being called before the caif_net structure was allocated.
+Which has been causing net_generic to fail with either BUG_ON's or by
+return NULL pointers.
+
+A more ugly problem that could be caused is packets in flight why the
+subsystem is shutting down.
+
+To remove confusion also remove the cruft cause by inappropriately
+trying to fix this bug.
+
+With the aid of the previous patch I have tested this patch and
+confirmed that using register_pernet_subsys makes the failure go away as
+it should.
+
+Signed-off-by: Eric W. Biederman <ebiederm at xmission.com>
+Acked-by: Sjur Brændeland <sjur.brandeland at stericsson.com>
+Tested-by: Sasha Levin <levinsasha928 at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/caif/caif_dev.c | 11 ++++-------
+ net/caif/cfcnfg.c | 1 -
+ 2 files changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
+index f1fa1f6..68223e4 100644
+--- a/net/caif/caif_dev.c
++++ b/net/caif/caif_dev.c
+@@ -53,7 +53,6 @@ struct cfcnfg *get_cfcnfg(struct net *net)
+ struct caif_net *caifn;
+ BUG_ON(!net);
+ caifn = net_generic(net, caif_net_id);
+- BUG_ON(!caifn);
+ return caifn->cfg;
+ }
+ EXPORT_SYMBOL(get_cfcnfg);
+@@ -63,7 +62,6 @@ static struct caif_device_entry_list *caif_device_list(struct net *net)
+ struct caif_net *caifn;
+ BUG_ON(!net);
+ caifn = net_generic(net, caif_net_id);
+- BUG_ON(!caifn);
+ return &caifn->caifdevs;
+ }
+
+@@ -92,7 +90,6 @@ static struct caif_device_entry *caif_device_alloc(struct net_device *dev)
+ struct caif_device_entry *caifd;
+
+ caifdevs = caif_device_list(dev_net(dev));
+- BUG_ON(!caifdevs);
+
+ caifd = kzalloc(sizeof(*caifd), GFP_KERNEL);
+ if (!caifd)
+@@ -112,7 +109,7 @@ static struct caif_device_entry *caif_get(struct net_device *dev)
+ struct caif_device_entry_list *caifdevs =
+ caif_device_list(dev_net(dev));
+ struct caif_device_entry *caifd;
+- BUG_ON(!caifdevs);
++
+ list_for_each_entry_rcu(caifd, &caifdevs->list, list) {
+ if (caifd->netdev == dev)
+ return caifd;
+@@ -353,7 +350,7 @@ static struct notifier_block caif_device_notifier = {
+ static int caif_init_net(struct net *net)
+ {
+ struct caif_net *caifn = net_generic(net, caif_net_id);
+- BUG_ON(!caifn);
++
+ INIT_LIST_HEAD(&caifn->caifdevs.list);
+ mutex_init(&caifn->caifdevs.lock);
+
+@@ -418,7 +415,7 @@ static int __init caif_device_init(void)
+ {
+ int result;
+
+- result = register_pernet_device(&caif_net_ops);
++ result = register_pernet_subsys(&caif_net_ops);
+
+ if (result)
+ return result;
+@@ -431,7 +428,7 @@ static int __init caif_device_init(void)
+
+ static void __exit caif_device_exit(void)
+ {
+- unregister_pernet_device(&caif_net_ops);
++ unregister_pernet_subsys(&caif_net_ops);
+ unregister_netdevice_notifier(&caif_device_notifier);
+ dev_remove_pack(&caif_packet_type);
+ }
+diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
+index 00523ec..86ff37c 100644
+--- a/net/caif/cfcnfg.c
++++ b/net/caif/cfcnfg.c
+@@ -309,7 +309,6 @@ int caif_connect_client(struct net *net, struct caif_connect_request *conn_req,
+ int err;
+ struct cfctrl_link_param param;
+ struct cfcnfg *cfg = get_cfcnfg(net);
+- caif_assert(cfg != NULL);
+
+ rcu_read_lock();
+ err = caif_connect_req_to_link_param(cfg, conn_req, ¶m);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch
new file mode 100644
index 0000000..6ddc4a0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch
@@ -0,0 +1,96 @@
+From cfd240df5a18d890c434c05ccff9e12cc83140a4 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet at gmail.com>
+Date: Sat, 28 Jan 2012 16:11:03 +0000
+Subject: [PATCH 72/90] af_unix: fix EPOLLET regression for stream sockets
+
+[ Upstream commit 6f01fd6e6f6809061b56e78f1e8d143099716d70 ]
+
+Commit 0884d7aa24 (AF_UNIX: Fix poll blocking problem when reading from
+a stream socket) added a regression for epoll() in Edge Triggered mode
+(EPOLLET)
+
+Appropriate fix is to use skb_peek()/skb_unlink() instead of
+skb_dequeue(), and only call skb_unlink() when skb is fully consumed.
+
+This remove the need to requeue a partial skb into sk_receive_queue head
+and the extra sk->sk_data_ready() calls that added the regression.
+
+This is safe because once skb is given to sk_receive_queue, it is not
+modified by a writer, and readers are serialized by u->readlock mutex.
+
+This also reduce number of spinlock acquisition for small reads or
+MSG_PEEK users so should improve overall performance.
+
+Reported-by: Nick Mathewson <nickm at freehaven.net>
+Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
+Cc: Alexey Moiseytsev <himeraster at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/unix/af_unix.c | 19 ++++---------------
+ 1 files changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index b595a3d..d99678a 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1915,7 +1915,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ struct sk_buff *skb;
+
+ unix_state_lock(sk);
+- skb = skb_dequeue(&sk->sk_receive_queue);
++ skb = skb_peek(&sk->sk_receive_queue);
+ if (skb == NULL) {
+ unix_sk(sk)->recursion_level = 0;
+ if (copied >= target)
+@@ -1955,11 +1955,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ if (check_creds) {
+ /* Never glue messages from different writers */
+ if ((UNIXCB(skb).pid != siocb->scm->pid) ||
+- (UNIXCB(skb).cred != siocb->scm->cred)) {
+- skb_queue_head(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
++ (UNIXCB(skb).cred != siocb->scm->cred))
+ break;
+- }
+ } else {
+ /* Copy credentials */
+ scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).cred);
+@@ -1974,8 +1971,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+
+ chunk = min_t(unsigned int, skb->len, size);
+ if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
+- skb_queue_head(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
+ if (copied == 0)
+ copied = -EFAULT;
+ break;
+@@ -1990,13 +1985,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ if (UNIXCB(skb).fp)
+ unix_detach_fds(siocb->scm, skb);
+
+- /* put the skb back if we didn't use it up.. */
+- if (skb->len) {
+- skb_queue_head(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
++ if (skb->len)
+ break;
+- }
+
++ skb_unlink(skb, &sk->sk_receive_queue);
+ consume_skb(skb);
+
+ if (siocb->scm->fp)
+@@ -2007,9 +1999,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ if (UNIXCB(skb).fp)
+ siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp);
+
+- /* put message back and return */
+- skb_queue_head(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
+ break;
+ }
+ } while (size);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch
new file mode 100644
index 0000000..3c97194
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch
@@ -0,0 +1,116 @@
+From b0f214df7c16b27e302fb5740be5b1f4264e2235 Mon Sep 17 00:00:00 2001
+From: Jiri Bohac <jbohac at suse.cz>
+Date: Wed, 18 Jan 2012 12:24:54 +0000
+Subject: [PATCH 73/90] bonding: fix enslaving in alb mode when link down
+
+[ Upstream commit b924551bed09f61b64f21bffe241afc5526b091a ]
+
+bond_alb_init_slave() is called from bond_enslave() and sets the slave's MAC
+address. This is done differently for TLB and ALB modes.
+bond->alb_info.rlb_enabled is used to discriminate between the two modes but
+this flag may be uninitialized if the slave is being enslaved prior to calling
+bond_open() -> bond_alb_initialize() on the master.
+
+It turns out all the callers of alb_set_slave_mac_addr() pass
+bond->alb_info.rlb_enabled as the hw parameter.
+
+This patch cleans up the unnecessary parameter of alb_set_slave_mac_addr() and
+makes the function decide based on the bonding mode instead, which fixes the
+above problem.
+
+Reported-by: Narendra K <Narendra_K at Dell.com>
+Signed-off-by: Jiri Bohac <jbohac at suse.cz>
+Signed-off-by: Jay Vosburgh <fubar at us.ibm.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/net/bonding/bond_alb.c | 27 +++++++++------------------
+ 1 files changed, 9 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index 106b88a..30431d8 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -871,16 +871,12 @@ static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[])
+ }
+ }
+
+-/* hw is a boolean parameter that determines whether we should try and
+- * set the hw address of the device as well as the hw address of the
+- * net_device
+- */
+-static int alb_set_slave_mac_addr(struct slave *slave, u8 addr[], int hw)
++static int alb_set_slave_mac_addr(struct slave *slave, u8 addr[])
+ {
+ struct net_device *dev = slave->dev;
+ struct sockaddr s_addr;
+
+- if (!hw) {
++ if (slave->bond->params.mode == BOND_MODE_TLB) {
+ memcpy(dev->dev_addr, addr, dev->addr_len);
+ return 0;
+ }
+@@ -910,8 +906,8 @@ static void alb_swap_mac_addr(struct bonding *bond, struct slave *slave1, struct
+ u8 tmp_mac_addr[ETH_ALEN];
+
+ memcpy(tmp_mac_addr, slave1->dev->dev_addr, ETH_ALEN);
+- alb_set_slave_mac_addr(slave1, slave2->dev->dev_addr, bond->alb_info.rlb_enabled);
+- alb_set_slave_mac_addr(slave2, tmp_mac_addr, bond->alb_info.rlb_enabled);
++ alb_set_slave_mac_addr(slave1, slave2->dev->dev_addr);
++ alb_set_slave_mac_addr(slave2, tmp_mac_addr);
+
+ }
+
+@@ -1058,8 +1054,7 @@ static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slav
+
+ /* Try setting slave mac to bond address and fall-through
+ to code handling that situation below... */
+- alb_set_slave_mac_addr(slave, bond->dev->dev_addr,
+- bond->alb_info.rlb_enabled);
++ alb_set_slave_mac_addr(slave, bond->dev->dev_addr);
+ }
+
+ /* The slave's address is equal to the address of the bond.
+@@ -1095,8 +1090,7 @@ static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slav
+ }
+
+ if (free_mac_slave) {
+- alb_set_slave_mac_addr(slave, free_mac_slave->perm_hwaddr,
+- bond->alb_info.rlb_enabled);
++ alb_set_slave_mac_addr(slave, free_mac_slave->perm_hwaddr);
+
+ pr_warning("%s: Warning: the hw address of slave %s is in use by the bond; giving it the hw address of %s\n",
+ bond->dev->name, slave->dev->name,
+@@ -1451,8 +1445,7 @@ int bond_alb_init_slave(struct bonding *bond, struct slave *slave)
+ {
+ int res;
+
+- res = alb_set_slave_mac_addr(slave, slave->perm_hwaddr,
+- bond->alb_info.rlb_enabled);
++ res = alb_set_slave_mac_addr(slave, slave->perm_hwaddr);
+ if (res) {
+ return res;
+ }
+@@ -1603,8 +1596,7 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
+ alb_swap_mac_addr(bond, swap_slave, new_slave);
+ } else {
+ /* set the new_slave to the bond mac address */
+- alb_set_slave_mac_addr(new_slave, bond->dev->dev_addr,
+- bond->alb_info.rlb_enabled);
++ alb_set_slave_mac_addr(new_slave, bond->dev->dev_addr);
+ }
+
+ if (swap_slave) {
+@@ -1664,8 +1656,7 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
+ alb_swap_mac_addr(bond, swap_slave, bond->curr_active_slave);
+ alb_fasten_mac_swap(bond, swap_slave, bond->curr_active_slave);
+ } else {
+- alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr,
+- bond->alb_info.rlb_enabled);
++ alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr);
+
+ read_lock(&bond->lock);
+ alb_send_learning_packets(bond->curr_active_slave, bond_dev->dev_addr);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch
new file mode 100644
index 0000000..8851dd4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch
@@ -0,0 +1,73 @@
+From 992c1eea6e2a220a7e157952fe30a4963bbb7c43 Mon Sep 17 00:00:00 2001
+From: James Chapman <jchapman at katalix.com>
+Date: Wed, 25 Jan 2012 02:39:05 +0000
+Subject: [PATCH 74/90] l2tp: l2tp_ip - fix possible oops on packet receive
+
+[ Upstream commit 68315801dbf3ab2001679fd2074c9dc5dcf87dfa ]
+
+When a packet is received on an L2TP IP socket (L2TPv3 IP link
+encapsulation), the l2tpip socket's backlog_rcv function calls
+xfrm4_policy_check(). This is not necessary, since it was called
+before the skb was added to the backlog. With CONFIG_NET_NS enabled,
+xfrm4_policy_check() will oops if skb->dev is null, so this trivial
+patch removes the call.
+
+This bug has always been present, but only when CONFIG_NET_NS is
+enabled does it cause problems. Most users are probably using UDP
+encapsulation for L2TP, hence the problem has only recently
+surfaced.
+
+EIP: 0060:[<c12bb62b>] EFLAGS: 00210246 CPU: 0
+EIP is at l2tp_ip_recvmsg+0xd4/0x2a7
+EAX: 00000001 EBX: d77b5180 ECX: 00000000 EDX: 00200246
+ESI: 00000000 EDI: d63cbd30 EBP: d63cbd18 ESP: d63cbcf4
+ DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
+Call Trace:
+ [<c1218568>] sock_common_recvmsg+0x31/0x46
+ [<c1215c92>] __sock_recvmsg_nosec+0x45/0x4d
+ [<c12163a1>] __sock_recvmsg+0x31/0x3b
+ [<c1216828>] sock_recvmsg+0x96/0xab
+ [<c10b2693>] ? might_fault+0x47/0x81
+ [<c10b2693>] ? might_fault+0x47/0x81
+ [<c1167fd0>] ? _copy_from_user+0x31/0x115
+ [<c121e8c8>] ? copy_from_user+0x8/0xa
+ [<c121ebd6>] ? verify_iovec+0x3e/0x78
+ [<c1216604>] __sys_recvmsg+0x10a/0x1aa
+ [<c1216792>] ? sock_recvmsg+0x0/0xab
+ [<c105a99b>] ? __lock_acquire+0xbdf/0xbee
+ [<c12d5a99>] ? do_page_fault+0x193/0x375
+ [<c10d1200>] ? fcheck_files+0x9b/0xca
+ [<c10d1259>] ? fget_light+0x2a/0x9c
+ [<c1216bbb>] sys_recvmsg+0x2b/0x43
+ [<c1218145>] sys_socketcall+0x16d/0x1a5
+ [<c11679f0>] ? trace_hardirqs_on_thunk+0xc/0x10
+ [<c100305f>] sysenter_do_call+0x12/0x38
+Code: c6 05 8c ea a8 c1 01 e8 0c d4 d9 ff 85 f6 74 07 3e ff 86 80 00 00 00 b9 17 b6 2b c1 ba 01 00 00 00 b8 78 ed 48 c1 e8 23 f6 d9 ff <ff> 76 0c 68 28 e3 30 c1 68 2d 44 41 c1 e8 89 57 01 00 83 c4 0c
+
+Signed-off-by: James Chapman <jchapman at katalix.com>
+Acked-by: Eric Dumazet <eric.dumazet at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/l2tp/l2tp_ip.c | 5 -----
+ 1 files changed, 0 insertions(+), 5 deletions(-)
+
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index d21e7eb..55670ec 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -393,11 +393,6 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
+ {
+ int rc;
+
+- if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
+- goto drop;
+-
+- nf_reset(skb);
+-
+ /* Charge it to the socket, dropping if the queue is full. */
+ rc = sock_queue_rcv_skb(sk, skb);
+ if (rc < 0)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch
new file mode 100644
index 0000000..b2c541a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch
@@ -0,0 +1,34 @@
+From 9a5ecd485e43ba300c72a2c44a4e966b23750c5e Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet at gmail.com>
+Date: Mon, 23 Jan 2012 05:38:59 +0000
+Subject: [PATCH 75/90] macvlan: fix a possible use after free
+
+[ Upstream commit 4ec7ac1203bcf21f5e3d977c9818b1a56c9ef40d ]
+
+Commit bc416d9768 (macvlan: handle fragmented multicast frames) added a
+possible use after free in macvlan_handle_frame(), since
+ip_check_defrag() uses pskb_may_pull() : skb header can be reallocated.
+
+Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
+Cc: Ben Greear <greearb at candelatech.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/net/macvlan.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 7413497..959d448 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -172,6 +172,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
+ skb = ip_check_defrag(skb, IP_DEFRAG_MACVLAN);
+ if (!skb)
+ return RX_HANDLER_CONSUMED;
++ eth = eth_hdr(skb);
+ src = macvlan_hash_lookup(port, eth->h_source);
+ if (!src)
+ /* frame comes from an external address */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch
new file mode 100644
index 0000000..aaf9a46
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch
@@ -0,0 +1,129 @@
+From ad23030b9029340bee87a03793aaaa98b1df8a18 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet at gmail.com>
+Date: Wed, 18 Jan 2012 07:21:42 +0000
+Subject: [PATCH 76/90] net: bpf_jit: fix divide by 0 generation
+
+[ Upstream commit d00a9dd21bdf7908b70866794c8313ee8a5abd5c ]
+
+Several problems fixed in this patch :
+
+1) Target of the conditional jump in case a divide by 0 is performed
+ by a bpf is wrong.
+
+2) Must 'generate' the full function prologue/epilogue at pass=0,
+ or else we can stop too early in pass=1 if the proglen doesnt change.
+ (if the increase of prologue/epilogue equals decrease of all
+ instructions length because some jumps are converted to near jumps)
+
+3) Change the wrong length detection at the end of code generation to
+ issue a more explicit message, no need for a full stack trace.
+
+Reported-by: Phil Oester <kernel at linuxace.com>
+Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ arch/x86/net/bpf_jit_comp.c | 36 ++++++++++++++++++++++--------------
+ 1 files changed, 22 insertions(+), 14 deletions(-)
+
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 7b65f75..7c1b765 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -151,17 +151,18 @@ void bpf_jit_compile(struct sk_filter *fp)
+ cleanup_addr = proglen; /* epilogue address */
+
+ for (pass = 0; pass < 10; pass++) {
++ u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
+ /* no prologue/epilogue for trivial filters (RET something) */
+ proglen = 0;
+ prog = temp;
+
+- if (seen) {
++ if (seen_or_pass0) {
+ EMIT4(0x55, 0x48, 0x89, 0xe5); /* push %rbp; mov %rsp,%rbp */
+ EMIT4(0x48, 0x83, 0xec, 96); /* subq $96,%rsp */
+ /* note : must save %rbx in case bpf_error is hit */
+- if (seen & (SEEN_XREG | SEEN_DATAREF))
++ if (seen_or_pass0 & (SEEN_XREG | SEEN_DATAREF))
+ EMIT4(0x48, 0x89, 0x5d, 0xf8); /* mov %rbx, -8(%rbp) */
+- if (seen & SEEN_XREG)
++ if (seen_or_pass0 & SEEN_XREG)
+ CLEAR_X(); /* make sure we dont leek kernel memory */
+
+ /*
+@@ -170,7 +171,7 @@ void bpf_jit_compile(struct sk_filter *fp)
+ * r9 = skb->len - skb->data_len
+ * r8 = skb->data
+ */
+- if (seen & SEEN_DATAREF) {
++ if (seen_or_pass0 & SEEN_DATAREF) {
+ if (offsetof(struct sk_buff, len) <= 127)
+ /* mov off8(%rdi),%r9d */
+ EMIT4(0x44, 0x8b, 0x4f, offsetof(struct sk_buff, len));
+@@ -260,9 +261,14 @@ void bpf_jit_compile(struct sk_filter *fp)
+ case BPF_S_ALU_DIV_X: /* A /= X; */
+ seen |= SEEN_XREG;
+ EMIT2(0x85, 0xdb); /* test %ebx,%ebx */
+- if (pc_ret0 != -1)
+- EMIT_COND_JMP(X86_JE, addrs[pc_ret0] - (addrs[i] - 4));
+- else {
++ if (pc_ret0 > 0) {
++ /* addrs[pc_ret0 - 1] is start address of target
++ * (addrs[i] - 4) is the address following this jmp
++ * ("xor %edx,%edx; div %ebx" being 4 bytes long)
++ */
++ EMIT_COND_JMP(X86_JE, addrs[pc_ret0 - 1] -
++ (addrs[i] - 4));
++ } else {
+ EMIT_COND_JMP(X86_JNE, 2 + 5);
+ CLEAR_A();
+ EMIT1_off32(0xe9, cleanup_addr - (addrs[i] - 4)); /* jmp .+off32 */
+@@ -335,12 +341,12 @@ void bpf_jit_compile(struct sk_filter *fp)
+ }
+ /* fallinto */
+ case BPF_S_RET_A:
+- if (seen) {
++ if (seen_or_pass0) {
+ if (i != flen - 1) {
+ EMIT_JMP(cleanup_addr - addrs[i]);
+ break;
+ }
+- if (seen & SEEN_XREG)
++ if (seen_or_pass0 & SEEN_XREG)
+ EMIT4(0x48, 0x8b, 0x5d, 0xf8); /* mov -8(%rbp),%rbx */
+ EMIT1(0xc9); /* leaveq */
+ }
+@@ -483,8 +489,9 @@ common_load: seen |= SEEN_DATAREF;
+ goto common_load;
+ case BPF_S_LDX_B_MSH:
+ if ((int)K < 0) {
+- if (pc_ret0 != -1) {
+- EMIT_JMP(addrs[pc_ret0] - addrs[i]);
++ if (pc_ret0 > 0) {
++ /* addrs[pc_ret0 - 1] is the start address */
++ EMIT_JMP(addrs[pc_ret0 - 1] - addrs[i]);
+ break;
+ }
+ CLEAR_A();
+@@ -599,13 +606,14 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
+ * use it to give the cleanup instruction(s) addr
+ */
+ cleanup_addr = proglen - 1; /* ret */
+- if (seen)
++ if (seen_or_pass0)
+ cleanup_addr -= 1; /* leaveq */
+- if (seen & SEEN_XREG)
++ if (seen_or_pass0 & SEEN_XREG)
+ cleanup_addr -= 4; /* mov -8(%rbp),%rbx */
+
+ if (image) {
+- WARN_ON(proglen != oldproglen);
++ if (proglen != oldproglen)
++ pr_err("bpb_jit_compile proglen=%u != oldproglen=%u\n", proglen, oldproglen);
+ break;
+ }
+ if (proglen == oldproglen) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch
new file mode 100644
index 0000000..71efe19
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch
@@ -0,0 +1,703 @@
+From c0c50d4a259eca186611e172563f5a6a06566b79 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet at gmail.com>
+Date: Thu, 12 Jan 2012 04:41:32 +0000
+Subject: [PATCH 77/90] net: reintroduce missing rcu_assign_pointer() calls
+
+[ Upstream commit cf778b00e96df6d64f8e21b8395d1f8a859ecdc7 ]
+
+commit a9b3cd7f32 (rcu: convert uses of rcu_assign_pointer(x, NULL) to
+RCU_INIT_POINTER) did a lot of incorrect changes, since it did a
+complete conversion of rcu_assign_pointer(x, y) to RCU_INIT_POINTER(x,
+y).
+
+We miss needed barriers, even on x86, when y is not NULL.
+
+Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
+CC: Stephen Hemminger <shemminger at vyatta.com>
+CC: Paul E. McKenney <paulmck at linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 6 +++---
+ net/core/netpoll.c | 2 +-
+ net/decnet/dn_dev.c | 4 ++--
+ net/ipv4/devinet.c | 2 +-
+ net/ipv4/fib_trie.c | 10 +++++-----
+ net/ipv4/igmp.c | 8 ++++----
+ net/ipv4/ipip.c | 8 ++++----
+ net/ipv4/ipmr.c | 2 +-
+ net/ipv6/addrconf.c | 2 +-
+ net/ipv6/ip6_tunnel.c | 8 ++++----
+ net/ipv6/raw.c | 2 +-
+ net/ipv6/sit.c | 10 +++++-----
+ net/mac80211/agg-rx.c | 2 +-
+ net/mac80211/cfg.c | 4 ++--
+ net/mac80211/ibss.c | 2 +-
+ net/mac80211/sta_info.c | 6 +++---
+ net/netfilter/nf_conntrack_core.c | 2 +-
+ net/netfilter/nf_conntrack_ecache.c | 4 ++--
+ net/netfilter/nf_conntrack_extend.c | 2 +-
+ net/netfilter/nf_conntrack_helper.c | 2 +-
+ net/netfilter/nf_conntrack_netlink.c | 2 +-
+ net/netfilter/nf_log.c | 6 +++---
+ net/netfilter/nf_queue.c | 2 +-
+ net/netfilter/nfnetlink.c | 4 ++--
+ net/netlabel/netlabel_domainhash.c | 4 ++--
+ net/netlabel/netlabel_unlabeled.c | 6 ++----
+ net/phonet/af_phonet.c | 2 +-
+ net/phonet/pn_dev.c | 2 +-
+ net/phonet/socket.c | 2 +-
+ net/socket.c | 2 +-
+ net/sunrpc/auth_gss/auth_gss.c | 2 +-
+ net/xfrm/xfrm_user.c | 2 +-
+ 32 files changed, 61 insertions(+), 63 deletions(-)
+
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index 385aefe..0329404 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -990,9 +990,9 @@ static ssize_t store_xps_map(struct netdev_queue *queue,
+ nonempty = 1;
+ }
+
+- if (nonempty)
+- RCU_INIT_POINTER(dev->xps_maps, new_dev_maps);
+- else {
++ if (nonempty) {
++ rcu_assign_pointer(dev->xps_maps, new_dev_maps);
++ } else {
+ kfree(new_dev_maps);
+ RCU_INIT_POINTER(dev->xps_maps, NULL);
+ }
+diff --git a/net/core/netpoll.c b/net/core/netpoll.c
+index cf64c1f..5d4d896 100644
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -763,7 +763,7 @@ int __netpoll_setup(struct netpoll *np)
+ }
+
+ /* last thing to do is link it to the net device structure */
+- RCU_INIT_POINTER(ndev->npinfo, npinfo);
++ rcu_assign_pointer(ndev->npinfo, npinfo);
+
+ return 0;
+
+diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
+index 2ab16e1..74d321a 100644
+--- a/net/decnet/dn_dev.c
++++ b/net/decnet/dn_dev.c
+@@ -388,7 +388,7 @@ static int dn_dev_insert_ifa(struct dn_dev *dn_db, struct dn_ifaddr *ifa)
+ }
+
+ ifa->ifa_next = dn_db->ifa_list;
+- RCU_INIT_POINTER(dn_db->ifa_list, ifa);
++ rcu_assign_pointer(dn_db->ifa_list, ifa);
+
+ dn_ifaddr_notify(RTM_NEWADDR, ifa);
+ blocking_notifier_call_chain(&dnaddr_chain, NETDEV_UP, ifa);
+@@ -1093,7 +1093,7 @@ static struct dn_dev *dn_dev_create(struct net_device *dev, int *err)
+
+ memcpy(&dn_db->parms, p, sizeof(struct dn_dev_parms));
+
+- RCU_INIT_POINTER(dev->dn_ptr, dn_db);
++ rcu_assign_pointer(dev->dn_ptr, dn_db);
+ dn_db->dev = dev;
+ init_timer(&dn_db->timer);
+
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index 65f01dc..e41c40f 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -258,7 +258,7 @@ static struct in_device *inetdev_init(struct net_device *dev)
+ ip_mc_up(in_dev);
+
+ /* we can receive as soon as ip_ptr is set -- do this last */
+- RCU_INIT_POINTER(dev->ip_ptr, in_dev);
++ rcu_assign_pointer(dev->ip_ptr, in_dev);
+ out:
+ return in_dev;
+ out_kfree:
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 37b6711..3ce23f9 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -205,7 +205,7 @@ static inline struct tnode *node_parent_rcu(const struct rt_trie_node *node)
+ return (struct tnode *)(parent & ~NODE_TYPE_MASK);
+ }
+
+-/* Same as RCU_INIT_POINTER
++/* Same as rcu_assign_pointer
+ * but that macro() assumes that value is a pointer.
+ */
+ static inline void node_set_parent(struct rt_trie_node *node, struct tnode *ptr)
+@@ -529,7 +529,7 @@ static void tnode_put_child_reorg(struct tnode *tn, int i, struct rt_trie_node *
+ if (n)
+ node_set_parent(n, tn);
+
+- RCU_INIT_POINTER(tn->child[i], n);
++ rcu_assign_pointer(tn->child[i], n);
+ }
+
+ #define MAX_WORK 10
+@@ -1015,7 +1015,7 @@ static void trie_rebalance(struct trie *t, struct tnode *tn)
+
+ tp = node_parent((struct rt_trie_node *) tn);
+ if (!tp)
+- RCU_INIT_POINTER(t->trie, (struct rt_trie_node *)tn);
++ rcu_assign_pointer(t->trie, (struct rt_trie_node *)tn);
+
+ tnode_free_flush();
+ if (!tp)
+@@ -1027,7 +1027,7 @@ static void trie_rebalance(struct trie *t, struct tnode *tn)
+ if (IS_TNODE(tn))
+ tn = (struct tnode *)resize(t, (struct tnode *)tn);
+
+- RCU_INIT_POINTER(t->trie, (struct rt_trie_node *)tn);
++ rcu_assign_pointer(t->trie, (struct rt_trie_node *)tn);
+ tnode_free_flush();
+ }
+
+@@ -1164,7 +1164,7 @@ static struct list_head *fib_insert_node(struct trie *t, u32 key, int plen)
+ put_child(t, (struct tnode *)tp, cindex,
+ (struct rt_trie_node *)tn);
+ } else {
+- RCU_INIT_POINTER(t->trie, (struct rt_trie_node *)tn);
++ rcu_assign_pointer(t->trie, (struct rt_trie_node *)tn);
+ tp = tn;
+ }
+ }
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index c3cc64c..c8989a7 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -1244,7 +1244,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
+
+ im->next_rcu = in_dev->mc_list;
+ in_dev->mc_count++;
+- RCU_INIT_POINTER(in_dev->mc_list, im);
++ rcu_assign_pointer(in_dev->mc_list, im);
+
+ #ifdef CONFIG_IP_MULTICAST
+ igmpv3_del_delrec(in_dev, im->multiaddr);
+@@ -1816,7 +1816,7 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
+ iml->next_rcu = inet->mc_list;
+ iml->sflist = NULL;
+ iml->sfmode = MCAST_EXCLUDE;
+- RCU_INIT_POINTER(inet->mc_list, iml);
++ rcu_assign_pointer(inet->mc_list, iml);
+ ip_mc_inc_group(in_dev, addr);
+ err = 0;
+ done:
+@@ -2003,7 +2003,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
+ atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+ kfree_rcu(psl, rcu);
+ }
+- RCU_INIT_POINTER(pmc->sflist, newpsl);
++ rcu_assign_pointer(pmc->sflist, newpsl);
+ psl = newpsl;
+ }
+ rv = 1; /* > 0 for insert logic below if sl_count is 0 */
+@@ -2106,7 +2106,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
+ } else
+ (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
+ 0, NULL, 0);
+- RCU_INIT_POINTER(pmc->sflist, newpsl);
++ rcu_assign_pointer(pmc->sflist, newpsl);
+ pmc->sfmode = msf->imsf_fmode;
+ err = 0;
+ done:
+diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
+index 0b2e732..17ad951 100644
+--- a/net/ipv4/ipip.c
++++ b/net/ipv4/ipip.c
+@@ -231,7 +231,7 @@ static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
+ (iter = rtnl_dereference(*tp)) != NULL;
+ tp = &iter->next) {
+ if (t == iter) {
+- RCU_INIT_POINTER(*tp, t->next);
++ rcu_assign_pointer(*tp, t->next);
+ break;
+ }
+ }
+@@ -241,8 +241,8 @@ static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
+ {
+ struct ip_tunnel __rcu **tp = ipip_bucket(ipn, t);
+
+- RCU_INIT_POINTER(t->next, rtnl_dereference(*tp));
+- RCU_INIT_POINTER(*tp, t);
++ rcu_assign_pointer(t->next, rtnl_dereference(*tp));
++ rcu_assign_pointer(*tp, t);
+ }
+
+ static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
+@@ -792,7 +792,7 @@ static int __net_init ipip_fb_tunnel_init(struct net_device *dev)
+ return -ENOMEM;
+
+ dev_hold(dev);
+- RCU_INIT_POINTER(ipn->tunnels_wc[0], tunnel);
++ rcu_assign_pointer(ipn->tunnels_wc[0], tunnel);
+ return 0;
+ }
+
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 76a7f07..d2aae27 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1225,7 +1225,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
+
+ ret = ip_ra_control(sk, 1, mrtsock_destruct);
+ if (ret == 0) {
+- RCU_INIT_POINTER(mrt->mroute_sk, sk);
++ rcu_assign_pointer(mrt->mroute_sk, sk);
+ IPV4_DEVCONF_ALL(net, MC_FORWARDING)++;
+ }
+ rtnl_unlock();
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 36806de..836c4ea 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -429,7 +429,7 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
+ ndev->tstamp = jiffies;
+ addrconf_sysctl_register(ndev);
+ /* protected by rtnl_lock */
+- RCU_INIT_POINTER(dev->ip6_ptr, ndev);
++ rcu_assign_pointer(dev->ip6_ptr, ndev);
+
+ /* Join all-node multicast group */
+ ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 4e2e9ff..d19f499 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -218,8 +218,8 @@ ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
+ {
+ struct ip6_tnl __rcu **tp = ip6_tnl_bucket(ip6n, &t->parms);
+
+- RCU_INIT_POINTER(t->next , rtnl_dereference(*tp));
+- RCU_INIT_POINTER(*tp, t);
++ rcu_assign_pointer(t->next , rtnl_dereference(*tp));
++ rcu_assign_pointer(*tp, t);
+ }
+
+ /**
+@@ -237,7 +237,7 @@ ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
+ (iter = rtnl_dereference(*tp)) != NULL;
+ tp = &iter->next) {
+ if (t == iter) {
+- RCU_INIT_POINTER(*tp, t->next);
++ rcu_assign_pointer(*tp, t->next);
+ break;
+ }
+ }
+@@ -1450,7 +1450,7 @@ static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
+
+ t->parms.proto = IPPROTO_IPV6;
+ dev_hold(dev);
+- RCU_INIT_POINTER(ip6n->tnls_wc[0], t);
++ rcu_assign_pointer(ip6n->tnls_wc[0], t);
+ return 0;
+ }
+
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 331af3b..361ebf3 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -131,7 +131,7 @@ static mh_filter_t __rcu *mh_filter __read_mostly;
+
+ int rawv6_mh_filter_register(mh_filter_t filter)
+ {
+- RCU_INIT_POINTER(mh_filter, filter);
++ rcu_assign_pointer(mh_filter, filter);
+ return 0;
+ }
+ EXPORT_SYMBOL(rawv6_mh_filter_register);
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 96f3623..72a939d 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -182,7 +182,7 @@ static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
+ (iter = rtnl_dereference(*tp)) != NULL;
+ tp = &iter->next) {
+ if (t == iter) {
+- RCU_INIT_POINTER(*tp, t->next);
++ rcu_assign_pointer(*tp, t->next);
+ break;
+ }
+ }
+@@ -192,8 +192,8 @@ static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
+ {
+ struct ip_tunnel __rcu **tp = ipip6_bucket(sitn, t);
+
+- RCU_INIT_POINTER(t->next, rtnl_dereference(*tp));
+- RCU_INIT_POINTER(*tp, t);
++ rcu_assign_pointer(t->next, rtnl_dereference(*tp));
++ rcu_assign_pointer(*tp, t);
+ }
+
+ static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
+@@ -393,7 +393,7 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
+ p->addr = a->addr;
+ p->flags = a->flags;
+ t->prl_count++;
+- RCU_INIT_POINTER(t->prl, p);
++ rcu_assign_pointer(t->prl, p);
+ out:
+ return err;
+ }
+@@ -1177,7 +1177,7 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
+ if (!dev->tstats)
+ return -ENOMEM;
+ dev_hold(dev);
+- RCU_INIT_POINTER(sitn->tunnels_wc[0], tunnel);
++ rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
+ return 0;
+ }
+
+diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
+index 93b2434..41c2310 100644
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -326,7 +326,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
+ status = WLAN_STATUS_SUCCESS;
+
+ /* activate it for RX */
+- RCU_INIT_POINTER(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
++ rcu_assign_pointer(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
+
+ if (timeout)
+ mod_timer(&tid_agg_rx->session_timer, TU_TO_EXP_TIME(timeout));
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index d06c65f..11cee76 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -575,7 +575,7 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
+
+ sdata->vif.bss_conf.dtim_period = new->dtim_period;
+
+- RCU_INIT_POINTER(sdata->u.ap.beacon, new);
++ rcu_assign_pointer(sdata->u.ap.beacon, new);
+
+ synchronize_rcu();
+
+@@ -922,7 +922,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
+ return -EBUSY;
+ }
+
+- RCU_INIT_POINTER(vlansdata->u.vlan.sta, sta);
++ rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
+ }
+
+ sta->sdata = vlansdata;
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index ede9a8b..3ece106 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -184,7 +184,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+ *pos++ = 0; /* U-APSD no in use */
+ }
+
+- RCU_INIT_POINTER(ifibss->presp, skb);
++ rcu_assign_pointer(ifibss->presp, skb);
+
+ sdata->vif.bss_conf.beacon_int = beacon_int;
+ sdata->vif.bss_conf.basic_rates = basic_rates;
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 8eaa746..1fdd8ff 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -73,7 +73,7 @@ static int sta_info_hash_del(struct ieee80211_local *local,
+ if (!s)
+ return -ENOENT;
+ if (s == sta) {
+- RCU_INIT_POINTER(local->sta_hash[STA_HASH(sta->sta.addr)],
++ rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)],
+ s->hnext);
+ return 0;
+ }
+@@ -83,7 +83,7 @@ static int sta_info_hash_del(struct ieee80211_local *local,
+ s = rcu_dereference_protected(s->hnext,
+ lockdep_is_held(&local->sta_lock));
+ if (rcu_access_pointer(s->hnext)) {
+- RCU_INIT_POINTER(s->hnext, sta->hnext);
++ rcu_assign_pointer(s->hnext, sta->hnext);
+ return 0;
+ }
+
+@@ -232,7 +232,7 @@ static void sta_info_hash_add(struct ieee80211_local *local,
+ struct sta_info *sta)
+ {
+ sta->hnext = local->sta_hash[STA_HASH(sta->sta.addr)];
+- RCU_INIT_POINTER(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
++ rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
+ }
+
+ static void sta_unblock(struct work_struct *wk)
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 7202b06..1d15193 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -776,7 +776,7 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
+ if (exp->helper) {
+ help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
+ if (help)
+- RCU_INIT_POINTER(help->helper, exp->helper);
++ rcu_assign_pointer(help->helper, exp->helper);
+ }
+
+ #ifdef CONFIG_NF_CONNTRACK_MARK
+diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
+index b62c414..14af632 100644
+--- a/net/netfilter/nf_conntrack_ecache.c
++++ b/net/netfilter/nf_conntrack_ecache.c
+@@ -91,7 +91,7 @@ int nf_conntrack_register_notifier(struct net *net,
+ ret = -EBUSY;
+ goto out_unlock;
+ }
+- RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, new);
++ rcu_assign_pointer(net->ct.nf_conntrack_event_cb, new);
+ mutex_unlock(&nf_ct_ecache_mutex);
+ return ret;
+
+@@ -128,7 +128,7 @@ int nf_ct_expect_register_notifier(struct net *net,
+ ret = -EBUSY;
+ goto out_unlock;
+ }
+- RCU_INIT_POINTER(net->ct.nf_expect_event_cb, new);
++ rcu_assign_pointer(net->ct.nf_expect_event_cb, new);
+ mutex_unlock(&nf_ct_ecache_mutex);
+ return ret;
+
+diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
+index 4605c94..641ff5f 100644
+--- a/net/netfilter/nf_conntrack_extend.c
++++ b/net/netfilter/nf_conntrack_extend.c
+@@ -169,7 +169,7 @@ int nf_ct_extend_register(struct nf_ct_ext_type *type)
+ before updating alloc_size */
+ type->alloc_size = ALIGN(sizeof(struct nf_ct_ext), type->align)
+ + type->len;
+- RCU_INIT_POINTER(nf_ct_ext_types[type->id], type);
++ rcu_assign_pointer(nf_ct_ext_types[type->id], type);
+ update_alloc_size(type);
+ out:
+ mutex_unlock(&nf_ct_ext_type_mutex);
+diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
+index 93c4bdb..bbe23ba 100644
+--- a/net/netfilter/nf_conntrack_helper.c
++++ b/net/netfilter/nf_conntrack_helper.c
+@@ -145,7 +145,7 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
+ memset(&help->help, 0, sizeof(help->help));
+ }
+
+- RCU_INIT_POINTER(help->helper, helper);
++ rcu_assign_pointer(help->helper, helper);
+ out:
+ return ret;
+ }
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 257e772..782cdcd 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -1163,7 +1163,7 @@ ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[])
+ return -EOPNOTSUPP;
+ }
+
+- RCU_INIT_POINTER(help->helper, helper);
++ rcu_assign_pointer(help->helper, helper);
+
+ return 0;
+ }
+diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
+index ce0c406..957374a 100644
+--- a/net/netfilter/nf_log.c
++++ b/net/netfilter/nf_log.c
+@@ -55,7 +55,7 @@ int nf_log_register(u_int8_t pf, struct nf_logger *logger)
+ llog = rcu_dereference_protected(nf_loggers[pf],
+ lockdep_is_held(&nf_log_mutex));
+ if (llog == NULL)
+- RCU_INIT_POINTER(nf_loggers[pf], logger);
++ rcu_assign_pointer(nf_loggers[pf], logger);
+ }
+
+ mutex_unlock(&nf_log_mutex);
+@@ -92,7 +92,7 @@ int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger)
+ mutex_unlock(&nf_log_mutex);
+ return -ENOENT;
+ }
+- RCU_INIT_POINTER(nf_loggers[pf], logger);
++ rcu_assign_pointer(nf_loggers[pf], logger);
+ mutex_unlock(&nf_log_mutex);
+ return 0;
+ }
+@@ -250,7 +250,7 @@ static int nf_log_proc_dostring(ctl_table *table, int write,
+ mutex_unlock(&nf_log_mutex);
+ return -ENOENT;
+ }
+- RCU_INIT_POINTER(nf_loggers[tindex], logger);
++ rcu_assign_pointer(nf_loggers[tindex], logger);
+ mutex_unlock(&nf_log_mutex);
+ } else {
+ mutex_lock(&nf_log_mutex);
+diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
+index 99ffd28..b3a7db6 100644
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -40,7 +40,7 @@ int nf_register_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh)
+ else if (old)
+ ret = -EBUSY;
+ else {
+- RCU_INIT_POINTER(queue_handler[pf], qh);
++ rcu_assign_pointer(queue_handler[pf], qh);
+ ret = 0;
+ }
+ mutex_unlock(&queue_handler_mutex);
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index c879c1a..b4f8d84 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -59,7 +59,7 @@ int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n)
+ nfnl_unlock();
+ return -EBUSY;
+ }
+- RCU_INIT_POINTER(subsys_table[n->subsys_id], n);
++ rcu_assign_pointer(subsys_table[n->subsys_id], n);
+ nfnl_unlock();
+
+ return 0;
+@@ -210,7 +210,7 @@ static int __net_init nfnetlink_net_init(struct net *net)
+ if (!nfnl)
+ return -ENOMEM;
+ net->nfnl_stash = nfnl;
+- RCU_INIT_POINTER(net->nfnl, nfnl);
++ rcu_assign_pointer(net->nfnl, nfnl);
+ return 0;
+ }
+
+diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
+index 3f905e5..e5330ed 100644
+--- a/net/netlabel/netlabel_domainhash.c
++++ b/net/netlabel/netlabel_domainhash.c
+@@ -282,7 +282,7 @@ int __init netlbl_domhsh_init(u32 size)
+ INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
+
+ spin_lock(&netlbl_domhsh_lock);
+- RCU_INIT_POINTER(netlbl_domhsh, hsh_tbl);
++ rcu_assign_pointer(netlbl_domhsh, hsh_tbl);
+ spin_unlock(&netlbl_domhsh_lock);
+
+ return 0;
+@@ -330,7 +330,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
+ &rcu_dereference(netlbl_domhsh)->tbl[bkt]);
+ } else {
+ INIT_LIST_HEAD(&entry->list);
+- RCU_INIT_POINTER(netlbl_domhsh_def, entry);
++ rcu_assign_pointer(netlbl_domhsh_def, entry);
+ }
+
+ if (entry->type == NETLBL_NLTYPE_ADDRSELECT) {
+diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
+index e251c2c..d463f5a 100644
+--- a/net/netlabel/netlabel_unlabeled.c
++++ b/net/netlabel/netlabel_unlabeled.c
+@@ -354,7 +354,7 @@ static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
+ INIT_LIST_HEAD(&iface->list);
+ if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL)
+ goto add_iface_failure;
+- RCU_INIT_POINTER(netlbl_unlhsh_def, iface);
++ rcu_assign_pointer(netlbl_unlhsh_def, iface);
+ }
+ spin_unlock(&netlbl_unlhsh_lock);
+
+@@ -1447,11 +1447,9 @@ int __init netlbl_unlabel_init(u32 size)
+ for (iter = 0; iter < hsh_tbl->size; iter++)
+ INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
+
+- rcu_read_lock();
+ spin_lock(&netlbl_unlhsh_lock);
+- RCU_INIT_POINTER(netlbl_unlhsh, hsh_tbl);
++ rcu_assign_pointer(netlbl_unlhsh, hsh_tbl);
+ spin_unlock(&netlbl_unlhsh_lock);
+- rcu_read_unlock();
+
+ register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier);
+
+diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
+index bf10ea8..d65f699 100644
+--- a/net/phonet/af_phonet.c
++++ b/net/phonet/af_phonet.c
+@@ -480,7 +480,7 @@ int __init_or_module phonet_proto_register(unsigned int protocol,
+ if (proto_tab[protocol])
+ err = -EBUSY;
+ else
+- RCU_INIT_POINTER(proto_tab[protocol], pp);
++ rcu_assign_pointer(proto_tab[protocol], pp);
+ mutex_unlock(&proto_tab_lock);
+
+ return err;
+diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
+index c582761..9b9a85e 100644
+--- a/net/phonet/pn_dev.c
++++ b/net/phonet/pn_dev.c
+@@ -390,7 +390,7 @@ int phonet_route_add(struct net_device *dev, u8 daddr)
+ daddr = daddr >> 2;
+ mutex_lock(&routes->lock);
+ if (routes->table[daddr] == NULL) {
+- RCU_INIT_POINTER(routes->table[daddr], dev);
++ rcu_assign_pointer(routes->table[daddr], dev);
+ dev_hold(dev);
+ err = 0;
+ }
+diff --git a/net/phonet/socket.c b/net/phonet/socket.c
+index 3f8d0b1..4c7eff3 100644
+--- a/net/phonet/socket.c
++++ b/net/phonet/socket.c
+@@ -680,7 +680,7 @@ int pn_sock_bind_res(struct sock *sk, u8 res)
+ mutex_lock(&resource_mutex);
+ if (pnres.sk[res] == NULL) {
+ sock_hold(sk);
+- RCU_INIT_POINTER(pnres.sk[res], sk);
++ rcu_assign_pointer(pnres.sk[res], sk);
+ ret = 0;
+ }
+ mutex_unlock(&resource_mutex);
+diff --git a/net/socket.c b/net/socket.c
+index 2877647..2dce67a 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2472,7 +2472,7 @@ int sock_register(const struct net_proto_family *ops)
+ lockdep_is_held(&net_family_lock)))
+ err = -EEXIST;
+ else {
+- RCU_INIT_POINTER(net_families[ops->family], ops);
++ rcu_assign_pointer(net_families[ops->family], ops);
+ err = 0;
+ }
+ spin_unlock(&net_family_lock);
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index afb5655..db0efde 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -122,7 +122,7 @@ gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
+ if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
+ return;
+ gss_get_ctx(ctx);
+- RCU_INIT_POINTER(gss_cred->gc_ctx, ctx);
++ rcu_assign_pointer(gss_cred->gc_ctx, ctx);
+ set_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+ smp_mb__before_clear_bit();
+ clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags);
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index d0a42df..7cae73e 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -2927,7 +2927,7 @@ static int __net_init xfrm_user_net_init(struct net *net)
+ if (nlsk == NULL)
+ return -ENOMEM;
+ net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
+- RCU_INIT_POINTER(net->xfrm.nlsk, nlsk);
++ rcu_assign_pointer(net->xfrm.nlsk, nlsk);
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch
new file mode 100644
index 0000000..f8ed71f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch
@@ -0,0 +1,119 @@
+From cd494e9314acf83a286be19315a4cf99fd8de826 Mon Sep 17 00:00:00 2001
+From: "David S. Miller" <davem at davemloft.net>
+Date: Tue, 24 Jan 2012 17:03:44 -0500
+Subject: [PATCH 78/90] rds: Make rds_sock_lock BH rather than IRQ safe.
+
+[ Upstream commit efc3dbc37412c027e363736b4f4c74ee5e8ecffc ]
+
+rds_sock_info() triggers locking warnings because we try to perform a
+local_bh_enable() (via sock_i_ino()) while hardware interrupts are
+disabled (via taking rds_sock_lock).
+
+There is no reason for rds_sock_lock to be a hardware IRQ disabling
+lock, none of these access paths run in hardware interrupt context.
+
+Therefore making it a BH disabling lock is safe and sufficient to
+fix this bug.
+
+Reported-by: Kumar Sanghvi <kumaras at chelsio.com>
+Reported-by: Josh Boyer <jwboyer at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/rds/af_rds.c | 20 ++++++++------------
+ 1 files changed, 8 insertions(+), 12 deletions(-)
+
+diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
+index bb6ad81..424ff62 100644
+--- a/net/rds/af_rds.c
++++ b/net/rds/af_rds.c
+@@ -68,7 +68,6 @@ static int rds_release(struct socket *sock)
+ {
+ struct sock *sk = sock->sk;
+ struct rds_sock *rs;
+- unsigned long flags;
+
+ if (!sk)
+ goto out;
+@@ -94,10 +93,10 @@ static int rds_release(struct socket *sock)
+ rds_rdma_drop_keys(rs);
+ rds_notify_queue_get(rs, NULL);
+
+- spin_lock_irqsave(&rds_sock_lock, flags);
++ spin_lock_bh(&rds_sock_lock);
+ list_del_init(&rs->rs_item);
+ rds_sock_count--;
+- spin_unlock_irqrestore(&rds_sock_lock, flags);
++ spin_unlock_bh(&rds_sock_lock);
+
+ rds_trans_put(rs->rs_transport);
+
+@@ -409,7 +408,6 @@ static const struct proto_ops rds_proto_ops = {
+
+ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
+ {
+- unsigned long flags;
+ struct rds_sock *rs;
+
+ sock_init_data(sock, sk);
+@@ -426,10 +424,10 @@ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
+ spin_lock_init(&rs->rs_rdma_lock);
+ rs->rs_rdma_keys = RB_ROOT;
+
+- spin_lock_irqsave(&rds_sock_lock, flags);
++ spin_lock_bh(&rds_sock_lock);
+ list_add_tail(&rs->rs_item, &rds_sock_list);
+ rds_sock_count++;
+- spin_unlock_irqrestore(&rds_sock_lock, flags);
++ spin_unlock_bh(&rds_sock_lock);
+
+ return 0;
+ }
+@@ -471,12 +469,11 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
+ {
+ struct rds_sock *rs;
+ struct rds_incoming *inc;
+- unsigned long flags;
+ unsigned int total = 0;
+
+ len /= sizeof(struct rds_info_message);
+
+- spin_lock_irqsave(&rds_sock_lock, flags);
++ spin_lock_bh(&rds_sock_lock);
+
+ list_for_each_entry(rs, &rds_sock_list, rs_item) {
+ read_lock(&rs->rs_recv_lock);
+@@ -492,7 +489,7 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
+ read_unlock(&rs->rs_recv_lock);
+ }
+
+- spin_unlock_irqrestore(&rds_sock_lock, flags);
++ spin_unlock_bh(&rds_sock_lock);
+
+ lens->nr = total;
+ lens->each = sizeof(struct rds_info_message);
+@@ -504,11 +501,10 @@ static void rds_sock_info(struct socket *sock, unsigned int len,
+ {
+ struct rds_info_socket sinfo;
+ struct rds_sock *rs;
+- unsigned long flags;
+
+ len /= sizeof(struct rds_info_socket);
+
+- spin_lock_irqsave(&rds_sock_lock, flags);
++ spin_lock_bh(&rds_sock_lock);
+
+ if (len < rds_sock_count)
+ goto out;
+@@ -529,7 +525,7 @@ out:
+ lens->nr = rds_sock_count;
+ lens->each = sizeof(struct rds_info_socket);
+
+- spin_unlock_irqrestore(&rds_sock_lock, flags);
++ spin_unlock_bh(&rds_sock_lock);
+ }
+
+ static void rds_exit(void)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch
new file mode 100644
index 0000000..cea976d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch
@@ -0,0 +1,61 @@
+From 7c06cc6faed622f1060c0d745187d5db147bdcfb Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell at google.com>
+Date: Sat, 28 Jan 2012 17:29:46 +0000
+Subject: [PATCH 79/90] tcp: fix tcp_trim_head() to adjust segment count with
+ skb MSS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 5b35e1e6e9ca651e6b291c96d1106043c9af314a ]
+
+This commit fixes tcp_trim_head() to recalculate the number of
+segments in the skb with the skb's existing MSS, so trimming the head
+causes the skb segment count to be monotonically non-increasing - it
+should stay the same or go down, but not increase.
+
+Previously tcp_trim_head() used the current MSS of the connection. But
+if there was a decrease in MSS between original transmission and ACK
+(e.g. due to PMTUD), this could cause tcp_trim_head() to
+counter-intuitively increase the segment count when trimming bytes off
+the head of an skb. This violated assumptions in tcp_tso_acked() that
+tcp_trim_head() only decreases the packet count, so that packets_acked
+in tcp_tso_acked() could underflow, leading tcp_clean_rtx_queue() to
+pass u32 pkts_acked values as large as 0xffffffff to
+ca_ops->pkts_acked().
+
+As an aside, if tcp_trim_head() had really wanted the skb to reflect
+the current MSS, it should have called tcp_set_skb_tso_segs()
+unconditionally, since a decrease in MSS would mean that a
+single-packet skb should now be sliced into multiple segments.
+
+Signed-off-by: Neal Cardwell <ncardwell at google.com>
+Acked-by: Nandita Dukkipati <nanditad at google.com>
+Acked-by: Ilpo Järvinen <ilpo.jarvinen at helsinki.fi>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/ipv4/tcp_output.c | 6 ++----
+ 1 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 63170e2..097e0c7 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1138,11 +1138,9 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
+ sk_mem_uncharge(sk, len);
+ sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
+
+- /* Any change of skb->len requires recalculation of tso
+- * factor and mss.
+- */
++ /* Any change of skb->len requires recalculation of tso factor. */
+ if (tcp_skb_pcount(skb) > 1)
+- tcp_set_skb_tso_segs(sk, skb, tcp_current_mss(sk));
++ tcp_set_skb_tso_segs(sk, skb, tcp_skb_mss(skb));
+
+ return 0;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch
new file mode 100644
index 0000000..f25290f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch
@@ -0,0 +1,49 @@
+From fa61f0bd02896b7157e8f283aa3865863c22bf6c Mon Sep 17 00:00:00 2001
+From: shawnlu <shawn.lu at ericsson.com>
+Date: Fri, 20 Jan 2012 12:22:04 +0000
+Subject: [PATCH 80/90] tcp: md5: using remote adress for md5 lookup in rst
+ packet
+
+[ Upstream commit 8a622e71f58ec9f092fc99eacae0e6cf14f6e742 ]
+
+md5 key is added in socket through remote address.
+remote address should be used in finding md5 key when
+sending out reset packet.
+
+Signed-off-by: shawnlu <shawn.lu at ericsson.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/ipv4/tcp_ipv4.c | 2 +-
+ net/ipv6/tcp_ipv6.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index a9db4b1..c89e354 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -630,7 +630,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
+ arg.iov[0].iov_len = sizeof(rep.th);
+
+ #ifdef CONFIG_TCP_MD5SIG
+- key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr) : NULL;
++ key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->saddr) : NULL;
+ if (key) {
+ rep.opt[0] = htonl((TCPOPT_NOP << 24) |
+ (TCPOPT_NOP << 16) |
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 2dea4bb..b859e4a 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1084,7 +1084,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
+
+ #ifdef CONFIG_TCP_MD5SIG
+ if (sk)
+- key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
++ key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr);
+ #endif
+
+ if (th->ack)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch
new file mode 100644
index 0000000..a1a651a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch
@@ -0,0 +1,32 @@
+From 1a6d99718e0d5b2933b160cd5e7a8690e1c73ecd Mon Sep 17 00:00:00 2001
+From: Renato Caldas <rmsc at fe.up.pt>
+Date: Fri, 6 Jan 2012 15:20:51 +0000
+Subject: [PATCH 81/90] USB: serial: CP210x: Added USB-ID for the Link
+ Instruments MSO-19
+
+commit 791b7d7cf69de11275e4dccec2f538eec02cbff6 upstream.
+
+This device is a Oscilloscope/Logic Analizer/Pattern Generator/TDR,
+using a Silabs CP2103 USB to UART Bridge.
+
+Signed-off-by: Renato Caldas <rmsc at fe.up.pt>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index a1a324b..3b43d9b 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -138,6 +138,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+ { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
++ { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
+ { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
+ { } /* Terminating Entry */
+ };
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch
new file mode 100644
index 0000000..b4b68f1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch
@@ -0,0 +1,47 @@
+From 58521f4f0eea9b60818ecf8368fb0da47373e076 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold at gmail.com>
+Date: Mon, 16 Jan 2012 00:36:48 +0100
+Subject: [PATCH 82/90] USB: cp210x: call generic open last in open
+
+commit 55b2afbb92ad92e9f6b0aa4354eb1c94589280c3 upstream.
+
+Make sure port is fully initialised before calling generic open.
+
+Signed-off-by: Johan Hovold <jhovold at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 9 ++-------
+ 1 files changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 3b43d9b..cbcaddb 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -393,8 +393,6 @@ static unsigned int cp210x_quantise_baudrate(unsigned int baud) {
+
+ static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
+- int result;
+-
+ dbg("%s - port %d", __func__, port->number);
+
+ if (cp210x_set_config_single(port, CP210X_IFC_ENABLE, UART_ENABLE)) {
+@@ -403,13 +401,10 @@ static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port)
+ return -EPROTO;
+ }
+
+- result = usb_serial_generic_open(tty, port);
+- if (result)
+- return result;
+-
+ /* Configure the termios structure */
+ cp210x_get_termios(tty, port);
+- return 0;
++
++ return usb_serial_generic_open(tty, port);
+ }
+
+ static void cp210x_close(struct usb_serial_port *port)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch
new file mode 100644
index 0000000..e81cfb0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch
@@ -0,0 +1,78 @@
+From a9b16102aedd54ff9d2fe79ac4dada6c15cba91d Mon Sep 17 00:00:00 2001
+From: Preston Fick <preston.fick at silabs.com>
+Date: Mon, 16 Jan 2012 18:14:09 -0600
+Subject: [PATCH 83/90] USB: cp210x: fix CP2104 baudrate usage
+
+commit 7f482fc88ac47662228d6b1f05759797c8936a30 upstream.
+
+This fix changes the way baudrates are set on the CP210x devices from
+Silicon Labs. The CP2101/2/3 will respond to both a GET/SET_BAUDDIV
+command, and GET/SET_BAUDRATE command, while CP2104 and higher devices
+only respond to GET/SET_BAUDRATE. The current cp210x.ko driver in
+kernel version 3.2.0 only implements the GET/SET_BAUDDIV command.
+
+This patch implements the two new codes for the GET/SET_BAUDRATE
+commands. Then there is a change in the way that the baudrate is
+assigned or retrieved. This is done according to the CP210x USB
+specification in AN571. This document can be found here:
+http://www.silabs.com/pages/DownloadDoc.aspx?FILEURL=Support%20Documents/TechnicalDocs/AN571.pdf&src=DocumentationWebPart
+
+Sections 5.3/5.4 describe the USB packets for the old baudrate method.
+Sections 5.5/5.6 describe the USB packets for the new method. This
+patch also implements the new request scheme, and eliminates the
+unnecessary baudrate calculations since it uses the "actual baudrate"
+method.
+
+This patch solves the problem reported for the CP2104 in bug 42586,
+and also keeps support for all other devices (CP2101/2/3).
+
+This patchfile is also attached to the bug report on
+bugzilla.kernel.org. This patch has been developed and test on the
+3.2.0 mainline kernel version under Ubuntu 10.11.
+
+Signed-off-by: Preston Fick <preston.fick at silabs.com>
+[duplicate patch also sent by Johan - gregkh]
+Signed-off-by: Johan Hovold <jhovold at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 10 ++++------
+ 1 files changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index cbcaddb..60993dc 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -202,6 +202,8 @@ static struct usb_serial_driver cp210x_device = {
+ #define CP210X_EMBED_EVENTS 0x15
+ #define CP210X_GET_EVENTSTATE 0x16
+ #define CP210X_SET_CHARS 0x19
++#define CP210X_GET_BAUDRATE 0x1D
++#define CP210X_SET_BAUDRATE 0x1E
+
+ /* CP210X_IFC_ENABLE */
+ #define UART_ENABLE 0x0001
+@@ -456,10 +458,7 @@ static void cp210x_get_termios_port(struct usb_serial_port *port,
+
+ dbg("%s - port %d", __func__, port->number);
+
+- cp210x_get_config(port, CP210X_GET_BAUDDIV, &baud, 2);
+- /* Convert to baudrate */
+- if (baud)
+- baud = cp210x_quantise_baudrate((BAUD_RATE_GEN_FREQ + baud/2)/ baud);
++ cp210x_get_config(port, CP210X_GET_BAUDRATE, &baud, 4);
+
+ dbg("%s - baud rate = %d", __func__, baud);
+ *baudp = baud;
+@@ -594,8 +593,7 @@ static void cp210x_set_termios(struct tty_struct *tty,
+ if (baud != tty_termios_baud_rate(old_termios) && baud != 0) {
+ dbg("%s - Setting baud rate to %d baud", __func__,
+ baud);
+- if (cp210x_set_config_single(port, CP210X_SET_BAUDDIV,
+- ((BAUD_RATE_GEN_FREQ + baud/2) / baud))) {
++ if (cp210x_set_config(port, CP210X_SET_BAUDRATE, &baud, 4)) {
+ dbg("Baud rate requested not supported by device");
+ baud = tty_termios_baud_rate(old_termios);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch
new file mode 100644
index 0000000..1a934b9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch
@@ -0,0 +1,34 @@
+From 2b7e1cbfd3688396b3be797d2454d6a9f5426f42 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold at gmail.com>
+Date: Mon, 16 Jan 2012 00:36:50 +0100
+Subject: [PATCH 84/90] USB: cp210x: do not map baud rates to B0
+
+commit be125d9c8d59560e7cc2d6e2b65c8fd233498ab7 upstream.
+
+We do not implement B0 hangup yet so map low baudrates to 300bps.
+
+Signed-off-by: Johan Hovold <jhovold at gmail.com>
+Cc: Preston Fick <preston.fick at silabs.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 60993dc..1bac7b9 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -357,8 +357,8 @@ static inline int cp210x_set_config_single(struct usb_serial_port *port,
+ * Quantises the baud rate as per AN205 Table 1
+ */
+ static unsigned int cp210x_quantise_baudrate(unsigned int baud) {
+- if (baud <= 56) baud = 0;
+- else if (baud <= 300) baud = 300;
++ if (baud <= 300)
++ baud = 300;
+ else if (baud <= 600) baud = 600;
+ else if (baud <= 1200) baud = 1200;
+ else if (baud <= 1800) baud = 1800;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch
new file mode 100644
index 0000000..6744226
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch
@@ -0,0 +1,44 @@
+From 921e92f0429586c745c182cea0e8a5ac7dc3ede6 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold at gmail.com>
+Date: Mon, 16 Jan 2012 00:36:49 +0100
+Subject: [PATCH 85/90] USB: cp210x: fix up set_termios variables
+
+commit 34b76fcaee574017862ea3fa0efdcd77a9d0e57d upstream.
+
+[Based on a patch from Johan, mangled by gregkh to keep things in line]
+
+Fix up the variable usage in the set_termios call.
+
+Signed-off-by: Johan Hovold <jhovold at gmail.com>
+Cc: Preston Fick <preston.fick at silabs.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 1bac7b9..5c3b7d1 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -576,7 +576,8 @@ static void cp210x_set_termios(struct tty_struct *tty,
+ struct usb_serial_port *port, struct ktermios *old_termios)
+ {
+ unsigned int cflag, old_cflag;
+- unsigned int baud = 0, bits;
++ u32 baud;
++ unsigned int bits;
+ unsigned int modem_ctl[4];
+
+ dbg("%s - port %d", __func__, port->number);
+@@ -593,7 +594,7 @@ static void cp210x_set_termios(struct tty_struct *tty,
+ if (baud != tty_termios_baud_rate(old_termios) && baud != 0) {
+ dbg("%s - Setting baud rate to %d baud", __func__,
+ baud);
+- if (cp210x_set_config(port, CP210X_SET_BAUDRATE, &baud, 4)) {
++ if (cp210x_set_config(port, CP210X_SET_BAUDRATE, &baud, sizeof(baud))) {
+ dbg("Baud rate requested not supported by device");
+ baud = tty_termios_baud_rate(old_termios);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch
new file mode 100644
index 0000000..a1bd42a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch
@@ -0,0 +1,121 @@
+From ea11e1bb18d77066ee3e17ad703a162993261c69 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold at gmail.com>
+Date: Mon, 16 Jan 2012 00:36:51 +0100
+Subject: [PATCH 86/90] USB: cp210x: clean up, refactor and document speed
+ handling
+
+commit e5990874e511d5bbca23b3396419480cb2ca0ee7 upstream.
+
+Clean up and refactor speed handling.
+Document baud rate handling for CP210{1,2,4,5,10}.
+
+Signed-off-by: Johan Hovold <jhovold at gmail.com>
+Cc: Preston Fick <preston.fick at silabs.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 71 ++++++++++++++++++++++++++++++++++--------
+ 1 files changed, 57 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 5c3b7d1..d2c4080 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -39,6 +39,8 @@ static void cp210x_get_termios(struct tty_struct *,
+ struct usb_serial_port *port);
+ static void cp210x_get_termios_port(struct usb_serial_port *port,
+ unsigned int *cflagp, unsigned int *baudp);
++static void cp210x_change_speed(struct tty_struct *, struct usb_serial_port *,
++ struct ktermios *);
+ static void cp210x_set_termios(struct tty_struct *, struct usb_serial_port *,
+ struct ktermios*);
+ static int cp210x_tiocmget(struct tty_struct *);
+@@ -572,11 +574,62 @@ static void cp210x_get_termios_port(struct usb_serial_port *port,
+ *cflagp = cflag;
+ }
+
++/*
++ * CP2101 supports the following baud rates:
++ *
++ * 300, 600, 1200, 1800, 2400, 4800, 7200, 9600, 14400, 19200, 28800,
++ * 38400, 56000, 57600, 115200, 128000, 230400, 460800, 921600
++ *
++ * CP2102 and CP2103 support the following additional rates:
++ *
++ * 4000, 16000, 51200, 64000, 76800, 153600, 250000, 256000, 500000,
++ * 576000
++ *
++ * The device will map a requested rate to a supported one, but the result
++ * of requests for rates greater than 1053257 is undefined (see AN205).
++ *
++ * CP2104, CP2105 and CP2110 support most rates up to 2M, 921k and 1M baud,
++ * respectively, with an error less than 1%. The actual rates are determined
++ * by
++ *
++ * div = round(freq / (2 x prescale x request))
++ * actual = freq / (2 x prescale x div)
++ *
++ * For CP2104 and CP2105 freq is 48Mhz and prescale is 4 for request <= 365bps
++ * or 1 otherwise.
++ * For CP2110 freq is 24Mhz and prescale is 4 for request <= 300bps or 1
++ * otherwise.
++ */
++static void cp210x_change_speed(struct tty_struct *tty,
++ struct usb_serial_port *port, struct ktermios *old_termios)
++{
++ u32 baud;
++
++ baud = tty->termios->c_ospeed;
++
++ /* This maps the requested rate to a rate valid on cp2102 or cp2103.
++ *
++ * NOTE: B0 is not implemented.
++ */
++ baud = cp210x_quantise_baudrate(baud);
++
++ dbg("%s - setting baud rate to %u", __func__, baud);
++ if (cp210x_set_config(port, CP210X_SET_BAUDRATE, &baud,
++ sizeof(baud))) {
++ dev_warn(&port->dev, "failed to set baud rate to %u\n", baud);
++ if (old_termios)
++ baud = old_termios->c_ospeed;
++ else
++ baud = 9600;
++ }
++
++ tty_encode_baud_rate(tty, baud, baud);
++}
++
+ static void cp210x_set_termios(struct tty_struct *tty,
+ struct usb_serial_port *port, struct ktermios *old_termios)
+ {
+ unsigned int cflag, old_cflag;
+- u32 baud;
+ unsigned int bits;
+ unsigned int modem_ctl[4];
+
+@@ -588,19 +641,9 @@ static void cp210x_set_termios(struct tty_struct *tty,
+ tty->termios->c_cflag &= ~CMSPAR;
+ cflag = tty->termios->c_cflag;
+ old_cflag = old_termios->c_cflag;
+- baud = cp210x_quantise_baudrate(tty_get_baud_rate(tty));
+-
+- /* If the baud rate is to be updated*/
+- if (baud != tty_termios_baud_rate(old_termios) && baud != 0) {
+- dbg("%s - Setting baud rate to %d baud", __func__,
+- baud);
+- if (cp210x_set_config(port, CP210X_SET_BAUDRATE, &baud, sizeof(baud))) {
+- dbg("Baud rate requested not supported by device");
+- baud = tty_termios_baud_rate(old_termios);
+- }
+- }
+- /* Report back the resulting baud rate */
+- tty_encode_baud_rate(tty, baud, baud);
++
++ if (tty->termios->c_ospeed != old_termios->c_ospeed)
++ cp210x_change_speed(tty, port, old_termios);
+
+ /* If the number of data bits is to be updated */
+ if ((cflag & CSIZE) != (old_cflag & CSIZE)) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch
new file mode 100644
index 0000000..85af4e5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch
@@ -0,0 +1,35 @@
+From ee734377c7849fcf39d20c5e2557d39d498622a6 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold at gmail.com>
+Date: Mon, 16 Jan 2012 00:36:52 +0100
+Subject: [PATCH 87/90] USB: cp210x: initialise baud rate at open
+
+commit cdc32fd6f7b2b2580d7f1b74563f888e4dd9eb8a upstream.
+
+The newer cp2104 devices require the baud rate to be initialised after
+power on. Make sure it is set when port is opened.
+
+Signed-off-by: Johan Hovold <jhovold at gmail.com>
+Cc: Preston Fick <preston.fick at silabs.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index d2c4080..07d297f 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -408,6 +408,10 @@ static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port)
+ /* Configure the termios structure */
+ cp210x_get_termios(tty, port);
+
++ /* The baud rate must be initialised on cp2104 */
++ if (tty)
++ cp210x_change_speed(tty, port, NULL);
++
+ return usb_serial_generic_open(tty, port);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch
new file mode 100644
index 0000000..1c71c50
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch
@@ -0,0 +1,48 @@
+From 2f180035f2cedd14428f7f81f1ab2826e4a56faf Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold at gmail.com>
+Date: Mon, 16 Jan 2012 00:36:53 +0100
+Subject: [PATCH 88/90] USB: cp210x: allow more baud rates above 1Mbaud
+
+commit d1620ca9e7bb0030068c3b45b653defde8839dac upstream.
+
+Allow more baud rates to be set in [1M,2M] baud.
+
+Signed-off-by: Johan Hovold <jhovold at gmail.com>
+Cc: Preston Fick <preston.fick at silabs.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 11 ++++++-----
+ 1 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 07d297f..a515237 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -388,10 +388,10 @@ static unsigned int cp210x_quantise_baudrate(unsigned int baud) {
+ else if (baud <= 491520) baud = 460800;
+ else if (baud <= 567138) baud = 500000;
+ else if (baud <= 670254) baud = 576000;
+- else if (baud <= 1053257) baud = 921600;
+- else if (baud <= 1474560) baud = 1228800;
+- else if (baud <= 2457600) baud = 1843200;
+- else baud = 3686400;
++ else if (baud < 1000000)
++ baud = 921600;
++ else if (baud > 2000000)
++ baud = 2000000;
+ return baud;
+ }
+
+@@ -611,7 +611,8 @@ static void cp210x_change_speed(struct tty_struct *tty,
+
+ baud = tty->termios->c_ospeed;
+
+- /* This maps the requested rate to a rate valid on cp2102 or cp2103.
++ /* This maps the requested rate to a rate valid on cp2102 or cp2103,
++ * or to an arbitrary rate in [1M,2M].
+ *
+ * NOTE: B0 is not implemented.
+ */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch
new file mode 100644
index 0000000..006bf25
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch
@@ -0,0 +1,34 @@
+From 1fd7dd832dba5ee8aa19a3109bff21cf239b1d19 Mon Sep 17 00:00:00 2001
+From: Philippe Langlais <philippe.langlais at linaro.org>
+Date: Fri, 20 Jan 2012 09:20:40 +0100
+Subject: [PATCH 89/90] mach-ux500: no MMC_CAP_SD_HIGHSPEED on Snowball
+
+commit 2ab1159e80e8f416071e9f51e4f77b9173948296 upstream.
+
+MMC_CAP_SD_HIGHSPEED is not supported on Snowball board resulting on
+initialization errors.
+
+Signed-off-by: Mathieu Poirier <mathieu.poirier at linaro.org>
+Signed-off-by: Fredrik Soderstedt <fredrik.soderstedt at stericsson.com>
+Signed-off-by: Philippe Langlais <philippe.langlais at linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij at linaro.org>
+---
+ arch/arm/mach-ux500/board-mop500-sdi.c | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/arch/arm/mach-ux500/board-mop500-sdi.c b/arch/arm/mach-ux500/board-mop500-sdi.c
+index 6826fae..306cff0 100644
+--- a/arch/arm/mach-ux500/board-mop500-sdi.c
++++ b/arch/arm/mach-ux500/board-mop500-sdi.c
+@@ -233,6 +233,8 @@ void __init snowball_sdi_init(void)
+ {
+ u32 periphid = 0x10480180;
+
++ /* On Snowball MMC_CAP_SD_HIGHSPEED isn't supported on sdi0 */
++ mop500_sdi0_data.capabilities &= ~MMC_CAP_SD_HIGHSPEED;
+ mop500_sdi2_data.capabilities |= MMC_CAP_MMC_HIGHSPEED;
+
+ /* On-board eMMC */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0090-Linux-3.2.3.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0090-Linux-3.2.3.patch
new file mode 100644
index 0000000..7cbbd43
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0090-Linux-3.2.3.patch
@@ -0,0 +1,24 @@
+From dbc3ba5c8784f704438c8ac70ae2700b07155703 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+Date: Fri, 3 Feb 2012 09:23:33 -0800
+Subject: [PATCH 90/90] Linux 3.2.3
+
+---
+ Makefile | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 2f684da..d45e887 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 2
++SUBLEVEL = 3
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch
new file mode 100644
index 0000000..17d5d09
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch
@@ -0,0 +1,32 @@
+From 63fb1539735afe7c76e7ccdf1999f1fc0d7434e1 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+Date: Fri, 3 Feb 2012 12:26:40 -0800
+Subject: [PATCH 1/3] Revert "ASoC: Mark WM5100 register map cache only when
+ going into BIAS_OFF"
+
+This reverts commit 11a17e56ac9c607c6eaecf64b618cd17c828ade0
+(e53e417331c57b9b97e3f8be870214a02c99265c upstream) as it breaks the
+build.
+
+Reported-by: Tim Gardner <rtg.canonical at gmail.com>
+Cc: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ sound/soc/codecs/wm5100.c | 1 -
+ 1 files changed, 0 insertions(+), 1 deletions(-)
+
+diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
+index d0beeec..c745ce8 100644
+--- a/sound/soc/codecs/wm5100.c
++++ b/sound/soc/codecs/wm5100.c
+@@ -1406,7 +1406,6 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
+ break;
+
+ case SND_SOC_BIAS_OFF:
+- regcache_cache_only(wm5100->regmap, true);
+ if (wm5100->pdata.ldo_ena)
+ gpio_set_value_cansleep(wm5100->pdata.ldo_ena, 0);
+ regulator_bulk_disable(ARRAY_SIZE(wm5100->core_supplies),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch
new file mode 100644
index 0000000..4be9025
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch
@@ -0,0 +1,39 @@
+From 39fcddc24caa8cda5db70ac62ae743a02551fec5 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+Date: Fri, 3 Feb 2012 12:27:49 -0800
+Subject: [PATCH 2/3] Revert "ASoC: Don't go through cache when applying
+ WM5100 rev A updates"
+
+This reverts commit 78fd75340768980ce6ca646106762a6928289e0c (upstream
+commit 495174a8ffbaa0d15153d855cf206cdc46d51cf4) as it breaks the build.
+
+Reported-by: Tim Gardner <rtg.canonical at gmail.com>
+Cc: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ sound/soc/codecs/wm5100.c | 2 --
+ 1 files changed, 0 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
+index c745ce8..42d9039 100644
+--- a/sound/soc/codecs/wm5100.c
++++ b/sound/soc/codecs/wm5100.c
+@@ -1379,7 +1379,6 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
+
+ switch (wm5100->rev) {
+ case 0:
+- regcache_cache_bypass(wm5100->regmap, true);
+ snd_soc_write(codec, 0x11, 0x3);
+ snd_soc_write(codec, 0x203, 0xc);
+ snd_soc_write(codec, 0x206, 0);
+@@ -1395,7 +1394,6 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
+ snd_soc_write(codec,
+ wm5100_reva_patches[i].reg,
+ wm5100_reva_patches[i].val);
+- regcache_cache_bypass(wm5100->regmap, false);
+ break;
+ default:
+ break;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0003-Linux-3.2.4.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0003-Linux-3.2.4.patch
new file mode 100644
index 0000000..b893e6e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0003-Linux-3.2.4.patch
@@ -0,0 +1,24 @@
+From 141936cc59aaec665841740f2d4290c5b6e3506c Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+Date: Fri, 3 Feb 2012 12:39:51 -0800
+Subject: [PATCH 3/3] Linux 3.2.4
+
+---
+ Makefile | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index d45e887..c8e187e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0001-PCI-Rework-ASPM-disable-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0001-PCI-Rework-ASPM-disable-code.patch
new file mode 100644
index 0000000..27d41b2
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0001-PCI-Rework-ASPM-disable-code.patch
@@ -0,0 +1,236 @@
+From 2dcce0a318fcc349b50215279290c6cff7ff9379 Mon Sep 17 00:00:00 2001
+From: Matthew Garrett <mjg at redhat.com>
+Date: Thu, 10 Nov 2011 16:38:33 -0500
+Subject: [PATCH 1/2] PCI: Rework ASPM disable code
+
+commit 3c076351c4027a56d5005a39a0b518a4ba393ce2 upstream.
+
+Right now we forcibly clear ASPM state on all devices if the BIOS indicates
+that the feature isn't supported. Based on the Microsoft presentation
+"PCI Express In Depth for Windows Vista and Beyond", I'm starting to think
+that this may be an error. The implication is that unless the platform
+grants full control via _OSC, Windows will not touch any PCIe features -
+including ASPM. In that case clearing ASPM state would be an error unless
+the platform has granted us that control.
+
+This patch reworks the ASPM disabling code such that the actual clearing
+of state is triggered by a successful handoff of PCIe control to the OS.
+The general ASPM code undergoes some changes in order to ensure that the
+ability to clear the bits isn't overridden by ASPM having already been
+disabled. Further, this theoretically now allows for situations where
+only a subset of PCIe roots hand over control, leaving the others in the
+BIOS state.
+
+It's difficult to know for sure that this is the right thing to do -
+there's zero public documentation on the interaction between all of these
+components. But enough vendors enable ASPM on platforms and then set this
+bit that it seems likely that they're expecting the OS to leave them alone.
+
+Measured to save around 5W on an idle Thinkpad X220.
+
+Signed-off-by: Matthew Garrett <mjg at redhat.com>
+Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/acpi/pci_root.c | 7 +++++
+ drivers/pci/pci-acpi.c | 1 -
+ drivers/pci/pcie/aspm.c | 58 +++++++++++++++++++++++++++++----------------
+ include/linux/pci-aspm.h | 4 +-
+ 4 files changed, 46 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index 2672c79..7aff631 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -596,6 +596,13 @@ static int __devinit acpi_pci_root_add(struct acpi_device *device)
+ if (ACPI_SUCCESS(status)) {
+ dev_info(root->bus->bridge,
+ "ACPI _OSC control (0x%02x) granted\n", flags);
++ if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM) {
++ /*
++ * We have ASPM control, but the FADT indicates
++ * that it's unsupported. Clear it.
++ */
++ pcie_clear_aspm(root->bus);
++ }
+ } else {
+ dev_info(root->bus->bridge,
+ "ACPI _OSC request failed (%s), "
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index 4ecb640..c8e7585 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -395,7 +395,6 @@ static int __init acpi_pci_init(void)
+
+ if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM) {
+ printk(KERN_INFO"ACPI FADT declares the system doesn't support PCIe ASPM, so disable it\n");
+- pcie_clear_aspm();
+ pcie_no_aspm();
+ }
+
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index cbfbab1..1cfbf22 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -68,7 +68,7 @@ struct pcie_link_state {
+ struct aspm_latency acceptable[8];
+ };
+
+-static int aspm_disabled, aspm_force, aspm_clear_state;
++static int aspm_disabled, aspm_force;
+ static bool aspm_support_enabled = true;
+ static DEFINE_MUTEX(aspm_lock);
+ static LIST_HEAD(link_list);
+@@ -500,9 +500,6 @@ static int pcie_aspm_sanity_check(struct pci_dev *pdev)
+ int pos;
+ u32 reg32;
+
+- if (aspm_clear_state)
+- return -EINVAL;
+-
+ /*
+ * Some functions in a slot might not all be PCIe functions,
+ * very strange. Disable ASPM for the whole slot
+@@ -574,9 +571,6 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev)
+ pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM)
+ return;
+
+- if (aspm_disabled && !aspm_clear_state)
+- return;
+-
+ /* VIA has a strange chipset, root port is under a bridge */
+ if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT &&
+ pdev->bus->self)
+@@ -608,7 +602,7 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev)
+ * the BIOS's expectation, we'll do so once pci_enable_device() is
+ * called.
+ */
+- if (aspm_policy != POLICY_POWERSAVE || aspm_clear_state) {
++ if (aspm_policy != POLICY_POWERSAVE) {
+ pcie_config_aspm_path(link);
+ pcie_set_clkpm(link, policy_to_clkpm_state(link));
+ }
+@@ -649,8 +643,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
+ struct pci_dev *parent = pdev->bus->self;
+ struct pcie_link_state *link, *root, *parent_link;
+
+- if ((aspm_disabled && !aspm_clear_state) || !pci_is_pcie(pdev) ||
+- !parent || !parent->link_state)
++ if (!pci_is_pcie(pdev) || !parent || !parent->link_state)
+ return;
+ if ((parent->pcie_type != PCI_EXP_TYPE_ROOT_PORT) &&
+ (parent->pcie_type != PCI_EXP_TYPE_DOWNSTREAM))
+@@ -734,13 +727,18 @@ void pcie_aspm_powersave_config_link(struct pci_dev *pdev)
+ * pci_disable_link_state - disable pci device's link state, so the link will
+ * never enter specific states
+ */
+-static void __pci_disable_link_state(struct pci_dev *pdev, int state, bool sem)
++static void __pci_disable_link_state(struct pci_dev *pdev, int state, bool sem,
++ bool force)
+ {
+ struct pci_dev *parent = pdev->bus->self;
+ struct pcie_link_state *link;
+
+- if (aspm_disabled || !pci_is_pcie(pdev))
++ if (aspm_disabled && !force)
++ return;
++
++ if (!pci_is_pcie(pdev))
+ return;
++
+ if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT ||
+ pdev->pcie_type == PCI_EXP_TYPE_DOWNSTREAM)
+ parent = pdev;
+@@ -768,16 +766,31 @@ static void __pci_disable_link_state(struct pci_dev *pdev, int state, bool sem)
+
+ void pci_disable_link_state_locked(struct pci_dev *pdev, int state)
+ {
+- __pci_disable_link_state(pdev, state, false);
++ __pci_disable_link_state(pdev, state, false, false);
+ }
+ EXPORT_SYMBOL(pci_disable_link_state_locked);
+
+ void pci_disable_link_state(struct pci_dev *pdev, int state)
+ {
+- __pci_disable_link_state(pdev, state, true);
++ __pci_disable_link_state(pdev, state, true, false);
+ }
+ EXPORT_SYMBOL(pci_disable_link_state);
+
++void pcie_clear_aspm(struct pci_bus *bus)
++{
++ struct pci_dev *child;
++
++ /*
++ * Clear any ASPM setup that the firmware has carried out on this bus
++ */
++ list_for_each_entry(child, &bus->devices, bus_list) {
++ __pci_disable_link_state(child, PCIE_LINK_STATE_L0S |
++ PCIE_LINK_STATE_L1 |
++ PCIE_LINK_STATE_CLKPM,
++ false, true);
++ }
++}
++
+ static int pcie_aspm_set_policy(const char *val, struct kernel_param *kp)
+ {
+ int i;
+@@ -935,6 +948,7 @@ void pcie_aspm_remove_sysfs_dev_files(struct pci_dev *pdev)
+ static int __init pcie_aspm_disable(char *str)
+ {
+ if (!strcmp(str, "off")) {
++ aspm_policy = POLICY_DEFAULT;
+ aspm_disabled = 1;
+ aspm_support_enabled = false;
+ printk(KERN_INFO "PCIe ASPM is disabled\n");
+@@ -947,16 +961,18 @@ static int __init pcie_aspm_disable(char *str)
+
+ __setup("pcie_aspm=", pcie_aspm_disable);
+
+-void pcie_clear_aspm(void)
+-{
+- if (!aspm_force)
+- aspm_clear_state = 1;
+-}
+-
+ void pcie_no_aspm(void)
+ {
+- if (!aspm_force)
++ /*
++ * Disabling ASPM is intended to prevent the kernel from modifying
++ * existing hardware state, not to clear existing state. To that end:
++ * (a) set policy to POLICY_DEFAULT in order to avoid changing state
++ * (b) prevent userspace from changing policy
++ */
++ if (!aspm_force) {
++ aspm_policy = POLICY_DEFAULT;
+ aspm_disabled = 1;
++ }
+ }
+
+ /**
+diff --git a/include/linux/pci-aspm.h b/include/linux/pci-aspm.h
+index 7cea7b6..c832014 100644
+--- a/include/linux/pci-aspm.h
++++ b/include/linux/pci-aspm.h
+@@ -29,7 +29,7 @@ extern void pcie_aspm_pm_state_change(struct pci_dev *pdev);
+ extern void pcie_aspm_powersave_config_link(struct pci_dev *pdev);
+ extern void pci_disable_link_state(struct pci_dev *pdev, int state);
+ extern void pci_disable_link_state_locked(struct pci_dev *pdev, int state);
+-extern void pcie_clear_aspm(void);
++extern void pcie_clear_aspm(struct pci_bus *bus);
+ extern void pcie_no_aspm(void);
+ #else
+ static inline void pcie_aspm_init_link_state(struct pci_dev *pdev)
+@@ -47,7 +47,7 @@ static inline void pcie_aspm_powersave_config_link(struct pci_dev *pdev)
+ static inline void pci_disable_link_state(struct pci_dev *pdev, int state)
+ {
+ }
+-static inline void pcie_clear_aspm(void)
++static inline void pcie_clear_aspm(struct pci_bus *bus)
+ {
+ }
+ static inline void pcie_no_aspm(void)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0002-Linux-3.2.5.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0002-Linux-3.2.5.patch
new file mode 100644
index 0000000..8712268
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0002-Linux-3.2.5.patch
@@ -0,0 +1,24 @@
+From 61339713b47d8905f3079bbd63d8e29343dd86ef Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+Date: Mon, 6 Feb 2012 09:47:00 -0800
+Subject: [PATCH 2/2] Linux 3.2.5
+
+---
+ Makefile | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index c8e187e..e9dd0ff 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt b/recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt
new file mode 100644
index 0000000..916c5c5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt
@@ -0,0 +1,295 @@
+ file://3.2.1/0001-MAINTAINERS-stable-Update-address.patch \
+ file://3.2.1/0002-Documentation-Update-stable-address.patch \
+ file://3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch \
+ file://3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch \
+ file://3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch \
+ file://3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch \
+ file://3.2.1/0007-libertas-clean-up-scan-thread-handling.patch \
+ file://3.2.1/0008-bcma-support-for-suspend-and-resume.patch \
+ file://3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch \
+ file://3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch \
+ file://3.2.1/0011-wl12xx-Restore-testmode-ABI.patch \
+ file://3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch \
+ file://3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch \
+ file://3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch \
+ file://3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch \
+ file://3.2.1/0016-iwlagn-fix-TID-use-bug.patch \
+ file://3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch \
+ file://3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch \
+ file://3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch \
+ file://3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch \
+ file://3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch \
+ file://3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch \
+ file://3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch \
+ file://3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch \
+ file://3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch \
+ file://3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch \
+ file://3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch \
+ file://3.2.1/0028-USB-update-documentation-for-usbmon.patch \
+ file://3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch \
+ file://3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch \
+ file://3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch \
+ file://3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch \
+ file://3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch \
+ file://3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch \
+ file://3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch \
+ file://3.2.1/0036-USB-pxa168-Fix-compilation-error.patch \
+ file://3.2.1/0037-USB-add-quirk-for-another-camera.patch \
+ file://3.2.1/0038-usb-musb-fix-pm_runtime-mismatch.patch \
+ file://3.2.1/0039-USB-omninet-fix-write_room.patch \
+ file://3.2.1/0040-usb-option-add-ZD-Incorporated-HSPA-modem.patch \
+ file://3.2.1/0041-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch \
+ file://3.2.1/0042-usb-fix-number-of-mapped-SG-DMA-entries.patch \
+ file://3.2.1/0043-xhci-Properly-handle-COMP_2ND_BW_ERR.patch \
+ file://3.2.1/0044-usb-ch9-fix-up-MaxStreams-helper.patch \
+ file://3.2.1/0045-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch \
+ file://3.2.1/0046-asix-fix-infinite-loop-in-rx_fixup.patch \
+ file://3.2.1/0047-bonding-fix-error-handling-if-slave-is-busy-v2.patch \
+ file://3.2.1/0048-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch \
+ file://3.2.1/0049-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch \
+ file://3.2.1/0050-Linux-3.2.1.patch \
+ file://3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch \
+ file://3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch \
+ file://3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch \
+ file://3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch \
+ file://3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch \
+ file://3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch \
+ file://3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch \
+ file://3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch \
+ file://3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch \
+ file://3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch \
+ file://3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch \
+ file://3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch \
+ file://3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch \
+ file://3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch \
+ file://3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch \
+ file://3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch \
+ file://3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch \
+ file://3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch \
+ file://3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch \
+ file://3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch \
+ file://3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch \
+ file://3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch \
+ file://3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch \
+ file://3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch \
+ file://3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch \
+ file://3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch \
+ file://3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch \
+ file://3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch \
+ file://3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch \
+ file://3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch \
+ file://3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch \
+ file://3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch \
+ file://3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch \
+ file://3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch \
+ file://3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch \
+ file://3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch \
+ file://3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch \
+ file://3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch \
+ file://3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch \
+ file://3.2.2/0040-ima-free-duplicate-measurement-memory.patch \
+ file://3.2.2/0041-ima-fix-invalid-memory-reference.patch \
+ file://3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch \
+ file://3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch \
+ file://3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch \
+ file://3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch \
+ file://3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch \
+ file://3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch \
+ file://3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch \
+ file://3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch \
+ file://3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch \
+ file://3.2.2/0051-x86-Fix-mmap-random-address-range.patch \
+ file://3.2.2/0052-UBI-fix-nameless-volumes-handling.patch \
+ file://3.2.2/0053-UBI-fix-debugging-messages.patch \
+ file://3.2.2/0054-UBI-make-vid_hdr-non-static.patch \
+ file://3.2.2/0055-UBIFS-fix-debugging-messages.patch \
+ file://3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch \
+ file://3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch \
+ file://3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch \
+ file://3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch \
+ file://3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch \
+ file://3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch \
+ file://3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch \
+ file://3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch \
+ file://3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch \
+ file://3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch \
+ file://3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch \
+ file://3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch \
+ file://3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch \
+ file://3.2.2/0069-nfsd4-fix-lockowner-matching.patch \
+ file://3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch \
+ file://3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch \
+ file://3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch \
+ file://3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch \
+ file://3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch \
+ file://3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch \
+ file://3.2.2/0076-fix-shrink_dcache_parent-livelock.patch \
+ file://3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch \
+ file://3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch \
+ file://3.2.2/0079-pnfsblock-limit-bio-page-count.patch \
+ file://3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch \
+ file://3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch \
+ file://3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch \
+ file://3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch \
+ file://3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch \
+ file://3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch \
+ file://3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch \
+ file://3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch \
+ file://3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch \
+ file://3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch \
+ file://3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch \
+ file://3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch \
+ file://3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch \
+ file://3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch \
+ file://3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch \
+ file://3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch \
+ file://3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch \
+ file://3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch \
+ file://3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch \
+ file://3.2.2/0099-intel_idle-fix-API-misuse.patch \
+ file://3.2.2/0100-ACPI-Store-SRAT-table-revision.patch \
+ file://3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch \
+ file://3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch \
+ file://3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch \
+ file://3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch \
+ file://3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch \
+ file://3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch \
+ file://3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch \
+ file://3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch \
+ file://3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch \
+ file://3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch \
+ file://3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch \
+ file://3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch \
+ file://3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch \
+ file://3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch \
+ file://3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch \
+ file://3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch \
+ file://3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch \
+ file://3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch \
+ file://3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch \
+ file://3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch \
+ file://3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch \
+ file://3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch \
+ file://3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch \
+ file://3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch \
+ file://3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch \
+ file://3.2.2/0126-iwlagn-check-for-SMPS-mode.patch \
+ file://3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch \
+ file://3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch \
+ file://3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch \
+ file://3.2.2/0130-Linux-3.2.2.patch \
+ file://3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch \
+ file://3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch \
+ file://3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch \
+ file://3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch \
+ file://3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch \
+ file://3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch \
+ file://3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch \
+ file://3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch \
+ file://3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch \
+ file://3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch \
+ file://3.2.3/0011-drm-Fix-authentication-kernel-crash.patch \
+ file://3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch \
+ file://3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch \
+ file://3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch \
+ file://3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch \
+ file://3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch \
+ file://3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch \
+ file://3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch \
+ file://3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch \
+ file://3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch \
+ file://3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch \
+ file://3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch \
+ file://3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch \
+ file://3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch \
+ file://3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch \
+ file://3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch \
+ file://3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch \
+ file://3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch \
+ file://3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch \
+ file://3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch \
+ file://3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch \
+ file://3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch \
+ file://3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch \
+ file://3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch \
+ file://3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch \
+ file://3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch \
+ file://3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch \
+ file://3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch \
+ file://3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch \
+ file://3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch \
+ file://3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch \
+ file://3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch \
+ file://3.2.3/0043-USB-serial-ftdi-additional-IDs.patch \
+ file://3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch \
+ file://3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch \
+ file://3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch \
+ file://3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch \
+ file://3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch \
+ file://3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch \
+ file://3.2.3/0050-TTY-fix-UV-serial-console-regression.patch \
+ file://3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch \
+ file://3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch \
+ file://3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch \
+ file://3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch \
+ file://3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch \
+ file://3.2.3/0056-USB-usbsevseg-fix-max-length.patch \
+ file://3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch \
+ file://3.2.3/0058-usb-gadget-storage-endian-fix.patch \
+ file://3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch \
+ file://3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch \
+ file://3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch \
+ file://3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch \
+ file://3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch \
+ file://3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch \
+ file://3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch \
+ file://3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch \
+ file://3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch \
+ file://3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch \
+ file://3.2.3/0069-netns-fix-net_alloc_generic.patch \
+ file://3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch \
+ file://3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch \
+ file://3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch \
+ file://3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch \
+ file://3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch \
+ file://3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch \
+ file://3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch \
+ file://3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch \
+ file://3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch \
+ file://3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch \
+ file://3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch \
+ file://3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch \
+ file://3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch \
+ file://3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch \
+ file://3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch \
+ file://3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch \
+ file://3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch \
+ file://3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch \
+ file://3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch \
+ file://3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch \
+ file://3.2.3/0090-Linux-3.2.3.patch \
+ file://3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch \
+ file://3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch \
+ file://3.2.4/0003-Linux-3.2.4.patch \
+ file://3.2.5/0001-PCI-Rework-ASPM-disable-code.patch \
+ file://3.2.5/0002-Linux-3.2.5.patch \
+ file://0002-f_rndis-HACK-around-undefined-variables.patch \
+ file://0003-da8xx-fb-add-DVI-support-for-beaglebone.patch \
+ file://0004-beaglebone-rebase-everything-onto-3.2-WARNING-MEGAPA.patch \
+ file://0005-more-beaglebone-merges.patch \
+ file://0006-beaglebone-disable-tsadc.patch \
+ file://0007-tscadc-Add-general-purpose-mode-untested-with-touchs.patch \
+ file://0008-tscadc-Add-board-file-mfd-support-fix-warning.patch \
+ file://0009-AM335X-init-tsc-bone-style-for-new-boards.patch \
+ file://0010-tscadc-make-stepconfig-channel-configurable.patch \
+ file://0011-tscadc-Trigger-through-sysfs.patch \
+ file://0012-meta-ti-Remove-debug-messages-for-meta-ti.patch \
+ file://0013-tscadc-switch-to-polling-instead-of-interrupts.patch \
+ file://0014-beaglebone-fix-ADC-init.patch \
+ file://0015-AM335x-MUX-add-ehrpwm1A.patch \
+ file://0016-beaglebone-enable-PWM-for-lcd-backlight-backlight-is.patch \
+ file://0017-omap_hsmmc-Set-dto-to-max-value-of-14-to-avoid-SD-Ca.patch \
+ file://0018-beaglebone-set-default-brightness-to-50-for-pwm-back.patch \
+ file://0019-st7735fb-WIP-framebuffer-driver-supporting-Adafruit-.patch \
+ file://0020-beaglebone-use-P8_6-gpio1_3-as-w1-bus.patch \
+ file://0021-beaglebone-add-support-for-Towertech-TT3201-CAN-cape.patch \
diff --git a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
index f2ba8e0..33ae9bd 100644
--- a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
+++ b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
@@ -11,7 +11,7 @@ MULTI_CONFIG_BASE_SUFFIX = ""
BRANCH = "v3.2-staging"
SRCREV = "09e9651bcf2ee8d86685f2a8075bc6557b1d3b91"
-MACHINE_KERNEL_PR_append = "f+gitr${SRCREV}"
+MACHINE_KERNEL_PR_append = "a+gitr${SRCREV}"
COMPATIBLE_MACHINE = "(ti33x)"
@@ -25,6 +25,280 @@ SRC_URI += "git://arago-project.org/git/projects/linux-am33x.git;protocol=http;b
file://defconfig"
PATCHES_OVER_PSP = " \
+ file://3.2.1/0001-MAINTAINERS-stable-Update-address.patch \
+ file://3.2.1/0002-Documentation-Update-stable-address.patch \
+ file://3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch \
+ file://3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch \
+ file://3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch \
+ file://3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch \
+ file://3.2.1/0007-libertas-clean-up-scan-thread-handling.patch \
+ file://3.2.1/0008-bcma-support-for-suspend-and-resume.patch \
+ file://3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch \
+ file://3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch \
+ file://3.2.1/0011-wl12xx-Restore-testmode-ABI.patch \
+ file://3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch \
+ file://3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch \
+ file://3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch \
+ file://3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch \
+ file://3.2.1/0016-iwlagn-fix-TID-use-bug.patch \
+ file://3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch \
+ file://3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch \
+ file://3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch \
+ file://3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch \
+ file://3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch \
+ file://3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch \
+ file://3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch \
+ file://3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch \
+ file://3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch \
+ file://3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch \
+ file://3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch \
+ file://3.2.1/0028-USB-update-documentation-for-usbmon.patch \
+ file://3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch \
+ file://3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch \
+ file://3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch \
+ file://3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch \
+ file://3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch \
+ file://3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch \
+ file://3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch \
+ file://3.2.1/0036-USB-pxa168-Fix-compilation-error.patch \
+ file://3.2.1/0037-USB-add-quirk-for-another-camera.patch \
+ file://3.2.1/0038-USB-omninet-fix-write_room.patch \
+ file://3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch \
+ file://3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch \
+ file://3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch \
+ file://3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch \
+ file://3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch \
+ file://3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch \
+ file://3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch \
+ file://3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch \
+ file://3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch \
+ file://3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch \
+ file://3.2.1/0049-Linux-3.2.1.patch \
+ file://3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch \
+ file://3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch \
+ file://3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch \
+ file://3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch \
+ file://3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch \
+ file://3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch \
+ file://3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch \
+ file://3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch \
+ file://3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch \
+ file://3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch \
+ file://3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch \
+ file://3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch \
+ file://3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch \
+ file://3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch \
+ file://3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch \
+ file://3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch \
+ file://3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch \
+ file://3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch \
+ file://3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch \
+ file://3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch \
+ file://3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch \
+ file://3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch \
+ file://3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch \
+ file://3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch \
+ file://3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch \
+ file://3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch \
+ file://3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch \
+ file://3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch \
+ file://3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch \
+ file://3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch \
+ file://3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch \
+ file://3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch \
+ file://3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch \
+ file://3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch \
+ file://3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch \
+ file://3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch \
+ file://3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch \
+ file://3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch \
+ file://3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch \
+ file://3.2.2/0040-ima-free-duplicate-measurement-memory.patch \
+ file://3.2.2/0041-ima-fix-invalid-memory-reference.patch \
+ file://3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch \
+ file://3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch \
+ file://3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch \
+ file://3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch \
+ file://3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch \
+ file://3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch \
+ file://3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch \
+ file://3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch \
+ file://3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch \
+ file://3.2.2/0051-x86-Fix-mmap-random-address-range.patch \
+ file://3.2.2/0052-UBI-fix-nameless-volumes-handling.patch \
+ file://3.2.2/0053-UBI-fix-debugging-messages.patch \
+ file://3.2.2/0054-UBI-make-vid_hdr-non-static.patch \
+ file://3.2.2/0055-UBIFS-fix-debugging-messages.patch \
+ file://3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch \
+ file://3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch \
+ file://3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch \
+ file://3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch \
+ file://3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch \
+ file://3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch \
+ file://3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch \
+ file://3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch \
+ file://3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch \
+ file://3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch \
+ file://3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch \
+ file://3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch \
+ file://3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch \
+ file://3.2.2/0069-nfsd4-fix-lockowner-matching.patch \
+ file://3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch \
+ file://3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch \
+ file://3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch \
+ file://3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch \
+ file://3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch \
+ file://3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch \
+ file://3.2.2/0076-fix-shrink_dcache_parent-livelock.patch \
+ file://3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch \
+ file://3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch \
+ file://3.2.2/0079-pnfsblock-limit-bio-page-count.patch \
+ file://3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch \
+ file://3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch \
+ file://3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch \
+ file://3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch \
+ file://3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch \
+ file://3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch \
+ file://3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch \
+ file://3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch \
+ file://3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch \
+ file://3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch \
+ file://3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch \
+ file://3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch \
+ file://3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch \
+ file://3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch \
+ file://3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch \
+ file://3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch \
+ file://3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch \
+ file://3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch \
+ file://3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch \
+ file://3.2.2/0099-intel_idle-fix-API-misuse.patch \
+ file://3.2.2/0100-ACPI-Store-SRAT-table-revision.patch \
+ file://3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch \
+ file://3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch \
+ file://3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch \
+ file://3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch \
+ file://3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch \
+ file://3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch \
+ file://3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch \
+ file://3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch \
+ file://3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch \
+ file://3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch \
+ file://3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch \
+ file://3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch \
+ file://3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch \
+ file://3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch \
+ file://3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch \
+ file://3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch \
+ file://3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch \
+ file://3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch \
+ file://3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch \
+ file://3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch \
+ file://3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch \
+ file://3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch \
+ file://3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch \
+ file://3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch \
+ file://3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch \
+ file://3.2.2/0126-iwlagn-check-for-SMPS-mode.patch \
+ file://3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch \
+ file://3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch \
+ file://3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch \
+ file://3.2.2/0130-Linux-3.2.2.patch \
+ file://3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch \
+ file://3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch \
+ file://3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch \
+ file://3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch \
+ file://3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch \
+ file://3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch \
+ file://3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch \
+ file://3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch \
+ file://3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch \
+ file://3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch \
+ file://3.2.3/0011-drm-Fix-authentication-kernel-crash.patch \
+ file://3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch \
+ file://3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch \
+ file://3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch \
+ file://3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch \
+ file://3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch \
+ file://3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch \
+ file://3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch \
+ file://3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch \
+ file://3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch \
+ file://3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch \
+ file://3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch \
+ file://3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch \
+ file://3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch \
+ file://3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch \
+ file://3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch \
+ file://3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch \
+ file://3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch \
+ file://3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch \
+ file://3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch \
+ file://3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch \
+ file://3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch \
+ file://3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch \
+ file://3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch \
+ file://3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch \
+ file://3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch \
+ file://3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch \
+ file://3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch \
+ file://3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch \
+ file://3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch \
+ file://3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch \
+ file://3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch \
+ file://3.2.3/0043-USB-serial-ftdi-additional-IDs.patch \
+ file://3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch \
+ file://3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch \
+ file://3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch \
+ file://3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch \
+ file://3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch \
+ file://3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch \
+ file://3.2.3/0050-TTY-fix-UV-serial-console-regression.patch \
+ file://3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch \
+ file://3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch \
+ file://3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch \
+ file://3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch \
+ file://3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch \
+ file://3.2.3/0056-USB-usbsevseg-fix-max-length.patch \
+ file://3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch \
+ file://3.2.3/0058-usb-gadget-storage-endian-fix.patch \
+ file://3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch \
+ file://3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch \
+ file://3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch \
+ file://3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch \
+ file://3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch \
+ file://3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch \
+ file://3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch \
+ file://3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch \
+ file://3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch \
+ file://3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch \
+ file://3.2.3/0069-netns-fix-net_alloc_generic.patch \
+ file://3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch \
+ file://3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch \
+ file://3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch \
+ file://3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch \
+ file://3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch \
+ file://3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch \
+ file://3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch \
+ file://3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch \
+ file://3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch \
+ file://3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch \
+ file://3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch \
+ file://3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch \
+ file://3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch \
+ file://3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch \
+ file://3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch \
+ file://3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch \
+ file://3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch \
+ file://3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch \
+ file://3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch \
+ file://3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch \
+ file://3.2.3/0090-Linux-3.2.3.patch \
+ file://3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch \
+ file://3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch \
+ file://3.2.4/0003-Linux-3.2.4.patch \
+ file://3.2.5/0001-PCI-Rework-ASPM-disable-code.patch \
+ file://3.2.5/0002-Linux-3.2.5.patch \
file://0002-f_rndis-HACK-around-undefined-variables.patch \
file://0003-da8xx-fb-add-DVI-support-for-beaglebone.patch \
file://0004-beaglebone-rebase-everything-onto-3.2-WARNING-MEGAPA.patch \
--
1.7.2.5
More information about the meta-ti
mailing list