* [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion
@ 2012-02-27 13:40 Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 02/11] linux-ti33x-psp 3.2: update to 3.2.5 Koen Kooi
` (10 more replies)
0 siblings, 11 replies; 12+ messages in thread
From: Koen Kooi @ 2012-02-27 13:40 UTC (permalink / raw)
To: meta-ti
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
recipes-kernel/linux/linux-ti33x-psp_3.2.bb | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
index a25d503..f2ba8e0 100644
--- a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
+++ b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
@@ -10,8 +10,8 @@ S = "${WORKDIR}/git"
MULTI_CONFIG_BASE_SUFFIX = ""
BRANCH = "v3.2-staging"
-SRCREV = "21ef5e1fa530eb8f23bfe18650e3915d7c291ca9"
-MACHINE_KERNEL_PR_append = "e+gitr${SRCREV}"
+SRCREV = "09e9651bcf2ee8d86685f2a8075bc6557b1d3b91"
+MACHINE_KERNEL_PR_append = "f+gitr${SRCREV}"
COMPATIBLE_MACHINE = "(ti33x)"
--
1.7.2.5
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [BeagleBone][PATCH v3 02/11] linux-ti33x-psp 3.2: update to 3.2.5
2012-02-27 13:40 [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Koen Kooi
@ 2012-02-27 13:40 ` Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 03/11] linux-ti335x-psp 3.2: update to 3.2.6 Koen Kooi
` (9 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Koen Kooi @ 2012-02-27 13:40 UTC (permalink / raw)
To: meta-ti
Runtime tested on a beaglebone A3
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
conf/machine/include/ti33x.inc | 2 +-
.../0001-MAINTAINERS-stable-Update-address.patch | 31 +
.../0002-Documentation-Update-stable-address.patch | 56 ++
...x-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch | 81 +++
.../0004-rt2800usb-Move-ID-out-of-unknown.patch | 43 ++
...ix-setting-of-the-pseudo-palette-for-8bpp.patch | 92 +++
...ix-bug-in-calculating-requested-vram-size.patch | 32 +
...07-libertas-clean-up-scan-thread-handling.patch | 86 +++
.../0008-bcma-support-for-suspend-and-resume.patch | 120 ++++
...x-Validate-FEM-index-from-ini-file-and-FW.patch | 75 +++
...eck-buffer-bound-when-processing-nvs-data.patch | 68 ++
.../3.2.1/0011-wl12xx-Restore-testmode-ABI.patch | 32 +
...werpc-time-Handle-wrapping-of-decrementer.patch | 93 +++
...-unpaired-probe_hcall_entry-and-probe_hca.patch | 85 +++
...a-possible-data-corruption-when-receiving.patch | 78 +++
.../0015-IB-uverbs-Protect-QP-multicast-list.patch | 96 +++
.../3.2.1/0016-iwlagn-fix-TID-use-bug.patch | 50 ++
.../0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch | 180 +++++
...Fix-parsing-of-__print_flags-in-TP_printk.patch | 37 +
...0019-ore-Fix-crash-in-case-of-an-IO-error.patch | 41 ++
...0-ore-fix-BUG_ON-too-few-sgs-when-reading.patch | 56 ++
...021-ore-Must-support-none-PAGE-aligned-IO.patch | 163 +++++
...breakage-when-MISC_FILESYSTEMS-is-not-set.patch | 89 +++
...3-reiserfs-Fix-quota-mount-option-parsing.patch | 34 +
...rce-inode-evictions-before-umount-to-avoi.patch | 70 ++
...warn-from-writepage-when-readonly-inode-i.patch | 73 ++
...-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch | 70 ++
...s-hv-Fix-a-bug-in-vmbus_driver_unregister.patch | 40 ++
.../0028-USB-update-documentation-for-usbmon.patch | 54 ++
...oops-related-to-user-namespace-conversion.patch | 125 ++++
..._serial-fix-spinlock-lockup-in-RS485-code.patch | 47 ++
...fix-to-allow-mounting-a-hierarchy-by-name.patch | 50 ++
...dlock-when-converting-file-from-in-ICB-on.patch | 130 ++++
...sb-class-cdc-acm.c-clear-dangling-pointer.patch | 45 ++
...ight-fix-kernel-bug-when-loading-firmware.patch | 47 ++
...rage-doesn-t-support-dynamic-id-currently.patch | 121 ++++
.../0036-USB-pxa168-Fix-compilation-error.patch | 42 ++
.../0037-USB-add-quirk-for-another-camera.patch | 37 +
.../3.2.1/0038-USB-omninet-fix-write_room.patch | 34 +
...usb-option-add-ZD-Incorporated-HSPA-modem.patch | 53 ++
...-ID-for-Multiplex-RC-serial-adapter-to-cp.patch | 36 +
...1-usb-fix-number-of-mapped-SG-DMA-entries.patch | 155 +++++
...0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch | 62 ++
.../0043-usb-ch9-fix-up-MaxStreams-helper.patch | 81 +++
...zero-delay-when-receiving-odd-mixture-of-.patch | 37 +
.../0045-asix-fix-infinite-loop-in-rx_fixup.patch | 38 ++
...ng-fix-error-handling-if-slave-is-busy-v2.patch | 68 ++
...-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch | 54 ++
...acl-count-validation-in-xfs_acl_from_disk.patch | 34 +
.../3.2.1/0049-Linux-3.2.1.patch | 24 +
...mtdoops-fix-the-oops_page_used-array-size.patch | 39 ++
...mtdoops-skip-reading-initially-bad-blocks.patch | 36 +
...devs-don-t-increase-open-count-on-error-p.patch | 85 +++
...tresstest-bail-out-if-device-has-not-enou.patch | 60 ++
...-interface.c-fix-alarm-rollover-when-day-.patch | 53 ++
...dd-missing-ext4_resize_end-on-error-paths.patch | 109 +++
...undefined-behavior-in-ext4_fill_flex_info.patch | 74 ++
...sb-us122l-Delete-calls-to-preempt_disable.patch | 54 ++
...-Fix-master-control-for-Cirrus-Logic-421X.patch | 57 ++
...SA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch | 48 ++
...e1724-Check-for-ac97-to-avoid-kernel-oops.patch | 38 ++
...dio-Avoid-flood-of-frame-active-debug-mes.patch | 46 ++
...e-auto-parser-for-HP-laptops-with-cx20459.patch | 37 +
...turn-the-error-from-get_wcaps_type-for-in.patch | 58 ++
...x-the-detection-of-Loopback-Mixing-contro.patch | 42 ++
...x-the-lost-power-setup-of-seconary-pins-a.patch | 92 +++
...kms-workaround-invalid-AVI-infoframe-chec.patch | 43 ++
...n-kms-disable-writeback-on-pre-R300-asics.patch | 40 ++
...disabling-PCI-bus-mastering-on-big-endian.patch | 70 ++
...FS-errors-are-communicated-on-iodata-pnfs.patch | 50 ++
...1-pnfs-obj-Must-return-layout-on-IO-error.patch | 92 +++
.../3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch | 94 +++
...4.1-fix-backchannel-slotid-off-by-one-bug.patch | 30 +
...fix-recent-breakage-to-NFS-error-handling.patch | 60 ++
...FSv4-include-bitmap-in-nfsv4-get-acl-data.patch | 313 +++++++++
...ression-in-handling-of-context-option-in-.patch | 147 ++++
...ximum-global-item-tag-report-size-to-96-b.patch | 35 +
.../0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch | 33 +
...ix-missing-scrub-when-there-is-a-bit-flip.patch | 81 +++
...0030-UBI-fix-use-after-free-on-error-path.patch | 52 ++
.../0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch | 32 +
...able-msi-interrupts-when-we-initialize-a-.patch | 53 ++
...ore-CPU-non-addressable-_CRS-reserved-mem.patch | 65 ++
...x86-PCI-amd-factor-out-MMCONFIG-discovery.patch | 160 +++++
...build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch | 37 +
...s-Release-spinlock-for-the-raid-device-li.patch | 56 ++
...s-Fix-for-memory-allocation-error-for-lar.patch | 177 +++++
...Reject-replies-with-payload-XENSTORE_PAYL.patch | 78 +++
...rform-bad-block-tests-for-WriteMostly-dev.patch | 56 ++
...040-ima-free-duplicate-measurement-memory.patch | 52 ++
.../0041-ima-fix-invalid-memory-reference.patch | 68 ++
...ub-fix-a-possible-memleak-in-__slab_alloc.patch | 47 ++
...ound-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch | 101 +++
...tting-custom-MAC-address-on-Asix-88178-de.patch | 45 ++
...tting-custom-MAC-address-on-Asix-88772-de.patch | 53 ++
...46-include-linux-crash_dump.h-needs-elf.h.patch | 54 ++
...ix-BUG-caused-by-failure-to-check-skb-all.patch | 44 ++
...x-rx-key-NULL-pointer-dereference-in-prom.patch | 52 ++
...egression-in-channelwidth-switch-at-the-s.patch | 68 ++
...em_cgroup_replace_page_cache-to-fix-LRU-i.patch | 179 +++++
.../0051-x86-Fix-mmap-random-address-range.patch | 47 ++
.../0052-UBI-fix-nameless-volumes-handling.patch | 37 +
.../3.2.2/0053-UBI-fix-debugging-messages.patch | 42 ++
.../3.2.2/0054-UBI-make-vid_hdr-non-static.patch | 36 +
.../3.2.2/0055-UBIFS-fix-debugging-messages.patch | 41 ++
...UBIFS-make-debugging-messages-light-again.patch | 57 ++
...ror-value-returned-by-several-bus-drivers.patch | 197 ++++++
...8-mmc-core-Fix-voltage-select-in-DDR-mode.patch | 39 ++
...ix-tuning-timer-incorrect-setting-when-su.patch | 39 ++
.../0060-mmc-sd-Fix-SDR12-timing-regression.patch | 38 ++
...2-ioctl-integer-overflow-in-video_usercop.patch | 54 ++
...s-in-a-batch-should-not-be-accounted-as-a.patch | 71 ++
...race-Fix-unregister-ftrace_ops-accounting.patch | 227 +++++++
...eamline-config.pl-Simplify-backslash-line.patch | 68 ++
...eamline-config.pl-Fix-parsing-Makefile-wi.patch | 98 +++
...double-free-on-shutdown-of-nfsd-after-cha.patch | 60 ++
...svcrpc-destroy-server-sockets-all-at-once.patch | 85 +++
...-avoid-memory-corruption-on-pool-shutdown.patch | 156 +++++
.../3.2.2/0069-nfsd4-fix-lockowner-matching.patch | 59 ++
...d-Fix-oops-when-parsing-a-0-length-export.patch | 82 +++
...notify-don-t-BUG-in-fsnotify_destroy_mark.patch | 61 ++
...Update-Boot-messages-for-SGI-UV2-platform.patch | 44 ++
...t-Fix-handling-of-elf64-big-endian-object.patch | 46 ++
...ix-integer-overflow-in-uvc_ioctl_ctrl_map.patch | 62 ++
...cache-use-a-dispose-list-in-select_parent.patch | 172 +++++
.../0076-fix-shrink_dcache_parent-livelock.patch | 130 ++++
...fsblock-acquire-im_lock-in-_preload_range.patch | 64 ++
...ock-don-t-spinlock-when-freeing-block_dev.patch | 46 ++
.../0079-pnfsblock-limit-bio-page-count.patch | 51 ++
...0211-revert-on-channel-work-optimisations.patch | 635 ++++++++++++++++++
...-HID-hid-multitouch-add-another-eGalax-id.patch | 60 ++
...touch-cleanup-with-eGalax-PID-definitions.patch | 112 ++++
...itouch-Add-egalax-ID-for-Acer-Iconia-W500.patch | 62 ++
...ouch-add-support-for-the-MSI-Windpad-110W.patch | 49 ++
...titouch-add-support-for-new-Hanvon-panels.patch | 63 ++
...uch-add-support-of-Atmel-multitouch-panel.patch | 63 ++
...0087-HID-multitouch-add-support-for-3M-32.patch | 45 ++
...ltitouch-add-support-9-new-Xiroku-devices.patch | 117 ++++
...-fix-cputime-overflow-in-uptime_proc_show.patch | 49 ++
...0090-block-add-and-use-scsi_blk_cmd_ioctl.patch | 166 +++++
...SCSI-passthrough-ioctls-on-partition-devi.patch | 166 +++++
...orward-ioctls-from-logical-volumes-to-the.patch | 90 +++
...oc-clean-up-and-fix-proc-pid-mem-handling.patch | 271 ++++++++
...Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch | 35 +
...oso-Xonar-DS-fix-polarity-of-front-output.patch | 37 +
...x-internal-microphone-on-Dell-Studio-16-X.patch | 36 +
...97-TOMOYO-Accept-000-as-a-valid-character.patch | 43 ++
...8-intel-idle-Make-idle-driver-more-robust.patch | 53 ++
.../3.2.2/0099-intel_idle-fix-API-misuse.patch | 56 ++
.../0100-ACPI-Store-SRAT-table-revision.patch | 66 ++
...e-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch | 50 ++
...se-SRAT-table-rev-to-use-8bit-or-16-32bit.patch | 66 ++
...back-the-call-to-acpi_os_validate_address.patch | 59 ++
...essor-fix-acpi_get_cpuid-for-UP-processor.patch | 75 +++
...ix-NULL-pointer-dereference-in-slave_dest.patch | 37 +
...t-Set-response-format-in-INQUIRY-response.patch | 44 ++
...additional-sense-length-field-in-sense-da.patch | 177 +++++
...idate-the-mapped-core-over-suspend-resume.patch | 44 ++
...-cx23885-dvb-check-if-dvb_attach-succeded.patch | 36 +
...ix-don-t-duplicate-xc4000-entry-for-radio.patch | 95 +++
...umberspace-conflict-between-xc4000-and-pt.patch | 42 ++
...-module-Fix-disabling-tracepoints-with-ta.patch | 50 ++
...AP-correct-SYSC-register-offset-for-OMAP4.patch | 34 +
...-new-UV2-hardware-by-using-native-UV2-bro.patch | 350 ++++++++++
...ix-BAU-destination-timeout-initialization.patch | 66 ++
.../3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch | 570 ++++++++++++++++
...fix-interpretation-of-the-rx-KeyMiss-flag.patch | 61 ++
...800pci-fix-spurious-interrupts-generation.patch | 86 +++
...x-endian-conversion-issue-in-discard-code.patch | 45 ++
...20t-modified-the-setting-of-transfer-rate.patch | 33 +
...e-fix-off-by-one-index-into-syscall-table.patch | 46 ++
...default-wsize-when-unix-extensions-are-no.patch | 67 ++
...3-kprobes-initialize-before-using-a-hlist.patch | 49 ++
...oc-clear_refs-do-not-clear-reserved-pages.patch | 64 ++
...-ptr-dereference-in-__count_immobile_page.patch | 91 +++
.../3.2.2/0126-iwlagn-check-for-SMPS-mode.patch | 50 ++
...945-fix-hw-passive-scan-on-radar-channels.patch | 60 ++
...SHM_UNLOCK-fix-long-unpreemptible-section.patch | 186 ++++++
...fix-Unevictable-pages-stranded-after-swap.patch | 342 ++++++++++
.../3.2.2/0130-Linux-3.2.2.patch | 24 +
...x-buffer-alignment-regression-with-Nvidia.patch | 62 ++
...x-silent-outputs-from-docking-station-jac.patch | 64 ++
...tfs-Sanitize-write-counts-of-dev-ecryptfs.patch | 103 +++
...tfs-Improve-metadata-read-failure-logging.patch | 58 ++
...0005-eCryptfs-Make-truncate-path-killable.patch | 71 ++
...6-eCryptfs-Check-inode-changes-in-setattr.patch | 122 ++++
...x-oops-when-printing-debug-info-in-extent.patch | 103 +++
...adeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch | 38 ++
...kms-move-panel-mode-setup-into-encoder-mo.patch | 130 ++++
...kms-rework-modeset-sequence-for-DCE41-and.patch | 87 +++
.../0011-drm-Fix-authentication-kernel-crash.patch | 91 +++
...sing-xfs_iunlock-on-error-recovery-path-i.patch | 38 ++
...M5100-register-map-cache-only-when-going-.patch | 32 +
...e-register-synchronisation-for-low-freque.patch | 66 ++
...go-through-cache-when-applying-WM5100-rev.patch | 41 ++
...-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch | 33 +
...brcmsmac-fix-tx-queue-flush-infinite-loop.patch | 53 ++
...c80211-fix-work-removal-on-deauth-request.patch | 111 +++
...jbd-Issue-cache-flush-after-checkpointing.patch | 118 ++++
...12-make-it-work-undo-percpu-message-sched.patch | 78 +++
...-sha512-reduce-stack-usage-to-safe-number.patch | 129 ++++
...-tpm_tis-add-delay-after-aborting-command.patch | 37 +
.../0023-x86-uv-Fix-uninitialized-spinlocks.patch | 58 ++
...4-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch | 41 ++
...de_amd-Add-support-for-CPU-family-specifi.patch | 75 +++
...sembler-constraint-to-prevent-overeager-g.patch | 172 +++++
...t-mute-led-polarity-for-laptops-with-bugg.patch | 43 ++
...8-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch | 55 ++
...hda-Fix-silent-output-on-Haier-W18-laptop.patch | 34 +
...per-over-missed-irq-issues-with-force-wak.patch | 126 ++++
...15-sdvo-always-set-positive-sync-polarity.patch | 52 ++
...-enable-gen7-RC6-and-GPU-turbo-after-resu.patch | 43 ++
...-at91-fix-at91rm9200-soc-subtype-handling.patch | 46 ++
.../0034-mach-ux500-enable-ARM-errata-764369.patch | 31 +
...proc-v7.S-remove-HARVARD_CACHE-preprocess.patch | 53 ++
...ain-bitterly-about-attempts-to-remove-fil.patch | 68 ++
...e-struct-xen_spinlock-to-always-fit-in-ar.patch | 103 +++
...oved-redundant-calling-of-_scsih_probe_de.patch | 96 +++
.../0039-USB-option-Add-LG-docomo-L-02C.patch | 41 ++
...di_sio-fix-TIOCSSERIAL-baud_base-handling.patch | 41 ++
.../0041-USB-ftdi_sio-fix-initial-baud-rate.patch | 49 ++
...sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch | 50 ++
.../0043-USB-serial-ftdi-additional-IDs.patch | 49 ++
.../0044-USB-ftdi_sio-Add-more-identifiers.patch | 48 ++
...-updating-desc-length-must-be-protected-b.patch | 37 +
...-use-two-mutexes-to-allow-simultaneous-re.patch | 178 +++++
...-add-more-Pantech-UML190-and-UML290-ports.patch | 43 ++
...dwc3-ep0-tidy-up-Pending-Request-handling.patch | 54 ++
...ake-edge_remove_sysfs_attrs-the-port_remo.patch | 60 ++
...0050-TTY-fix-UV-serial-console-regression.patch | 72 ++
...-pl011-lock-console-writes-against-interr.patch | 67 ++
.../3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch | 53 ++
...053-iwlwifi-fix-PCI-E-transport-inta-race.patch | 53 ++
...assignment-in-vmw_framebuffer_create_hand.patch | 34 +
...tek-cr-fix-autopm-scheduling-while-atomic.patch | 36 +
.../3.2.3/0056-USB-usbsevseg-fix-max-length.patch | 34 +
...t-langwell-don-t-call-gadget-s-disconnect.patch | 94 +++
.../3.2.3/0058-usb-gadget-storage-endian-fix.patch | 43 ++
...s-usb-host-ehci-fsl.c-add-missing-iounmap.patch | 54 ++
...xhci-Fix-USB-3.0-device-restart-on-resume.patch | 51 ++
...p-isoc-transfer-ring-when-TD-length-misma.patch | 40 ++
.../0062-usb-musb-davinci-fix-build-breakage.patch | 41 ++
...71805f-Fix-clamping-of-temperature-limits.patch | 43 ++
...7ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch | 46 ++
.../0065-hwmon-sht15-fix-bad-error-code.patch | 40 ++
...-call-wake_up_all-to-allow-driver-to-shut.patch | 45 ++
...-better-allocate-a-buffer-that-is-at-leas.patch | 38 ++
...-Avoid-hanging-on-interface-with-no-USB_C.patch | 53 ++
.../3.2.3/0069-netns-fix-net_alloc_generic.patch | 120 ++++
...conspicously-if-someone-uses-net_generic-.patch | 42 ++
...f-Register-properly-as-a-pernet-subsystem.patch | 117 ++++
...fix-EPOLLET-regression-for-stream-sockets.patch | 96 +++
...-fix-enslaving-in-alb-mode-when-link-down.patch | 116 ++++
...tp_ip-fix-possible-oops-on-packet-receive.patch | 73 ++
...075-macvlan-fix-a-possible-use-after-free.patch | 34 +
...76-net-bpf_jit-fix-divide-by-0-generation.patch | 129 ++++
...ntroduce-missing-rcu_assign_pointer-calls.patch | 703 ++++++++++++++++++++
...ake-rds_sock_lock-BH-rather-than-IRQ-safe.patch | 119 ++++
..._trim_head-to-adjust-segment-count-with-s.patch | 61 ++
...ng-remote-adress-for-md5-lookup-in-rst-pa.patch | 49 ++
...CP210x-Added-USB-ID-for-the-Link-Instrume.patch | 32 +
...USB-cp210x-call-generic-open-last-in-open.patch | 47 ++
...0083-USB-cp210x-fix-CP2104-baudrate-usage.patch | 78 +++
...84-USB-cp210x-do-not-map-baud-rates-to-B0.patch | 34 +
...5-USB-cp210x-fix-up-set_termios-variables.patch | 44 ++
...clean-up-refactor-and-document-speed-hand.patch | 121 ++++
...7-USB-cp210x-initialise-baud-rate-at-open.patch | 35 +
...cp210x-allow-more-baud-rates-above-1Mbaud.patch | 48 ++
...ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch | 34 +
.../3.2.3/0090-Linux-3.2.3.patch | 24 +
...-Mark-WM5100-register-map-cache-only-when.patch | 32 +
...-Don-t-go-through-cache-when-applying-WM5.patch | 39 ++
.../3.2.4/0003-Linux-3.2.4.patch | 24 +
.../3.2.5/0001-PCI-Rework-ASPM-disable-code.patch | 236 +++++++
.../3.2.5/0002-Linux-3.2.5.patch | 24 +
recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt | 295 ++++++++
recipes-kernel/linux/linux-ti33x-psp_3.2.bb | 276 ++++++++-
277 files changed, 21802 insertions(+), 2 deletions(-)
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0001-MAINTAINERS-stable-Update-address.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0002-Documentation-Update-stable-address.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0007-libertas-clean-up-scan-thread-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0008-bcma-support-for-suspend-and-resume.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0011-wl12xx-Restore-testmode-ABI.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0016-iwlagn-fix-TID-use-bug.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0028-USB-update-documentation-for-usbmon.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0036-USB-pxa168-Fix-compilation-error.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0037-USB-add-quirk-for-another-camera.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0038-USB-omninet-fix-write_room.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0049-Linux-3.2.1.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0040-ima-free-duplicate-measurement-memory.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0041-ima-fix-invalid-memory-reference.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0051-x86-Fix-mmap-random-address-range.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0052-UBI-fix-nameless-volumes-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0053-UBI-fix-debugging-messages.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0054-UBI-make-vid_hdr-non-static.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0055-UBIFS-fix-debugging-messages.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0069-nfsd4-fix-lockowner-matching.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0076-fix-shrink_dcache_parent-livelock.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0079-pnfsblock-limit-bio-page-count.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0099-intel_idle-fix-API-misuse.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0100-ACPI-Store-SRAT-table-revision.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0126-iwlagn-check-for-SMPS-mode.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0130-Linux-3.2.2.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0011-drm-Fix-authentication-kernel-crash.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0043-USB-serial-ftdi-additional-IDs.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0050-TTY-fix-UV-serial-console-regression.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0056-USB-usbsevseg-fix-max-length.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0058-usb-gadget-storage-endian-fix.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0069-netns-fix-net_alloc_generic.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0090-Linux-3.2.3.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0003-Linux-3.2.4.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0001-PCI-Rework-ASPM-disable-code.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0002-Linux-3.2.5.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt
diff --git a/conf/machine/include/ti33x.inc b/conf/machine/include/ti33x.inc
index 3807fbb..fc670d0 100644
--- a/conf/machine/include/ti33x.inc
+++ b/conf/machine/include/ti33x.inc
@@ -3,7 +3,7 @@ SOC_FAMILY = "ti33x"
require conf/machine/include/tune-cortexa8.inc
PREFERRED_PROVIDER_virtual/kernel = "linux-ti33x-psp"
# Increase this everytime you change something in the kernel
-MACHINE_KERNEL_PR = "r2"
+MACHINE_KERNEL_PR = "r3"
KERNEL_IMAGETYPE = "uImage"
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0001-MAINTAINERS-stable-Update-address.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0001-MAINTAINERS-stable-Update-address.patch
new file mode 100644
index 0000000..fe2b0d6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0001-MAINTAINERS-stable-Update-address.patch
@@ -0,0 +1,31 @@
+From d1fe421bb81064477843db98b4804fec79eae30e Mon Sep 17 00:00:00 2001
+From: Joe Perches <joe@perches.com>
+Date: Fri, 9 Dec 2011 13:54:34 -0800
+Subject: [PATCH 01/49] MAINTAINERS: stable: Update address
+
+commit bc7a2f3abc636d7cab84258a48e77b08fb5fd3d6 upstream.
+
+The old address hasn't worked since the great intrusion of August 2011.
+
+Signed-off-by: Joe Perches <joe@perches.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ MAINTAINERS | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 62f1cd3..f986e7d 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -6258,7 +6258,7 @@ F: arch/alpha/kernel/srm_env.c
+
+ STABLE BRANCH
+ M: Greg Kroah-Hartman <greg@kroah.com>
+-L: stable@kernel.org
++L: stable@vger.kernel.org
+ S: Maintained
+
+ STAGING SUBSYSTEM
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0002-Documentation-Update-stable-address.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0002-Documentation-Update-stable-address.patch
new file mode 100644
index 0000000..10b9e32
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0002-Documentation-Update-stable-address.patch
@@ -0,0 +1,56 @@
+From 3dc851fe5a59ee0eb306b3a29819ee040ba69a24 Mon Sep 17 00:00:00 2001
+From: Joe Perches <joe@perches.com>
+Date: Fri, 9 Dec 2011 14:12:00 -0800
+Subject: [PATCH 02/49] Documentation: Update stable address
+
+commit 2eb7f204db51969ea558802a6601d79c2fb273b9 upstream.
+
+The Japanese/Korean/Chinese versions still need updating.
+
+Also, the stable kernel 2.6.x.y descriptions are out of date
+and should be updated as well.
+
+Signed-off-by: Joe Perches <joe@perches.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ Documentation/HOWTO | 4 ++--
+ Documentation/development-process/5.Posting | 8 ++++----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/Documentation/HOWTO b/Documentation/HOWTO
+index 81bc1a9..f7ade3b 100644
+--- a/Documentation/HOWTO
++++ b/Documentation/HOWTO
+@@ -275,8 +275,8 @@ versions.
+ If no 2.6.x.y kernel is available, then the highest numbered 2.6.x
+ kernel is the current stable kernel.
+
+-2.6.x.y are maintained by the "stable" team <stable@kernel.org>, and are
+-released as needs dictate. The normal release period is approximately
++2.6.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
++are released as needs dictate. The normal release period is approximately
+ two weeks, but it can be longer if there are no pressing problems. A
+ security-related problem, instead, can cause a release to happen almost
+ instantly.
+diff --git a/Documentation/development-process/5.Posting b/Documentation/development-process/5.Posting
+index 903a254..8a48c9b 100644
+--- a/Documentation/development-process/5.Posting
++++ b/Documentation/development-process/5.Posting
+@@ -271,10 +271,10 @@ copies should go to:
+ the linux-kernel list.
+
+ - If you are fixing a bug, think about whether the fix should go into the
+- next stable update. If so, stable@kernel.org should get a copy of the
+- patch. Also add a "Cc: stable@kernel.org" to the tags within the patch
+- itself; that will cause the stable team to get a notification when your
+- fix goes into the mainline.
++ next stable update. If so, stable@vger.kernel.org should get a copy of
++ the patch. Also add a "Cc: stable@vger.kernel.org" to the tags within
++ the patch itself; that will cause the stable team to get a notification
++ when your fix goes into the mainline.
+
+ When selecting recipients for a patch, it is good to have an idea of who
+ you think will eventually accept the patch and get it merged. While it
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch
new file mode 100644
index 0000000..146af6d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch
@@ -0,0 +1,81 @@
+From 9fa97016831ab21d14565a478dc462f35dfb7d2b Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Mon, 2 Jan 2012 15:31:23 -0500
+Subject: [PATCH 03/49] firmware: Fix an oops on reading fw_priv->fw in sysfs
+ loading file
+
+commit eea915bb0d1358755f151eaefb8208a2d5f3e10c upstream.
+
+This oops was reported recently:
+firmware_loading_store+0xf9/0x17b
+dev_attr_store+0x20/0x22
+sysfs_write_file+0x101/0x134
+vfs_write+0xac/0xf3
+sys_write+0x4a/0x6e
+system_call_fastpath+0x16/0x1b
+
+The complete backtrace was unfortunately not captured, but details can be found
+here:
+https://bugzilla.redhat.com/show_bug.cgi?id=769920
+
+The cause is fairly clear.
+
+Its caused by the fact that firmware_loading_store has a case 0 in its
+switch statement that reads and writes the fw_priv->fw poniter without the
+protection of the fw_lock mutex. since there is a window between the time that
+_request_firmware sets fw_priv->fw to NULL and the time the corresponding sysfs
+file is unregistered, its possible for a user space application to race in, and
+write a zero to the loading file, causing a NULL dereference in
+firmware_loading_store. Fix it by extending the protection of the fw_lock mutex
+to cover all of the firware_loading_store function.
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/base/firmware_class.c | 14 +++++++-------
+ 1 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
+index 06ed6b4..3719c94 100644
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -226,13 +226,13 @@ static ssize_t firmware_loading_store(struct device *dev,
+ int loading = simple_strtol(buf, NULL, 10);
+ int i;
+
++ mutex_lock(&fw_lock);
++
++ if (!fw_priv->fw)
++ goto out;
++
+ switch (loading) {
+ case 1:
+- mutex_lock(&fw_lock);
+- if (!fw_priv->fw) {
+- mutex_unlock(&fw_lock);
+- break;
+- }
+ firmware_free_data(fw_priv->fw);
+ memset(fw_priv->fw, 0, sizeof(struct firmware));
+ /* If the pages are not owned by 'struct firmware' */
+@@ -243,7 +243,6 @@ static ssize_t firmware_loading_store(struct device *dev,
+ fw_priv->page_array_size = 0;
+ fw_priv->nr_pages = 0;
+ set_bit(FW_STATUS_LOADING, &fw_priv->status);
+- mutex_unlock(&fw_lock);
+ break;
+ case 0:
+ if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {
+@@ -274,7 +273,8 @@ static ssize_t firmware_loading_store(struct device *dev,
+ fw_load_abort(fw_priv);
+ break;
+ }
+-
++out:
++ mutex_unlock(&fw_lock);
+ return count;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch
new file mode 100644
index 0000000..6923c7e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch
@@ -0,0 +1,43 @@
+From c64f87400ad7f27c043d969e695b3b2384e8a246 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 27 Dec 2011 12:22:51 -0600
+Subject: [PATCH 04/49] rt2800usb: Move ID out of unknown
+
+commit 3f81f8f1524ccca24df1029b0cf825ecef5e5cdc upstream.
+
+Testing on the openSUSE wireless forum has shown that a Linksys
+WUSB54GC v3 with USB ID 1737:0077 works with rt2800usb when the ID is
+written to /sys/.../new_id. This ID can therefore be moved out of UNKNOWN.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/rt2x00/rt2800usb.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index 3778763..3265b34 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -976,6 +976,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x13b1, 0x0031) },
+ { USB_DEVICE(0x1737, 0x0070) },
+ { USB_DEVICE(0x1737, 0x0071) },
++ { USB_DEVICE(0x1737, 0x0077) },
+ /* Logitec */
+ { USB_DEVICE(0x0789, 0x0162) },
+ { USB_DEVICE(0x0789, 0x0163) },
+@@ -1171,7 +1172,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x1740, 0x0605) },
+ { USB_DEVICE(0x1740, 0x0615) },
+ /* Linksys */
+- { USB_DEVICE(0x1737, 0x0077) },
+ { USB_DEVICE(0x1737, 0x0078) },
+ /* Logitec */
+ { USB_DEVICE(0x0789, 0x0168) },
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch
new file mode 100644
index 0000000..e019802
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch
@@ -0,0 +1,92 @@
+From 698d2012f8540d1cedc1f49013ba320e382cd1d9 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Wed, 28 Dec 2011 00:10:16 +0000
+Subject: [PATCH 05/49] offb: Fix setting of the pseudo-palette for >8bpp
+
+commit 1bb0b7d21584b3f878e2bc880db62351ddee5185 upstream.
+
+When using a >8bpp framebuffer, offb advertises truecolor, not directcolor,
+and doesn't touch the color map even if it has a corresponding access method
+for the real hardware.
+
+Thus it needs to set the pseudo-palette with all 3 components of the color,
+like other truecolor framebuffers, not with copies of the color index like
+a directcolor framebuffer would do.
+
+This went unnoticed for a long time because it's pretty hard to get offb
+to kick in with anything but 8bpp (old BootX under MacOS will do that and
+qemu does it).
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/video/offb.c | 50 +++++++++++++++++++++++---------------------------
+ 1 files changed, 23 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/video/offb.c b/drivers/video/offb.c
+index cb163a5..24e1fc6 100644
+--- a/drivers/video/offb.c
++++ b/drivers/video/offb.c
+@@ -100,36 +100,32 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
+ u_int transp, struct fb_info *info)
+ {
+ struct offb_par *par = (struct offb_par *) info->par;
+- int i, depth;
+- u32 *pal = info->pseudo_palette;
+-
+- depth = info->var.bits_per_pixel;
+- if (depth == 16)
+- depth = (info->var.green.length == 5) ? 15 : 16;
+-
+- if (regno > 255 ||
+- (depth == 16 && regno > 63) ||
+- (depth == 15 && regno > 31))
+- return 1;
+-
+- if (regno < 16) {
+- switch (depth) {
+- case 15:
+- pal[regno] = (regno << 10) | (regno << 5) | regno;
+- break;
+- case 16:
+- pal[regno] = (regno << 11) | (regno << 5) | regno;
+- break;
+- case 24:
+- pal[regno] = (regno << 16) | (regno << 8) | regno;
+- break;
+- case 32:
+- i = (regno << 8) | regno;
+- pal[regno] = (i << 16) | i;
+- break;
++
++ if (info->fix.visual == FB_VISUAL_TRUECOLOR) {
++ u32 *pal = info->pseudo_palette;
++ u32 cr = red >> (16 - info->var.red.length);
++ u32 cg = green >> (16 - info->var.green.length);
++ u32 cb = blue >> (16 - info->var.blue.length);
++ u32 value;
++
++ if (regno >= 16)
++ return -EINVAL;
++
++ value = (cr << info->var.red.offset) |
++ (cg << info->var.green.offset) |
++ (cb << info->var.blue.offset);
++ if (info->var.transp.length > 0) {
++ u32 mask = (1 << info->var.transp.length) - 1;
++ mask <<= info->var.transp.offset;
++ value |= mask;
+ }
++ pal[regno] = value;
++ return 0;
+ }
+
++ if (regno > 255)
++ return -EINVAL;
++
+ red >>= 8;
+ green >>= 8;
+ blue >>= 8;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch
new file mode 100644
index 0000000..19c6d42
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch
@@ -0,0 +1,32 @@
+From 37c7c45ec59ce80eaedb2b8edc4b797e4ad0ef03 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Tue, 3 Jan 2012 12:09:15 +1100
+Subject: [PATCH 06/49] offb: Fix bug in calculating requested vram size
+
+commit c055fe0797b7bd8f6f21a13598a55a16d5c13ae7 upstream.
+
+We used to try to request 8 times more vram than needed, which would
+fail if the card has a too small BAR (observed with qemu & kvm).
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/video/offb.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/video/offb.c b/drivers/video/offb.c
+index 24e1fc6..3251a02 100644
+--- a/drivers/video/offb.c
++++ b/drivers/video/offb.c
+@@ -377,7 +377,7 @@ static void __init offb_init_fb(const char *name, const char *full_name,
+ int pitch, unsigned long address,
+ int foreign_endian, struct device_node *dp)
+ {
+- unsigned long res_size = pitch * height * (depth + 7) / 8;
++ unsigned long res_size = pitch * height;
+ struct offb_par *par = &default_par;
+ unsigned long res_start = address;
+ struct fb_fix_screeninfo *fix;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0007-libertas-clean-up-scan-thread-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0007-libertas-clean-up-scan-thread-handling.patch
new file mode 100644
index 0000000..38fbce3
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0007-libertas-clean-up-scan-thread-handling.patch
@@ -0,0 +1,86 @@
+From 3184baa0e69e6ad327808b91e0d915090c59b99b Mon Sep 17 00:00:00 2001
+From: Andres Salomon <dilinger@queued.net>
+Date: Mon, 19 Dec 2011 12:22:58 -0800
+Subject: [PATCH 07/49] libertas: clean up scan thread handling
+
+commit afbca95f95f2bf7283a72670c24c1f6de00b1cb5 upstream.
+
+The libertas scan thread expects priv->scan_req to be non-NULL. In theory,
+it should always be set. In practice, we've seen the following oops:
+
+[ 8363.067444] Unable to handle kernel NULL pointer dereference at virtual address 00000004
+[ 8363.067490] pgd = c0004000
+[ 8363.078393] [00000004] *pgd=00000000
+[ 8363.086711] Internal error: Oops: 17 [#1] PREEMPT
+[ 8363.091375] Modules linked in: fuse libertas_sdio libertas psmouse mousedev ov7670 mmp_camera joydev videobuf2_core videobuf2_dma_sg videobuf2_memops [last unloaded: scsi_wait_scan]
+[ 8363.107490] CPU: 0 Not tainted (3.0.0-gf7ccc69 #671)
+[ 8363.112799] PC is at lbs_scan_worker+0x108/0x5a4 [libertas]
+[ 8363.118326] LR is at 0x0
+[ 8363.120836] pc : [<bf03a854>] lr : [<00000000>] psr: 60000113
+[ 8363.120845] sp : ee66bf48 ip : 00000000 fp : 00000000
+[ 8363.120845] r10: ee2c2088 r9 : c04e2efc r8 : eef97005
+[ 8363.132231] r7 : eee0716f r6 : ee2c02c0 r5 : ee2c2088 r4 : eee07160
+[ 8363.137419] r3 : 00000000 r2 : a0000113 r1 : 00000001 r0 : eee07160
+[ 8363.143896] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
+[ 8363.157630] Control: 10c5387d Table: 2e754019 DAC: 00000015
+[ 8363.163334] Process kworker/u:1 (pid: 25, stack limit = 0xee66a2f8)
+
+While I've not found a smoking gun, there are two places that raised red flags
+for me. The first is in _internal_start_scan, when we queue up a scan; we
+first queue the worker, and then set priv->scan_req. There's theoretically
+a 50mS delay which should be plenty, but doing things that way just seems
+racy (and not in the good way).
+
+The second is in the scan worker thread itself. Depending on the state of
+priv->scan_channel, we cancel pending scan runs and then requeue a run in
+300mS. We then send the scan command down to the hardware, sleep, and if
+we get scan results for all the desired channels, we set priv->scan_req to
+NULL. However, it that's happened in less than 300mS, what happens with
+the pending scan run?
+
+This patch addresses both of those concerns. With the patch applied, we
+have not seen the oops in the past two weeks.
+
+Signed-off-by: Andres Salomon <dilinger@queued.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/libertas/cfg.c | 10 ++++++----
+ 1 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
+index a7f1ab2..db64ef1 100644
+--- a/drivers/net/wireless/libertas/cfg.c
++++ b/drivers/net/wireless/libertas/cfg.c
+@@ -728,9 +728,11 @@ static void lbs_scan_worker(struct work_struct *work)
+ le16_to_cpu(scan_cmd->hdr.size),
+ lbs_ret_scan, 0);
+
+- if (priv->scan_channel >= priv->scan_req->n_channels)
++ if (priv->scan_channel >= priv->scan_req->n_channels) {
+ /* Mark scan done */
++ cancel_delayed_work(&priv->scan_work);
+ lbs_scan_done(priv);
++ }
+
+ /* Restart network */
+ if (carrier)
+@@ -759,12 +761,12 @@ static void _internal_start_scan(struct lbs_private *priv, bool internal,
+ request->n_ssids, request->n_channels, request->ie_len);
+
+ priv->scan_channel = 0;
+- queue_delayed_work(priv->work_thread, &priv->scan_work,
+- msecs_to_jiffies(50));
+-
+ priv->scan_req = request;
+ priv->internal_scan = internal;
+
++ queue_delayed_work(priv->work_thread, &priv->scan_work,
++ msecs_to_jiffies(50));
++
+ lbs_deb_leave(LBS_DEB_CFG80211);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0008-bcma-support-for-suspend-and-resume.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0008-bcma-support-for-suspend-and-resume.patch
new file mode 100644
index 0000000..fa51849
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0008-bcma-support-for-suspend-and-resume.patch
@@ -0,0 +1,120 @@
+From 84c0b10f18c54e0f669f9ac81872db6aff1e59b4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Fri, 9 Dec 2011 22:16:07 +0100
+Subject: [PATCH 08/49] bcma: support for suspend and resume
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 775ab52142b02237a54184238e922251c59a2b5c upstream.
+
+bcma used to lock up machine without enabling PCI or initializing CC.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/bcma/bcma_private.h | 3 +++
+ drivers/bcma/host_pci.c | 37 +++++++++++++++++++++++++++++++++++++
+ drivers/bcma/main.c | 16 ++++++++++++++++
+ 3 files changed, 56 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
+index 30a3085..fda56bd 100644
+--- a/drivers/bcma/bcma_private.h
++++ b/drivers/bcma/bcma_private.h
+@@ -18,6 +18,9 @@ void bcma_bus_unregister(struct bcma_bus *bus);
+ int __init bcma_bus_early_register(struct bcma_bus *bus,
+ struct bcma_device *core_cc,
+ struct bcma_device *core_mips);
++#ifdef CONFIG_PM
++int bcma_bus_resume(struct bcma_bus *bus);
++#endif
+
+ /* scan.c */
+ int bcma_bus_scan(struct bcma_bus *bus);
+diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
+index 1b51d8b..990f5a8 100644
+--- a/drivers/bcma/host_pci.c
++++ b/drivers/bcma/host_pci.c
+@@ -224,6 +224,41 @@ static void bcma_host_pci_remove(struct pci_dev *dev)
+ pci_set_drvdata(dev, NULL);
+ }
+
++#ifdef CONFIG_PM
++static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
++{
++ /* Host specific */
++ pci_save_state(dev);
++ pci_disable_device(dev);
++ pci_set_power_state(dev, pci_choose_state(dev, state));
++
++ return 0;
++}
++
++static int bcma_host_pci_resume(struct pci_dev *dev)
++{
++ struct bcma_bus *bus = pci_get_drvdata(dev);
++ int err;
++
++ /* Host specific */
++ pci_set_power_state(dev, 0);
++ err = pci_enable_device(dev);
++ if (err)
++ return err;
++ pci_restore_state(dev);
++
++ /* Bus specific */
++ err = bcma_bus_resume(bus);
++ if (err)
++ return err;
++
++ return 0;
++}
++#else /* CONFIG_PM */
++# define bcma_host_pci_suspend NULL
++# define bcma_host_pci_resume NULL
++#endif /* CONFIG_PM */
++
+ static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
+ { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
+ { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
+@@ -239,6 +274,8 @@ static struct pci_driver bcma_pci_bridge_driver = {
+ .id_table = bcma_pci_bridge_tbl,
+ .probe = bcma_host_pci_probe,
+ .remove = bcma_host_pci_remove,
++ .suspend = bcma_host_pci_suspend,
++ .resume = bcma_host_pci_resume,
+ };
+
+ int __init bcma_host_pci_init(void)
+diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
+index 70c84b9..10f92b3 100644
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -240,6 +240,22 @@ int __init bcma_bus_early_register(struct bcma_bus *bus,
+ return 0;
+ }
+
++#ifdef CONFIG_PM
++int bcma_bus_resume(struct bcma_bus *bus)
++{
++ struct bcma_device *core;
++
++ /* Init CC core */
++ core = bcma_find_core(bus, BCMA_CORE_CHIPCOMMON);
++ if (core) {
++ bus->drv_cc.setup_done = false;
++ bcma_core_chipcommon_init(&bus->drv_cc);
++ }
++
++ return 0;
++}
++#endif
++
+ int __bcma_driver_register(struct bcma_driver *drv, struct module *owner)
+ {
+ drv->drv.name = drv->name;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch
new file mode 100644
index 0000000..3380e52
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch
@@ -0,0 +1,75 @@
+From aa9c7fd565d04120156ef720235e9a759638606a Mon Sep 17 00:00:00 2001
+From: Pontus Fuchs <pontus.fuchs@gmail.com>
+Date: Tue, 18 Oct 2011 09:23:41 +0200
+Subject: [PATCH 09/49] wl12xx: Validate FEM index from ini file and FW
+
+commit 2131d3c2f99b081806fdae7662c92fe6acda52af upstream.
+
+Check for out of bound FEM index to prevent reading beyond ini
+memory end.
+
+Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
+Reviewed-by: Luciano Coelho <coelho@ti.com>
+Signed-off-by: Luciano Coelho <coelho@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/wl12xx/cmd.c | 22 ++++++++++++++++++++++
+ 1 files changed, 22 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/wl12xx/cmd.c b/drivers/net/wireless/wl12xx/cmd.c
+index a52299e..54a0d66 100644
+--- a/drivers/net/wireless/wl12xx/cmd.c
++++ b/drivers/net/wireless/wl12xx/cmd.c
+@@ -120,6 +120,11 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
+ if (!wl->nvs)
+ return -ENODEV;
+
++ if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
++ wl1271_warning("FEM index from INI out of bounds");
++ return -EINVAL;
++ }
++
+ gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
+ if (!gen_parms)
+ return -ENOMEM;
+@@ -143,6 +148,12 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
+ gp->tx_bip_fem_manufacturer =
+ gen_parms->general_params.tx_bip_fem_manufacturer;
+
++ if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
++ wl1271_warning("FEM index from FW out of bounds");
++ ret = -EINVAL;
++ goto out;
++ }
++
+ wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
+ answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
+
+@@ -162,6 +173,11 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
+ if (!wl->nvs)
+ return -ENODEV;
+
++ if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
++ wl1271_warning("FEM index from ini out of bounds");
++ return -EINVAL;
++ }
++
+ gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
+ if (!gen_parms)
+ return -ENOMEM;
+@@ -186,6 +202,12 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
+ gp->tx_bip_fem_manufacturer =
+ gen_parms->general_params.tx_bip_fem_manufacturer;
+
++ if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
++ wl1271_warning("FEM index from FW out of bounds");
++ ret = -EINVAL;
++ goto out;
++ }
++
+ wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
+ answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch
new file mode 100644
index 0000000..d462ef6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch
@@ -0,0 +1,68 @@
+From bcd7880977c293b60ae6dbae4264d6c47be08fb9 Mon Sep 17 00:00:00 2001
+From: Pontus Fuchs <pontus.fuchs@gmail.com>
+Date: Tue, 18 Oct 2011 09:23:42 +0200
+Subject: [PATCH 10/49] wl12xx: Check buffer bound when processing nvs data
+
+commit f6efe96edd9c41c624c8f4ddbc4930c1a2d8f1e1 upstream.
+
+An nvs with malformed contents could cause the processing of the
+calibration data to read beyond the end of the buffer. Prevent this
+from happening by adding bound checking.
+
+Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
+Reviewed-by: Luciano Coelho <coelho@ti.com>
+Signed-off-by: Luciano Coelho <coelho@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/wl12xx/boot.c | 14 ++++++++++++++
+ 1 files changed, 14 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c
+index 6813379..a7b327d 100644
+--- a/drivers/net/wireless/wl12xx/boot.c
++++ b/drivers/net/wireless/wl12xx/boot.c
+@@ -347,6 +347,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+ nvs_ptr += 3;
+
+ for (i = 0; i < burst_len; i++) {
++ if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
++ goto out_badnvs;
++
+ val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
+ | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
+
+@@ -358,6 +361,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+ nvs_ptr += 4;
+ dest_addr += 4;
+ }
++
++ if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
++ goto out_badnvs;
+ }
+
+ /*
+@@ -369,6 +375,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+ */
+ nvs_ptr = (u8 *)wl->nvs +
+ ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
++
++ if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
++ goto out_badnvs;
++
+ nvs_len -= nvs_ptr - (u8 *)wl->nvs;
+
+ /* Now we must set the partition correctly */
+@@ -384,6 +394,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+
+ kfree(nvs_aligned);
+ return 0;
++
++out_badnvs:
++ wl1271_error("nvs data is malformed");
++ return -EILSEQ;
+ }
+
+ static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0011-wl12xx-Restore-testmode-ABI.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0011-wl12xx-Restore-testmode-ABI.patch
new file mode 100644
index 0000000..7c619d4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0011-wl12xx-Restore-testmode-ABI.patch
@@ -0,0 +1,32 @@
+From 78848b4805314cdbf6c342b8315cdf7db2a1d09e Mon Sep 17 00:00:00 2001
+From: Pontus Fuchs <pontus.fuchs@gmail.com>
+Date: Thu, 1 Dec 2011 12:13:44 +0100
+Subject: [PATCH 11/49] wl12xx: Restore testmode ABI
+
+commit 3f1764945eaac532c20ab1f23afa352a40f797b2 upstream.
+
+Commit 80900d0140a7648587982c8f299830e900e49165 accidently broke
+the ABI for testmode commands. Restore the ABI again.
+
+Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
+Signed-off-by: Luciano Coelho <coelho@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/wl12xx/testmode.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
+index 4ae8eff..abfb120 100644
+--- a/drivers/net/wireless/wl12xx/testmode.c
++++ b/drivers/net/wireless/wl12xx/testmode.c
+@@ -36,6 +36,7 @@ enum wl1271_tm_commands {
+ WL1271_TM_CMD_TEST,
+ WL1271_TM_CMD_INTERROGATE,
+ WL1271_TM_CMD_CONFIGURE,
++ WL1271_TM_CMD_NVS_PUSH, /* Not in use. Keep to not break ABI */
+ WL1271_TM_CMD_SET_PLT_MODE,
+ WL1271_TM_CMD_RECOVER,
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch
new file mode 100644
index 0000000..77fcc8b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch
@@ -0,0 +1,93 @@
+From 9c146884a6b099ed8892c056e26eae85019bc2c9 Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Wed, 23 Nov 2011 20:07:17 +0000
+Subject: [PATCH 12/49] powerpc/time: Handle wrapping of decrementer
+
+commit 37fb9a0231ee43d42d069863bdfd567fca2b61af upstream.
+
+When re-enabling interrupts we have code to handle edge sensitive
+decrementers by resetting the decrementer to 1 whenever it is negative.
+If interrupts were disabled long enough that the decrementer wrapped to
+positive we do nothing. This means interrupts can be delayed for a long
+time until it finally goes negative again.
+
+While we hope interrupts are never be disabled long enough for the
+decrementer to go positive, we have a very good test team that can
+drive any kernel into the ground. The softlockup data we get back
+from these fails could be seconds in the future, completely missing
+the cause of the lockup.
+
+We already keep track of the timebase of the next event so use that
+to work out if we should trigger a decrementer exception.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/powerpc/include/asm/time.h | 2 ++
+ arch/powerpc/kernel/irq.c | 15 ++++++---------
+ arch/powerpc/kernel/time.c | 9 +++++++++
+ 3 files changed, 17 insertions(+), 9 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/time.h b/arch/powerpc/include/asm/time.h
+index fe6f7c2..bc3c745 100644
+--- a/arch/powerpc/include/asm/time.h
++++ b/arch/powerpc/include/asm/time.h
+@@ -219,5 +219,7 @@ DECLARE_PER_CPU(struct cpu_usage, cpu_usage_array);
+ extern void secondary_cpu_time_init(void);
+ extern void iSeries_time_init_early(void);
+
++extern void decrementer_check_overflow(void);
++
+ #endif /* __KERNEL__ */
+ #endif /* __POWERPC_TIME_H */
+diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
+index 5c3c469..745c1e7 100644
+--- a/arch/powerpc/kernel/irq.c
++++ b/arch/powerpc/kernel/irq.c
+@@ -164,16 +164,13 @@ notrace void arch_local_irq_restore(unsigned long en)
+ */
+ local_paca->hard_enabled = en;
+
+-#ifndef CONFIG_BOOKE
+- /* On server, re-trigger the decrementer if it went negative since
+- * some processors only trigger on edge transitions of the sign bit.
+- *
+- * BookE has a level sensitive decrementer (latches in TSR) so we
+- * don't need that
++ /*
++ * Trigger the decrementer if we have a pending event. Some processors
++ * only trigger on edge transitions of the sign bit. We might also
++ * have disabled interrupts long enough that the decrementer wrapped
++ * to positive.
+ */
+- if ((int)mfspr(SPRN_DEC) < 0)
+- mtspr(SPRN_DEC, 1);
+-#endif /* CONFIG_BOOKE */
++ decrementer_check_overflow();
+
+ /*
+ * Force the delivery of pending soft-disabled interrupts on PS3.
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index 522bb1d..5db163c 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -889,6 +889,15 @@ static void __init clocksource_init(void)
+ clock->name, clock->mult, clock->shift);
+ }
+
++void decrementer_check_overflow(void)
++{
++ u64 now = get_tb_or_rtc();
++ struct decrementer_clock *decrementer = &__get_cpu_var(decrementers);
++
++ if (now >= decrementer->next_tb)
++ set_dec(1);
++}
++
+ static int decrementer_set_next_event(unsigned long evt,
+ struct clock_event_device *dev)
+ {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch
new file mode 100644
index 0000000..69c746e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch
@@ -0,0 +1,85 @@
+From 78f337d172aafe8577dab8044f26326850b6c5d0 Mon Sep 17 00:00:00 2001
+From: Li Zhong <zhong@linux.vnet.ibm.com>
+Date: Sun, 18 Dec 2011 16:03:04 +0000
+Subject: [PATCH 13/49] powerpc: Fix unpaired probe_hcall_entry and
+ probe_hcall_exit
+
+commit e4f387d8db3ba3c2dae4d8bdfe7bb5f4fe1bcb0d upstream.
+
+Unpaired calling of probe_hcall_entry and probe_hcall_exit might happen
+as following, which could cause incorrect preempt count.
+
+__trace_hcall_entry => trace_hcall_entry -> probe_hcall_entry =>
+get_cpu_var => preempt_disable
+
+__trace_hcall_exit => trace_hcall_exit -> probe_hcall_exit =>
+put_cpu_var => preempt_enable
+
+where:
+A => B and A -> B means A calls B, but
+=> means A will call B through function name, and B will definitely be
+called.
+-> means A will call B through function pointer, so B might not be
+called if the function pointer is not set.
+
+So error happens when only one of probe_hcall_entry and probe_hcall_exit
+get called during a hcall.
+
+This patch tries to move the preempt count operations from
+probe_hcall_entry and probe_hcall_exit to its callers.
+
+Reported-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Li Zhong <zhong@linux.vnet.ibm.com>
+Tested-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/powerpc/platforms/pseries/hvCall_inst.c | 4 +---
+ arch/powerpc/platforms/pseries/lpar.c | 2 ++
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/hvCall_inst.c b/arch/powerpc/platforms/pseries/hvCall_inst.c
+index f106662..c9311cf 100644
+--- a/arch/powerpc/platforms/pseries/hvCall_inst.c
++++ b/arch/powerpc/platforms/pseries/hvCall_inst.c
+@@ -109,7 +109,7 @@ static void probe_hcall_entry(void *ignored, unsigned long opcode, unsigned long
+ if (opcode > MAX_HCALL_OPCODE)
+ return;
+
+- h = &get_cpu_var(hcall_stats)[opcode / 4];
++ h = &__get_cpu_var(hcall_stats)[opcode / 4];
+ h->tb_start = mftb();
+ h->purr_start = mfspr(SPRN_PURR);
+ }
+@@ -126,8 +126,6 @@ static void probe_hcall_exit(void *ignored, unsigned long opcode, unsigned long
+ h->num_calls++;
+ h->tb_total += mftb() - h->tb_start;
+ h->purr_total += mfspr(SPRN_PURR) - h->purr_start;
+-
+- put_cpu_var(hcall_stats);
+ }
+
+ static int __init hcall_inst_init(void)
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index 27a4950..dc36ea6 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -554,6 +554,7 @@ void __trace_hcall_entry(unsigned long opcode, unsigned long *args)
+ goto out;
+
+ (*depth)++;
++ preempt_disable();
+ trace_hcall_entry(opcode, args);
+ (*depth)--;
+
+@@ -576,6 +577,7 @@ void __trace_hcall_exit(long opcode, unsigned long retval,
+
+ (*depth)++;
+ trace_hcall_exit(opcode, retval, retbuf);
++ preempt_enable();
+ (*depth)--;
+
+ out:
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch
new file mode 100644
index 0000000..8f8624a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch
@@ -0,0 +1,78 @@
+From 838487db8eb68ce5fa5417e9ea1333795f172523 Mon Sep 17 00:00:00 2001
+From: Ram Vepa <ram.vepa@qlogic.com>
+Date: Fri, 23 Dec 2011 08:01:43 -0500
+Subject: [PATCH 14/49] IB/qib: Fix a possible data corruption when receiving
+ packets
+
+commit eddfb675256f49d14e8c5763098afe3eb2c93701 upstream.
+
+Prevent a receive data corruption by ensuring that the write to update
+the rcvhdrheadn register to generate an interrupt is at the very end
+of the receive processing.
+
+Signed-off-by: Ramkrishna Vepa <ram.vepa@qlogic.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@qlogic.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/infiniband/hw/qib/qib_iba6120.c | 4 +++-
+ drivers/infiniband/hw/qib/qib_iba7220.c | 4 +++-
+ drivers/infiniband/hw/qib/qib_iba7322.c | 6 ++++--
+ 3 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
+index 781a802..4f18e2d 100644
+--- a/drivers/infiniband/hw/qib/qib_iba6120.c
++++ b/drivers/infiniband/hw/qib/qib_iba6120.c
+@@ -2076,9 +2076,11 @@ static void qib_6120_config_ctxts(struct qib_devdata *dd)
+ static void qib_update_6120_usrhead(struct qib_ctxtdata *rcd, u64 hd,
+ u32 updegr, u32 egrhd, u32 npkts)
+ {
+- qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+ if (updegr)
+ qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
++ mmiowb();
++ qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
++ mmiowb();
+ }
+
+ static u32 qib_6120_hdrqempty(struct qib_ctxtdata *rcd)
+diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
+index 439d3c5..7ec4048 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7220.c
++++ b/drivers/infiniband/hw/qib/qib_iba7220.c
+@@ -2725,9 +2725,11 @@ static int qib_7220_set_loopback(struct qib_pportdata *ppd, const char *what)
+ static void qib_update_7220_usrhead(struct qib_ctxtdata *rcd, u64 hd,
+ u32 updegr, u32 egrhd, u32 npkts)
+ {
+- qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+ if (updegr)
+ qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
++ mmiowb();
++ qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
++ mmiowb();
+ }
+
+ static u32 qib_7220_hdrqempty(struct qib_ctxtdata *rcd)
+diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
+index 1d58959..5a070e8 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7322.c
++++ b/drivers/infiniband/hw/qib/qib_iba7322.c
+@@ -4082,10 +4082,12 @@ static void qib_update_7322_usrhead(struct qib_ctxtdata *rcd, u64 hd,
+ */
+ if (hd >> IBA7322_HDRHEAD_PKTINT_SHIFT)
+ adjust_rcv_timeout(rcd, npkts);
+- qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+- qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+ if (updegr)
+ qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
++ mmiowb();
++ qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
++ qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
++ mmiowb();
+ }
+
+ static u32 qib_7322_hdrqempty(struct qib_ctxtdata *rcd)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch
new file mode 100644
index 0000000..bff1351
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch
@@ -0,0 +1,96 @@
+From a2beea13ae4c2ffcaa7f0ddf94fde1246e2e6fc1 Mon Sep 17 00:00:00 2001
+From: Eli Cohen <eli@dev.mellanox.co.il>
+Date: Tue, 3 Jan 2012 20:36:48 -0800
+Subject: [PATCH 15/49] IB/uverbs: Protect QP multicast list
+
+commit e214a0fe2b382fa302c036ecd6e6ffe99e3b9875 upstream.
+
+Userspace verbs multicast attach/detach operations on a QP are done
+while holding the rwsem of the QP for reading. That's not sufficient
+since a reader lock allows more than one reader to acquire the
+lock. However, multicast attach/detach does list manipulation that
+can corrupt the list if multiple threads run in parallel.
+
+Fix this by acquiring the rwsem as a writer to serialize attach/detach
+operations. Add idr_write_qp() and put_qp_write() to encapsulate
+this.
+
+This fixes oops seen when running applications that perform multicast
+joins/leaves.
+
+Reported by: Mike Dubman <miked@mellanox.com>
+Signed-off-by: Eli Cohen <eli@mellanox.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/infiniband/core/uverbs_cmd.c | 21 +++++++++++++++++----
+ 1 files changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 254f164..e3db8ef 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -241,11 +241,24 @@ static struct ib_qp *idr_read_qp(int qp_handle, struct ib_ucontext *context)
+ return idr_read_obj(&ib_uverbs_qp_idr, qp_handle, context, 0);
+ }
+
++static struct ib_qp *idr_write_qp(int qp_handle, struct ib_ucontext *context)
++{
++ struct ib_uobject *uobj;
++
++ uobj = idr_write_uobj(&ib_uverbs_qp_idr, qp_handle, context);
++ return uobj ? uobj->object : NULL;
++}
++
+ static void put_qp_read(struct ib_qp *qp)
+ {
+ put_uobj_read(qp->uobject);
+ }
+
++static void put_qp_write(struct ib_qp *qp)
++{
++ put_uobj_write(qp->uobject);
++}
++
+ static struct ib_srq *idr_read_srq(int srq_handle, struct ib_ucontext *context)
+ {
+ return idr_read_obj(&ib_uverbs_srq_idr, srq_handle, context, 0);
+@@ -2375,7 +2388,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
+ if (copy_from_user(&cmd, buf, sizeof cmd))
+ return -EFAULT;
+
+- qp = idr_read_qp(cmd.qp_handle, file->ucontext);
++ qp = idr_write_qp(cmd.qp_handle, file->ucontext);
+ if (!qp)
+ return -EINVAL;
+
+@@ -2404,7 +2417,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
+ kfree(mcast);
+
+ out_put:
+- put_qp_read(qp);
++ put_qp_write(qp);
+
+ return ret ? ret : in_len;
+ }
+@@ -2422,7 +2435,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
+ if (copy_from_user(&cmd, buf, sizeof cmd))
+ return -EFAULT;
+
+- qp = idr_read_qp(cmd.qp_handle, file->ucontext);
++ qp = idr_write_qp(cmd.qp_handle, file->ucontext);
+ if (!qp)
+ return -EINVAL;
+
+@@ -2441,7 +2454,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
+ }
+
+ out_put:
+- put_qp_read(qp);
++ put_qp_write(qp);
+
+ return ret ? ret : in_len;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0016-iwlagn-fix-TID-use-bug.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0016-iwlagn-fix-TID-use-bug.patch
new file mode 100644
index 0000000..7c02037
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0016-iwlagn-fix-TID-use-bug.patch
@@ -0,0 +1,50 @@
+From 274a64cd739d2b5e33e6e2112f78c896b18849a9 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 2 Dec 2011 12:22:54 -0800
+Subject: [PATCH 16/49] iwlagn: fix TID use bug
+
+commit 9a215e40d70ae63762963ab3ccc7f31dd966dc6a upstream.
+
+The driver everywhere uses max TID count as 9,
+which is wrong, it should be 8.
+
+I think the reason it uses 9 here is off-by-one
+confusion by whoever wrote this. We do use the
+value IWL_MAX_TID_COUNT for "not QoS/no TID"
+but that is completely correct even if it is 8
+and not 9 since 0-7 are only valid.
+
+As a side effect, this fixes the following bug:
+
+ Open BA session requested for 00:23:cd:16:8a:7e tid 8
+ ------------[ cut here ]------------
+ kernel BUG at drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h:350!
+ ...
+
+when you do
+echo "tx start 8" > /sys/kernel/debug/ieee80211/*/*/*/*/agg_status
+
+Reported-by: Nikolay Martynov <mar.kolya@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/iwlwifi/iwl-commands.h | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
+index 69d5f85..8b9ff28 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
++++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
+@@ -809,7 +809,7 @@ struct iwl_qosparam_cmd {
+ #define IWLAGN_STATION_COUNT 16
+
+ #define IWL_INVALID_STATION 255
+-#define IWL_MAX_TID_COUNT 9
++#define IWL_MAX_TID_COUNT 8
+
+ #define STA_FLG_TX_RATE_MSK cpu_to_le32(1 << 2)
+ #define STA_FLG_PWR_SAVE_MSK cpu_to_le32(1 << 8)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch
new file mode 100644
index 0000000..5dcc7c4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch
@@ -0,0 +1,180 @@
+From 8de3e18bbd1ec02914f9bf1517d2c3557c666314 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 19 Dec 2011 14:00:59 -0800
+Subject: [PATCH 17/49] iwlagn: fix (remove) use of PAGE_SIZE
+
+commit 106671369e6d046c0b3e1e72b18ad6dd9cb298b0 upstream.
+
+The ICT code erroneously uses PAGE_SIZE. The bug
+is that PAGE_SIZE isn't necessarily 4096, so on
+such platforms this code will not work correctly
+as we'll try to attempt to read an index in the
+table that the device never wrote, it always has
+4096-byte pages.
+
+Additionally, the manual alignment code here is
+unnecessary -- Documentation/DMA-API-HOWTO.txt
+states:
+ The cpu return address and the DMA bus master address are both
+ guaranteed to be aligned to the smallest PAGE_SIZE order which
+ is greater than or equal to the requested size. This invariant
+ exists (for example) to guarantee that if you allocate a chunk
+ which is smaller than or equal to 64 kilobytes, the extent of the
+ buffer you receive will not cross a 64K boundary.
+
+Just use appropriate new constants and get rid of
+the alignment code.
+
+Cc: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h | 2 -
+ drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c | 73 +++++++++------------
+ 2 files changed, 31 insertions(+), 44 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
+index 2b6756e..5c29281 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
++++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
+@@ -219,9 +219,7 @@ struct iwl_trans_pcie {
+
+ /* INT ICT Table */
+ __le32 *ict_tbl;
+- void *ict_tbl_vir;
+ dma_addr_t ict_tbl_dma;
+- dma_addr_t aligned_ict_tbl_dma;
+ int ict_index;
+ u32 inta;
+ bool use_ict;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+index 374c68c..1920237 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+@@ -1136,7 +1136,11 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
+ * ICT functions
+ *
+ ******************************************************************************/
+-#define ICT_COUNT (PAGE_SIZE/sizeof(u32))
++
++/* a device (PCI-E) page is 4096 bytes long */
++#define ICT_SHIFT 12
++#define ICT_SIZE (1 << ICT_SHIFT)
++#define ICT_COUNT (ICT_SIZE / sizeof(u32))
+
+ /* Free dram table */
+ void iwl_free_isr_ict(struct iwl_trans *trans)
+@@ -1144,21 +1148,19 @@ void iwl_free_isr_ict(struct iwl_trans *trans)
+ struct iwl_trans_pcie *trans_pcie =
+ IWL_TRANS_GET_PCIE_TRANS(trans);
+
+- if (trans_pcie->ict_tbl_vir) {
+- dma_free_coherent(bus(trans)->dev,
+- (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
+- trans_pcie->ict_tbl_vir,
++ if (trans_pcie->ict_tbl) {
++ dma_free_coherent(bus(trans)->dev, ICT_SIZE,
++ trans_pcie->ict_tbl,
+ trans_pcie->ict_tbl_dma);
+- trans_pcie->ict_tbl_vir = NULL;
+- memset(&trans_pcie->ict_tbl_dma, 0,
+- sizeof(trans_pcie->ict_tbl_dma));
+- memset(&trans_pcie->aligned_ict_tbl_dma, 0,
+- sizeof(trans_pcie->aligned_ict_tbl_dma));
++ trans_pcie->ict_tbl = NULL;
++ trans_pcie->ict_tbl_dma = 0;
+ }
+ }
+
+
+-/* allocate dram shared table it is a PAGE_SIZE aligned
++/*
++ * allocate dram shared table, it is an aligned memory
++ * block of ICT_SIZE.
+ * also reset all data related to ICT table interrupt.
+ */
+ int iwl_alloc_isr_ict(struct iwl_trans *trans)
+@@ -1166,36 +1168,26 @@ int iwl_alloc_isr_ict(struct iwl_trans *trans)
+ struct iwl_trans_pcie *trans_pcie =
+ IWL_TRANS_GET_PCIE_TRANS(trans);
+
+- /* allocate shrared data table */
+- trans_pcie->ict_tbl_vir =
+- dma_alloc_coherent(bus(trans)->dev,
+- (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
+- &trans_pcie->ict_tbl_dma, GFP_KERNEL);
+- if (!trans_pcie->ict_tbl_vir)
++ trans_pcie->ict_tbl =
++ dma_alloc_coherent(bus(trans)->dev, ICT_SIZE,
++ &trans_pcie->ict_tbl_dma,
++ GFP_KERNEL);
++ if (!trans_pcie->ict_tbl)
+ return -ENOMEM;
+
+- /* align table to PAGE_SIZE boundary */
+- trans_pcie->aligned_ict_tbl_dma =
+- ALIGN(trans_pcie->ict_tbl_dma, PAGE_SIZE);
+-
+- IWL_DEBUG_ISR(trans, "ict dma addr %Lx dma aligned %Lx diff %d\n",
+- (unsigned long long)trans_pcie->ict_tbl_dma,
+- (unsigned long long)trans_pcie->aligned_ict_tbl_dma,
+- (int)(trans_pcie->aligned_ict_tbl_dma -
+- trans_pcie->ict_tbl_dma));
++ /* just an API sanity check ... it is guaranteed to be aligned */
++ if (WARN_ON(trans_pcie->ict_tbl_dma & (ICT_SIZE - 1))) {
++ iwl_free_isr_ict(trans);
++ return -EINVAL;
++ }
+
+- trans_pcie->ict_tbl = trans_pcie->ict_tbl_vir +
+- (trans_pcie->aligned_ict_tbl_dma -
+- trans_pcie->ict_tbl_dma);
++ IWL_DEBUG_ISR(trans, "ict dma addr %Lx\n",
++ (unsigned long long)trans_pcie->ict_tbl_dma);
+
+- IWL_DEBUG_ISR(trans, "ict vir addr %p vir aligned %p diff %d\n",
+- trans_pcie->ict_tbl, trans_pcie->ict_tbl_vir,
+- (int)(trans_pcie->aligned_ict_tbl_dma -
+- trans_pcie->ict_tbl_dma));
++ IWL_DEBUG_ISR(trans, "ict vir addr %p\n", trans_pcie->ict_tbl);
+
+ /* reset table and index to all 0 */
+- memset(trans_pcie->ict_tbl_vir, 0,
+- (sizeof(u32) * ICT_COUNT) + PAGE_SIZE);
++ memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
+ trans_pcie->ict_index = 0;
+
+ /* add periodic RX interrupt */
+@@ -1213,23 +1205,20 @@ int iwl_reset_ict(struct iwl_trans *trans)
+ struct iwl_trans_pcie *trans_pcie =
+ IWL_TRANS_GET_PCIE_TRANS(trans);
+
+- if (!trans_pcie->ict_tbl_vir)
++ if (!trans_pcie->ict_tbl)
+ return 0;
+
+ spin_lock_irqsave(&trans->shrd->lock, flags);
+ iwl_disable_interrupts(trans);
+
+- memset(&trans_pcie->ict_tbl[0], 0, sizeof(u32) * ICT_COUNT);
++ memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
+
+- val = trans_pcie->aligned_ict_tbl_dma >> PAGE_SHIFT;
++ val = trans_pcie->ict_tbl_dma >> ICT_SHIFT;
+
+ val |= CSR_DRAM_INT_TBL_ENABLE;
+ val |= CSR_DRAM_INIT_TBL_WRAP_CHECK;
+
+- IWL_DEBUG_ISR(trans, "CSR_DRAM_INT_TBL_REG =0x%X "
+- "aligned dma address %Lx\n",
+- val,
+- (unsigned long long)trans_pcie->aligned_ict_tbl_dma);
++ IWL_DEBUG_ISR(trans, "CSR_DRAM_INT_TBL_REG =0x%x\n", val);
+
+ iwl_write32(bus(trans), CSR_DRAM_INT_TBL_REG, val);
+ trans_pcie->use_ict = true;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch
new file mode 100644
index 0000000..96e1c79
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch
@@ -0,0 +1,37 @@
+From 3d69705bbc0503baa930a277c3570ccdc2b82ac1 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt@redhat.com>
+Date: Fri, 4 Nov 2011 16:32:25 -0400
+Subject: [PATCH 18/49] perf: Fix parsing of __print_flags() in TP_printk()
+
+commit 49908a1b25d448d68fd26faca260e1850201575f upstream.
+
+A update is made to the sched:sched_switch event that adds some
+logic to the first parameter of the __print_flags() that shows the
+state of tasks. This change cause perf to fail parsing the flags.
+
+A simple fix is needed to have the parser be able to process ops
+within the argument.
+
+Reported-by: Andrew Vagin <avagin@openvz.org>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ tools/perf/util/trace-event-parse.c | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
+index 6c164dc..bf54c48 100644
+--- a/tools/perf/util/trace-event-parse.c
++++ b/tools/perf/util/trace-event-parse.c
+@@ -1582,6 +1582,8 @@ process_symbols(struct event *event, struct print_arg *arg, char **tok)
+ field = malloc_or_die(sizeof(*field));
+
+ type = process_arg(event, field, &token);
++ while (type == EVENT_OP)
++ type = process_op(event, field, &token);
+ if (test_type_token(type, token, EVENT_DELIM, ","))
+ goto out_free;
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch
new file mode 100644
index 0000000..903491a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch
@@ -0,0 +1,41 @@
+From b892a813649b593177f4b36c200691ec7b610af7 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh@panasas.com>
+Date: Tue, 27 Dec 2011 19:23:36 +0200
+Subject: [PATCH 19/49] ore: Fix crash in case of an IO error.
+
+commit ffefb8eaa367e8a5c14f779233d9da1fbc23d164 upstream.
+
+The users of ore_check_io() expect the reported device
+(In case of error) to be indexed relative to the passed-in
+ore_components table, and not the logical dev index.
+
+This causes a crash inside objlayoutdriver in case of
+an IO error.
+
+Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/exofs/ore.c | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c
+index d271ad8..894f3e1 100644
+--- a/fs/exofs/ore.c
++++ b/fs/exofs/ore.c
+@@ -445,10 +445,10 @@ int ore_check_io(struct ore_io_state *ios, ore_on_dev_error on_dev_error)
+ u64 residual = ios->reading ?
+ or->in.residual : or->out.residual;
+ u64 offset = (ios->offset + ios->length) - residual;
+- struct ore_dev *od = ios->oc->ods[
+- per_dev->dev - ios->oc->first_dev];
++ unsigned dev = per_dev->dev - ios->oc->first_dev;
++ struct ore_dev *od = ios->oc->ods[dev];
+
+- on_dev_error(ios, od, per_dev->dev, osi.osd_err_pri,
++ on_dev_error(ios, od, dev, osi.osd_err_pri,
+ offset, residual);
+ }
+ if (osi.osd_err_pri >= acumulated_osd_err) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch
new file mode 100644
index 0000000..76fe4bf
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch
@@ -0,0 +1,56 @@
+From 3c8f1a35fab7418f9afeda2618992c1fd5504475 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh@panasas.com>
+Date: Wed, 28 Dec 2011 19:14:23 +0200
+Subject: [PATCH 20/49] ore: fix BUG_ON, too few sgs when reading
+
+commit 361aba569f55dd159b850489a3538253afbb3973 upstream.
+
+When reading RAID5 files, in rare cases, we calculated too
+few sg segments. There should be two extra for the beginning
+and end partial units.
+
+Also "too few sg segments" should not be a BUG_ON there is
+all the mechanics in place to handle it, as a short read.
+So just return -ENOMEM and the rest of the code will gracefully
+split the IO.
+
+Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/exofs/ore.c | 2 +-
+ fs/exofs/ore_raid.c | 6 +++++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c
+index 894f3e1..49cf230 100644
+--- a/fs/exofs/ore.c
++++ b/fs/exofs/ore.c
+@@ -266,7 +266,7 @@ int ore_get_rw_state(struct ore_layout *layout, struct ore_components *oc,
+
+ /* first/last seg is split */
+ num_raid_units += layout->group_width;
+- sgs_per_dev = div_u64(num_raid_units, data_devs);
++ sgs_per_dev = div_u64(num_raid_units, data_devs) + 2;
+ } else {
+ /* For Writes add parity pages array. */
+ max_par_pages = num_raid_units * pages_in_unit *
+diff --git a/fs/exofs/ore_raid.c b/fs/exofs/ore_raid.c
+index 29c47e5..414a2df 100644
+--- a/fs/exofs/ore_raid.c
++++ b/fs/exofs/ore_raid.c
+@@ -551,7 +551,11 @@ int _ore_add_parity_unit(struct ore_io_state *ios,
+ unsigned cur_len)
+ {
+ if (ios->reading) {
+- BUG_ON(per_dev->cur_sg >= ios->sgs_per_dev);
++ if (per_dev->cur_sg >= ios->sgs_per_dev) {
++ ORE_DBGMSG("cur_sg(%d) >= sgs_per_dev(%d)\n" ,
++ per_dev->cur_sg, ios->sgs_per_dev);
++ return -ENOMEM;
++ }
+ _ore_add_sg_seg(per_dev, cur_len, true);
+ } else {
+ struct __stripe_pages_2d *sp2d = ios->sp2d;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch
new file mode 100644
index 0000000..94fe29e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch
@@ -0,0 +1,163 @@
+From f3db3efc229dac1097a71b9d793d61aefb033ac2 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh@panasas.com>
+Date: Wed, 28 Dec 2011 19:21:45 +0200
+Subject: [PATCH 21/49] ore: Must support none-PAGE-aligned IO
+
+commit 724577ca355795b0a25c93ccbeee927871ca1a77 upstream.
+
+NFS might send us offsets that are not PAGE aligned. So
+we must read in the reminder of the first/last pages, in cases
+we need it for Parity calculations.
+
+We only add an sg segments to read the partial page. But
+we don't mark it as read=true because it is a lock-for-write
+page.
+
+TODO: In some cases (IO spans a single unit) we can just
+adjust the raid_unit offset/length, but this is left for
+later Kernels.
+
+Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/exofs/ore_raid.c | 72 ++++++++++++++++++++++++++++++++++++++++++--------
+ 1 files changed, 60 insertions(+), 12 deletions(-)
+
+diff --git a/fs/exofs/ore_raid.c b/fs/exofs/ore_raid.c
+index 414a2df..d222c77 100644
+--- a/fs/exofs/ore_raid.c
++++ b/fs/exofs/ore_raid.c
+@@ -328,8 +328,8 @@ static int _alloc_read_4_write(struct ore_io_state *ios)
+ /* @si contains info of the to-be-inserted page. Update of @si should be
+ * maintained by caller. Specificaly si->dev, si->obj_offset, ...
+ */
+-static int _add_to_read_4_write(struct ore_io_state *ios,
+- struct ore_striping_info *si, struct page *page)
++static int _add_to_r4w(struct ore_io_state *ios, struct ore_striping_info *si,
++ struct page *page, unsigned pg_len)
+ {
+ struct request_queue *q;
+ struct ore_per_dev_state *per_dev;
+@@ -366,17 +366,60 @@ static int _add_to_read_4_write(struct ore_io_state *ios,
+ _ore_add_sg_seg(per_dev, gap, true);
+ }
+ q = osd_request_queue(ore_comp_dev(read_ios->oc, per_dev->dev));
+- added_len = bio_add_pc_page(q, per_dev->bio, page, PAGE_SIZE, 0);
+- if (unlikely(added_len != PAGE_SIZE)) {
++ added_len = bio_add_pc_page(q, per_dev->bio, page, pg_len,
++ si->obj_offset % PAGE_SIZE);
++ if (unlikely(added_len != pg_len)) {
+ ORE_DBGMSG("Failed to bio_add_pc_page bi_vcnt=%d\n",
+ per_dev->bio->bi_vcnt);
+ return -ENOMEM;
+ }
+
+- per_dev->length += PAGE_SIZE;
++ per_dev->length += pg_len;
+ return 0;
+ }
+
++/* read the beginning of an unaligned first page */
++static int _add_to_r4w_first_page(struct ore_io_state *ios, struct page *page)
++{
++ struct ore_striping_info si;
++ unsigned pg_len;
++
++ ore_calc_stripe_info(ios->layout, ios->offset, 0, &si);
++
++ pg_len = si.obj_offset % PAGE_SIZE;
++ si.obj_offset -= pg_len;
++
++ ORE_DBGMSG("offset=0x%llx len=0x%x index=0x%lx dev=%x\n",
++ _LLU(si.obj_offset), pg_len, page->index, si.dev);
++
++ return _add_to_r4w(ios, &si, page, pg_len);
++}
++
++/* read the end of an incomplete last page */
++static int _add_to_r4w_last_page(struct ore_io_state *ios, u64 *offset)
++{
++ struct ore_striping_info si;
++ struct page *page;
++ unsigned pg_len, p, c;
++
++ ore_calc_stripe_info(ios->layout, *offset, 0, &si);
++
++ p = si.unit_off / PAGE_SIZE;
++ c = _dev_order(ios->layout->group_width * ios->layout->mirrors_p1,
++ ios->layout->mirrors_p1, si.par_dev, si.dev);
++ page = ios->sp2d->_1p_stripes[p].pages[c];
++
++ pg_len = PAGE_SIZE - (si.unit_off % PAGE_SIZE);
++ *offset += pg_len;
++
++ ORE_DBGMSG("p=%d, c=%d next-offset=0x%llx len=0x%x dev=%x par_dev=%d\n",
++ p, c, _LLU(*offset), pg_len, si.dev, si.par_dev);
++
++ BUG_ON(!page);
++
++ return _add_to_r4w(ios, &si, page, pg_len);
++}
++
+ static void _mark_read4write_pages_uptodate(struct ore_io_state *ios, int ret)
+ {
+ struct bio_vec *bv;
+@@ -444,9 +487,13 @@ static int _read_4_write(struct ore_io_state *ios)
+ struct page **pp = &_1ps->pages[c];
+ bool uptodate;
+
+- if (*pp)
++ if (*pp) {
++ if (ios->offset % PAGE_SIZE)
++ /* Read the remainder of the page */
++ _add_to_r4w_first_page(ios, *pp);
+ /* to-be-written pages start here */
+ goto read_last_stripe;
++ }
+
+ *pp = ios->r4w->get_page(ios->private, offset,
+ &uptodate);
+@@ -454,7 +501,7 @@ static int _read_4_write(struct ore_io_state *ios)
+ return -ENOMEM;
+
+ if (!uptodate)
+- _add_to_read_4_write(ios, &read_si, *pp);
++ _add_to_r4w(ios, &read_si, *pp, PAGE_SIZE);
+
+ /* Mark read-pages to be cache_released */
+ _1ps->page_is_read[c] = true;
+@@ -465,8 +512,11 @@ static int _read_4_write(struct ore_io_state *ios)
+ }
+
+ read_last_stripe:
+- offset = ios->offset + (ios->length + PAGE_SIZE - 1) /
+- PAGE_SIZE * PAGE_SIZE;
++ offset = ios->offset + ios->length;
++ if (offset % PAGE_SIZE)
++ _add_to_r4w_last_page(ios, &offset);
++ /* offset will be aligned to next page */
++
+ last_stripe_end = div_u64(offset + bytes_in_stripe - 1, bytes_in_stripe)
+ * bytes_in_stripe;
+ if (offset == last_stripe_end) /* Optimize for the aligned case */
+@@ -503,7 +553,7 @@ read_last_stripe:
+ /* Mark read-pages to be cache_released */
+ _1ps->page_is_read[c] = true;
+ if (!uptodate)
+- _add_to_read_4_write(ios, &read_si, page);
++ _add_to_r4w(ios, &read_si, page, PAGE_SIZE);
+ }
+
+ offset += PAGE_SIZE;
+@@ -616,8 +666,6 @@ int _ore_post_alloc_raid_stuff(struct ore_io_state *ios)
+ return -ENOMEM;
+ }
+
+- BUG_ON(ios->offset % PAGE_SIZE);
+-
+ /* Round io down to last full strip */
+ first_stripe = div_u64(ios->offset, stripe_size);
+ last_stripe = div_u64(ios->offset + ios->length, stripe_size);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch
new file mode 100644
index 0000000..a55cd86
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch
@@ -0,0 +1,89 @@
+From db0889eb6584510c3e1d860bfcfc7a85efc6fabe Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh@panasas.com>
+Date: Tue, 29 Nov 2011 15:35:53 -0800
+Subject: [PATCH 22/49] ore: FIX breakage when MISC_FILESYSTEMS is not set
+
+commit 831c2dc5f47c1dc79c32229d75065ada1dcc66e1 upstream.
+
+As Reported by Randy Dunlap
+
+When MISC_FILESYSTEMS is not enabled and NFS4.1 is:
+
+fs/built-in.o: In function `objio_alloc_io_state':
+objio_osd.c:(.text+0xcb525): undefined reference to `ore_get_rw_state'
+fs/built-in.o: In function `_write_done':
+objio_osd.c:(.text+0xcb58d): undefined reference to `ore_check_io'
+fs/built-in.o: In function `_read_done':
+...
+
+When MISC_FILESYSTEMS, which is more of a GUI thing then anything else,
+is not selected. exofs/Kconfig is never examined during Kconfig,
+and it can not do it's magic stuff to automatically select everything
+needed.
+
+We must split exofs/Kconfig in two. The ore one is always included.
+And the exofs one is left in it's old place in the menu.
+
+Reported-by: Randy Dunlap <rdunlap@xenotime.net>
+Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/Kconfig | 2 ++
+ fs/exofs/Kconfig | 11 -----------
+ fs/exofs/Kconfig.ore | 12 ++++++++++++
+ 3 files changed, 14 insertions(+), 11 deletions(-)
+ create mode 100644 fs/exofs/Kconfig.ore
+
+diff --git a/fs/Kconfig b/fs/Kconfig
+index 5f4c45d..6ad58a5 100644
+--- a/fs/Kconfig
++++ b/fs/Kconfig
+@@ -218,6 +218,8 @@ source "fs/exofs/Kconfig"
+
+ endif # MISC_FILESYSTEMS
+
++source "fs/exofs/Kconfig.ore"
++
+ menuconfig NETWORK_FILESYSTEMS
+ bool "Network File Systems"
+ default y
+diff --git a/fs/exofs/Kconfig b/fs/exofs/Kconfig
+index da42f32..86194b2 100644
+--- a/fs/exofs/Kconfig
++++ b/fs/exofs/Kconfig
+@@ -1,14 +1,3 @@
+-# Note ORE needs to "select ASYNC_XOR". So Not to force multiple selects
+-# for every ORE user we do it like this. Any user should add itself here
+-# at the "depends on EXOFS_FS || ..." with an ||. The dependencies are
+-# selected here, and we default to "ON". So in effect it is like been
+-# selected by any of the users.
+-config ORE
+- tristate
+- depends on EXOFS_FS || PNFS_OBJLAYOUT
+- select ASYNC_XOR
+- default SCSI_OSD_ULD
+-
+ config EXOFS_FS
+ tristate "exofs: OSD based file system support"
+ depends on SCSI_OSD_ULD
+diff --git a/fs/exofs/Kconfig.ore b/fs/exofs/Kconfig.ore
+new file mode 100644
+index 0000000..1ca7fb7
+--- /dev/null
++++ b/fs/exofs/Kconfig.ore
+@@ -0,0 +1,12 @@
++# ORE - Objects Raid Engine (libore.ko)
++#
++# Note ORE needs to "select ASYNC_XOR". So Not to force multiple selects
++# for every ORE user we do it like this. Any user should add itself here
++# at the "depends on EXOFS_FS || ..." with an ||. The dependencies are
++# selected here, and we default to "ON". So in effect it is like been
++# selected by any of the users.
++config ORE
++ tristate
++ depends on EXOFS_FS || PNFS_OBJLAYOUT
++ select ASYNC_XOR
++ default SCSI_OSD_ULD
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch
new file mode 100644
index 0000000..0121579
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch
@@ -0,0 +1,34 @@
+From 914681dc085b7bdeae0de64fba94532a6bcd093e Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 21 Dec 2011 17:35:34 +0100
+Subject: [PATCH 23/49] reiserfs: Fix quota mount option parsing
+
+commit a06d789b424190e9f59da391681f908486db2554 upstream.
+
+When jqfmt mount option is not specified on remount, we mistakenly clear
+s_jquota_fmt value stored in superblock. Fix the problem.
+
+CC: reiserfs-devel@vger.kernel.org
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/reiserfs/super.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index 14363b9..f9eaa4a 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -1164,7 +1164,8 @@ static void handle_quota_files(struct super_block *s, char **qf_names,
+ kfree(REISERFS_SB(s)->s_qf_names[i]);
+ REISERFS_SB(s)->s_qf_names[i] = qf_names[i];
+ }
+- REISERFS_SB(s)->s_jquota_fmt = *qfmt;
++ if (*qfmt)
++ REISERFS_SB(s)->s_jquota_fmt = *qfmt;
+ }
+ #endif
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch
new file mode 100644
index 0000000..32475f9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch
@@ -0,0 +1,70 @@
+From 0621050323cd3eef6fe27f168151e8823a6f63dd Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Wed, 21 Dec 2011 21:18:43 +0100
+Subject: [PATCH 24/49] reiserfs: Force inode evictions before umount to avoid
+ crash
+
+commit a9e36da655e54545c3289b2a0700b5c443de0edd upstream.
+
+This patch fixes a crash in reiserfs_delete_xattrs during umount.
+
+When shrink_dcache_for_umount clears the dcache from
+generic_shutdown_super, delayed evictions are forced to disk. If an
+evicted inode has extended attributes associated with it, it will
+need to walk the xattr tree to locate and remove them.
+
+But since shrink_dcache_for_umount will BUG if it encounters active
+dentries, the xattr tree must be released before it's called or it will
+crash during every umount.
+
+This patch forces the evictions to occur before generic_shutdown_super
+by calling shrink_dcache_sb first. The additional evictions caused
+by the removal of each associated xattr file and dir will be automatically
+handled as they're added to the LRU list.
+
+CC: reiserfs-devel@vger.kernel.org
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/reiserfs/super.c | 24 ++++++++++++++----------
+ 1 files changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index f9eaa4a..5e3527b 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -453,16 +453,20 @@ int remove_save_link(struct inode *inode, int truncate)
+ static void reiserfs_kill_sb(struct super_block *s)
+ {
+ if (REISERFS_SB(s)) {
+- if (REISERFS_SB(s)->xattr_root) {
+- d_invalidate(REISERFS_SB(s)->xattr_root);
+- dput(REISERFS_SB(s)->xattr_root);
+- REISERFS_SB(s)->xattr_root = NULL;
+- }
+- if (REISERFS_SB(s)->priv_root) {
+- d_invalidate(REISERFS_SB(s)->priv_root);
+- dput(REISERFS_SB(s)->priv_root);
+- REISERFS_SB(s)->priv_root = NULL;
+- }
++ /*
++ * Force any pending inode evictions to occur now. Any
++ * inodes to be removed that have extended attributes
++ * associated with them need to clean them up before
++ * we can release the extended attribute root dentries.
++ * shrink_dcache_for_umount will BUG if we don't release
++ * those before it's called so ->put_super is too late.
++ */
++ shrink_dcache_sb(s);
++
++ dput(REISERFS_SB(s)->xattr_root);
++ REISERFS_SB(s)->xattr_root = NULL;
++ dput(REISERFS_SB(s)->priv_root);
++ REISERFS_SB(s)->priv_root = NULL;
+ }
+
+ kill_block_super(s);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch
new file mode 100644
index 0000000..5a04017
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch
@@ -0,0 +1,73 @@
+From d6bc098d6daabceca79a299bfe95dfe218661423 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Thu, 22 Dec 2011 16:49:05 +0100
+Subject: [PATCH 25/49] ext3: Don't warn from writepage when readonly inode is
+ spotted after error
+
+commit 33c104d415e92a51aaf638dc3d93920cfa601e5c upstream.
+
+WARN_ON_ONCE(IS_RDONLY(inode)) tends to trip when filesystem hits error and is
+remounted read-only. This unnecessarily scares users (well, they should be
+scared because of filesystem error, but the stack trace distracts them from the
+right source of their fear ;-). We could as well just remove the WARN_ON but
+it's not hard to fix it to not trip on filesystem with errors and not use more
+cycles in the common case so that's what we do.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/ext3/inode.c | 24 +++++++++++++++++++++---
+ 1 files changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
+index 85fe655..5b3f907 100644
+--- a/fs/ext3/inode.c
++++ b/fs/ext3/inode.c
+@@ -1617,7 +1617,13 @@ static int ext3_ordered_writepage(struct page *page,
+ int err;
+
+ J_ASSERT(PageLocked(page));
+- WARN_ON_ONCE(IS_RDONLY(inode));
++ /*
++ * We don't want to warn for emergency remount. The condition is
++ * ordered to avoid dereferencing inode->i_sb in non-error case to
++ * avoid slow-downs.
++ */
++ WARN_ON_ONCE(IS_RDONLY(inode) &&
++ !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
+
+ /*
+ * We give up here if we're reentered, because it might be for a
+@@ -1692,7 +1698,13 @@ static int ext3_writeback_writepage(struct page *page,
+ int err;
+
+ J_ASSERT(PageLocked(page));
+- WARN_ON_ONCE(IS_RDONLY(inode));
++ /*
++ * We don't want to warn for emergency remount. The condition is
++ * ordered to avoid dereferencing inode->i_sb in non-error case to
++ * avoid slow-downs.
++ */
++ WARN_ON_ONCE(IS_RDONLY(inode) &&
++ !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
+
+ if (ext3_journal_current_handle())
+ goto out_fail;
+@@ -1735,7 +1747,13 @@ static int ext3_journalled_writepage(struct page *page,
+ int err;
+
+ J_ASSERT(PageLocked(page));
+- WARN_ON_ONCE(IS_RDONLY(inode));
++ /*
++ * We don't want to warn for emergency remount. The condition is
++ * ordered to avoid dereferencing inode->i_sb in non-error case to
++ * avoid slow-downs.
++ */
++ WARN_ON_ONCE(IS_RDONLY(inode) &&
++ !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
+
+ if (ext3_journal_current_handle())
+ goto no_write;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch
new file mode 100644
index 0000000..98dedab
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch
@@ -0,0 +1,70 @@
+From b9e6c637b69ffe81b7f272f433f18e3cd2f58052 Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Thu, 1 Dec 2011 09:59:34 -0800
+Subject: [PATCH 26/49] drivers: hv: Don't OOPS when you cannot init vmbus
+
+commit cf6a2eacbcb2593b5b91d0817915c4f0464bb534 upstream.
+
+The hv vmbus driver was causing an OOPS since it was trying to register drivers
+on top of the bus even if initialization of the bus has failed for some
+reason (such as the odd chance someone would run a hv enabled kernel in a
+non-hv environment).
+
+Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hv/vmbus_drv.c | 16 ++++++++++++++++
+ 1 files changed, 16 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 0c048dd..d3b0b4f 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -62,6 +62,14 @@ struct hv_device_info {
+ struct hv_dev_port_info outbound;
+ };
+
++static int vmbus_exists(void)
++{
++ if (hv_acpi_dev == NULL)
++ return -ENODEV;
++
++ return 0;
++}
++
+
+ static void get_channel_info(struct hv_device *device,
+ struct hv_device_info *info)
+@@ -590,6 +598,10 @@ int __vmbus_driver_register(struct hv_driver *hv_driver, struct module *owner, c
+
+ pr_info("registering driver %s\n", hv_driver->name);
+
++ ret = vmbus_exists();
++ if (ret < 0)
++ return ret;
++
+ hv_driver->driver.name = hv_driver->name;
+ hv_driver->driver.owner = owner;
+ hv_driver->driver.mod_name = mod_name;
+@@ -614,6 +626,9 @@ void vmbus_driver_unregister(struct hv_driver *hv_driver)
+ {
+ pr_info("unregistering driver %s\n", hv_driver->name);
+
++ if (!vmbus_exists())
++ return;
++
+ driver_unregister(&hv_driver->driver);
+
+ }
+@@ -776,6 +791,7 @@ static int __init hv_acpi_init(void)
+
+ cleanup:
+ acpi_bus_unregister_driver(&vmbus_acpi_driver);
++ hv_acpi_dev = NULL;
+ return ret;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch
new file mode 100644
index 0000000..e6184ae
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch
@@ -0,0 +1,40 @@
+From 797931db7094985a8aa99b24695192d1773129de Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Tue, 27 Dec 2011 13:49:37 -0800
+Subject: [PATCH 27/49] Drivers:hv: Fix a bug in vmbus_driver_unregister()
+
+commit 8f257a142fc3868d69de3f996b95d7bdbc509560 upstream.
+
+The function vmbus_exists() was introduced recently to deal with cases where
+the vmbus driver failed to initialize and yet other Hyper-V drivers attempted
+to register with the vmbus bus driver. This patch introduced a bug where
+vmbus_driver_unregister() would fail to unregister the driver. This patch
+fixes the problem.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Fuzhou Chen <fuzhouch@microsoft.com>
+Cc: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hv/vmbus_drv.c | 5 +----
+ 1 files changed, 1 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index d3b0b4f..d2d0a2a 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -627,10 +627,7 @@ void vmbus_driver_unregister(struct hv_driver *hv_driver)
+ pr_info("unregistering driver %s\n", hv_driver->name);
+
+ if (!vmbus_exists())
+- return;
+-
+- driver_unregister(&hv_driver->driver);
+-
++ driver_unregister(&hv_driver->driver);
+ }
+ EXPORT_SYMBOL_GPL(vmbus_driver_unregister);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0028-USB-update-documentation-for-usbmon.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0028-USB-update-documentation-for-usbmon.patch
new file mode 100644
index 0000000..8a6a5fb
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0028-USB-update-documentation-for-usbmon.patch
@@ -0,0 +1,54 @@
+From a4d5730e9c4b209e74eab2f7650b23f95417dc71 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 4 Jan 2012 16:36:35 -0500
+Subject: [PATCH 28/49] USB: update documentation for usbmon
+
+commit d8cae98cddd286e38db1724dda1b0e7b467f9237 upstream.
+
+The documentation for usbmon is out of date; the usbfs "devices" file
+now exists in /sys/kernel/debug/usb rather than /proc/bus/usb. This
+patch (as1505) updates the documentation accordingly, and also
+mentions that the necessary information can be found by running lsusb.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: Pete Zaitcev <zaitcev@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ Documentation/usb/usbmon.txt | 14 +++++++++-----
+ 1 files changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/Documentation/usb/usbmon.txt b/Documentation/usb/usbmon.txt
+index a4efa04..5335fa8 100644
+--- a/Documentation/usb/usbmon.txt
++++ b/Documentation/usb/usbmon.txt
+@@ -47,10 +47,11 @@ This allows to filter away annoying devices that talk continuously.
+
+ 2. Find which bus connects to the desired device
+
+-Run "cat /proc/bus/usb/devices", and find the T-line which corresponds to
+-the device. Usually you do it by looking for the vendor string. If you have
+-many similar devices, unplug one and compare two /proc/bus/usb/devices outputs.
+-The T-line will have a bus number. Example:
++Run "cat /sys/kernel/debug/usb/devices", and find the T-line which corresponds
++to the device. Usually you do it by looking for the vendor string. If you have
++many similar devices, unplug one and compare the two
++/sys/kernel/debug/usb/devices outputs. The T-line will have a bus number.
++Example:
+
+ T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+ D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
+@@ -58,7 +59,10 @@ P: Vendor=0557 ProdID=2004 Rev= 1.00
+ S: Manufacturer=ATEN
+ S: Product=UC100KM V2.00
+
+-Bus=03 means it's bus 3.
++"Bus=03" means it's bus 3. Alternatively, you can look at the output from
++"lsusb" and get the bus number from the appropriate line. Example:
++
++Bus 003 Device 002: ID 0557:2004 ATEN UC100KM V2.00
+
+ 3. Start 'cat'
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch
new file mode 100644
index 0000000..dfc6d0b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch
@@ -0,0 +1,125 @@
+From 6b544616a14b48a670d0c7ce10a5f8de1246cc96 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Fri, 16 Dec 2011 11:26:30 -0800
+Subject: [PATCH 29/49] usbfs: Fix oops related to user namespace conversion.
+
+commit 1b41c8321e495337e877ca02d0b9680bc4112eff upstream.
+
+When running the Point Grey "flycap" program for their USB 3.0 camera
+(which was running as a USB 2.0 device for some reason), I trigger this
+oops whenever I try to open a video stream:
+
+Dec 15 16:48:34 puck kernel: [ 1798.715559] BUG: unable to handle kernel NULL pointer dereference at (null)
+Dec 15 16:48:34 puck kernel: [ 1798.719153] IP: [<ffffffff8147841e>] free_async+0x1e/0x70
+Dec 15 16:48:34 puck kernel: [ 1798.720991] PGD 6f833067 PUD 6fc56067 PMD 0
+Dec 15 16:48:34 puck kernel: [ 1798.722815] Oops: 0002 [#1] SMP
+Dec 15 16:48:34 puck kernel: [ 1798.724627] CPU 0
+Dec 15 16:48:34 puck kernel: [ 1798.724636] Modules linked in: ecryptfs encrypted_keys sha1_generic trusted binfmt_misc sha256_generic aesni_intel cryptd aes_x86_64 aes_generic parport_pc dm_crypt ppdev joydev snd_hda_codec_hdmi snd_hda_codec_conexant arc4 iwlwifi snd_hda_intel snd_hda_codec snd_hwdep snd_pcm thinkpad_acpi mac80211 snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer btusb uvcvideo snd_seq_device bluetooth videodev psmouse snd v4l2_compat_ioctl32 serio_raw tpm_tis cfg80211 tpm tpm_bios nvram soundcore snd_page_alloc lp parport i915 xhci_hcd ahci libahci drm_kms_helper drm sdhci_pci sdhci e1000e i2c_algo_bit video
+Dec 15 16:48:34 puck kernel: [ 1798.734212]
+Dec 15 16:48:34 puck kernel: [ 1798.736162] Pid: 2713, comm: FlyCap2 Not tainted 3.2.0-rc5+ #28 LENOVO 4286CTO/4286CTO
+Dec 15 16:48:34 puck kernel: [ 1798.738148] RIP: 0010:[<ffffffff8147841e>] [<ffffffff8147841e>] free_async+0x1e/0x70
+Dec 15 16:48:34 puck kernel: [ 1798.740134] RSP: 0018:ffff88005715fd78 EFLAGS: 00010296
+Dec 15 16:48:34 puck kernel: [ 1798.742118] RAX: 00000000fffffff4 RBX: ffff88006fe8f900 RCX: 0000000000004118
+Dec 15 16:48:34 puck kernel: [ 1798.744116] RDX: 0000000001000000 RSI: 0000000000016390 RDI: 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.746087] RBP: ffff88005715fd88 R08: 0000000000000000 R09: ffffffff8146f22e
+Dec 15 16:48:34 puck kernel: [ 1798.748018] R10: ffff88006e520ac0 R11: 0000000000000001 R12: ffff88005715fe28
+Dec 15 16:48:34 puck kernel: [ 1798.749916] R13: ffff88005d31df00 R14: ffff88006fe8f900 R15: 00007f688c995cb8
+Dec 15 16:48:34 puck kernel: [ 1798.751785] FS: 00007f68a366da40(0000) GS:ffff880100200000(0000) knlGS:0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.753659] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+Dec 15 16:48:34 puck kernel: [ 1798.755509] CR2: 0000000000000000 CR3: 00000000706bb000 CR4: 00000000000406f0
+Dec 15 16:48:34 puck kernel: [ 1798.757334] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.759124] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Dec 15 16:48:34 puck kernel: [ 1798.760871] Process FlyCap2 (pid: 2713, threadinfo ffff88005715e000, task ffff88006c675b80)
+Dec 15 16:48:34 puck kernel: [ 1798.762605] Stack:
+Dec 15 16:48:34 puck kernel: [ 1798.764297] ffff88005715fe28 0000000000000000 ffff88005715fe08 ffffffff81479058
+Dec 15 16:48:34 puck kernel: [ 1798.766020] 0000000000000000 ffffea0000004000 ffff880000004118 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.767750] ffff880000000001 ffff88006e520ac0 fffffff46fd81180 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.769472] Call Trace:
+Dec 15 16:48:34 puck kernel: [ 1798.771147] [<ffffffff81479058>] proc_do_submiturb+0x778/0xa00
+Dec 15 16:48:34 puck kernel: [ 1798.772798] [<ffffffff8147a5fd>] usbdev_do_ioctl+0x24d/0x1200
+Dec 15 16:48:34 puck kernel: [ 1798.774410] [<ffffffff8147b5de>] usbdev_ioctl+0xe/0x20
+Dec 15 16:48:34 puck kernel: [ 1798.775975] [<ffffffff81189259>] do_vfs_ioctl+0x99/0x600
+Dec 15 16:48:34 puck kernel: [ 1798.777534] [<ffffffff81189851>] sys_ioctl+0x91/0xa0
+Dec 15 16:48:34 puck kernel: [ 1798.779088] [<ffffffff816247c2>] system_call_fastpath+0x16/0x1b
+ec 15 16:48:34 puck kernel: [ 1798.780634] Code: 51 ff ff ff e9 29 ff ff ff 0f 1f 40 00 55 48 89 e5 53 48 83 ec 08 66 66 66 66 90 48 89 fb 48 8b 7f 18 e8 a6 ea c0 ff 4
+8 8b 7b 20 <f0> ff 0f 0f 94 c0 84 c0 74 05 e8 d3 99 c1 ff 48 8b 43 40 48 8b
+Dec 15 16:48:34 puck kernel: [ 1798.783970] RIP [<ffffffff8147841e>] free_async+0x1e/0x70
+Dec 15 16:48:34 puck kernel: [ 1798.785630] RSP <ffff88005715fd78>
+Dec 15 16:48:34 puck kernel: [ 1798.787274] CR2: 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.794728] ---[ end trace 52894d3355f88d19 ]---
+
+markup_oops.pl says the oops is in put_cred:
+
+ ffffffff81478401: 48 89 e5 mov %rsp,%rbp
+ ffffffff81478404: 53 push %rbx
+ ffffffff81478405: 48 83 ec 08 sub $0x8,%rsp
+ ffffffff81478409: e8 f2 c0 1a 00 callq ffffffff81624500 <mcount>
+ ffffffff8147840e: 48 89 fb mov %rdi,%rbx | %ebx => ffff88006fe8f900
+ put_pid(as->pid);
+ ffffffff81478411: 48 8b 7f 18 mov 0x18(%rdi),%rdi
+ ffffffff81478415: e8 a6 ea c0 ff callq ffffffff81086ec0 <put_pid>
+ put_cred(as->cred);
+ ffffffff8147841a: 48 8b 7b 20 mov 0x20(%rbx),%rdi | %edi => 0 %ebx = ffff88006fe8f900
+ */
+ static inline int atomic_dec_and_test(atomic_t *v)
+ {
+ unsigned char c;
+
+ asm volatile(LOCK_PREFIX "decl %0; sete %1"
+*ffffffff8147841e: f0 ff 0f lock decl (%rdi) | %edi = 0 <--- faulting instruction
+ ffffffff81478421: 0f 94 c0 sete %al
+ static inline void put_cred(const struct cred *_cred)
+ {
+ struct cred *cred = (struct cred *) _cred;
+
+ validate_creds(cred);
+ if (atomic_dec_and_test(&(cred)->usage))
+ ffffffff81478424: 84 c0 test %al,%al
+ ffffffff81478426: 74 05 je ffffffff8147842d <free_async+0x2d>
+ __put_cred(cred);
+ ffffffff81478428: e8 d3 99 c1 ff callq ffffffff81091e00 <__put_cred>
+ kfree(as->urb->transfer_buffer);
+ ffffffff8147842d: 48 8b 43 40 mov 0x40(%rbx),%rax
+ ffffffff81478431: 48 8b 78 68 mov 0x68(%rax),%rdi
+ ffffffff81478435: e8 a6 e1 ce ff callq ffffffff811665e0 <kfree>
+ kfree(as->urb->setup_packet);
+ ffffffff8147843a: 48 8b 43 40 mov 0x40(%rbx),%rax
+ ffffffff8147843e: 48 8b b8 90 00 00 00 mov 0x90(%rax),%rdi
+ ffffffff81478445: e8 96 e1 ce ff callq ffffffff811665e0 <kfree>
+ usb_free_urb(as->urb);
+ ffffffff8147844a: 48 8b 7b 40 mov 0x40(%rbx),%rdi
+ ffffffff8147844e: e8 0d 6b ff ff callq ffffffff8146ef60 <usb_free_urb>
+
+This bug seems to have been introduced by commit
+d178bc3a708f39cbfefc3fab37032d3f2511b4ec "user namespace: usb: make usb
+urbs user namespace aware (v2)"
+
+I'm not sure if this is right fix, but it does stop the oops.
+
+Unfortunately, the Point Grey software still refuses to work, but it's a
+closed source app, so I can't fix it.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/core/devio.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index e3beaf2..7abf060 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -249,7 +249,8 @@ static struct async *alloc_async(unsigned int numisoframes)
+ static void free_async(struct async *as)
+ {
+ put_pid(as->pid);
+- put_cred(as->cred);
++ if (as->cred)
++ put_cred(as->cred);
+ kfree(as->urb->transfer_buffer);
+ kfree(as->urb->setup_packet);
+ usb_free_urb(as->urb);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch
new file mode 100644
index 0000000..75f2b51
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch
@@ -0,0 +1,47 @@
+From 2918b666fe0636d9d90ce6defda2d3ec908231a8 Mon Sep 17 00:00:00 2001
+From: Claudio Scordino <claudio@evidence.eu.com>
+Date: Fri, 16 Dec 2011 15:08:49 +0100
+Subject: [PATCH 30/49] atmel_serial: fix spinlock lockup in RS485 code
+
+commit dbf1115d3f8c7052788aa4e6e46abd27f3b3eeba upstream.
+
+Patch to fix a spinlock lockup in the driver that sometimes happens when the
+tasklet starts.
+
+Signed-off-by: Claudio Scordino <claudio@evidence.eu.com>
+Signed-off-by: Dave Bender <codehero@gmail.com>
+Tested-by: Dave Bender <codehero@gmail.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Acked-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/tty/serial/atmel_serial.c | 5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 4c823f3..90c8e3a 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -212,8 +212,9 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+ {
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+ unsigned int mode;
++ unsigned long flags;
+
+- spin_lock(&port->lock);
++ spin_lock_irqsave(&port->lock, flags);
+
+ /* Disable interrupts */
+ UART_PUT_IDR(port, atmel_port->tx_done_mask);
+@@ -244,7 +245,7 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+ /* Enable interrupts */
+ UART_PUT_IER(port, atmel_port->tx_done_mask);
+
+- spin_unlock(&port->lock);
++ spin_unlock_irqrestore(&port->lock, flags);
+
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch
new file mode 100644
index 0000000..649d103
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch
@@ -0,0 +1,50 @@
+From 7e755f9707e34e7de22e2f3b77ab26d1d8de5a4b Mon Sep 17 00:00:00 2001
+From: Li Zefan <lizf@cn.fujitsu.com>
+Date: Tue, 27 Dec 2011 14:25:55 +0800
+Subject: [PATCH 31/49] cgroup: fix to allow mounting a hierarchy by name
+
+commit 0d19ea866562e46989412a0676412fa0983c9ce7 upstream.
+
+If we mount a hierarchy with a specified name, the name is unique,
+and we can use it to mount the hierarchy without specifying its
+set of subsystem names. This feature is documented is
+Documentation/cgroups/cgroups.txt section 2.3
+
+Here's an example:
+
+ # mount -t cgroup -o cpuset,name=myhier xxx /cgroup1
+ # mount -t cgroup -o name=myhier xxx /cgroup2
+
+But it was broken by commit 32a8cf235e2f192eb002755076994525cdbaa35a
+(cgroup: make the mount options parsing more accurate)
+
+This fixes the regression.
+
+Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ kernel/cgroup.c | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index a184470..cdc0354 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -1175,10 +1175,10 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
+
+ /*
+ * If the 'all' option was specified select all the subsystems,
+- * otherwise 'all, 'none' and a subsystem name options were not
+- * specified, let's default to 'all'
++ * otherwise if 'none', 'name=' and a subsystem name options
++ * were not specified, let's default to 'all'
+ */
+- if (all_ss || (!all_ss && !one_ss && !opts->none)) {
++ if (all_ss || (!one_ss && !opts->none && !opts->name)) {
+ for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+ struct cgroup_subsys *ss = subsys[i];
+ if (ss == NULL)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch
new file mode 100644
index 0000000..e5d99f7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch
@@ -0,0 +1,130 @@
+From b2b56aa7932508ce3a81187a68e6a558268efc35 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Sat, 10 Dec 2011 02:30:48 +0100
+Subject: [PATCH 32/49] udf: Fix deadlock when converting file from in-ICB one
+ to normal one
+
+commit d2eb8c359309ec45d6bf5b147303ab8e13be86ea upstream.
+
+During BKL removal in 2.6.38, conversion of files from in-ICB format to normal
+format got broken. We call ->writepage with i_data_sem held but udf_get_block()
+also acquires i_data_sem thus creating A-A deadlock.
+
+We fix the problem by dropping i_data_sem before calling ->writepage() which is
+safe since i_mutex still protects us against any changes in the file. Also fix
+pagelock - i_data_sem lock inversion in udf_expand_file_adinicb() by dropping
+i_data_sem before calling find_or_create_page().
+
+Reported-by: Matthias Matiak <netzpython@mail-on.us>
+Tested-by: Matthias Matiak <netzpython@mail-on.us>
+Reviewed-by: Namjae Jeon <linkinjeon@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/udf/file.c | 6 +++---
+ fs/udf/inode.c | 21 ++++++++++++++++++---
+ 2 files changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/fs/udf/file.c b/fs/udf/file.c
+index d8ffa7c..dca0c38 100644
+--- a/fs/udf/file.c
++++ b/fs/udf/file.c
+@@ -125,7 +125,6 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
+ err = udf_expand_file_adinicb(inode);
+ if (err) {
+ udf_debug("udf_expand_adinicb: err=%d\n", err);
+- up_write(&iinfo->i_data_sem);
+ return err;
+ }
+ } else {
+@@ -133,9 +132,10 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
+ iinfo->i_lenAlloc = pos + count;
+ else
+ iinfo->i_lenAlloc = inode->i_size;
++ up_write(&iinfo->i_data_sem);
+ }
+- }
+- up_write(&iinfo->i_data_sem);
++ } else
++ up_write(&iinfo->i_data_sem);
+
+ retval = generic_file_aio_write(iocb, iov, nr_segs, ppos);
+ if (retval > 0)
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 4fd1d80..e2787d0 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -151,6 +151,12 @@ const struct address_space_operations udf_aops = {
+ .bmap = udf_bmap,
+ };
+
++/*
++ * Expand file stored in ICB to a normal one-block-file
++ *
++ * This function requires i_data_sem for writing and releases it.
++ * This function requires i_mutex held
++ */
+ int udf_expand_file_adinicb(struct inode *inode)
+ {
+ struct page *page;
+@@ -169,9 +175,15 @@ int udf_expand_file_adinicb(struct inode *inode)
+ iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
+ /* from now on we have normal address_space methods */
+ inode->i_data.a_ops = &udf_aops;
++ up_write(&iinfo->i_data_sem);
+ mark_inode_dirty(inode);
+ return 0;
+ }
++ /*
++ * Release i_data_sem so that we can lock a page - page lock ranks
++ * above i_data_sem. i_mutex still protects us against file changes.
++ */
++ up_write(&iinfo->i_data_sem);
+
+ page = find_or_create_page(inode->i_mapping, 0, GFP_NOFS);
+ if (!page)
+@@ -187,6 +199,7 @@ int udf_expand_file_adinicb(struct inode *inode)
+ SetPageUptodate(page);
+ kunmap(page);
+ }
++ down_write(&iinfo->i_data_sem);
+ memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr, 0x00,
+ iinfo->i_lenAlloc);
+ iinfo->i_lenAlloc = 0;
+@@ -196,17 +209,20 @@ int udf_expand_file_adinicb(struct inode *inode)
+ iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
+ /* from now on we have normal address_space methods */
+ inode->i_data.a_ops = &udf_aops;
++ up_write(&iinfo->i_data_sem);
+ err = inode->i_data.a_ops->writepage(page, &udf_wbc);
+ if (err) {
+ /* Restore everything back so that we don't lose data... */
+ lock_page(page);
+ kaddr = kmap(page);
++ down_write(&iinfo->i_data_sem);
+ memcpy(iinfo->i_ext.i_data + iinfo->i_lenEAttr, kaddr,
+ inode->i_size);
+ kunmap(page);
+ unlock_page(page);
+ iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB;
+ inode->i_data.a_ops = &udf_adinicb_aops;
++ up_write(&iinfo->i_data_sem);
+ }
+ page_cache_release(page);
+ mark_inode_dirty(inode);
+@@ -1111,10 +1127,9 @@ int udf_setsize(struct inode *inode, loff_t newsize)
+ if (bsize <
+ (udf_file_entry_alloc_offset(inode) + newsize)) {
+ err = udf_expand_file_adinicb(inode);
+- if (err) {
+- up_write(&iinfo->i_data_sem);
++ if (err)
+ return err;
+- }
++ down_write(&iinfo->i_data_sem);
+ } else
+ iinfo->i_lenAlloc = newsize;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch
new file mode 100644
index 0000000..e5e7b95
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch
@@ -0,0 +1,45 @@
+From 2aabf017a2a76405dd9efbca80320965d8361302 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Fri, 23 Dec 2011 14:02:55 +0100
+Subject: [PATCH 33/49] drivers/usb/class/cdc-acm.c: clear dangling pointer
+
+commit e7c8e8605d0bafc705ff27f9da98a1668427cc0f upstream.
+
+On some failures, the country_code field of an acm structure is freed
+without freeing the acm structure itself. Elsewhere, operations including
+memcpy and kfree are performed on the country_code field. The patch sets
+the country_code field to NULL when it is freed, and likewise sets the
+country_code_size field to 0.
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Acked-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/class/cdc-acm.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index a8078d0..ea5e487 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1183,6 +1183,8 @@ made_compressed_probe:
+ i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
+ if (i < 0) {
+ kfree(acm->country_codes);
++ acm->country_codes = NULL;
++ acm->country_code_size = 0;
+ goto skip_countries;
+ }
+
+@@ -1191,6 +1193,8 @@ made_compressed_probe:
+ if (i < 0) {
+ device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
+ kfree(acm->country_codes);
++ acm->country_codes = NULL;
++ acm->country_code_size = 0;
+ goto skip_countries;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch
new file mode 100644
index 0000000..ed02f1e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch
@@ -0,0 +1,47 @@
+From 1d24cdb0797a26e1fb1d3545f6d4b992a5a23e96 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Mon, 5 Dec 2011 14:02:59 -0800
+Subject: [PATCH 34/49] USB: isight: fix kernel bug when loading firmware
+
+commit 59bf5cf94f0fa3b08fb1258b52649077b7d0914d upstream.
+
+We were sending data on the stack when uploading firmware, which causes
+some machines fits, and is not allowed. Fix this by using the buffer we
+already had around for this very purpose.
+
+Reported-by: Wouter M. Koolen <wmkoolen@cwi.nl>
+Tested-by: Wouter M. Koolen <wmkoolen@cwi.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/misc/isight_firmware.c | 6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/isight_firmware.c b/drivers/usb/misc/isight_firmware.c
+index fe1d443..8f725f6 100644
+--- a/drivers/usb/misc/isight_firmware.c
++++ b/drivers/usb/misc/isight_firmware.c
+@@ -55,8 +55,9 @@ static int isight_firmware_load(struct usb_interface *intf,
+
+ ptr = firmware->data;
+
++ buf[0] = 0x01;
+ if (usb_control_msg
+- (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\1", 1,
++ (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
+ 300) != 1) {
+ printk(KERN_ERR
+ "Failed to initialise isight firmware loader\n");
+@@ -100,8 +101,9 @@ static int isight_firmware_load(struct usb_interface *intf,
+ }
+ }
+
++ buf[0] = 0x00;
+ if (usb_control_msg
+- (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1,
++ (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
+ 300) != 1) {
+ printk(KERN_ERR "isight firmware loading completion failed\n");
+ ret = -ENODEV;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch
new file mode 100644
index 0000000..3b4450a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch
@@ -0,0 +1,121 @@
+From 713ad0e8402a7e377bb8b4254b9b522628c9afeb Mon Sep 17 00:00:00 2001
+From: Huajun Li <huajun.li.lee@gmail.com>
+Date: Wed, 4 Jan 2012 19:25:33 +0800
+Subject: [PATCH 35/49] usb: usb-storage doesn't support dynamic id currently,
+ the patch disables the feature to fix an oops
+
+commit 1a3a026ba1b6bbfe0b7f79ab38cf991d691e7c9a upstream.
+
+Echo vendor and product number of a non usb-storage device to
+usb-storage driver's new_id, then plug in the device to host and you
+will find following oops msg, the root cause is usb_stor_probe1()
+refers invalid id entry if giving a dynamic id, so just disable the
+feature.
+
+[ 3105.018012] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
+[ 3105.018062] CPU 0
+[ 3105.018075] Modules linked in: usb_storage usb_libusual bluetooth
+dm_crypt binfmt_misc snd_hda_codec_analog snd_hda_intel snd_hda_codec
+snd_hwdep hp_wmi ppdev sparse_keymap snd_pcm snd_seq_midi snd_rawmidi
+snd_seq_midi_event snd_seq snd_timer snd_seq_device psmouse snd
+serio_raw tpm_infineon soundcore i915 snd_page_alloc tpm_tis
+parport_pc tpm tpm_bios drm_kms_helper drm i2c_algo_bit video lp
+parport usbhid hid sg sr_mod sd_mod ehci_hcd uhci_hcd usbcore e1000e
+usb_common floppy
+[ 3105.018408]
+[ 3105.018419] Pid: 189, comm: khubd Tainted: G I 3.2.0-rc7+
+#29 Hewlett-Packard HP Compaq dc7800p Convertible Minitower/0AACh
+[ 3105.018481] RIP: 0010:[<ffffffffa045830d>] [<ffffffffa045830d>]
+usb_stor_probe1+0x2fd/0xc20 [usb_storage]
+[ 3105.018536] RSP: 0018:ffff880056a3d830 EFLAGS: 00010286
+[ 3105.018562] RAX: ffff880065f4e648 RBX: ffff88006bb28000 RCX: 0000000000000000
+[ 3105.018597] RDX: ffff88006f23c7b0 RSI: 0000000000000001 RDI: 0000000000000206
+[ 3105.018632] RBP: ffff880056a3d900 R08: 0000000000000000 R09: ffff880067365000
+[ 3105.018665] R10: 00000000000002ac R11: 0000000000000010 R12: ffff6000b41a7340
+[ 3105.018698] R13: ffff880065f4ef60 R14: ffff88006bb28b88 R15: ffff88006f23d270
+[ 3105.018733] FS: 0000000000000000(0000) GS:ffff88007a200000(0000)
+knlGS:0000000000000000
+[ 3105.018773] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+[ 3105.018801] CR2: 00007fc99c8c4650 CR3: 0000000001e05000 CR4: 00000000000006f0
+[ 3105.018835] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 3105.018870] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+[ 3105.018906] Process khubd (pid: 189, threadinfo ffff880056a3c000,
+task ffff88005677a400)
+[ 3105.018945] Stack:
+[ 3105.018959] 0000000000000000 0000000000000000 ffff880056a3d8d0
+0000000000000002
+[ 3105.019011] 0000000000000000 ffff880056a3d918 ffff880000000000
+0000000000000002
+[ 3105.019058] ffff880056a3d8d0 0000000000000012 ffff880056a3d8d0
+0000000000000006
+[ 3105.019105] Call Trace:
+[ 3105.019128] [<ffffffffa0458cd4>] storage_probe+0xa4/0xe0 [usb_storage]
+[ 3105.019173] [<ffffffffa0097822>] usb_probe_interface+0x172/0x330 [usbcore]
+[ 3105.019211] [<ffffffff815fda67>] driver_probe_device+0x257/0x3b0
+[ 3105.019243] [<ffffffff815fdd43>] __device_attach+0x73/0x90
+[ 3105.019272] [<ffffffff815fdcd0>] ? __driver_attach+0x110/0x110
+[ 3105.019303] [<ffffffff815fb93c>] bus_for_each_drv+0x9c/0xf0
+[ 3105.019334] [<ffffffff815fd6c7>] device_attach+0xf7/0x120
+[ 3105.019364] [<ffffffff815fc905>] bus_probe_device+0x45/0x80
+[ 3105.019396] [<ffffffff815f98a6>] device_add+0x876/0x990
+[ 3105.019434] [<ffffffffa0094e42>] usb_set_configuration+0x822/0x9e0 [usbcore]
+[ 3105.019479] [<ffffffffa00a3492>] generic_probe+0x62/0xf0 [usbcore]
+[ 3105.019518] [<ffffffffa0097a46>] usb_probe_device+0x66/0xb0 [usbcore]
+[ 3105.019555] [<ffffffff815fda67>] driver_probe_device+0x257/0x3b0
+[ 3105.019589] [<ffffffff815fdd43>] __device_attach+0x73/0x90
+[ 3105.019617] [<ffffffff815fdcd0>] ? __driver_attach+0x110/0x110
+[ 3105.019648] [<ffffffff815fb93c>] bus_for_each_drv+0x9c/0xf0
+[ 3105.019680] [<ffffffff815fd6c7>] device_attach+0xf7/0x120
+[ 3105.019709] [<ffffffff815fc905>] bus_probe_device+0x45/0x80
+[ 3105.021040] usb usb6: usb auto-resume
+[ 3105.021045] usb usb6: wakeup_rh
+[ 3105.024849] [<ffffffff815f98a6>] device_add+0x876/0x990
+[ 3105.025086] [<ffffffffa0088987>] usb_new_device+0x1e7/0x2b0 [usbcore]
+[ 3105.025086] [<ffffffffa008a4d7>] hub_thread+0xb27/0x1ec0 [usbcore]
+[ 3105.025086] [<ffffffff810d5200>] ? wake_up_bit+0x50/0x50
+[ 3105.025086] [<ffffffffa00899b0>] ? usb_remote_wakeup+0xa0/0xa0 [usbcore]
+[ 3105.025086] [<ffffffff810d49b8>] kthread+0xd8/0xf0
+[ 3105.025086] [<ffffffff81939884>] kernel_thread_helper+0x4/0x10
+[ 3105.025086] [<ffffffff8192a8c0>] ? _raw_spin_unlock_irq+0x50/0x80
+[ 3105.025086] [<ffffffff8192b1b4>] ? retint_restore_args+0x13/0x13
+[ 3105.025086] [<ffffffff810d48e0>] ? __init_kthread_worker+0x80/0x80
+[ 3105.025086] [<ffffffff81939880>] ? gs_change+0x13/0x13
+[ 3105.025086] Code: 00 48 83 05 cd ad 00 00 01 48 83 05 cd ad 00 00
+01 4c 8b ab 30 0c 00 00 48 8b 50 08 48 83 c0 30 48 89 45 a0 4c 89 a3
+40 0c 00 00 <41> 0f b6 44 24 10 48 89 55 a8 3c ff 0f 84 b8 04 00 00 48
+83 05
+[ 3105.025086] RIP [<ffffffffa045830d>] usb_stor_probe1+0x2fd/0xc20
+[usb_storage]
+[ 3105.025086] RSP <ffff880056a3d830>
+[ 3105.060037] hub 6-0:1.0: hub_resume
+[ 3105.062616] usb usb5: usb auto-resume
+[ 3105.064317] ehci_hcd 0000:00:1d.7: resume root hub
+[ 3105.094809] ---[ end trace a7919e7f17c0a727 ]---
+[ 3105.130069] hub 5-0:1.0: hub_resume
+[ 3105.132131] usb usb4: usb auto-resume
+[ 3105.132136] usb usb4: wakeup_rh
+[ 3105.180059] hub 4-0:1.0: hub_resume
+[ 3106.290052] usb usb6: suspend_rh (auto-stop)
+[ 3106.290077] usb usb4: suspend_rh (auto-stop)
+
+Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/storage/usb.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
+index c325e69..9e069ef 100644
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -1073,6 +1073,7 @@ static struct usb_driver usb_storage_driver = {
+ .id_table = usb_storage_usb_ids,
+ .supports_autosuspend = 1,
+ .soft_unbind = 1,
++ .no_dynamic_id = 1,
+ };
+
+ static int __init usb_stor_init(void)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0036-USB-pxa168-Fix-compilation-error.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0036-USB-pxa168-Fix-compilation-error.patch
new file mode 100644
index 0000000..87cc3a5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0036-USB-pxa168-Fix-compilation-error.patch
@@ -0,0 +1,42 @@
+From 17e7ea93a7ec7bb64e3bcd6b3cbee1fea5021587 Mon Sep 17 00:00:00 2001
+From: Tanmay Upadhyay <tanmay.upadhyay@einfochips.com>
+Date: Thu, 8 Dec 2011 10:03:49 +0530
+Subject: [PATCH 36/49] USB: pxa168: Fix compilation error
+
+commit 35657c4d72925936c7219cc5caac118ca632acc2 upstream.
+
+After commit c430131a02d677aa708f56342c1565edfdacb3c0 (Support
+controllers with big endian capability regs), HC_LENGTH takes
+two arguments. This patch fixes following compilation error:
+
+In file included from drivers/usb/host/ehci-hcd.c:1323:
+drivers/usb/host/ehci-pxa168.c:302:54: error: macro "HC_LENGTH" requires 2 arguments, but only 1 given
+In file included from drivers/usb/host/ehci-hcd.c:1323:
+drivers/usb/host/ehci-pxa168.c: In function 'ehci_pxa168_drv_probe':
+drivers/usb/host/ehci-pxa168.c:302: error: 'HC_LENGTH' undeclared (first use in this function)
+drivers/usb/host/ehci-pxa168.c:302: error: (Each undeclared identifier is reported only once
+drivers/usb/host/ehci-pxa168.c:302: error: for each function it appears in.)
+
+Signed-off-by: Tanmay Upadhyay <tanmay.upadhyay@einfochips.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/host/ehci-pxa168.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-pxa168.c b/drivers/usb/host/ehci-pxa168.c
+index ac0c16e..8d0e7a2 100644
+--- a/drivers/usb/host/ehci-pxa168.c
++++ b/drivers/usb/host/ehci-pxa168.c
+@@ -299,7 +299,7 @@ static int __devinit ehci_pxa168_drv_probe(struct platform_device *pdev)
+ ehci = hcd_to_ehci(hcd);
+ ehci->caps = hcd->regs + 0x100;
+ ehci->regs = hcd->regs + 0x100 +
+- HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
++ HC_LENGTH(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase));
+ ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
+ hcd->has_tt = 1;
+ ehci->sbrn = 0x20;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0037-USB-add-quirk-for-another-camera.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0037-USB-add-quirk-for-another-camera.patch
new file mode 100644
index 0000000..c981711
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0037-USB-add-quirk-for-another-camera.patch
@@ -0,0 +1,37 @@
+From ae803972522d34f68270782827580ba0d762468c Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Tue, 3 Jan 2012 09:58:54 +0100
+Subject: [PATCH 37/49] USB: add quirk for another camera
+
+commit 35284b3d2f68a8a3703745e629999469f78386b5 upstream.
+
+The Guillemot Webcam Hercules Dualpix Exchange camera
+has been reported with a second ID.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/core/quirks.c | 5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index ecf12e1..4c65eb6 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -117,9 +117,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x06a3, 0x0006), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
+- /* Guillemot Webcam Hercules Dualpix Exchange*/
++ /* Guillemot Webcam Hercules Dualpix Exchange (2nd ID) */
+ { USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Guillemot Webcam Hercules Dualpix Exchange*/
++ { USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* M-Systems Flash Disk Pioneers */
+ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0038-USB-omninet-fix-write_room.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0038-USB-omninet-fix-write_room.patch
new file mode 100644
index 0000000..cbd585a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0038-USB-omninet-fix-write_room.patch
@@ -0,0 +1,34 @@
+From 4a6a3895c6ffe420a07f90df0f8ad5d7ac5a47a4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Sun, 6 Nov 2011 19:06:21 +0100
+Subject: [PATCH 38/49] USB: omninet: fix write_room
+
+commit 694c6301e515bad574af74b6552134c4d9dcb334 upstream.
+
+Fix regression introduced by commit 507ca9bc047666 ([PATCH] USB: add
+ability for usb-serial drivers to determine if their write urb is
+currently being used.) which inverted the logic in write_room so that it
+returns zero when the write urb is actually free.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/serial/omninet.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
+index 60f38d5..0a8c1e6 100644
+--- a/drivers/usb/serial/omninet.c
++++ b/drivers/usb/serial/omninet.c
+@@ -315,7 +315,7 @@ static int omninet_write_room(struct tty_struct *tty)
+ int room = 0; /* Default: no room */
+
+ /* FIXME: no consistent locking for write_urb_busy */
+- if (wport->write_urb_busy)
++ if (!wport->write_urb_busy)
+ room = wport->bulk_out_size - OMNINET_HEADERLEN;
+
+ dbg("%s - returns %d", __func__, room);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch
new file mode 100644
index 0000000..7c062f0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch
@@ -0,0 +1,53 @@
+From bd6e892c7f49027eb7d6f5739406142db70fee7e Mon Sep 17 00:00:00 2001
+From: Janne Snabb <snabb@epipe.com>
+Date: Wed, 28 Dec 2011 19:36:00 +0000
+Subject: [PATCH 39/49] usb: option: add ZD Incorporated HSPA modem
+
+commit 3c8c9316710b83e906e425024153bf0929887b59 upstream.
+
+Add support for Chinese Noname HSPA USB modem which is apparently
+manufactured by a company called ZD Incorporated (based on texts in the
+Windows drivers).
+
+This product is available at least from Dealextreme (SKU 80032) and
+possibly in India with name Olive V-MW250. It is based on Qualcomm
+MSM6280 chip.
+
+I needed to also add "options usb-storage quirks=0685:7000:i" in modprobe
+configuration because udevd or the kernel keeps poking the embedded
+fake-cd-rom which fails and causes the device to reset. There might be
+a better way to accomplish the same. usb_modeswitch is not needed with
+this device.
+
+Signed-off-by: Janne Snabb <snabb@epipe.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/serial/option.c | 5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 6dd6453..c96b6b6 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -476,6 +476,10 @@ static void option_instat_callback(struct urb *urb);
+ #define VIETTEL_VENDOR_ID 0x2262
+ #define VIETTEL_PRODUCT_VT1000 0x0002
+
++/* ZD Incorporated */
++#define ZD_VENDOR_ID 0x0685
++#define ZD_PRODUCT_7000 0x7000
++
+ /* some devices interfaces need special handling due to a number of reasons */
+ enum option_blacklist_reason {
+ OPTION_BLACKLIST_NONE = 0,
+@@ -1178,6 +1182,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU528) },
+ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
+ { USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch
new file mode 100644
index 0000000..164d169
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch
@@ -0,0 +1,36 @@
+From a558d5668e8c66327a1a84f5db8381e94c2b0cd9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Malte=20Schr=C3=B6der?= <maltesch@gmx.de>
+Date: Thu, 5 Jan 2012 20:34:40 +0100
+Subject: [PATCH 40/49] USB: Add USB-ID for Multiplex RC serial adapter to
+ cp210x.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 08e87d0d773dc9ca5faf4c3306e238ed0ea129b0 upstream.
+
+Hi, below patch adds the USB-ID of the serial adapters sold by
+Multiplex RC (www.multiplex-rc.de).
+
+Signed-off-by: Malte Schröder <maltesch@gmx.de>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index fd67cc5..a1a324b 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -92,6 +92,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */
+ { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */
+ { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
++ { USB_DEVICE(0x10C4, 0x81A9) }, /* Multiplex RC Interface */
+ { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
+ { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */
+ { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch
new file mode 100644
index 0000000..bc2716a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch
@@ -0,0 +1,155 @@
+From 61ff4bd883cde399d333204fe9878e90b6f87329 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Sat, 3 Dec 2011 23:41:31 +0100
+Subject: [PATCH 41/49] usb: fix number of mapped SG DMA entries
+
+commit bc677d5b64644c399cd3db6a905453e611f402ab upstream.
+
+Add a new field num_mapped_sgs to struct urb so that we have a place to
+store the number of mapped entries and can also retain the original
+value of entries in num_sgs. Previously, usb_hcd_map_urb_for_dma()
+would overwrite this with the number of mapped entries, which would
+break dma_unmap_sg() because it requires the original number of entries.
+
+This fixes warnings like the following when using USB storage devices:
+ ------------[ cut here ]------------
+ WARNING: at lib/dma-debug.c:902 check_unmap+0x4e4/0x695()
+ ehci_hcd 0000:00:12.2: DMA-API: device driver frees DMA sg list with different entry count [map count=4] [unmap count=1]
+ Modules linked in: ohci_hcd ehci_hcd
+ Pid: 0, comm: kworker/0:1 Not tainted 3.2.0-rc2+ #319
+ Call Trace:
+ <IRQ> [<ffffffff81036d3b>] warn_slowpath_common+0x80/0x98
+ [<ffffffff81036de7>] warn_slowpath_fmt+0x41/0x43
+ [<ffffffff811fa5ae>] check_unmap+0x4e4/0x695
+ [<ffffffff8105e92c>] ? trace_hardirqs_off+0xd/0xf
+ [<ffffffff8147208b>] ? _raw_spin_unlock_irqrestore+0x33/0x50
+ [<ffffffff811fa84a>] debug_dma_unmap_sg+0xeb/0x117
+ [<ffffffff8137b02f>] usb_hcd_unmap_urb_for_dma+0x71/0x188
+ [<ffffffff8137b166>] unmap_urb_for_dma+0x20/0x22
+ [<ffffffff8137b1c5>] usb_hcd_giveback_urb+0x5d/0xc0
+ [<ffffffffa0000d02>] ehci_urb_done+0xf7/0x10c [ehci_hcd]
+ [<ffffffffa0001140>] qh_completions+0x429/0x4bd [ehci_hcd]
+ [<ffffffffa000340a>] ehci_work+0x95/0x9c0 [ehci_hcd]
+ ...
+ ---[ end trace f29ac88a5a48c580 ]---
+ Mapped at:
+ [<ffffffff811faac4>] debug_dma_map_sg+0x45/0x139
+ [<ffffffff8137bc0b>] usb_hcd_map_urb_for_dma+0x22e/0x478
+ [<ffffffff8137c494>] usb_hcd_submit_urb+0x63f/0x6fa
+ [<ffffffff8137d01c>] usb_submit_urb+0x2c7/0x2de
+ [<ffffffff8137dcd4>] usb_sg_wait+0x55/0x161
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/core/hcd.c | 5 ++---
+ drivers/usb/host/ehci-q.c | 2 +-
+ drivers/usb/host/uhci-q.c | 2 +-
+ drivers/usb/host/whci/qset.c | 4 ++--
+ drivers/usb/host/xhci-ring.c | 4 ++--
+ include/linux/usb.h | 1 +
+ 6 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 13222d3..179e364 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1412,11 +1412,10 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
+ ret = -EAGAIN;
+ else
+ urb->transfer_flags |= URB_DMA_MAP_SG;
+- if (n != urb->num_sgs) {
+- urb->num_sgs = n;
++ urb->num_mapped_sgs = n;
++ if (n != urb->num_sgs)
+ urb->transfer_flags |=
+ URB_DMA_SG_COMBINED;
+- }
+ } else if (urb->sg) {
+ struct scatterlist *sg = urb->sg;
+ urb->transfer_dma = dma_map_page(
+diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
+index 4e4066c..fef1db3 100644
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -647,7 +647,7 @@ qh_urb_transaction (
+ /*
+ * data transfer stage: buffer setup
+ */
+- i = urb->num_sgs;
++ i = urb->num_mapped_sgs;
+ if (len > 0 && i > 0) {
+ sg = urb->sg;
+ buf = sg_dma_address(sg);
+diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
+index f6ca80e..d2c6f5a 100644
+--- a/drivers/usb/host/uhci-q.c
++++ b/drivers/usb/host/uhci-q.c
+@@ -943,7 +943,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
+ if (usb_pipein(urb->pipe))
+ status |= TD_CTRL_SPD;
+
+- i = urb->num_sgs;
++ i = urb->num_mapped_sgs;
+ if (len > 0 && i > 0) {
+ sg = urb->sg;
+ data = sg_dma_address(sg);
+diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
+index a403b53..76083ae 100644
+--- a/drivers/usb/host/whci/qset.c
++++ b/drivers/usb/host/whci/qset.c
+@@ -443,7 +443,7 @@ static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *u
+
+ remaining = urb->transfer_buffer_length;
+
+- for_each_sg(urb->sg, sg, urb->num_sgs, i) {
++ for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) {
+ dma_addr_t dma_addr;
+ size_t dma_remaining;
+ dma_addr_t sp, ep;
+@@ -561,7 +561,7 @@ static int qset_add_urb_sg_linearize(struct whc *whc, struct whc_qset *qset,
+
+ remaining = urb->transfer_buffer_length;
+
+- for_each_sg(urb->sg, sg, urb->num_sgs, i) {
++ for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) {
+ size_t len;
+ size_t sg_remaining;
+ void *orig;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 9f1d4b1..d28c586 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2561,7 +2561,7 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
+ struct scatterlist *sg;
+
+ sg = NULL;
+- num_sgs = urb->num_sgs;
++ num_sgs = urb->num_mapped_sgs;
+ temp = urb->transfer_buffer_length;
+
+ xhci_dbg(xhci, "count sg list trbs: \n");
+@@ -2745,7 +2745,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ return -EINVAL;
+
+ num_trbs = count_sg_trbs_needed(xhci, urb);
+- num_sgs = urb->num_sgs;
++ num_sgs = urb->num_mapped_sgs;
+ total_packet_count = roundup(urb->transfer_buffer_length,
+ usb_endpoint_maxp(&urb->ep->desc));
+
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 1cea207..7626e5a 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -1222,6 +1222,7 @@ struct urb {
+ void *transfer_buffer; /* (in) associated data buffer */
+ dma_addr_t transfer_dma; /* (in) dma addr for transfer_buffer */
+ struct scatterlist *sg; /* (in) scatter gather buffer list */
++ int num_mapped_sgs; /* (internal) mapped sg entries */
+ int num_sgs; /* (in) number of entries in the sg list */
+ u32 transfer_buffer_length; /* (in) data buffer length */
+ u32 actual_length; /* (return) actual transfer length */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch
new file mode 100644
index 0000000..607ae21
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch
@@ -0,0 +1,62 @@
+From df0f4624e1225d9b7fb4d8934565418c81b42c04 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 4 Jan 2012 23:29:18 +0100
+Subject: [PATCH 42/49] xhci: Properly handle COMP_2ND_BW_ERR
+
+commit 71d85724bdd947a3b42a88d08af79f290a1a767b upstream.
+
+I encountered a result of COMP_2ND_BW_ERR while improving how the pwc
+webcam driver handles not having the full usb1 bandwidth available to
+itself.
+
+I created the following test setup, a NEC xhci controller with a
+single TT USB 2 hub plugged into it, with a usb keyboard and a pwc webcam
+plugged into the usb2 hub. This caused the following to show up in dmesg
+when trying to stream from the pwc camera at its highest alt setting:
+
+xhci_hcd 0000:01:00.0: ERROR: unexpected command completion code 0x23.
+usb 6-2.1: Not enough bandwidth for altsetting 9
+
+And usb_set_interface returned -EINVAL, which caused my pwc code to not
+do the right thing as it expected -ENOSPC.
+
+This patch makes the xhci driver properly handle COMP_2ND_BW_ERR and makes
+usb_set_interface return -ENOSPC as expected.
+
+This should be backported to stable kernels as old as 2.6.32.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/host/xhci.c | 1 +
+ drivers/usb/host/xhci.h | 1 -
+ 2 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index a1afb7c..36f9dd8 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1620,6 +1620,7 @@ static int xhci_configure_endpoint_result(struct xhci_hcd *xhci,
+ /* FIXME: can we allocate more resources for the HC? */
+ break;
+ case COMP_BW_ERR:
++ case COMP_2ND_BW_ERR:
+ dev_warn(&udev->dev, "Not enough bandwidth "
+ "for new device state.\n");
+ ret = -ENOSPC;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 3c8fbd2..09eda3a 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1033,7 +1033,6 @@ struct xhci_transfer_event {
+ /* Invalid Stream ID Error */
+ #define COMP_STRID_ERR 34
+ /* Secondary Bandwidth Error - may be returned by a Configure Endpoint cmd */
+-/* FIXME - check for this */
+ #define COMP_2ND_BW_ERR 35
+ /* Split Transaction Error */
+ #define COMP_SPLIT_ERR 36
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch
new file mode 100644
index 0000000..a96c372
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch
@@ -0,0 +1,81 @@
+From db46f35cb2853ffa42157c7222335cae15eda7e0 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Mon, 2 Jan 2012 13:35:41 +0200
+Subject: [PATCH 43/49] usb: ch9: fix up MaxStreams helper
+
+commit 18b7ede5f7ee2092aedcb578d3ac30bd5d4fc23c upstream.
+
+[ removed the dwc3 portion of the patch as it didn't apply to
+older kernels - gregkh]
+
+According to USB 3.0 Specification Table 9-22, if
+bmAttributes [4:0] are set to zero, it means "no
+streams supported", but the way this helper was
+defined on Linux, we will *always* have one stream
+which might cause several problems.
+
+For example on DWC3, we would tell the controller
+endpoint has streams enabled and yet start transfers
+with Stream ID set to 0, which would goof up the host
+side.
+
+While doing that, convert the macro to an inline
+function due to the different checks we now need.
+
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/host/xhci.c | 3 +--
+ include/linux/usb/ch9.h | 20 +++++++++++++++++++-
+ 2 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 36f9dd8..b33f059 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -2797,8 +2797,7 @@ static int xhci_calculate_streams_and_bitmask(struct xhci_hcd *xhci,
+ if (ret < 0)
+ return ret;
+
+- max_streams = USB_SS_MAX_STREAMS(
+- eps[i]->ss_ep_comp.bmAttributes);
++ max_streams = usb_ss_max_streams(&eps[i]->ss_ep_comp);
+ if (max_streams < (*num_streams - 1)) {
+ xhci_dbg(xhci, "Ep 0x%x only supports %u stream IDs.\n",
+ eps[i]->desc.bEndpointAddress,
+diff --git a/include/linux/usb/ch9.h b/include/linux/usb/ch9.h
+index d5da6c6..61b2905 100644
+--- a/include/linux/usb/ch9.h
++++ b/include/linux/usb/ch9.h
+@@ -605,8 +605,26 @@ struct usb_ss_ep_comp_descriptor {
+ } __attribute__ ((packed));
+
+ #define USB_DT_SS_EP_COMP_SIZE 6
++
+ /* Bits 4:0 of bmAttributes if this is a bulk endpoint */
+-#define USB_SS_MAX_STREAMS(p) (1 << ((p) & 0x1f))
++static inline int
++usb_ss_max_streams(const struct usb_ss_ep_comp_descriptor *comp)
++{
++ int max_streams;
++
++ if (!comp)
++ return 0;
++
++ max_streams = comp->bmAttributes & 0x1f;
++
++ if (!max_streams)
++ return 0;
++
++ max_streams = 1 << max_streams;
++
++ return max_streams;
++}
++
+ /* Bits 1:0 of bmAttributes if this is an isoc endpoint */
+ #define USB_SS_MULT(p) (1 + ((p) & 0x3))
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch
new file mode 100644
index 0000000..d740353
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch
@@ -0,0 +1,37 @@
+From 53876956cbd176ad0da89ca8e066202f6c143ea8 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Mon, 9 Jan 2012 14:06:46 -0800
+Subject: [PATCH 44/49] igmp: Avoid zero delay when receiving odd mixture of
+ IGMP queries
+
+commit a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27 upstream.
+
+Commit 5b7c84066733c5dfb0e4016d939757b38de189e4 ('ipv4: correct IGMP
+behavior on v3 query during v2-compatibility mode') added yet another
+case for query parsing, which can result in max_delay = 0. Substitute
+a value of 1, as in the usual v3 case.
+
+Reported-by: Simon McVittie <smcv@debian.org>
+References: http://bugs.debian.org/654876
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/ipv4/igmp.c | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index b2ca095..c3cc64c 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -875,6 +875,8 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+ * to be intended in a v3 query.
+ */
+ max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
++ if (!max_delay)
++ max_delay = 1; /* can't mod w/ 0 */
+ } else { /* v3 */
+ if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
+ return;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch
new file mode 100644
index 0000000..93da6cd
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch
@@ -0,0 +1,38 @@
+From eaa03e7a01f7dd67773c27e82d446a44440843a6 Mon Sep 17 00:00:00 2001
+From: Aurelien Jacobs <aurel@gnuage.org>
+Date: Sat, 7 Jan 2012 12:15:16 -0800
+Subject: [PATCH 45/49] asix: fix infinite loop in rx_fixup()
+
+commit 6c15d74defd38e7e7f8805392578b7a1d508097e upstream.
+
+At this point if skb->len happens to be 2, the subsequant skb_pull(skb, 4)
+call won't work and the skb->len won't be decreased and won't ever reach 0,
+resulting in an infinite loop.
+
+With an ASIX 88772 under heavy load, without this patch, rx_fixup() reaches
+an infinite loop in less than a minute. With this patch applied,
+no infinite loop even after hours of heavy load.
+
+Signed-off-by: Aurelien Jacobs <aurel@gnuage.org>
+Cc: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/usb/asix.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
+index e95f0e6..dd2625a 100644
+--- a/drivers/net/usb/asix.c
++++ b/drivers/net/usb/asix.c
+@@ -376,7 +376,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+
+ skb_pull(skb, (size + 1) & 0xfffe);
+
+- if (skb->len == 0)
++ if (skb->len < sizeof(header))
+ break;
+
+ head = (u8 *) skb->data;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch
new file mode 100644
index 0000000..7b7e03a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch
@@ -0,0 +1,68 @@
+From b40864c73fef3aefced0863fc2b3c3a7716d9f09 Mon Sep 17 00:00:00 2001
+From: stephen hemminger <shemminger@vyatta.com>
+Date: Sat, 31 Dec 2011 13:26:46 +0000
+Subject: [PATCH 46/49] bonding: fix error handling if slave is busy (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit f7d9821a6a9c83450ac35e76d3709e32fd38b76f upstream.
+
+If slave device already has a receive handler registered, then the
+error unwind of bonding device enslave function is broken.
+
+The following will leave a pointer to freed memory in the slave
+device list, causing a later kernel panic.
+# modprobe dummy
+# ip li add dummy0-1 link dummy0 type macvlan
+# modprobe bonding
+# echo +dummy0 >/sys/class/net/bond0/bonding/slaves
+
+The fix is to detach the slave (which removes it from the list)
+in the unwind path.
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Reviewed-by: Nicolas de Pesloüan <nicolas.2p.debian@free.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/bonding/bond_main.c | 9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 7f87568..e58aa2b 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1822,7 +1822,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ "but new slave device does not support netpoll.\n",
+ bond_dev->name);
+ res = -EBUSY;
+- goto err_close;
++ goto err_detach;
+ }
+ }
+ #endif
+@@ -1831,7 +1831,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+
+ res = bond_create_slave_symlinks(bond_dev, slave_dev);
+ if (res)
+- goto err_close;
++ goto err_detach;
+
+ res = netdev_rx_handler_register(slave_dev, bond_handle_frame,
+ new_slave);
+@@ -1852,6 +1852,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ err_dest_symlinks:
+ bond_destroy_slave_symlinks(bond_dev, slave_dev);
+
++err_detach:
++ write_lock_bh(&bond->lock);
++ bond_detach_slave(bond, new_slave);
++ write_unlock_bh(&bond->lock);
++
+ err_close:
+ dev_close(slave_dev);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch
new file mode 100644
index 0000000..f9363aa
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch
@@ -0,0 +1,54 @@
+From 9d3898fe46309ee5688697d1a65975208dc49639 Mon Sep 17 00:00:00 2001
+From: Thilo-Alexander Ginkel <thilo@ginkel.com>
+Date: Sat, 17 Dec 2011 10:55:10 +0100
+Subject: [PATCH 47/49] usb: cdc-acm: Fix acm_tty_hangup() vs. acm_tty_close()
+ race
+
+[Not upstream as it was fixed differently for 3.3 with a much more
+"intrusive" rework of the driver - gregkh]
+
+There is a race condition involving acm_tty_hangup() and acm_tty_close()
+where hangup() would attempt to access tty->driver_data without proper
+locking and NULL checking after close() has potentially already set it
+to NULL. One possibility to (sporadically) trigger this behavior is to
+perform a suspend/resume cycle with a running WWAN data connection.
+
+This patch addresses the issue by introducing a NULL check for
+tty->driver_data in acm_tty_hangup() protected by open_mutex and exiting
+gracefully when hangup() is invoked on a device that has already been
+closed.
+
+Signed-off-by: Thilo-Alexander Ginkel <thilo@ginkel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/class/cdc-acm.c | 12 ++++++++++--
+ 1 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index ea5e487..e61d9c4 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -554,10 +554,18 @@ static void acm_port_down(struct acm *acm)
+
+ static void acm_tty_hangup(struct tty_struct *tty)
+ {
+- struct acm *acm = tty->driver_data;
+- tty_port_hangup(&acm->port);
++ struct acm *acm;
++
+ mutex_lock(&open_mutex);
++ acm = tty->driver_data;
++
++ if (!acm)
++ goto out;
++
++ tty_port_hangup(&acm->port);
+ acm_port_down(acm);
++
++out:
+ mutex_unlock(&open_mutex);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch
new file mode 100644
index 0000000..1ddf63d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch
@@ -0,0 +1,34 @@
+From 5af63c5af9a335ff2af8d6b84d512e92ac522995 Mon Sep 17 00:00:00 2001
+From: Xi Wang <xi.wang@gmail.com>
+Date: Mon, 12 Dec 2011 21:55:52 +0000
+Subject: [PATCH 48/49] xfs: fix acl count validation in xfs_acl_from_disk()
+
+commit 093019cf1b18dd31b2c3b77acce4e000e2cbc9ce upstream.
+
+Commit fa8b18ed didn't prevent the integer overflow and possible
+memory corruption. "count" can go negative and bypass the check.
+
+Signed-off-by: Xi Wang <xi.wang@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/xfs/xfs_acl.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
+index 76e4266..ac702a6 100644
+--- a/fs/xfs/xfs_acl.c
++++ b/fs/xfs/xfs_acl.c
+@@ -39,7 +39,7 @@ xfs_acl_from_disk(struct xfs_acl *aclp)
+ struct posix_acl_entry *acl_e;
+ struct posix_acl *acl;
+ struct xfs_acl_entry *ace;
+- int count, i;
++ unsigned int count, i;
+
+ count = be32_to_cpu(aclp->acl_cnt);
+ if (count > XFS_ACL_MAX_ENTRIES)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0049-Linux-3.2.1.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0049-Linux-3.2.1.patch
new file mode 100644
index 0000000..37c5764
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.1/0049-Linux-3.2.1.patch
@@ -0,0 +1,24 @@
+From 78d772bb92fa633fc41d234887b050dce88542bc Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Thu, 12 Jan 2012 11:42:45 -0800
+Subject: [PATCH 49/49] Linux 3.2.1
+
+---
+ Makefile | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index adddd11..c5edffa 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 0
++SUBLEVEL = 1
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch
new file mode 100644
index 0000000..08b2918
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch
@@ -0,0 +1,39 @@
+From 9589d3910b50c6e66f1a050e365c22271936b6b0 Mon Sep 17 00:00:00 2001
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Date: Tue, 29 Nov 2011 12:49:18 +0200
+Subject: [PATCH 001/130] mtdoops: fix the oops_page_used array size
+
+commit 556f063580db2953a7e53cd46b47724246320f60 upstream.
+
+The array of unsigned long pointed by oops_page_used is allocated
+by vmalloc which requires the size to be in bytes.
+
+BITS_PER_LONG is equal to 32.
+If we want to allocate memory for 32 pages with one bit per page then
+32 / BITS_PER_LONG is equal to 1 byte that is 8 bits.
+To fix it we need to multiply the result by sizeof(unsigned long) equal to 4.
+
+Signed-off-by: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/mtd/mtdoops.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
+index 1e2fa62..0782b31 100644
+--- a/drivers/mtd/mtdoops.c
++++ b/drivers/mtd/mtdoops.c
+@@ -369,7 +369,7 @@ static void mtdoops_notify_add(struct mtd_info *mtd)
+
+ /* oops_page_used is a bit field */
+ cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages,
+- BITS_PER_LONG));
++ BITS_PER_LONG) * sizeof(unsigned long));
+ if (!cxt->oops_page_used) {
+ printk(KERN_ERR "mtdoops: could not allocate page array\n");
+ return;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch
new file mode 100644
index 0000000..82e97cc
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch
@@ -0,0 +1,36 @@
+From e8f072aad40b7d45c605e27f1337b5eb7b6fbc11 Mon Sep 17 00:00:00 2001
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Date: Fri, 2 Dec 2011 15:07:17 +0200
+Subject: [PATCH 002/130] mtd: mtdoops: skip reading initially bad blocks
+
+commit 3538c56329936c78f7d356889908790006d0124c upstream.
+
+Use block_isbad to check and skip the bad blocks reading.
+This will allow to get rid of the read errors if bad blocks
+are present initially.
+
+Signed-off-by: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/mtd/mtdoops.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
+index 0782b31..f3cdce9 100644
+--- a/drivers/mtd/mtdoops.c
++++ b/drivers/mtd/mtdoops.c
+@@ -253,6 +253,9 @@ static void find_next_position(struct mtdoops_context *cxt)
+ size_t retlen;
+
+ for (page = 0; page < cxt->oops_pages; page++) {
++ if (mtd->block_isbad &&
++ mtd->block_isbad(mtd, page * record_size))
++ continue;
+ /* Assume the page is used */
+ mark_page_used(cxt, page);
+ ret = mtd->read(mtd, page * record_size, MTDOOPS_HEADER_SIZE,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch
new file mode 100644
index 0000000..1aa180c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch
@@ -0,0 +1,85 @@
+From 7e1c31ad0d3116ac301e5d6ef6df036eec548229 Mon Sep 17 00:00:00 2001
+From: Brian Norris <computersforpeace@gmail.com>
+Date: Mon, 7 Nov 2011 15:51:05 -0800
+Subject: [PATCH 003/130] mtd: mtd_blkdevs: don't increase 'open' count on
+ error path
+
+commit 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 upstream.
+
+Some error paths in mtd_blkdevs were fixed in the following commit:
+
+ commit 94735ec4044a6d318b83ad3c5794e931ed168d10
+ mtd: mtd_blkdevs: fix error path in blktrans_open
+
+But on these error paths, the block device's `dev->open' count is
+already incremented before we check for errors. This meant that, while
+the error path was handled correctly on the first time through
+blktrans_open(), the device is erroneously considered already open on
+the second time through.
+
+This problem can be seen, for instance, when a UBI volume is
+simultaneously mounted as a UBIFS partition and read through its
+corresponding gluebi mtdblockX device. This results in blktrans_open()
+passing its error checks (with `dev->open > 0') without actually having
+a handle on the device. Here's a summarized log of the actions and
+results with nandsim:
+
+ # modprobe nandsim
+ # modprobe mtdblock
+ # modprobe gluebi
+ # modprobe ubifs
+ # ubiattach /dev/ubi_ctrl -m 0
+ ...
+ # ubimkvol /dev/ubi0 -N test -s 16MiB
+ ...
+ # mount -t ubifs ubi0:test /mnt
+ # ls /dev/mtdblock*
+ /dev/mtdblock0 /dev/mtdblock1
+ # cat /dev/mtdblock1 > /dev/null
+ cat: can't open '/dev/mtdblock4': Device or resource busy
+ # cat /dev/mtdblock1 > /dev/null
+
+ CPU 0 Unable to handle kernel paging request at virtual address
+ fffffff0, epc == 8031536c, ra == 8031f280
+ Oops[#1]:
+ ...
+ Call Trace:
+ [<8031536c>] ubi_leb_read+0x14/0x164
+ [<8031f280>] gluebi_read+0xf0/0x148
+ [<802edba8>] mtdblock_readsect+0x64/0x198
+ [<802ecfe4>] mtd_blktrans_thread+0x330/0x3f4
+ [<8005be98>] kthread+0x88/0x90
+ [<8000bc04>] kernel_thread_helper+0x10/0x18
+
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/mtd/mtd_blkdevs.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
+index ed8b5e7..424ca5f 100644
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -215,7 +215,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
+
+ mutex_lock(&dev->lock);
+
+- if (dev->open++)
++ if (dev->open)
+ goto unlock;
+
+ kref_get(&dev->ref);
+@@ -235,6 +235,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
+ goto error_release;
+
+ unlock:
++ dev->open++;
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ return ret;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch
new file mode 100644
index 0000000..f28f386
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch
@@ -0,0 +1,60 @@
+From 24935db264c015f91046c597ead8f42a3de24858 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <w.sang@pengutronix.de>
+Date: Tue, 29 Nov 2011 15:34:08 +0100
+Subject: [PATCH 004/130] mtd: tests: stresstest: bail out if device has not
+ enough eraseblocks
+
+commit 2f4478ccff7df845dc9c0f8996a96373122c4417 upstream.
+
+stresstest needs at least two eraseblocks. Bail out gracefully if that
+condition is not met. Fixes the following 'division by zero' OOPS:
+
+[ 619.100000] mtd_stresstest: MTD device size 131072, eraseblock size 131072, page size 2048, count of eraseblocks 1, pages per eraseblock 64, OOB size 64
+[ 619.120000] mtd_stresstest: scanning for bad eraseblocks
+[ 619.120000] mtd_stresstest: scanned 1 eraseblocks, 0 are bad
+[ 619.130000] mtd_stresstest: doing operations
+[ 619.130000] mtd_stresstest: 0 operations done
+[ 619.140000] Division by zero in kernel.
+...
+
+caused by
+
+ /* Read or write up 2 eraseblocks at a time - hence 'ebcnt - 1' */
+ eb %= (ebcnt - 1);
+
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/mtd/tests/mtd_stresstest.c | 7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/mtd/tests/mtd_stresstest.c b/drivers/mtd/tests/mtd_stresstest.c
+index 52ffd91..811642f 100644
+--- a/drivers/mtd/tests/mtd_stresstest.c
++++ b/drivers/mtd/tests/mtd_stresstest.c
+@@ -284,6 +284,12 @@ static int __init mtd_stresstest_init(void)
+ (unsigned long long)mtd->size, mtd->erasesize,
+ pgsize, ebcnt, pgcnt, mtd->oobsize);
+
++ if (ebcnt < 2) {
++ printk(PRINT_PREF "error: need at least 2 eraseblocks\n");
++ err = -ENOSPC;
++ goto out_put_mtd;
++ }
++
+ /* Read or write up 2 eraseblocks at a time */
+ bufsize = mtd->erasesize * 2;
+
+@@ -322,6 +328,7 @@ out:
+ kfree(bbt);
+ vfree(writebuf);
+ vfree(readbuf);
++out_put_mtd:
+ put_mtd_device(mtd);
+ if (err)
+ printk(PRINT_PREF "error %d occurred\n", err);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch
new file mode 100644
index 0000000..15c214e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch
@@ -0,0 +1,53 @@
+From 0ff595b93bc982c60777d727c282cf76050802bf Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Tue, 10 Jan 2012 15:11:02 -0800
+Subject: [PATCH 005/130] drivers/rtc/interface.c: fix alarm rollover when day
+ or month is out-of-range
+
+commit e74a8f2edb92cb690b467cea0ab652c509e9f624 upstream.
+
+Commit f44f7f96a20a ("RTC: Initialize kernel state from RTC") introduced a
+potential infinite loop. If an alarm time contains a wildcard month and
+an invalid day (> 31), or a wildcard year and an invalid month (>= 12),
+the loop searching for the next matching date will never terminate. Treat
+the invalid values as wildcards.
+
+Fixes <http://bugs.debian.org/646429>, <http://bugs.debian.org/653331>
+
+Reported-by: leo weppelman <leoweppelman@googlemail.com>
+Reported-by: "P. van Gaans" <mailme667@yahoo.co.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Cc: Marcelo Roberto Jimenez <mroberto@cpti.cetuc.puc-rio.br>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: John Stultz <john.stultz@linaro.org>
+Acked-by: Alessandro Zummo <a.zummo@towertech.it>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/rtc/interface.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index 8e28625..8a1c031 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -228,11 +228,11 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ alarm->time.tm_hour = now.tm_hour;
+
+ /* For simplicity, only support date rollover for now */
+- if (alarm->time.tm_mday == -1) {
++ if (alarm->time.tm_mday < 1 || alarm->time.tm_mday > 31) {
+ alarm->time.tm_mday = now.tm_mday;
+ missing = day;
+ }
+- if (alarm->time.tm_mon == -1) {
++ if ((unsigned)alarm->time.tm_mon >= 12) {
+ alarm->time.tm_mon = now.tm_mon;
+ if (missing == none)
+ missing = month;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch
new file mode 100644
index 0000000..3306542
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch
@@ -0,0 +1,109 @@
+From 90d3fbe7c2f63a83921d15a9bb1f451d03040f9b Mon Sep 17 00:00:00 2001
+From: Djalal Harouni <tixxdz@opendz.org>
+Date: Wed, 4 Jan 2012 17:09:52 -0500
+Subject: [PATCH 006/130] ext4: add missing ext4_resize_end on error paths
+
+commit 014a1770371a028d22f364718c805f4216911ecd upstream.
+
+Online resize ioctls 'EXT4_IOC_GROUP_EXTEND' and 'EXT4_IOC_GROUP_ADD'
+call ext4_resize_begin() to check permissions and to set the
+EXT4_RESIZING bit lock, they do their work and they must finish with
+ext4_resize_end() which calls clear_bit_unlock() to unlock and to
+avoid -EBUSY errors for the next resize operations.
+
+This patch adds the missing ext4_resize_end() calls on error paths.
+
+Patch tested.
+
+Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/ext4/ioctl.c | 28 ++++++++++++++++++----------
+ 1 files changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index a567968..ab25f57 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -182,19 +182,22 @@ setversion_out:
+ if (err)
+ return err;
+
+- if (get_user(n_blocks_count, (__u32 __user *)arg))
+- return -EFAULT;
++ if (get_user(n_blocks_count, (__u32 __user *)arg)) {
++ err = -EFAULT;
++ goto group_extend_out;
++ }
+
+ if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
+ EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
+ ext4_msg(sb, KERN_ERR,
+ "Online resizing not supported with bigalloc");
+- return -EOPNOTSUPP;
++ err = -EOPNOTSUPP;
++ goto group_extend_out;
+ }
+
+ err = mnt_want_write(filp->f_path.mnt);
+ if (err)
+- return err;
++ goto group_extend_out;
+
+ err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
+ if (EXT4_SB(sb)->s_journal) {
+@@ -204,9 +207,10 @@ setversion_out:
+ }
+ if (err == 0)
+ err = err2;
++
+ mnt_drop_write(filp->f_path.mnt);
++group_extend_out:
+ ext4_resize_end(sb);
+-
+ return err;
+ }
+
+@@ -267,19 +271,22 @@ mext_out:
+ return err;
+
+ if (copy_from_user(&input, (struct ext4_new_group_input __user *)arg,
+- sizeof(input)))
+- return -EFAULT;
++ sizeof(input))) {
++ err = -EFAULT;
++ goto group_add_out;
++ }
+
+ if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
+ EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
+ ext4_msg(sb, KERN_ERR,
+ "Online resizing not supported with bigalloc");
+- return -EOPNOTSUPP;
++ err = -EOPNOTSUPP;
++ goto group_add_out;
+ }
+
+ err = mnt_want_write(filp->f_path.mnt);
+ if (err)
+- return err;
++ goto group_add_out;
+
+ err = ext4_group_add(sb, &input);
+ if (EXT4_SB(sb)->s_journal) {
+@@ -289,9 +296,10 @@ mext_out:
+ }
+ if (err == 0)
+ err = err2;
++
+ mnt_drop_write(filp->f_path.mnt);
++group_add_out:
+ ext4_resize_end(sb);
+-
+ return err;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch
new file mode 100644
index 0000000..95f0d2e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch
@@ -0,0 +1,74 @@
+From 149672e502af36fdb60960faaf2ca3bdde96bd5e Mon Sep 17 00:00:00 2001
+From: Xi Wang <xi.wang@gmail.com>
+Date: Tue, 10 Jan 2012 11:51:10 -0500
+Subject: [PATCH 007/130] ext4: fix undefined behavior in
+ ext4_fill_flex_info()
+
+commit d50f2ab6f050311dbf7b8f5501b25f0bf64a439b upstream.
+
+Commit 503358ae01b70ce6909d19dd01287093f6b6271c ("ext4: avoid divide by
+zero when trying to mount a corrupted file system") fixes CVE-2009-4307
+by performing a sanity check on s_log_groups_per_flex, since it can be
+set to a bogus value by an attacker.
+
+ sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
+ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+
+ if (groups_per_flex < 2) { ... }
+
+This patch fixes two potential issues in the previous commit.
+
+1) The sanity check might only work on architectures like PowerPC.
+On x86, 5 bits are used for the shifting amount. That means, given a
+large s_log_groups_per_flex value like 36, groups_per_flex = 1 << 36
+is essentially 1 << 4 = 16, rather than 0. This will bypass the check,
+leaving s_log_groups_per_flex and groups_per_flex inconsistent.
+
+2) The sanity check relies on undefined behavior, i.e., oversized shift.
+A standard-confirming C compiler could rewrite the check in unexpected
+ways. Consider the following equivalent form, assuming groups_per_flex
+is unsigned for simplicity.
+
+ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+ if (groups_per_flex == 0 || groups_per_flex == 1) {
+
+We compile the code snippet using Clang 3.0 and GCC 4.6. Clang will
+completely optimize away the check groups_per_flex == 0, leaving the
+patched code as vulnerable as the original. GCC keeps the check, but
+there is no guarantee that future versions will do the same.
+
+Signed-off-by: Xi Wang <xi.wang@gmail.com>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/ext4/super.c | 7 +++----
+ 1 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 3e1329e..9281dbe 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2006,17 +2006,16 @@ static int ext4_fill_flex_info(struct super_block *sb)
+ struct ext4_group_desc *gdp = NULL;
+ ext4_group_t flex_group_count;
+ ext4_group_t flex_group;
+- int groups_per_flex = 0;
++ unsigned int groups_per_flex = 0;
+ size_t size;
+ int i;
+
+ sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
+- groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+-
+- if (groups_per_flex < 2) {
++ if (sbi->s_log_groups_per_flex < 1 || sbi->s_log_groups_per_flex > 31) {
+ sbi->s_log_groups_per_flex = 0;
+ return 1;
+ }
++ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+
+ /* We allocate both existing and potentially added groups */
+ flex_group_count = ((sbi->s_groups_count + groups_per_flex - 1) +
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch
new file mode 100644
index 0000000..922b70a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch
@@ -0,0 +1,54 @@
+From 77b0511fab25f495a30242f4b2fd940e71ce11ad Mon Sep 17 00:00:00 2001
+From: Karsten Wiese <fzu@wemgehoertderstaat.de>
+Date: Fri, 30 Dec 2011 01:42:01 +0100
+Subject: [PATCH 008/130] ALSA: snd-usb-us122l: Delete calls to
+ preempt_disable
+
+commit d0f3a2eb9062560bebca8b923424f3ca02a331ba upstream.
+
+They are not needed here.
+
+Signed-off-by: Karsten Wiese <fzu@wemgehoertderstaat.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ sound/usb/usx2y/usb_stream.c | 6 ++----
+ 1 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c
+index c400ade..1e7a47a 100644
+--- a/sound/usb/usx2y/usb_stream.c
++++ b/sound/usb/usx2y/usb_stream.c
+@@ -674,7 +674,7 @@ dotry:
+ inurb->transfer_buffer_length =
+ inurb->number_of_packets *
+ inurb->iso_frame_desc[0].length;
+- preempt_disable();
++
+ if (u == 0) {
+ int now;
+ struct usb_device *dev = inurb->dev;
+@@ -686,19 +686,17 @@ dotry:
+ }
+ err = usb_submit_urb(inurb, GFP_ATOMIC);
+ if (err < 0) {
+- preempt_enable();
+ snd_printk(KERN_ERR"usb_submit_urb(sk->inurb[%i])"
+ " returned %i\n", u, err);
+ return err;
+ }
+ err = usb_submit_urb(outurb, GFP_ATOMIC);
+ if (err < 0) {
+- preempt_enable();
+ snd_printk(KERN_ERR"usb_submit_urb(sk->outurb[%i])"
+ " returned %i\n", u, err);
+ return err;
+ }
+- preempt_enable();
++
+ if (inurb->start_frame != outurb->start_frame) {
+ snd_printd(KERN_DEBUG
+ "u[%i] start_frames differ in:%u out:%u\n",
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch
new file mode 100644
index 0000000..266d112
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch
@@ -0,0 +1,57 @@
+From c237e8b240ea09139d387e89f7474fbcd2b4bd0c Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 2 Jan 2012 12:40:15 +0100
+Subject: [PATCH 009/130] ALSA: HDA: Fix master control for Cirrus Logic 421X
+
+commit 40d03e63e91af8ddccdfd5a536cc2a6e51433e1d upstream.
+
+The control name "HP/Speakers" is non-standard, and since there is
+only one DAC on this chip there is no need for a virtual master
+anyway.
+
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ sound/pci/hda/patch_cirrus.c | 13 +------------
+ 1 files changed, 1 insertions(+), 12 deletions(-)
+
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index 70a7abd..f55ceb6 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -1771,30 +1771,19 @@ static int build_cs421x_output(struct hda_codec *codec)
+ struct auto_pin_cfg *cfg = &spec->autocfg;
+ struct snd_kcontrol *kctl;
+ int err;
+- char *name = "HP/Speakers";
++ char *name = "Master";
+
+ fix_volume_caps(codec, dac);
+- if (!spec->vmaster_sw) {
+- err = add_vmaster(codec, dac);
+- if (err < 0)
+- return err;
+- }
+
+ err = add_mute(codec, name, 0,
+ HDA_COMPOSE_AMP_VAL(dac, 3, 0, HDA_OUTPUT), 0, &kctl);
+ if (err < 0)
+ return err;
+- err = snd_ctl_add_slave(spec->vmaster_sw, kctl);
+- if (err < 0)
+- return err;
+
+ err = add_volume(codec, name, 0,
+ HDA_COMPOSE_AMP_VAL(dac, 3, 0, HDA_OUTPUT), 0, &kctl);
+ if (err < 0)
+ return err;
+- err = snd_ctl_add_slave(spec->vmaster_vol, kctl);
+- if (err < 0)
+- return err;
+
+ if (cfg->speaker_outs) {
+ err = snd_hda_ctl_add(codec, 0,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch
new file mode 100644
index 0000000..c3a57e8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch
@@ -0,0 +1,48 @@
+From d08570c3c46be8ea5797897e7ae4df418d404c2d Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 2 Jan 2012 12:40:16 +0100
+Subject: [PATCH 010/130] ALSA: HDA: Fix automute for Cirrus Logic 421x
+
+commit 78e2a928e377d5124932d4399c6c581908b027a0 upstream.
+
+There was a bug in the automute logic causing speakers not to
+mute when headphones were plugged in.
+
+Tested-by: Hsin-Yi Chen <hychen@canonical.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ sound/pci/hda/patch_cirrus.c | 14 ++++++--------
+ 1 files changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index f55ceb6..5b0a9bb 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -920,16 +920,14 @@ static void cs_automute(struct hda_codec *codec)
+
+ /* mute speakers if spdif or hp jack is plugged in */
+ for (i = 0; i < cfg->speaker_outs; i++) {
++ int pin_ctl = hp_present ? 0 : PIN_OUT;
++ /* detect on spdif is specific to CS421x */
++ if (spdif_present && (spec->vendor_nid == CS421X_VENDOR_NID))
++ pin_ctl = 0;
++
+ nid = cfg->speaker_pins[i];
+ snd_hda_codec_write(codec, nid, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL,
+- hp_present ? 0 : PIN_OUT);
+- /* detect on spdif is specific to CS421x */
+- if (spec->vendor_nid == CS421X_VENDOR_NID) {
+- snd_hda_codec_write(codec, nid, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL,
+- spdif_present ? 0 : PIN_OUT);
+- }
++ AC_VERB_SET_PIN_WIDGET_CONTROL, pin_ctl);
+ }
+ if (spec->gpio_eapd_hp) {
+ unsigned int gpio = hp_present ?
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch
new file mode 100644
index 0000000..a311248
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch
@@ -0,0 +1,38 @@
+From 37a4221e9e94eb1841d5367baba68e31b0c29d4b Mon Sep 17 00:00:00 2001
+From: Pavel Hofman <pavel.hofman@ivitera.com>
+Date: Thu, 5 Jan 2012 23:05:18 +0100
+Subject: [PATCH 011/130] ALSA: ice1724 - Check for ac97 to avoid kernel oops
+
+commit e7848163aa2a649d9065f230fadff80dc3519775 upstream.
+
+Cards with identical PCI ids but no AC97 config in EEPROM do not have
+the ac97 field initialized. We must check for this case to avoid kernel oops.
+
+Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ sound/pci/ice1712/amp.c | 7 +++++--
+ 1 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/ice1712/amp.c b/sound/pci/ice1712/amp.c
+index e328cfb..e525da2 100644
+--- a/sound/pci/ice1712/amp.c
++++ b/sound/pci/ice1712/amp.c
+@@ -68,8 +68,11 @@ static int __devinit snd_vt1724_amp_init(struct snd_ice1712 *ice)
+
+ static int __devinit snd_vt1724_amp_add_controls(struct snd_ice1712 *ice)
+ {
+- /* we use pins 39 and 41 of the VT1616 for left and right read outputs */
+- snd_ac97_write_cache(ice->ac97, 0x5a, snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
++ if (ice->ac97)
++ /* we use pins 39 and 41 of the VT1616 for left and right
++ read outputs */
++ snd_ac97_write_cache(ice->ac97, 0x5a,
++ snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch
new file mode 100644
index 0000000..98db255
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch
@@ -0,0 +1,46 @@
+From 3997412715c72bd24b2433c841b63590ec175755 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 9 Jan 2012 11:37:20 +0100
+Subject: [PATCH 012/130] ALSA: usb-audio - Avoid flood of frame-active debug
+ messages
+
+commit 80c8a2a372599e604b04a9c568952fe39cd1851d upstream.
+
+With some buggy devices, the usb-audio driver may give "frame xxx active"
+kernel messages too often. Better to keep it as debug-only using
+snd_printdd(), and also add the rate-limit for avoiding floods.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=738681
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ sound/usb/endpoint.c | 5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 81c6ede..08dcce5 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -17,6 +17,7 @@
+
+ #include <linux/gfp.h>
+ #include <linux/init.h>
++#include <linux/ratelimit.h>
+ #include <linux/usb.h>
+ #include <linux/usb/audio.h>
+
+@@ -458,8 +459,8 @@ static int retire_capture_urb(struct snd_usb_substream *subs,
+
+ for (i = 0; i < urb->number_of_packets; i++) {
+ cp = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset;
+- if (urb->iso_frame_desc[i].status) {
+- snd_printd(KERN_ERR "frame %d active: %d\n", i, urb->iso_frame_desc[i].status);
++ if (urb->iso_frame_desc[i].status && printk_ratelimit()) {
++ snd_printdd("frame %d active: %d\n", i, urb->iso_frame_desc[i].status);
+ // continue;
+ }
+ bytes = urb->iso_frame_desc[i].actual_length;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch
new file mode 100644
index 0000000..20e9a98
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch
@@ -0,0 +1,37 @@
+From 82b777e29dcdaa78de5834c88eec7d6733f7aaff Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 10 Jan 2012 08:59:56 +0100
+Subject: [PATCH 013/130] ALSA: hda - Use auto-parser for HP laptops with
+ cx20459 codec
+
+commit de4da59e480cdf1075b33dbaf8078fc87bc52241 upstream.
+
+These laptops can work well with the auto-parser and their BIOS setups,
+and in addition, the auto-parser fixes the problem with S3/S4 where
+the unsol event handling is killed after resume due to fallback to the
+single-cmd mode.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740115
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ sound/pci/hda/patch_conexant.c | 2 --
+ 1 files changed, 0 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 0de2119..7072251 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1120,8 +1120,6 @@ static const char * const cxt5045_models[CXT5045_MODELS] = {
+
+ static const struct snd_pci_quirk cxt5045_cfg_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x30d5, "HP 530", CXT5045_LAPTOP_HP530),
+- SND_PCI_QUIRK_MASK(0x103c, 0xff00, 0x3000, "HP DV Series",
+- CXT5045_LAPTOP_HPSENSE),
+ SND_PCI_QUIRK(0x1179, 0xff31, "Toshiba P105", CXT5045_LAPTOP_MICSENSE),
+ SND_PCI_QUIRK(0x152d, 0x0753, "Benq R55E", CXT5045_BENQ),
+ SND_PCI_QUIRK(0x1734, 0x10ad, "Fujitsu Si1520", CXT5045_LAPTOP_MICSENSE),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch
new file mode 100644
index 0000000..d7b647a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch
@@ -0,0 +1,58 @@
+From b347c4f831da8a0e1498b0947e7a334e9113cd83 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 10 Jan 2012 12:41:22 +0100
+Subject: [PATCH 014/130] ALSA: hda - Return the error from get_wcaps_type()
+ for invalid NIDs
+
+commit 3a90274de3548ebb2aabfbf488cea8e275a73dc6 upstream.
+
+When an invalid NID is given, get_wcaps() returns zero as the error,
+but get_wcaps_type() takes it as the normal value and returns a bogus
+AC_WID_AUD_OUT value. This confuses the parser.
+
+With this patch, get_wcaps_type() returns -1 when value 0 is given,
+i.e. an invalid NID is passed to get_wcaps().
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740118
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ sound/pci/hda/hda_local.h | 7 ++++++-
+ sound/pci/hda/hda_proc.c | 2 ++
+ 2 files changed, 8 insertions(+), 1 deletions(-)
+
+diff --git a/sound/pci/hda/hda_local.h b/sound/pci/hda/hda_local.h
+index 618ddad..368f0c5 100644
+--- a/sound/pci/hda/hda_local.h
++++ b/sound/pci/hda/hda_local.h
+@@ -487,7 +487,12 @@ static inline u32 get_wcaps(struct hda_codec *codec, hda_nid_t nid)
+ }
+
+ /* get the widget type from widget capability bits */
+-#define get_wcaps_type(wcaps) (((wcaps) & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT)
++static inline int get_wcaps_type(unsigned int wcaps)
++{
++ if (!wcaps)
++ return -1; /* invalid type */
++ return (wcaps & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT;
++}
+
+ static inline unsigned int get_wcaps_channels(u32 wcaps)
+ {
+diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
+index 2c981b5..254ab52 100644
+--- a/sound/pci/hda/hda_proc.c
++++ b/sound/pci/hda/hda_proc.c
+@@ -54,6 +54,8 @@ static const char *get_wid_type_name(unsigned int wid_value)
+ [AC_WID_BEEP] = "Beep Generator Widget",
+ [AC_WID_VENDOR] = "Vendor Defined Widget",
+ };
++ if (wid_value == -1)
++ return "UNKNOWN Widget";
+ wid_value &= 0xf;
+ if (names[wid_value])
+ return names[wid_value];
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch
new file mode 100644
index 0000000..d2a40b7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch
@@ -0,0 +1,42 @@
+From ea14c41fb5a54a4f2089c97f85c399965415871a Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 10 Jan 2012 15:16:02 +0100
+Subject: [PATCH 015/130] ALSA: hda - Fix the detection of "Loopback Mixing"
+ control for VIA codecs
+
+commit 4808d12d1dddb046ec86425e5f6766f02e950292 upstream.
+
+Currently the driver checks only the out_mix_path[] for the primary
+output route for judging whether to create the loopback-mixing control
+or not. But, there are cases where aamix-routing is available only on
+headphone or speaker paths but not on the primary output path. So, the
+driver ignores such cases inappropriately.
+
+This patch fixes the check of the loopback-mixing control by testing
+all mix-routing paths.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ sound/pci/hda/patch_via.c | 5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index b513762..8d69e59 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -2200,7 +2200,10 @@ static int via_auto_create_loopback_switch(struct hda_codec *codec)
+ {
+ struct via_spec *spec = codec->spec;
+
+- if (!spec->aa_mix_nid || !spec->out_mix_path.depth)
++ if (!spec->aa_mix_nid)
++ return 0; /* no loopback switching available */
++ if (!(spec->out_mix_path.depth || spec->hp_mix_path.depth ||
++ spec->speaker_path.depth))
+ return 0; /* no loopback switching available */
+ if (!via_clone_control(spec, &via_aamix_ctl_enum))
+ return -ENOMEM;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch
new file mode 100644
index 0000000..01e3a6b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch
@@ -0,0 +1,92 @@
+From 53eb674241d25d1496c966cd5f140b0bb213dbdc Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 11 Jan 2012 12:34:11 +0100
+Subject: [PATCH 016/130] ALSA: hda - Fix the lost power-setup of seconary
+ pins after PM resume
+
+commit f2cbba7602383cd9cdd21f0a5d0b8bd1aad47b33 upstream.
+
+When multiple headphone or other detectable output pins are present,
+the power-map has to be updated after resume appropriately, but the
+current driver doesn't check all pins but only the first pin (since
+it's enough to check it for the mute-behavior). This resulted in the
+silent output from the secondary outputs after PM resume.
+
+This patch fixes the problem by checking all pins at (re-)init time.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740347
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ sound/pci/hda/patch_sigmatel.c | 36 +++++++++++++++++++++++-------------
+ 1 files changed, 23 insertions(+), 13 deletions(-)
+
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 616678f..a87b260 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4326,6 +4326,27 @@ static void stac_store_hints(struct hda_codec *codec)
+ }
+ }
+
++static void stac_issue_unsol_events(struct hda_codec *codec, int num_pins,
++ const hda_nid_t *pins)
++{
++ while (num_pins--)
++ stac_issue_unsol_event(codec, *pins++);
++}
++
++/* fake event to set up pins */
++static void stac_fake_hp_events(struct hda_codec *codec)
++{
++ struct sigmatel_spec *spec = codec->spec;
++
++ if (spec->autocfg.hp_outs)
++ stac_issue_unsol_events(codec, spec->autocfg.hp_outs,
++ spec->autocfg.hp_pins);
++ if (spec->autocfg.line_outs &&
++ spec->autocfg.line_out_pins[0] != spec->autocfg.hp_pins[0])
++ stac_issue_unsol_events(codec, spec->autocfg.line_outs,
++ spec->autocfg.line_out_pins);
++}
++
+ static int stac92xx_init(struct hda_codec *codec)
+ {
+ struct sigmatel_spec *spec = codec->spec;
+@@ -4376,10 +4397,7 @@ static int stac92xx_init(struct hda_codec *codec)
+ stac92xx_auto_set_pinctl(codec, spec->autocfg.line_out_pins[0],
+ AC_PINCTL_OUT_EN);
+ /* fake event to set up pins */
+- if (cfg->hp_pins[0])
+- stac_issue_unsol_event(codec, cfg->hp_pins[0]);
+- else if (cfg->line_out_pins[0])
+- stac_issue_unsol_event(codec, cfg->line_out_pins[0]);
++ stac_fake_hp_events(codec);
+ } else {
+ stac92xx_auto_init_multi_out(codec);
+ stac92xx_auto_init_hp_out(codec);
+@@ -5028,19 +5046,11 @@ static void stac927x_proc_hook(struct snd_info_buffer *buffer,
+ #ifdef CONFIG_PM
+ static int stac92xx_resume(struct hda_codec *codec)
+ {
+- struct sigmatel_spec *spec = codec->spec;
+-
+ stac92xx_init(codec);
+ snd_hda_codec_resume_amp(codec);
+ snd_hda_codec_resume_cache(codec);
+ /* fake event to set up pins again to override cached values */
+- if (spec->hp_detect) {
+- if (spec->autocfg.hp_pins[0])
+- stac_issue_unsol_event(codec, spec->autocfg.hp_pins[0]);
+- else if (spec->autocfg.line_out_pins[0])
+- stac_issue_unsol_event(codec,
+- spec->autocfg.line_out_pins[0]);
+- }
++ stac_fake_hp_events(codec);
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch
new file mode 100644
index 0000000..93e7b23
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch
@@ -0,0 +1,43 @@
+From d69882b450293b61af0820e75dc1bfb8823c58bd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Fri, 23 Dec 2011 20:32:18 +0100
+Subject: [PATCH 017/130] drm/radeon/kms: workaround invalid AVI infoframe
+ checksum issue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 92db7f6c860b8190571a9dc1fcbc16d003422fe8 upstream.
+
+This change was verified to fix both issues with no video I've
+investigated. I've also checked checksum calculation with fglrx on:
+RV620, HD54xx, HD5450, HD6310, HD6320.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/gpu/drm/radeon/r600_hdmi.c | 7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
+index f5ac7e7..c45d921 100644
+--- a/drivers/gpu/drm/radeon/r600_hdmi.c
++++ b/drivers/gpu/drm/radeon/r600_hdmi.c
+@@ -196,6 +196,13 @@ static void r600_hdmi_videoinfoframe(
+ frame[0xD] = (right_bar >> 8);
+
+ r600_hdmi_infoframe_checksum(0x82, 0x02, 0x0D, frame);
++ /* Our header values (type, version, length) should be alright, Intel
++ * is using the same. Checksum function also seems to be OK, it works
++ * fine for audio infoframe. However calculated value is always lower
++ * by 2 in comparison to fglrx. It breaks displaying anything in case
++ * of TVs that strictly check the checksum. Hack it manually here to
++ * workaround this issue. */
++ frame[0x0] += 2;
+
+ WREG32(offset+R600_HDMI_VIDEOINFOFRAME_0,
+ frame[0x0] | (frame[0x1] << 8) | (frame[0x2] << 16) | (frame[0x3] << 24));
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch
new file mode 100644
index 0000000..690c3ab
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch
@@ -0,0 +1,40 @@
+From 056276f2509223f4f07a0778f1f1b398fdc8ae87 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 3 Jan 2012 09:48:38 -0500
+Subject: [PATCH 018/130] drm/radeon/kms: disable writeback on pre-R300 asics
+
+commit 28eebb703e28bc455ba704adb1026f76649b768c upstream.
+
+We often end up missing fences on older asics with
+writeback enabled which leads to delays in the userspace
+accel code, so just disable it by default on those asics.
+
+Reported-by: Helge Deller <deller@gmx.de>
+Reported-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index c4d00a1..9b39145 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -224,8 +224,11 @@ int radeon_wb_init(struct radeon_device *rdev)
+ if (radeon_no_wb == 1)
+ rdev->wb.enabled = false;
+ else {
+- /* often unreliable on AGP */
+ if (rdev->flags & RADEON_IS_AGP) {
++ /* often unreliable on AGP */
++ rdev->wb.enabled = false;
++ } else if (rdev->family < CHIP_R300) {
++ /* often unreliable on pre-r300 */
+ rdev->wb.enabled = false;
+ } else {
+ rdev->wb.enabled = true;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch
new file mode 100644
index 0000000..7d85919
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch
@@ -0,0 +1,70 @@
+From a4064a0d9fab7c0a6aa4b6bf170d6ffaed93601a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+Date: Thu, 5 Jan 2012 18:42:17 +0100
+Subject: [PATCH 019/130] radeon: Fix disabling PCI bus mastering on big
+ endian hosts.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 3df96909b75835d487a9178761622b0cbd7310d4 upstream.
+
+It would previously write basically random bits to PCI configuration space...
+Not very surprising that the GPU tended to stop responding completely. The
+resulting MCE even froze the whole machine sometimes.
+
+Now resetting the GPU after a lockup has at least a fighting chance of
+succeeding.
+
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/gpu/drm/radeon/r100.c | 5 +++--
+ drivers/gpu/drm/radeon/rs600.c | 4 ++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
+index bfc08f6..31b0d1a 100644
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -2177,6 +2177,7 @@ bool r100_gpu_is_lockup(struct radeon_device *rdev)
+ void r100_bm_disable(struct radeon_device *rdev)
+ {
+ u32 tmp;
++ u16 tmp16;
+
+ /* disable bus mastering */
+ tmp = RREG32(R_000030_BUS_CNTL);
+@@ -2187,8 +2188,8 @@ void r100_bm_disable(struct radeon_device *rdev)
+ WREG32(R_000030_BUS_CNTL, (tmp & 0xFFFFFFFF) | 0x00000040);
+ tmp = RREG32(RADEON_BUS_CNTL);
+ mdelay(1);
+- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp);
+- pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB);
++ pci_read_config_word(rdev->pdev, 0x4, &tmp16);
++ pci_write_config_word(rdev->pdev, 0x4, tmp16 & 0xFFFB);
+ mdelay(1);
+ }
+
+diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
+index b1053d6..c259e21 100644
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -324,10 +324,10 @@ void rs600_hpd_fini(struct radeon_device *rdev)
+
+ void rs600_bm_disable(struct radeon_device *rdev)
+ {
+- u32 tmp;
++ u16 tmp;
+
+ /* disable bus mastering */
+- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp);
++ pci_read_config_word(rdev->pdev, 0x4, &tmp);
+ pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB);
+ mdelay(1);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch
new file mode 100644
index 0000000..0b1e79b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch
@@ -0,0 +1,50 @@
+From df673b323fa5ef227649ad218343f244261c0611 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh@panasas.com>
+Date: Fri, 6 Jan 2012 09:28:12 +0200
+Subject: [PATCH 020/130] pnfs-obj: pNFS errors are communicated on
+ iodata->pnfs_error
+
+commit 5c0b4129c07b902b27d3f3ebc087757f534a3abd upstream.
+
+Some time along the way pNFS IO errors were switched to
+communicate with a special iodata->pnfs_error member instead
+of the regular RPC members. But objlayout was not switched
+over.
+
+Fix that!
+Without this fix any IO error is hanged, because IO is not
+switched to MDS and pages are never cleared or read.
+
+[Applies to 3.2.0. Same bug different patch for 3.1/0 Kernels]
+Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/nfs/objlayout/objlayout.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/fs/nfs/objlayout/objlayout.c b/fs/nfs/objlayout/objlayout.c
+index 72074e3..b3c2903 100644
+--- a/fs/nfs/objlayout/objlayout.c
++++ b/fs/nfs/objlayout/objlayout.c
+@@ -254,6 +254,8 @@ objlayout_read_done(struct objlayout_io_res *oir, ssize_t status, bool sync)
+ oir->status = rdata->task.tk_status = status;
+ if (status >= 0)
+ rdata->res.count = status;
++ else
++ rdata->pnfs_error = status;
+ objlayout_iodone(oir);
+ /* must not use oir after this point */
+
+@@ -334,6 +336,8 @@ objlayout_write_done(struct objlayout_io_res *oir, ssize_t status, bool sync)
+ if (status >= 0) {
+ wdata->res.count = status;
+ wdata->verf.committed = oir->committed;
++ } else {
++ wdata->pnfs_error = status;
+ }
+ objlayout_iodone(oir);
+ /* must not use oir after this point */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch
new file mode 100644
index 0000000..0b31c54
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch
@@ -0,0 +1,92 @@
+From 9c85d688c42a6feb8f72204730514ae658854828 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh@panasas.com>
+Date: Fri, 6 Jan 2012 09:31:20 +0200
+Subject: [PATCH 021/130] pnfs-obj: Must return layout on IO error
+
+commit fe0fe83585f88346557868a803a479dfaaa0688a upstream.
+
+As mandated by the standard. In case of an IO error, a pNFS
+objects layout driver must return it's layout. This is because
+all device errors are reported to the server as part of the
+layout return buffer.
+
+This is implemented the same way PNFS_LAYOUTRET_ON_SETATTR
+is done, through a bit flag on the pnfs_layoutdriver_type->flags
+member. The flag is set by the layout driver that wants a
+layout_return preformed at pnfs_ld_{write,read}_done in case
+of an error.
+(Though I have not defined a wrapper like pnfs_ld_layoutret_on_setattr
+ because this code is never called outside of pnfs.c and pnfs IO
+ paths)
+
+Without this patch 3.[0-2] Kernels leak memory and have an annoying
+WARN_ON after every IO error utilizing the pnfs-obj driver.
+
+Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/nfs/objlayout/objio_osd.c | 3 ++-
+ fs/nfs/pnfs.c | 12 ++++++++++++
+ fs/nfs/pnfs.h | 1 +
+ 3 files changed, 15 insertions(+), 1 deletions(-)
+
+diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
+index c807ab9..55d0128 100644
+--- a/fs/nfs/objlayout/objio_osd.c
++++ b/fs/nfs/objlayout/objio_osd.c
+@@ -551,7 +551,8 @@ static const struct nfs_pageio_ops objio_pg_write_ops = {
+ static struct pnfs_layoutdriver_type objlayout_type = {
+ .id = LAYOUT_OSD2_OBJECTS,
+ .name = "LAYOUT_OSD2_OBJECTS",
+- .flags = PNFS_LAYOUTRET_ON_SETATTR,
++ .flags = PNFS_LAYOUTRET_ON_SETATTR |
++ PNFS_LAYOUTRET_ON_ERROR,
+
+ .alloc_layout_hdr = objlayout_alloc_layout_hdr,
+ .free_layout_hdr = objlayout_free_layout_hdr,
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 8e672a2..f881a63 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1178,6 +1178,15 @@ void pnfs_ld_write_done(struct nfs_write_data *data)
+ put_lseg(data->lseg);
+ data->lseg = NULL;
+ dprintk("pnfs write error = %d\n", data->pnfs_error);
++ if (NFS_SERVER(data->inode)->pnfs_curr_ld->flags &
++ PNFS_LAYOUTRET_ON_ERROR) {
++ /* Don't lo_commit on error, Server will needs to
++ * preform a file recovery.
++ */
++ clear_bit(NFS_INO_LAYOUTCOMMIT,
++ &NFS_I(data->inode)->flags);
++ pnfs_return_layout(data->inode);
++ }
+ }
+ data->mds_ops->rpc_release(data);
+ }
+@@ -1267,6 +1276,9 @@ static void pnfs_ld_handle_read_error(struct nfs_read_data *data)
+ put_lseg(data->lseg);
+ data->lseg = NULL;
+ dprintk("pnfs write error = %d\n", data->pnfs_error);
++ if (NFS_SERVER(data->inode)->pnfs_curr_ld->flags &
++ PNFS_LAYOUTRET_ON_ERROR)
++ pnfs_return_layout(data->inode);
+
+ nfs_pageio_init_read_mds(&pgio, data->inode);
+
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index 1509530..53d593a 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -68,6 +68,7 @@ enum {
+ enum layoutdriver_policy_flags {
+ /* Should the pNFS client commit and return the layout upon a setattr */
+ PNFS_LAYOUTRET_ON_SETATTR = 1 << 0,
++ PNFS_LAYOUTRET_ON_ERROR = 1 << 1,
+ };
+
+ struct nfs4_deviceid_node;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch
new file mode 100644
index 0000000..8c4acc6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch
@@ -0,0 +1,94 @@
+From 1ef216baa398a27c95a9de67f36805cbeea81fe6 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Mon, 5 Dec 2011 15:40:30 -0500
+Subject: [PATCH 022/130] NFS: Retry mounting NFSROOT
+
+commit 43717c7daebf10b43f12e68512484b3095bb1ba5 upstream.
+
+Lukas Razik <linux@razik.name> reports that on his SPARC system,
+booting with an NFS root file system stopped working after commit
+56463e50 "NFS: Use super.c for NFSROOT mount option parsing."
+
+We found that the network switch to which Lukas' client was attached
+was delaying access to the LAN after the client's NIC driver reported
+that its link was up. The delay was longer than the timeouts used in
+the NFS client during mounting.
+
+NFSROOT worked for Lukas before commit 56463e50 because in those
+kernels, the client's first operation was an rpcbind request to
+determine which port the NFS server was listening on. When that
+request failed after a long timeout, the client simply selected the
+default NFS port (2049). By that time the switch was allowing access
+to the LAN, and the mount succeeded.
+
+Neither of these client behaviors is desirable, so reverting 56463e50
+is really not a choice. Instead, introduce a mechanism that retries
+the NFSROOT mount request several times. This is the same tactic that
+normal user space NFS mounts employ to overcome server and network
+delays.
+
+Signed-off-by: Lukas Razik <linux@razik.name>
+[ cel: match kernel coding style, add proper patch description ]
+[ cel: add exponential back-off ]
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Tested-by: Lukas Razik <linux@razik.name>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ init/do_mounts.c | 35 +++++++++++++++++++++++++++++++----
+ 1 files changed, 31 insertions(+), 4 deletions(-)
+
+diff --git a/init/do_mounts.c b/init/do_mounts.c
+index 0f6e1d9..db6e5ee 100644
+--- a/init/do_mounts.c
++++ b/init/do_mounts.c
+@@ -398,15 +398,42 @@ out:
+ }
+
+ #ifdef CONFIG_ROOT_NFS
++
++#define NFSROOT_TIMEOUT_MIN 5
++#define NFSROOT_TIMEOUT_MAX 30
++#define NFSROOT_RETRY_MAX 5
++
+ static int __init mount_nfs_root(void)
+ {
+ char *root_dev, *root_data;
++ unsigned int timeout;
++ int try, err;
+
+- if (nfs_root_data(&root_dev, &root_data) != 0)
+- return 0;
+- if (do_mount_root(root_dev, "nfs", root_mountflags, root_data) != 0)
++ err = nfs_root_data(&root_dev, &root_data);
++ if (err != 0)
+ return 0;
+- return 1;
++
++ /*
++ * The server or network may not be ready, so try several
++ * times. Stop after a few tries in case the client wants
++ * to fall back to other boot methods.
++ */
++ timeout = NFSROOT_TIMEOUT_MIN;
++ for (try = 1; ; try++) {
++ err = do_mount_root(root_dev, "nfs",
++ root_mountflags, root_data);
++ if (err == 0)
++ return 1;
++ if (try > NFSROOT_RETRY_MAX)
++ break;
++
++ /* Wait, in case the server refused us immediately */
++ ssleep(timeout);
++ timeout <<= 1;
++ if (timeout > NFSROOT_TIMEOUT_MAX)
++ timeout = NFSROOT_TIMEOUT_MAX;
++ }
++ return 0;
+ }
+ #endif
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch
new file mode 100644
index 0000000..62c5b45
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch
@@ -0,0 +1,30 @@
+From a4d5a638ff204626f6244b3a316cf8f01ef3e2fa Mon Sep 17 00:00:00 2001
+From: Andy Adamson <andros@netapp.com>
+Date: Wed, 9 Nov 2011 13:58:20 -0500
+Subject: [PATCH 023/130] NFSv4.1: fix backchannel slotid off-by-one bug
+
+commit 61f2e5106582d02f30b6807e3f9c07463c572ccb upstream.
+
+Signed-off-by: Andy Adamson <andros@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/nfs/callback_proc.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index 43926ad..54cea8a 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -339,7 +339,7 @@ validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
+ dprintk("%s enter. slotid %d seqid %d\n",
+ __func__, args->csa_slotid, args->csa_sequenceid);
+
+- if (args->csa_slotid > NFS41_BC_MAX_CALLBACKS)
++ if (args->csa_slotid >= NFS41_BC_MAX_CALLBACKS)
+ return htonl(NFS4ERR_BADSLOT);
+
+ slot = tbl->slots + args->csa_slotid;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch
new file mode 100644
index 0000000..7f82511
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch
@@ -0,0 +1,60 @@
+From 876118d108ac910a4b4b4384b6d827ef9eb599bb Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Wed, 16 Nov 2011 11:46:31 +1100
+Subject: [PATCH 024/130] NFS - fix recent breakage to NFS error handling.
+
+commit 2edb6bc3852c681c0d948245bd55108dc6407604 upstream.
+
+ From c6d615d2b97fe305cbf123a8751ced859dca1d5e Mon Sep 17 00:00:00 2001
+ From: NeilBrown <neilb@suse.de>
+ Date: Wed, 16 Nov 2011 09:39:05 +1100
+ Subject: NFS - fix recent breakage to NFS error handling.
+
+commit 02c24a82187d5a628c68edfe71ae60dc135cd178 made a small and
+presumably unintended change to write error handling in NFS.
+
+Previously an error from filemap_write_and_wait_range would only be of
+interest if nfs_file_fsync did not return an error. After this commit,
+an error from filemap_write_and_wait_range would mean that (the rest of)
+nfs_file_fsync would not even be called.
+
+This means that:
+ 1/ you are more likely to see EIO than e.g. EDQUOT or ENOSPC.
+ 2/ NFS_CONTEXT_ERROR_WRITE remains set for longer so more writes are
+ synchronous.
+
+This patch restores previous behaviour.
+
+Cc: Josef Bacik <josef@redhat.com>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/nfs/file.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index 606ef0f..c43a452 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -272,13 +272,13 @@ nfs_file_fsync(struct file *file, loff_t start, loff_t end, int datasync)
+ datasync);
+
+ ret = filemap_write_and_wait_range(inode->i_mapping, start, end);
+- if (ret)
+- return ret;
+ mutex_lock(&inode->i_mutex);
+
+ nfs_inc_stats(inode, NFSIOS_VFSFSYNC);
+ have_error = test_and_clear_bit(NFS_CONTEXT_ERROR_WRITE, &ctx->flags);
+ status = nfs_commit_inode(inode, FLUSH_SYNC);
++ if (status >= 0 && ret < 0)
++ status = ret;
+ have_error |= test_bit(NFS_CONTEXT_ERROR_WRITE, &ctx->flags);
+ if (have_error)
+ ret = xchg(&ctx->error, 0);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch
new file mode 100644
index 0000000..383a8f1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch
@@ -0,0 +1,313 @@
+From ea3a3ed18130c4a0fe0dbdd3f7dabc59a67c5064 Mon Sep 17 00:00:00 2001
+From: Andy Adamson <andros@netapp.com>
+Date: Wed, 7 Dec 2011 11:55:27 -0500
+Subject: [PATCH 025/130] NFSv4: include bitmap in nfsv4 get acl data
+
+commit bf118a342f10dafe44b14451a1392c3254629a1f upstream.
+
+The NFSv4 bitmap size is unbounded: a server can return an arbitrary
+sized bitmap in an FATTR4_WORD0_ACL request. Replace using the
+nfs4_fattr_bitmap_maxsz as a guess to the maximum bitmask returned by a server
+with the inclusion of the bitmap (xdr length plus bitmasks) and the acl data
+xdr length to the (cached) acl page data.
+
+This is a general solution to commit e5012d1f "NFSv4.1: update
+nfs4_fattr_bitmap_maxsz" and fixes hitting a BUG_ON in xdr_shrink_bufhead
+when getting ACLs.
+
+Fix a bug in decode_getacl that returned -EINVAL on ACLs > page when getxattr
+was called with a NULL buffer, preventing ACL > PAGE_SIZE from being retrieved.
+
+Signed-off-by: Andy Adamson <andros@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/nfs/nfs4proc.c | 96 ++++++++++++++++++++++++++------------------
+ fs/nfs/nfs4xdr.c | 31 ++++++++++----
+ include/linux/nfs_xdr.h | 5 ++
+ include/linux/sunrpc/xdr.h | 2 +
+ net/sunrpc/xdr.c | 3 +-
+ 5 files changed, 89 insertions(+), 48 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index d9f4d78..055d702 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3430,19 +3430,6 @@ static inline int nfs4_server_supports_acls(struct nfs_server *server)
+ */
+ #define NFS4ACL_MAXPAGES (XATTR_SIZE_MAX >> PAGE_CACHE_SHIFT)
+
+-static void buf_to_pages(const void *buf, size_t buflen,
+- struct page **pages, unsigned int *pgbase)
+-{
+- const void *p = buf;
+-
+- *pgbase = offset_in_page(buf);
+- p -= *pgbase;
+- while (p < buf + buflen) {
+- *(pages++) = virt_to_page(p);
+- p += PAGE_CACHE_SIZE;
+- }
+-}
+-
+ static int buf_to_pages_noslab(const void *buf, size_t buflen,
+ struct page **pages, unsigned int *pgbase)
+ {
+@@ -3539,9 +3526,19 @@ out:
+ nfs4_set_cached_acl(inode, acl);
+ }
+
++/*
++ * The getxattr API returns the required buffer length when called with a
++ * NULL buf. The NFSv4 acl tool then calls getxattr again after allocating
++ * the required buf. On a NULL buf, we send a page of data to the server
++ * guessing that the ACL request can be serviced by a page. If so, we cache
++ * up to the page of ACL data, and the 2nd call to getxattr is serviced by
++ * the cache. If not so, we throw away the page, and cache the required
++ * length. The next getxattr call will then produce another round trip to
++ * the server, this time with the input buf of the required size.
++ */
+ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
+ {
+- struct page *pages[NFS4ACL_MAXPAGES];
++ struct page *pages[NFS4ACL_MAXPAGES] = {NULL, };
+ struct nfs_getaclargs args = {
+ .fh = NFS_FH(inode),
+ .acl_pages = pages,
+@@ -3556,41 +3553,60 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
+ .rpc_argp = &args,
+ .rpc_resp = &res,
+ };
+- struct page *localpage = NULL;
+- int ret;
++ int ret = -ENOMEM, npages, i, acl_len = 0;
+
+- if (buflen < PAGE_SIZE) {
+- /* As long as we're doing a round trip to the server anyway,
+- * let's be prepared for a page of acl data. */
+- localpage = alloc_page(GFP_KERNEL);
+- resp_buf = page_address(localpage);
+- if (localpage == NULL)
+- return -ENOMEM;
+- args.acl_pages[0] = localpage;
+- args.acl_pgbase = 0;
+- args.acl_len = PAGE_SIZE;
+- } else {
+- resp_buf = buf;
+- buf_to_pages(buf, buflen, args.acl_pages, &args.acl_pgbase);
++ npages = (buflen + PAGE_SIZE - 1) >> PAGE_SHIFT;
++ /* As long as we're doing a round trip to the server anyway,
++ * let's be prepared for a page of acl data. */
++ if (npages == 0)
++ npages = 1;
++
++ for (i = 0; i < npages; i++) {
++ pages[i] = alloc_page(GFP_KERNEL);
++ if (!pages[i])
++ goto out_free;
++ }
++ if (npages > 1) {
++ /* for decoding across pages */
++ args.acl_scratch = alloc_page(GFP_KERNEL);
++ if (!args.acl_scratch)
++ goto out_free;
+ }
+- ret = nfs4_call_sync(NFS_SERVER(inode)->client, NFS_SERVER(inode), &msg, &args.seq_args, &res.seq_res, 0);
++ args.acl_len = npages * PAGE_SIZE;
++ args.acl_pgbase = 0;
++ /* Let decode_getfacl know not to fail if the ACL data is larger than
++ * the page we send as a guess */
++ if (buf == NULL)
++ res.acl_flags |= NFS4_ACL_LEN_REQUEST;
++ resp_buf = page_address(pages[0]);
++
++ dprintk("%s buf %p buflen %ld npages %d args.acl_len %ld\n",
++ __func__, buf, buflen, npages, args.acl_len);
++ ret = nfs4_call_sync(NFS_SERVER(inode)->client, NFS_SERVER(inode),
++ &msg, &args.seq_args, &res.seq_res, 0);
+ if (ret)
+ goto out_free;
+- if (res.acl_len > args.acl_len)
+- nfs4_write_cached_acl(inode, NULL, res.acl_len);
++
++ acl_len = res.acl_len - res.acl_data_offset;
++ if (acl_len > args.acl_len)
++ nfs4_write_cached_acl(inode, NULL, acl_len);
+ else
+- nfs4_write_cached_acl(inode, resp_buf, res.acl_len);
++ nfs4_write_cached_acl(inode, resp_buf + res.acl_data_offset,
++ acl_len);
+ if (buf) {
+ ret = -ERANGE;
+- if (res.acl_len > buflen)
++ if (acl_len > buflen)
+ goto out_free;
+- if (localpage)
+- memcpy(buf, resp_buf, res.acl_len);
++ _copy_from_pages(buf, pages, res.acl_data_offset,
++ res.acl_len);
+ }
+- ret = res.acl_len;
++ ret = acl_len;
+ out_free:
+- if (localpage)
+- __free_page(localpage);
++ for (i = 0; i < npages; i++)
++ if (pages[i])
++ __free_page(pages[i]);
++ if (args.acl_scratch)
++ __free_page(args.acl_scratch);
+ return ret;
+ }
+
+@@ -3621,6 +3637,8 @@ static ssize_t nfs4_proc_get_acl(struct inode *inode, void *buf, size_t buflen)
+ nfs_zap_acl_cache(inode);
+ ret = nfs4_read_cached_acl(inode, buf, buflen);
+ if (ret != -ENOENT)
++ /* -ENOENT is returned if there is no ACL or if there is an ACL
++ * but no cached acl data, just the acl length */
+ return ret;
+ return nfs4_get_acl_uncached(inode, buf, buflen);
+ }
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index e6161b2..dcaf693 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -2517,11 +2517,13 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr,
+ encode_compound_hdr(xdr, req, &hdr);
+ encode_sequence(xdr, &args->seq_args, &hdr);
+ encode_putfh(xdr, args->fh, &hdr);
+- replen = hdr.replen + op_decode_hdr_maxsz + nfs4_fattr_bitmap_maxsz + 1;
++ replen = hdr.replen + op_decode_hdr_maxsz + 1;
+ encode_getattr_two(xdr, FATTR4_WORD0_ACL, 0, &hdr);
+
+ xdr_inline_pages(&req->rq_rcv_buf, replen << 2,
+ args->acl_pages, args->acl_pgbase, args->acl_len);
++ xdr_set_scratch_buffer(xdr, page_address(args->acl_scratch), PAGE_SIZE);
++
+ encode_nops(&hdr);
+ }
+
+@@ -4957,17 +4959,18 @@ decode_restorefh(struct xdr_stream *xdr)
+ }
+
+ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
+- size_t *acl_len)
++ struct nfs_getaclres *res)
+ {
+- __be32 *savep;
++ __be32 *savep, *bm_p;
+ uint32_t attrlen,
+ bitmap[3] = {0};
+ struct kvec *iov = req->rq_rcv_buf.head;
+ int status;
+
+- *acl_len = 0;
++ res->acl_len = 0;
+ if ((status = decode_op_hdr(xdr, OP_GETATTR)) != 0)
+ goto out;
++ bm_p = xdr->p;
+ if ((status = decode_attr_bitmap(xdr, bitmap)) != 0)
+ goto out;
+ if ((status = decode_attr_length(xdr, &attrlen, &savep)) != 0)
+@@ -4979,18 +4982,30 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
+ size_t hdrlen;
+ u32 recvd;
+
++ /* The bitmap (xdr len + bitmaps) and the attr xdr len words
++ * are stored with the acl data to handle the problem of
++ * variable length bitmaps.*/
++ xdr->p = bm_p;
++ res->acl_data_offset = be32_to_cpup(bm_p) + 2;
++ res->acl_data_offset <<= 2;
++
+ /* We ignore &savep and don't do consistency checks on
+ * the attr length. Let userspace figure it out.... */
+ hdrlen = (u8 *)xdr->p - (u8 *)iov->iov_base;
++ attrlen += res->acl_data_offset;
+ recvd = req->rq_rcv_buf.len - hdrlen;
+ if (attrlen > recvd) {
+- dprintk("NFS: server cheating in getattr"
+- " acl reply: attrlen %u > recvd %u\n",
++ if (res->acl_flags & NFS4_ACL_LEN_REQUEST) {
++ /* getxattr interface called with a NULL buf */
++ res->acl_len = attrlen;
++ goto out;
++ }
++ dprintk("NFS: acl reply: attrlen %u > recvd %u\n",
+ attrlen, recvd);
+ return -EINVAL;
+ }
+ xdr_read_pages(xdr, attrlen);
+- *acl_len = attrlen;
++ res->acl_len = attrlen;
+ } else
+ status = -EOPNOTSUPP;
+
+@@ -6028,7 +6043,7 @@ nfs4_xdr_dec_getacl(struct rpc_rqst *rqstp, struct xdr_stream *xdr,
+ status = decode_putfh(xdr);
+ if (status)
+ goto out;
+- status = decode_getacl(xdr, rqstp, &res->acl_len);
++ status = decode_getacl(xdr, rqstp, res);
+
+ out:
+ return status;
+diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
+index 2a7c533..6c898af 100644
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -602,11 +602,16 @@ struct nfs_getaclargs {
+ size_t acl_len;
+ unsigned int acl_pgbase;
+ struct page ** acl_pages;
++ struct page * acl_scratch;
+ struct nfs4_sequence_args seq_args;
+ };
+
++/* getxattr ACL interface flags */
++#define NFS4_ACL_LEN_REQUEST 0x0001 /* zero length getxattr buffer */
+ struct nfs_getaclres {
+ size_t acl_len;
++ size_t acl_data_offset;
++ int acl_flags;
+ struct nfs4_sequence_res seq_res;
+ };
+
+diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
+index a20970e..af70af3 100644
+--- a/include/linux/sunrpc/xdr.h
++++ b/include/linux/sunrpc/xdr.h
+@@ -191,6 +191,8 @@ extern int xdr_decode_array2(struct xdr_buf *buf, unsigned int base,
+ struct xdr_array2_desc *desc);
+ extern int xdr_encode_array2(struct xdr_buf *buf, unsigned int base,
+ struct xdr_array2_desc *desc);
++extern void _copy_from_pages(char *p, struct page **pages, size_t pgbase,
++ size_t len);
+
+ /*
+ * Provide some simple tools for XDR buffer overflow-checking etc.
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 277ebd4..593f4c6 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -296,7 +296,7 @@ _copy_to_pages(struct page **pages, size_t pgbase, const char *p, size_t len)
+ * Copies data into an arbitrary memory location from an array of pages
+ * The copy is assumed to be non-overlapping.
+ */
+-static void
++void
+ _copy_from_pages(char *p, struct page **pages, size_t pgbase, size_t len)
+ {
+ struct page **pgfrom;
+@@ -324,6 +324,7 @@ _copy_from_pages(char *p, struct page **pages, size_t pgbase, size_t len)
+
+ } while ((len -= copy) != 0);
+ }
++EXPORT_SYMBOL_GPL(_copy_from_pages);
+
+ /*
+ * xdr_shrink_bufhead
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch
new file mode 100644
index 0000000..02f9fe1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch
@@ -0,0 +1,147 @@
+From e7d23a1c02013b27699c8d993ef0ceb6e3110955 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 20 Dec 2011 06:57:45 -0500
+Subject: [PATCH 026/130] nfs: fix regression in handling of context= option
+ in NFSv4
+
+commit 8a0d551a59ac92d8ff048d6cb29d3a02073e81e8 upstream.
+
+Setting the security context of a NFSv4 mount via the context= mount
+option is currently broken. The NFSv4 codepath allocates a parsed
+options struct, and then parses the mount options to fill it. It
+eventually calls nfs4_remote_mount which calls security_init_mnt_opts.
+That clobbers the lsm_opts struct that was populated earlier. This bug
+also looks like it causes a small memory leak on each v4 mount where
+context= is used.
+
+Fix this by moving the initialization of the lsm_opts into
+nfs_alloc_parsed_mount_data. Also, add a destructor for
+nfs_parsed_mount_data to make it easier to free all of the allocations
+hanging off of it, and to ensure that the security_free_mnt_opts is
+called whenever security_init_mnt_opts is.
+
+I believe this regression was introduced quite some time ago, probably
+by commit c02d7adf.
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/nfs/super.c | 43 +++++++++++++++++++------------------------
+ 1 files changed, 19 insertions(+), 24 deletions(-)
+
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 1347774..3ada13c 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -909,10 +909,24 @@ static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(unsigned int ve
+ data->auth_flavor_len = 1;
+ data->version = version;
+ data->minorversion = 0;
++ security_init_mnt_opts(&data->lsm_opts);
+ }
+ return data;
+ }
+
++static void nfs_free_parsed_mount_data(struct nfs_parsed_mount_data *data)
++{
++ if (data) {
++ kfree(data->client_address);
++ kfree(data->mount_server.hostname);
++ kfree(data->nfs_server.export_path);
++ kfree(data->nfs_server.hostname);
++ kfree(data->fscache_uniq);
++ security_free_mnt_opts(&data->lsm_opts);
++ kfree(data);
++ }
++}
++
+ /*
+ * Sanity-check a server address provided by the mount command.
+ *
+@@ -2220,9 +2234,7 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
+ data = nfs_alloc_parsed_mount_data(NFS_DEFAULT_VERSION);
+ mntfh = nfs_alloc_fhandle();
+ if (data == NULL || mntfh == NULL)
+- goto out_free_fh;
+-
+- security_init_mnt_opts(&data->lsm_opts);
++ goto out;
+
+ /* Validate the mount data */
+ error = nfs_validate_mount_data(raw_data, data, mntfh, dev_name);
+@@ -2234,8 +2246,6 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
+ #ifdef CONFIG_NFS_V4
+ if (data->version == 4) {
+ mntroot = nfs4_try_mount(flags, dev_name, data);
+- kfree(data->client_address);
+- kfree(data->nfs_server.export_path);
+ goto out;
+ }
+ #endif /* CONFIG_NFS_V4 */
+@@ -2290,13 +2300,8 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
+ s->s_flags |= MS_ACTIVE;
+
+ out:
+- kfree(data->nfs_server.hostname);
+- kfree(data->mount_server.hostname);
+- kfree(data->fscache_uniq);
+- security_free_mnt_opts(&data->lsm_opts);
+-out_free_fh:
++ nfs_free_parsed_mount_data(data);
+ nfs_free_fhandle(mntfh);
+- kfree(data);
+ return mntroot;
+
+ out_err_nosb:
+@@ -2623,9 +2628,7 @@ nfs4_remote_mount(struct file_system_type *fs_type, int flags,
+
+ mntfh = nfs_alloc_fhandle();
+ if (data == NULL || mntfh == NULL)
+- goto out_free_fh;
+-
+- security_init_mnt_opts(&data->lsm_opts);
++ goto out;
+
+ /* Get a volume representation */
+ server = nfs4_create_server(data, mntfh);
+@@ -2677,13 +2680,10 @@ nfs4_remote_mount(struct file_system_type *fs_type, int flags,
+
+ s->s_flags |= MS_ACTIVE;
+
+- security_free_mnt_opts(&data->lsm_opts);
+ nfs_free_fhandle(mntfh);
+ return mntroot;
+
+ out:
+- security_free_mnt_opts(&data->lsm_opts);
+-out_free_fh:
+ nfs_free_fhandle(mntfh);
+ return ERR_PTR(error);
+
+@@ -2838,7 +2838,7 @@ static struct dentry *nfs4_mount(struct file_system_type *fs_type,
+
+ data = nfs_alloc_parsed_mount_data(4);
+ if (data == NULL)
+- goto out_free_data;
++ goto out;
+
+ /* Validate the mount data */
+ error = nfs4_validate_mount_data(raw_data, data, dev_name);
+@@ -2852,12 +2852,7 @@ static struct dentry *nfs4_mount(struct file_system_type *fs_type,
+ error = PTR_ERR(res);
+
+ out:
+- kfree(data->client_address);
+- kfree(data->nfs_server.export_path);
+- kfree(data->nfs_server.hostname);
+- kfree(data->fscache_uniq);
+-out_free_data:
+- kfree(data);
++ nfs_free_parsed_mount_data(data);
+ dprintk("<-- nfs4_mount() = %d%s\n", error,
+ error != 0 ? " [error]" : "");
+ return res;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch
new file mode 100644
index 0000000..86e599f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch
@@ -0,0 +1,35 @@
+From 1d30ef7aee8f11c3f90038ba7d57a82e0acbadb5 Mon Sep 17 00:00:00 2001
+From: Chase Douglas <chase.douglas@canonical.com>
+Date: Mon, 7 Nov 2011 11:08:05 -0800
+Subject: [PATCH 027/130] HID: bump maximum global item tag report size to 96
+ bytes
+
+commit e46e927b9b7e8d95526e69322855243882b7e1a3 upstream.
+
+This allows the latest N-Trig devices to function properly.
+
+BugLink: https://bugs.launchpad.net/bugs/724831
+
+Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hid/hid-core.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index af35384..1473067 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -362,7 +362,7 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
+
+ case HID_GLOBAL_ITEM_TAG_REPORT_SIZE:
+ parser->global.report_size = item_udata(item);
+- if (parser->global.report_size > 32) {
++ if (parser->global.report_size > 96) {
+ dbg_hid("invalid report_size %d\n",
+ parser->global.report_size);
+ return -1;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch
new file mode 100644
index 0000000..c2132bd
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch
@@ -0,0 +1,33 @@
+From f60dd210e7edd913a760ca4c4f9df2c6341f5ef8 Mon Sep 17 00:00:00 2001
+From: David Herrmann <dh.herrmann@googlemail.com>
+Date: Wed, 7 Dec 2011 21:33:59 +0100
+Subject: [PATCH 028/130] HID: wiimote: Select INPUT_FF_MEMLESS
+
+commit ef6f41157f3864d9bf42671b2ed66062dcafb72e upstream.
+
+We depend on memless force-feedback support, therefore correctly select the
+related config options.
+
+Reported-by: Randy Dunlap <rdunlap@xenotime.net>
+Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hid/Kconfig | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 22a4a05..332c22a 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -620,6 +620,7 @@ config HID_WIIMOTE
+ depends on BT_HIDP
+ depends on LEDS_CLASS
+ select POWER_SUPPLY
++ select INPUT_FF_MEMLESS
+ ---help---
+ Support for the Nintendo Wii Remote bluetooth device.
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch
new file mode 100644
index 0000000..b6b6bd3
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch
@@ -0,0 +1,81 @@
+From e20542f497522671fa121d7612442a2557bfa2ff Mon Sep 17 00:00:00 2001
+From: Bhavesh Parekh <bparekh@nvidia.com>
+Date: Wed, 30 Nov 2011 17:43:42 +0530
+Subject: [PATCH 029/130] UBI: fix missing scrub when there is a bit-flip
+
+commit e801e128b2200c40a0ec236cf2330b2586b6e05a upstream.
+
+Under some cases, when scrubbing the PEB if we did not get the lock on
+the PEB it fails to scrub. Add that PEB again to the scrub list
+
+Artem: minor amendments.
+
+Signed-off-by: Bhavesh Parekh <bparekh@nvidia.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/mtd/ubi/eba.c | 6 ++++--
+ drivers/mtd/ubi/ubi.h | 2 ++
+ drivers/mtd/ubi/wl.c | 5 ++++-
+ 3 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index fb7f19b..cd26da8 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -1028,12 +1028,14 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
+ * 'ubi_wl_put_peb()' function on the @ubi->move_mutex. In turn, we are
+ * holding @ubi->move_mutex and go sleep on the LEB lock. So, if the
+ * LEB is already locked, we just do not move it and return
+- * %MOVE_CANCEL_RACE, which means that UBI will re-try, but later.
++ * %MOVE_RETRY. Note, we do not return %MOVE_CANCEL_RACE here because
++ * we do not know the reasons of the contention - it may be just a
++ * normal I/O on this LEB, so we want to re-try.
+ */
+ err = leb_write_trylock(ubi, vol_id, lnum);
+ if (err) {
+ dbg_wl("contention on LEB %d:%d, cancel", vol_id, lnum);
+- return MOVE_CANCEL_RACE;
++ return MOVE_RETRY;
+ }
+
+ /*
+diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
+index dc64c76..d51d75d 100644
+--- a/drivers/mtd/ubi/ubi.h
++++ b/drivers/mtd/ubi/ubi.h
+@@ -120,6 +120,7 @@ enum {
+ * PEB
+ * MOVE_CANCEL_BITFLIPS: canceled because a bit-flip was detected in the
+ * target PEB
++ * MOVE_RETRY: retry scrubbing the PEB
+ */
+ enum {
+ MOVE_CANCEL_RACE = 1,
+@@ -127,6 +128,7 @@ enum {
+ MOVE_TARGET_RD_ERR,
+ MOVE_TARGET_WR_ERR,
+ MOVE_CANCEL_BITFLIPS,
++ MOVE_RETRY,
+ };
+
+ /**
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 42c684c..277c429 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -795,7 +795,10 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ protect = 1;
+ goto out_not_moved;
+ }
+-
++ if (err == MOVE_RETRY) {
++ scrubbing = 1;
++ goto out_not_moved;
++ }
+ if (err == MOVE_CANCEL_BITFLIPS || err == MOVE_TARGET_WR_ERR ||
+ err == MOVE_TARGET_RD_ERR) {
+ /*
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch
new file mode 100644
index 0000000..223b41a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch
@@ -0,0 +1,52 @@
+From e9089302a9d795113e8efe652fe30331d75d1fd8 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Thu, 5 Jan 2012 10:47:18 +0200
+Subject: [PATCH 030/130] UBI: fix use-after-free on error path
+
+commit e57e0d8e818512047fe379157c3f77f1b9fabffb upstream.
+
+When we fail to erase a PEB, we free the corresponding erase entry object,
+but then re-schedule this object if the error code was something like -EAGAIN.
+Obviously, it is a bug to use the object after we have freed it.
+
+Reported-by: Emese Revfy <re.emese@gmail.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/mtd/ubi/wl.c | 7 ++++---
+ 1 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 277c429..0696e36 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1052,7 +1052,6 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
+
+ ubi_err("failed to erase PEB %d, error %d", pnum, err);
+ kfree(wl_wrk);
+- kmem_cache_free(ubi_wl_entry_slab, e);
+
+ if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
+ err == -EBUSY) {
+@@ -1065,14 +1064,16 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
+ goto out_ro;
+ }
+ return err;
+- } else if (err != -EIO) {
++ }
++
++ kmem_cache_free(ubi_wl_entry_slab, e);
++ if (err != -EIO)
+ /*
+ * If this is not %-EIO, we have no idea what to do. Scheduling
+ * this physical eraseblock for erasure again would cause
+ * errors again and again. Well, lets switch to R/O mode.
+ */
+ goto out_ro;
+- }
+
+ /* It is %-EIO, the PEB went bad */
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch
new file mode 100644
index 0000000..c7947be
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch
@@ -0,0 +1,32 @@
+From 9d9e1e743ab7ca6f40a0f6f60f5ebda2a6b8b07b Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Wed, 16 Nov 2011 09:24:16 -0700
+Subject: [PATCH 031/130] PCI: Fix PCI_EXP_TYPE_RC_EC value
+
+commit 1830ea91c20b06608f7cdb2455ce05ba834b3214 upstream.
+
+Spec shows this as 1010b = 0xa
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/linux/pci_regs.h | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/include/linux/pci_regs.h b/include/linux/pci_regs.h
+index b5d9657..411c412 100644
+--- a/include/linux/pci_regs.h
++++ b/include/linux/pci_regs.h
+@@ -392,7 +392,7 @@
+ #define PCI_EXP_TYPE_DOWNSTREAM 0x6 /* Downstream Port */
+ #define PCI_EXP_TYPE_PCI_BRIDGE 0x7 /* PCI/PCI-X Bridge */
+ #define PCI_EXP_TYPE_RC_END 0x9 /* Root Complex Integrated Endpoint */
+-#define PCI_EXP_TYPE_RC_EC 0x10 /* Root Complex Event Collector */
++#define PCI_EXP_TYPE_RC_EC 0xa /* Root Complex Event Collector */
+ #define PCI_EXP_FLAGS_SLOT 0x0100 /* Slot implemented */
+ #define PCI_EXP_FLAGS_IRQ 0x3e00 /* Interrupt message number */
+ #define PCI_EXP_DEVCAP 4 /* Device capabilities */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch
new file mode 100644
index 0000000..f8c36b7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch
@@ -0,0 +1,53 @@
+From 63365de9ebb1b944d0306668f726ad62a08a0371 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Mon, 17 Oct 2011 11:46:06 -0700
+Subject: [PATCH 032/130] PCI: msi: Disable msi interrupts when we initialize
+ a pci device
+
+commit a776c491ca5e38c26d9f66923ff574d041e747f4 upstream.
+
+I traced a nasty kexec on panic boot failure to the fact that we had
+screaming msi interrupts and we were not disabling the msi messages at
+kernel startup. The booting kernel had not enabled those interupts so
+was not prepared to handle them.
+
+I can see no reason why we would ever want to leave the msi interrupts
+enabled at boot if something else has enabled those interrupts. The pci
+spec specifies that msi interrupts should be off by default. Drivers
+are expected to enable the msi interrupts if they want to use them. Our
+interrupt handling code reprograms the interrupt handlers at boot and
+will not be be able to do anything useful with an unexpected interrupt.
+
+This patch applies cleanly all of the way back to 2.6.32 where I noticed
+the problem.
+
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/pci/msi.c | 10 ++++++++++
+ 1 files changed, 10 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index 0e6d04d..e3efb43 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -870,5 +870,15 @@ EXPORT_SYMBOL(pci_msi_enabled);
+
+ void pci_msi_init_pci_dev(struct pci_dev *dev)
+ {
++ int pos;
+ INIT_LIST_HEAD(&dev->msi_list);
++
++ /* Disable the msi hardware to avoid screaming interrupts
++ * during boot. This is the power on reset default so
++ * usually this should be a noop.
++ */
++ pos = pci_find_capability(dev, PCI_CAP_ID_MSI);
++ if (pos)
++ msi_set_enable(dev, pos, 0);
++ msix_set_enable(dev, 0);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch
new file mode 100644
index 0000000..8149969
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch
@@ -0,0 +1,65 @@
+From 5040b50e89f45f17231e6d2ad101596bedc5e431 Mon Sep 17 00:00:00 2001
+From: Gary Hade <garyhade@us.ibm.com>
+Date: Mon, 14 Nov 2011 15:42:16 -0800
+Subject: [PATCH 033/130] x86/PCI: Ignore CPU non-addressable _CRS reserved
+ memory resources
+
+commit ae5cd86455381282ece162966183d3f208c6fad7 upstream.
+
+This assures that a _CRS reserved host bridge window or window region is
+not used if it is not addressable by the CPU. The new code either trims
+the window to exclude the non-addressable portion or totally ignores the
+window if the entire window is non-addressable.
+
+The current code has been shown to be problematic with 32-bit non-PAE
+kernels on systems where _CRS reserves resources above 4GB.
+
+Signed-off-by: Gary Hade <garyhade@us.ibm.com>
+Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Thomas Renninger <trenn@novell.com>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/pci/acpi.c | 18 ++++++++++++++++--
+ 1 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
+index 404f21a..f8348ab 100644
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -149,7 +149,7 @@ setup_resource(struct acpi_resource *acpi_res, void *data)
+ struct acpi_resource_address64 addr;
+ acpi_status status;
+ unsigned long flags;
+- u64 start, end;
++ u64 start, orig_end, end;
+
+ status = resource_to_addr(acpi_res, &addr);
+ if (!ACPI_SUCCESS(status))
+@@ -165,7 +165,21 @@ setup_resource(struct acpi_resource *acpi_res, void *data)
+ return AE_OK;
+
+ start = addr.minimum + addr.translation_offset;
+- end = addr.maximum + addr.translation_offset;
++ orig_end = end = addr.maximum + addr.translation_offset;
++
++ /* Exclude non-addressable range or non-addressable portion of range */
++ end = min(end, (u64)iomem_resource.end);
++ if (end <= start) {
++ dev_info(&info->bridge->dev,
++ "host bridge window [%#llx-%#llx] "
++ "(ignored, not CPU addressable)\n", start, orig_end);
++ return AE_OK;
++ } else if (orig_end != end) {
++ dev_info(&info->bridge->dev,
++ "host bridge window [%#llx-%#llx] "
++ "([%#llx-%#llx] ignored, not CPU addressable)\n",
++ start, orig_end, end + 1, orig_end);
++ }
+
+ res = &info->res[info->res_num];
+ res->name = info->name;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch
new file mode 100644
index 0000000..ff16fb4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch
@@ -0,0 +1,160 @@
+From c6f611b87ae8cf8a5bd1fc916b4b63e0fd48d6f3 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Thu, 5 Jan 2012 14:27:19 -0700
+Subject: [PATCH 034/130] x86/PCI: amd: factor out MMCONFIG discovery
+
+commit 24d25dbfa63c376323096660bfa9ad45a08870ce upstream.
+
+This factors out the AMD native MMCONFIG discovery so we can use it
+outside amd_bus.c.
+
+amd_bus.c reads AMD MSRs so it can remove the MMCONFIG area from the
+PCI resources. We may also need the MMCONFIG information to work
+around BIOS defects in the ACPI MCFG table.
+
+Cc: Borislav Petkov <borislav.petkov@amd.com>
+Cc: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/include/asm/amd_nb.h | 2 +
+ arch/x86/kernel/amd_nb.c | 31 ++++++++++++++++++++++++++++++
+ arch/x86/pci/amd_bus.c | 42 ++++++++++------------------------------
+ 3 files changed, 44 insertions(+), 31 deletions(-)
+
+diff --git a/arch/x86/include/asm/amd_nb.h b/arch/x86/include/asm/amd_nb.h
+index 8e41071..49ad773 100644
+--- a/arch/x86/include/asm/amd_nb.h
++++ b/arch/x86/include/asm/amd_nb.h
+@@ -1,6 +1,7 @@
+ #ifndef _ASM_X86_AMD_NB_H
+ #define _ASM_X86_AMD_NB_H
+
++#include <linux/ioport.h>
+ #include <linux/pci.h>
+
+ struct amd_nb_bus_dev_range {
+@@ -13,6 +14,7 @@ extern const struct pci_device_id amd_nb_misc_ids[];
+ extern const struct amd_nb_bus_dev_range amd_nb_bus_dev_ranges[];
+
+ extern bool early_is_amd_nb(u32 value);
++extern struct resource *amd_get_mmconfig_range(struct resource *res);
+ extern int amd_cache_northbridges(void);
+ extern void amd_flush_garts(void);
+ extern int amd_numa_init(void);
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index 4c39baa..bae1efe 100644
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -119,6 +119,37 @@ bool __init early_is_amd_nb(u32 device)
+ return false;
+ }
+
++struct resource *amd_get_mmconfig_range(struct resource *res)
++{
++ u32 address;
++ u64 base, msr;
++ unsigned segn_busn_bits;
++
++ if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
++ return NULL;
++
++ /* assume all cpus from fam10h have mmconfig */
++ if (boot_cpu_data.x86 < 0x10)
++ return NULL;
++
++ address = MSR_FAM10H_MMIO_CONF_BASE;
++ rdmsrl(address, msr);
++
++ /* mmconfig is not enabled */
++ if (!(msr & FAM10H_MMIO_CONF_ENABLE))
++ return NULL;
++
++ base = msr & (FAM10H_MMIO_CONF_BASE_MASK<<FAM10H_MMIO_CONF_BASE_SHIFT);
++
++ segn_busn_bits = (msr >> FAM10H_MMIO_CONF_BUSRANGE_SHIFT) &
++ FAM10H_MMIO_CONF_BUSRANGE_MASK;
++
++ res->flags = IORESOURCE_MEM;
++ res->start = base;
++ res->end = base + (1ULL<<(segn_busn_bits + 20)) - 1;
++ return res;
++}
++
+ int amd_get_subcaches(int cpu)
+ {
+ struct pci_dev *link = node_to_amd_nb(amd_get_nb_id(cpu))->link;
+diff --git a/arch/x86/pci/amd_bus.c b/arch/x86/pci/amd_bus.c
+index 026e493..385a940 100644
+--- a/arch/x86/pci/amd_bus.c
++++ b/arch/x86/pci/amd_bus.c
+@@ -30,34 +30,6 @@ static struct pci_hostbridge_probe pci_probes[] __initdata = {
+ { 0, 0x18, PCI_VENDOR_ID_AMD, 0x1300 },
+ };
+
+-static u64 __initdata fam10h_mmconf_start;
+-static u64 __initdata fam10h_mmconf_end;
+-static void __init get_pci_mmcfg_amd_fam10h_range(void)
+-{
+- u32 address;
+- u64 base, msr;
+- unsigned segn_busn_bits;
+-
+- /* assume all cpus from fam10h have mmconf */
+- if (boot_cpu_data.x86 < 0x10)
+- return;
+-
+- address = MSR_FAM10H_MMIO_CONF_BASE;
+- rdmsrl(address, msr);
+-
+- /* mmconfig is not enable */
+- if (!(msr & FAM10H_MMIO_CONF_ENABLE))
+- return;
+-
+- base = msr & (FAM10H_MMIO_CONF_BASE_MASK<<FAM10H_MMIO_CONF_BASE_SHIFT);
+-
+- segn_busn_bits = (msr >> FAM10H_MMIO_CONF_BUSRANGE_SHIFT) &
+- FAM10H_MMIO_CONF_BUSRANGE_MASK;
+-
+- fam10h_mmconf_start = base;
+- fam10h_mmconf_end = base + (1ULL<<(segn_busn_bits + 20)) - 1;
+-}
+-
+ #define RANGE_NUM 16
+
+ /**
+@@ -85,6 +57,9 @@ static int __init early_fill_mp_bus_info(void)
+ u64 val;
+ u32 address;
+ bool found;
++ struct resource fam10h_mmconf_res, *fam10h_mmconf;
++ u64 fam10h_mmconf_start;
++ u64 fam10h_mmconf_end;
+
+ if (!early_pci_allowed())
+ return -1;
+@@ -211,12 +186,17 @@ static int __init early_fill_mp_bus_info(void)
+ subtract_range(range, RANGE_NUM, 0, end);
+
+ /* get mmconfig */
+- get_pci_mmcfg_amd_fam10h_range();
++ fam10h_mmconf = amd_get_mmconfig_range(&fam10h_mmconf_res);
+ /* need to take out mmconf range */
+- if (fam10h_mmconf_end) {
+- printk(KERN_DEBUG "Fam 10h mmconf [%llx, %llx]\n", fam10h_mmconf_start, fam10h_mmconf_end);
++ if (fam10h_mmconf) {
++ printk(KERN_DEBUG "Fam 10h mmconf %pR\n", fam10h_mmconf);
++ fam10h_mmconf_start = fam10h_mmconf->start;
++ fam10h_mmconf_end = fam10h_mmconf->end;
+ subtract_range(range, RANGE_NUM, fam10h_mmconf_start,
+ fam10h_mmconf_end + 1);
++ } else {
++ fam10h_mmconf_start = 0;
++ fam10h_mmconf_end = 0;
+ }
+
+ /* mmio resource */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch
new file mode 100644
index 0000000..7967028
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch
@@ -0,0 +1,37 @@
+From a67bd4738894215f045d9d1aed024277cb5ae99e Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Thu, 12 Jan 2012 08:01:40 -0700
+Subject: [PATCH 035/130] x86/PCI: build amd_bus.o only when CONFIG_AMD_NB=y
+
+commit 5cf9a4e69c1ff0ccdd1d2b7404f95c0531355274 upstream.
+
+We only need amd_bus.o for AMD systems with PCI. arch/x86/pci/Makefile
+already depends on CONFIG_PCI=y, so this patch just adds the dependency
+on CONFIG_AMD_NB.
+
+Cc: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/pci/Makefile | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/arch/x86/pci/Makefile b/arch/x86/pci/Makefile
+index 6b8759f..d24d3da 100644
+--- a/arch/x86/pci/Makefile
++++ b/arch/x86/pci/Makefile
+@@ -18,8 +18,9 @@ obj-$(CONFIG_X86_NUMAQ) += numaq_32.o
+ obj-$(CONFIG_X86_MRST) += mrst.o
+
+ obj-y += common.o early.o
+-obj-y += amd_bus.o bus_numa.o
++obj-y += bus_numa.o
+
++obj-$(CONFIG_AMD_NB) += amd_bus.o
+ obj-$(CONFIG_PCI_CNB20LE_QUIRK) += broadcom_bus.o
+
+ ifeq ($(CONFIG_PCI_DEBUG),y)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch
new file mode 100644
index 0000000..c9647f7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch
@@ -0,0 +1,56 @@
+From c96f90776325ceb9fcda278cba8bc85e287d8d15 Mon Sep 17 00:00:00 2001
+From: "nagalakshmi.nandigama@lsi.com" <nagalakshmi.nandigama@lsi.com>
+Date: Thu, 1 Dec 2011 07:52:56 +0530
+Subject: [PATCH 036/130] SCSI: mpt2sas: Release spinlock for the raid device
+ list before blocking it
+
+commit 30c43282f3d347f47f9e05199d2b14f56f3f2837 upstream.
+
+Added code to release the spinlock that is used to protect the
+raid device list before calling a function that can block. The
+blocking was causing a reschedule, and subsequently it is tried
+to acquire the same lock, resulting in a panic (NMI Watchdog
+detecting a CPU lockup).
+
+Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 7 ++++---
+ 1 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+index d570573..3a4f666 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -6714,6 +6714,7 @@ _scsih_mark_responding_raid_device(struct MPT2SAS_ADAPTER *ioc, u64 wwid,
+ } else
+ sas_target_priv_data = NULL;
+ raid_device->responding = 1;
++ spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
+ starget_printk(KERN_INFO, raid_device->starget,
+ "handle(0x%04x), wwid(0x%016llx)\n", handle,
+ (unsigned long long)raid_device->wwid);
+@@ -6724,16 +6725,16 @@ _scsih_mark_responding_raid_device(struct MPT2SAS_ADAPTER *ioc, u64 wwid,
+ */
+ _scsih_init_warpdrive_properties(ioc, raid_device);
+ if (raid_device->handle == handle)
+- goto out;
++ return;
+ printk(KERN_INFO "\thandle changed from(0x%04x)!!!\n",
+ raid_device->handle);
+ raid_device->handle = handle;
+ if (sas_target_priv_data)
+ sas_target_priv_data->handle = handle;
+- goto out;
++ return;
+ }
+ }
+- out:
++
+ spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch
new file mode 100644
index 0000000..36d2703
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch
@@ -0,0 +1,177 @@
+From fe5907648567469336c06cf215932adac76a8e11 Mon Sep 17 00:00:00 2001
+From: "nagalakshmi.nandigama@lsi.com" <nagalakshmi.nandigama@lsi.com>
+Date: Thu, 1 Dec 2011 07:53:08 +0530
+Subject: [PATCH 037/130] SCSI: mpt2sas : Fix for memory allocation error for
+ large host credits
+
+commit aff132d95ffe14eca96cab90597cdd010b457af7 upstream.
+
+The amount of memory required for tracking chain buffers is rather
+large, and when the host credit count is big, memory allocation
+failure occurs inside __get_free_pages.
+
+The fix is to limit the number of chains to 100,000. In addition,
+the number of host credits is limited to 30,000 IOs. However this
+limitation can be overridden this using the command line option
+max_queue_depth. The algorithm for calculating the
+reply_post_queue_depth is changed so that it is equal to
+(reply_free_queue_depth + 16), previously it was (reply_free_queue_depth * 2).
+
+Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c | 83 +++++++++++-----------------------
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 4 +-
+ 2 files changed, 29 insertions(+), 58 deletions(-)
+
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
+index beda04a..0794c72 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -65,6 +65,8 @@ static MPT_CALLBACK mpt_callbacks[MPT_MAX_CALLBACKS];
+
+ #define FAULT_POLLING_INTERVAL 1000 /* in milliseconds */
+
++#define MAX_HBA_QUEUE_DEPTH 30000
++#define MAX_CHAIN_DEPTH 100000
+ static int max_queue_depth = -1;
+ module_param(max_queue_depth, int, 0);
+ MODULE_PARM_DESC(max_queue_depth, " max controller queue depth ");
+@@ -2311,8 +2313,6 @@ _base_release_memory_pools(struct MPT2SAS_ADAPTER *ioc)
+ }
+ if (ioc->chain_dma_pool)
+ pci_pool_destroy(ioc->chain_dma_pool);
+- }
+- if (ioc->chain_lookup) {
+ free_pages((ulong)ioc->chain_lookup, ioc->chain_pages);
+ ioc->chain_lookup = NULL;
+ }
+@@ -2330,9 +2330,7 @@ static int
+ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ {
+ struct mpt2sas_facts *facts;
+- u32 queue_size, queue_diff;
+ u16 max_sge_elements;
+- u16 num_of_reply_frames;
+ u16 chains_needed_per_io;
+ u32 sz, total_sz, reply_post_free_sz;
+ u32 retry_sz;
+@@ -2359,7 +2357,8 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ max_request_credit = (max_queue_depth < facts->RequestCredit)
+ ? max_queue_depth : facts->RequestCredit;
+ else
+- max_request_credit = facts->RequestCredit;
++ max_request_credit = min_t(u16, facts->RequestCredit,
++ MAX_HBA_QUEUE_DEPTH);
+
+ ioc->hba_queue_depth = max_request_credit;
+ ioc->hi_priority_depth = facts->HighPriorityCredit;
+@@ -2400,50 +2399,25 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ }
+ ioc->chains_needed_per_io = chains_needed_per_io;
+
+- /* reply free queue sizing - taking into account for events */
+- num_of_reply_frames = ioc->hba_queue_depth + 32;
+-
+- /* number of replies frames can't be a multiple of 16 */
+- /* decrease number of reply frames by 1 */
+- if (!(num_of_reply_frames % 16))
+- num_of_reply_frames--;
+-
+- /* calculate number of reply free queue entries
+- * (must be multiple of 16)
+- */
+-
+- /* (we know reply_free_queue_depth is not a multiple of 16) */
+- queue_size = num_of_reply_frames;
+- queue_size += 16 - (queue_size % 16);
+- ioc->reply_free_queue_depth = queue_size;
+-
+- /* reply descriptor post queue sizing */
+- /* this size should be the number of request frames + number of reply
+- * frames
+- */
+-
+- queue_size = ioc->hba_queue_depth + num_of_reply_frames + 1;
+- /* round up to 16 byte boundary */
+- if (queue_size % 16)
+- queue_size += 16 - (queue_size % 16);
+-
+- /* check against IOC maximum reply post queue depth */
+- if (queue_size > facts->MaxReplyDescriptorPostQueueDepth) {
+- queue_diff = queue_size -
+- facts->MaxReplyDescriptorPostQueueDepth;
++ /* reply free queue sizing - taking into account for 64 FW events */
++ ioc->reply_free_queue_depth = ioc->hba_queue_depth + 64;
+
+- /* round queue_diff up to multiple of 16 */
+- if (queue_diff % 16)
+- queue_diff += 16 - (queue_diff % 16);
+-
+- /* adjust hba_queue_depth, reply_free_queue_depth,
+- * and queue_size
+- */
+- ioc->hba_queue_depth -= (queue_diff / 2);
+- ioc->reply_free_queue_depth -= (queue_diff / 2);
+- queue_size = facts->MaxReplyDescriptorPostQueueDepth;
++ /* align the reply post queue on the next 16 count boundary */
++ if (!ioc->reply_free_queue_depth % 16)
++ ioc->reply_post_queue_depth = ioc->reply_free_queue_depth + 16;
++ else
++ ioc->reply_post_queue_depth = ioc->reply_free_queue_depth +
++ 32 - (ioc->reply_free_queue_depth % 16);
++ if (ioc->reply_post_queue_depth >
++ facts->MaxReplyDescriptorPostQueueDepth) {
++ ioc->reply_post_queue_depth = min_t(u16,
++ (facts->MaxReplyDescriptorPostQueueDepth -
++ (facts->MaxReplyDescriptorPostQueueDepth % 16)),
++ (ioc->hba_queue_depth - (ioc->hba_queue_depth % 16)));
++ ioc->reply_free_queue_depth = ioc->reply_post_queue_depth - 16;
++ ioc->hba_queue_depth = ioc->reply_free_queue_depth - 64;
+ }
+- ioc->reply_post_queue_depth = queue_size;
++
+
+ dinitprintk(ioc, printk(MPT2SAS_INFO_FMT "scatter gather: "
+ "sge_in_main_msg(%d), sge_per_chain(%d), sge_per_io(%d), "
+@@ -2529,15 +2503,12 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ "depth(%d)\n", ioc->name, ioc->request,
+ ioc->scsiio_depth));
+
+- /* loop till the allocation succeeds */
+- do {
+- sz = ioc->chain_depth * sizeof(struct chain_tracker);
+- ioc->chain_pages = get_order(sz);
+- ioc->chain_lookup = (struct chain_tracker *)__get_free_pages(
+- GFP_KERNEL, ioc->chain_pages);
+- if (ioc->chain_lookup == NULL)
+- ioc->chain_depth -= 100;
+- } while (ioc->chain_lookup == NULL);
++ ioc->chain_depth = min_t(u32, ioc->chain_depth, MAX_CHAIN_DEPTH);
++ sz = ioc->chain_depth * sizeof(struct chain_tracker);
++ ioc->chain_pages = get_order(sz);
++
++ ioc->chain_lookup = (struct chain_tracker *)__get_free_pages(
++ GFP_KERNEL, ioc->chain_pages);
+ ioc->chain_dma_pool = pci_pool_create("chain pool", ioc->pdev,
+ ioc->request_sz, 16, 0);
+ if (!ioc->chain_dma_pool) {
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+index 3a4f666..9bc6fb2 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -1007,8 +1007,8 @@ _scsih_get_chain_buffer_tracker(struct MPT2SAS_ADAPTER *ioc, u16 smid)
+ spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+ if (list_empty(&ioc->free_chain_list)) {
+ spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
+- printk(MPT2SAS_WARN_FMT "chain buffers not available\n",
+- ioc->name);
++ dfailprintk(ioc, printk(MPT2SAS_WARN_FMT "chain buffers not "
++ "available\n", ioc->name));
+ return NULL;
+ }
+ chain_req = list_entry(ioc->free_chain_list.next,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch
new file mode 100644
index 0000000..fcf777c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch
@@ -0,0 +1,78 @@
+From fbefcde91f27d0a80ebe70c0b3359b2e6c463cc0 Mon Sep 17 00:00:00 2001
+From: Ian Campbell <Ian.Campbell@citrix.com>
+Date: Wed, 4 Jan 2012 09:34:49 +0000
+Subject: [PATCH 038/130] xen/xenbus: Reject replies with payload >
+ XENSTORE_PAYLOAD_MAX.
+
+commit 9e7860cee18241633eddb36a4c34c7b61d8cecbc upstream.
+
+Haogang Chen found out that:
+
+ There is a potential integer overflow in process_msg() that could result
+ in cross-domain attack.
+
+ body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH);
+
+ When a malicious guest passes 0xffffffff in msg->hdr.len, the subsequent
+ call to xb_read() would write to a zero-length buffer.
+
+ The other end of this connection is always the xenstore backend daemon
+ so there is no guest (malicious or otherwise) which can do this. The
+ xenstore daemon is a trusted component in the system.
+
+ However this seem like a reasonable robustness improvement so we should
+ have it.
+
+And Ian when read the API docs found that:
+ The payload length (len field of the header) is limited to 4096
+ (XENSTORE_PAYLOAD_MAX) in both directions. If a client exceeds the
+ limit, its xenstored connection will be immediately killed by
+ xenstored, which is usually catastrophic from the client's point of
+ view. Clients (particularly domains, which cannot just reconnect)
+ should avoid this.
+
+so this patch checks against that instead.
+
+This also avoids a potential integer overflow pointed out by Haogang Chen.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Cc: Haogang Chen <haogangchen@gmail.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/xen/xenbus/xenbus_xs.c | 6 ++++++
+ include/xen/interface/io/xs_wire.h | 3 +++
+ 2 files changed, 9 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
+index ede860f..a580b17 100644
+--- a/drivers/xen/xenbus/xenbus_xs.c
++++ b/drivers/xen/xenbus/xenbus_xs.c
+@@ -801,6 +801,12 @@ static int process_msg(void)
+ goto out;
+ }
+
++ if (msg->hdr.len > XENSTORE_PAYLOAD_MAX) {
++ kfree(msg);
++ err = -EINVAL;
++ goto out;
++ }
++
+ body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH);
+ if (body == NULL) {
+ kfree(msg);
+diff --git a/include/xen/interface/io/xs_wire.h b/include/xen/interface/io/xs_wire.h
+index f6f07aa..7cdfca2 100644
+--- a/include/xen/interface/io/xs_wire.h
++++ b/include/xen/interface/io/xs_wire.h
+@@ -87,4 +87,7 @@ struct xenstore_domain_interface {
+ XENSTORE_RING_IDX rsp_cons, rsp_prod;
+ };
+
++/* Violating this is very bad. See docs/misc/xenstore.txt. */
++#define XENSTORE_PAYLOAD_MAX 4096
++
+ #endif /* _XS_WIRE_H */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch
new file mode 100644
index 0000000..99b3f12
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch
@@ -0,0 +1,56 @@
+From b08c639fb415855bbca91bff089b8bada0f4b044 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Mon, 9 Jan 2012 01:41:51 +1100
+Subject: [PATCH 039/130] md/raid1: perform bad-block tests for WriteMostly
+ devices too.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 307729c8bc5b5a41361af8af95906eee7552acb1 upstream.
+
+We normally try to avoid reading from write-mostly devices, but when
+we do we really have to check for bad blocks and be sure not to
+try reading them.
+
+With the current code, best_good_sectors might not get set and that
+causes zero-length read requests to be send down which is very
+confusing.
+
+This bug was introduced in commit d2eb35acfdccbe2 and so the patch
+is suitable for 3.1.x and 3.2.x
+
+Reported-and-tested-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Reported-and-tested-by: Art -kwaak- van Breemen <ard@telegraafnet.nl>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/md/raid1.c | 11 ++++++++++-
+ 1 files changed, 10 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index ede2461..7d9e071 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -525,8 +525,17 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ if (test_bit(WriteMostly, &rdev->flags)) {
+ /* Don't balance among write-mostly, just
+ * use the first as a last resort */
+- if (best_disk < 0)
++ if (best_disk < 0) {
++ if (is_badblock(rdev, this_sector, sectors,
++ &first_bad, &bad_sectors)) {
++ if (first_bad < this_sector)
++ /* Cannot use this */
++ continue;
++ best_good_sectors = first_bad - this_sector;
++ } else
++ best_good_sectors = sectors;
+ best_disk = disk;
++ }
+ continue;
+ }
+ /* This is a reasonable device to use. It might
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0040-ima-free-duplicate-measurement-memory.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0040-ima-free-duplicate-measurement-memory.patch
new file mode 100644
index 0000000..40457fa
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0040-ima-free-duplicate-measurement-memory.patch
@@ -0,0 +1,52 @@
+From 52e6ae83dbb962de0a33d2cd1b610cdfd0a09b0d Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@polito.it>
+Date: Mon, 19 Dec 2011 15:57:27 +0100
+Subject: [PATCH 040/130] ima: free duplicate measurement memory
+
+commit 45fae7493970d7c45626ccd96d4a74f5f1eea5a9 upstream.
+
+Info about new measurements are cached in the iint for performance. When
+the inode is flushed from cache, the associated iint is flushed as well.
+Subsequent access to the inode will cause the inode to be re-measured and
+will attempt to add a duplicate entry to the measurement list.
+
+This patch frees the duplicate measurement memory, fixing a memory leak.
+
+Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
+Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ security/integrity/ima/ima_api.c | 4 ++--
+ security/integrity/ima/ima_queue.c | 1 +
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
+index 0d50df0..88a2788 100644
+--- a/security/integrity/ima/ima_api.c
++++ b/security/integrity/ima/ima_api.c
+@@ -178,8 +178,8 @@ void ima_store_measurement(struct integrity_iint_cache *iint,
+ strncpy(entry->template.file_name, filename, IMA_EVENT_NAME_LEN_MAX);
+
+ result = ima_store_template(entry, violation, inode);
+- if (!result)
++ if (!result || result == -EEXIST)
+ iint->flags |= IMA_MEASURED;
+- else
++ if (result < 0)
+ kfree(entry);
+ }
+diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
+index 8e28f04..e1a5062 100644
+--- a/security/integrity/ima/ima_queue.c
++++ b/security/integrity/ima/ima_queue.c
+@@ -114,6 +114,7 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
+ memcpy(digest, entry->digest, sizeof digest);
+ if (ima_lookup_digest_entry(digest)) {
+ audit_cause = "hash_exists";
++ result = -EEXIST;
+ goto out;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0041-ima-fix-invalid-memory-reference.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0041-ima-fix-invalid-memory-reference.patch
new file mode 100644
index 0000000..66139b9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0041-ima-fix-invalid-memory-reference.patch
@@ -0,0 +1,68 @@
+From b5be4dc54cfe7c5bb0ce387519c2019d9915435e Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@polito.it>
+Date: Mon, 19 Dec 2011 15:57:28 +0100
+Subject: [PATCH 041/130] ima: fix invalid memory reference
+
+commit 7b7e5916aa2f46e57f8bd8cb89c34620ebfda5da upstream.
+
+Don't free a valid measurement entry on TPM PCR extend failure.
+
+Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
+Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ security/integrity/ima/ima_queue.c | 16 +++++++++++-----
+ 1 files changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
+index e1a5062..55a6271 100644
+--- a/security/integrity/ima/ima_queue.c
++++ b/security/integrity/ima/ima_queue.c
+@@ -23,6 +23,8 @@
+ #include <linux/slab.h>
+ #include "ima.h"
+
++#define AUDIT_CAUSE_LEN_MAX 32
++
+ LIST_HEAD(ima_measurements); /* list of all measurements */
+
+ /* key: inode (before secure-hashing a file) */
+@@ -94,7 +96,8 @@ static int ima_pcr_extend(const u8 *hash)
+
+ result = tpm_pcr_extend(TPM_ANY_NUM, CONFIG_IMA_MEASURE_PCR_IDX, hash);
+ if (result != 0)
+- pr_err("IMA: Error Communicating to TPM chip\n");
++ pr_err("IMA: Error Communicating to TPM chip, result: %d\n",
++ result);
+ return result;
+ }
+
+@@ -106,8 +109,9 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
+ {
+ u8 digest[IMA_DIGEST_SIZE];
+ const char *audit_cause = "hash_added";
++ char tpm_audit_cause[AUDIT_CAUSE_LEN_MAX];
+ int audit_info = 1;
+- int result = 0;
++ int result = 0, tpmresult = 0;
+
+ mutex_lock(&ima_extend_list_mutex);
+ if (!violation) {
+@@ -129,9 +133,11 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
+ if (violation) /* invalidate pcr */
+ memset(digest, 0xff, sizeof digest);
+
+- result = ima_pcr_extend(digest);
+- if (result != 0) {
+- audit_cause = "TPM error";
++ tpmresult = ima_pcr_extend(digest);
++ if (tpmresult != 0) {
++ snprintf(tpm_audit_cause, AUDIT_CAUSE_LEN_MAX, "TPM_error(%d)",
++ tpmresult);
++ audit_cause = tpm_audit_cause;
+ audit_info = 0;
+ }
+ out:
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch
new file mode 100644
index 0000000..87a49ae
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch
@@ -0,0 +1,47 @@
+From c25b1c3dffca9191001f97e64c9be8e1ff861c0a Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 13 Dec 2011 04:57:06 +0100
+Subject: [PATCH 042/130] slub: fix a possible memleak in __slab_alloc()
+
+commit 73736e0387ba0e6d2b703407b4d26168d31516a7 upstream.
+
+Zhihua Che reported a possible memleak in slub allocator on
+CONFIG_PREEMPT=y builds.
+
+It is possible current thread migrates right before disabling irqs in
+__slab_alloc(). We must check again c->freelist, and perform a normal
+allocation instead of scratching c->freelist.
+
+Many thanks to Zhihua Che for spotting this bug, introduced in 2.6.39
+
+V2: Its also possible an IRQ freed one (or several) object(s) and
+populated c->freelist, so its not a CONFIG_PREEMPT only problem.
+
+Reported-by: Zhihua Che <zhihua.che@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Acked-by: Christoph Lameter <cl@linux.com>
+Signed-off-by: Pekka Enberg <penberg@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ mm/slub.c | 5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/mm/slub.c b/mm/slub.c
+index ed3334d..1a919f0 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -2166,6 +2166,11 @@ redo:
+ goto new_slab;
+ }
+
++ /* must check again c->freelist in case of cpu migration or IRQ */
++ object = c->freelist;
++ if (object)
++ goto load_freelist;
++
+ stat(s, ALLOC_SLOWPATH);
+
+ do {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch
new file mode 100644
index 0000000..d539c66
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch
@@ -0,0 +1,101 @@
+From c450bfbe6e0d5b7feb3c7570c2f22c4a8da7ca44 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Thu, 5 Jan 2012 14:27:24 -0700
+Subject: [PATCH 043/130] PNP: work around Dell 1536/1546 BIOS MMCONFIG bug
+ that breaks USB
+
+commit eb31aae8cb5eb54e234ed2d857ddac868195d911 upstream.
+
+Some Dell BIOSes have MCFG tables that don't report the entire
+MMCONFIG area claimed by the chipset. If we move PCI devices into
+that claimed-but-unreported area, they don't work.
+
+This quirk reads the AMD MMCONFIG MSRs and adds PNP0C01 resources as
+needed to cover the entire area.
+
+Example problem scenario:
+
+ BIOS-e820: 00000000cfec5400 - 00000000d4000000 (reserved)
+ Fam 10h mmconf [d0000000, dfffffff]
+ PCI: MMCONFIG for domain 0000 [bus 00-3f] at [mem 0xd0000000-0xd3ffffff] (base 0xd0000000)
+ pnp 00:0c: [mem 0xd0000000-0xd3ffffff]
+ pci 0000:00:12.0: reg 10: [mem 0xffb00000-0xffb00fff]
+ pci 0000:00:12.0: no compatible bridge window for [mem 0xffb00000-0xffb00fff]
+ pci 0000:00:12.0: BAR 0: assigned [mem 0xd4000000-0xd40000ff]
+
+Reported-by: Lisa Salimbas <lisa.salimbas@canonical.com>
+Reported-by: <thuban@singularity.fr>
+Tested-by: dann frazier <dann.frazier@canonical.com>
+References: https://bugzilla.kernel.org/show_bug.cgi?id=31602
+References: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/647043
+References: https://bugzilla.redhat.com/show_bug.cgi?id=770308
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/pnp/quirks.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ 1 files changed, 42 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c
+index dfbd5a6..258fef2 100644
+--- a/drivers/pnp/quirks.c
++++ b/drivers/pnp/quirks.c
+@@ -295,6 +295,45 @@ static void quirk_system_pci_resources(struct pnp_dev *dev)
+ }
+ }
+
++#ifdef CONFIG_AMD_NB
++
++#include <asm/amd_nb.h>
++
++static void quirk_amd_mmconfig_area(struct pnp_dev *dev)
++{
++ resource_size_t start, end;
++ struct pnp_resource *pnp_res;
++ struct resource *res;
++ struct resource mmconfig_res, *mmconfig;
++
++ mmconfig = amd_get_mmconfig_range(&mmconfig_res);
++ if (!mmconfig)
++ return;
++
++ list_for_each_entry(pnp_res, &dev->resources, list) {
++ res = &pnp_res->res;
++ if (res->end < mmconfig->start || res->start > mmconfig->end ||
++ (res->start == mmconfig->start && res->end == mmconfig->end))
++ continue;
++
++ dev_info(&dev->dev, FW_BUG
++ "%pR covers only part of AMD MMCONFIG area %pR; adding more reservations\n",
++ res, mmconfig);
++ if (mmconfig->start < res->start) {
++ start = mmconfig->start;
++ end = res->start - 1;
++ pnp_add_mem_resource(dev, start, end, 0);
++ }
++ if (mmconfig->end > res->end) {
++ start = res->end + 1;
++ end = mmconfig->end;
++ pnp_add_mem_resource(dev, start, end, 0);
++ }
++ break;
++ }
++}
++#endif
++
+ /*
+ * PnP Quirks
+ * Cards or devices that need some tweaking due to incomplete resource info
+@@ -322,6 +361,9 @@ static struct pnp_fixup pnp_fixups[] = {
+ /* PnP resources that might overlap PCI BARs */
+ {"PNP0c01", quirk_system_pci_resources},
+ {"PNP0c02", quirk_system_pci_resources},
++#ifdef CONFIG_AMD_NB
++ {"PNP0c01", quirk_amd_mmconfig_area},
++#endif
+ {""}
+ };
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch
new file mode 100644
index 0000000..88c4419
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch
@@ -0,0 +1,45 @@
+From 95bb58957d5f4db07339eb5c6c87345ec877a3b6 Mon Sep 17 00:00:00 2001
+From: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+Date: Tue, 10 Jan 2012 06:40:23 +0000
+Subject: [PATCH 044/130] asix: fix setting custom MAC address on Asix 88178
+ devices
+
+commit 71bc5d94061516c4e70303570128797bcf768b10 upstream.
+
+In kernel v3.2 initialization sequence for Asix 88178 devices was changed so
+that hardware is reseted on every time interface is brought up (ifconfig up),
+instead just at USB probe time. This causes problem with setting custom MAC
+address to device as ax88178_reset causes reload of MAC address from EEPROM.
+
+This patch fixes the issue by rewriting MAC address at end of ax88178_reset.
+
+Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+Acked-by: Grant Grundler <grundler@chromium.org>
+Cc: Allan Chou <allan@asix.com.tw>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/usb/asix.c | 7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
+index dd2625a..b495821 100644
+--- a/drivers/net/usb/asix.c
++++ b/drivers/net/usb/asix.c
+@@ -1316,6 +1316,13 @@ static int ax88178_reset(struct usbnet *dev)
+ if (ret < 0)
+ return ret;
+
++ /* Rewrite MAC address */
++ memcpy(data->mac_addr, dev->net->dev_addr, ETH_ALEN);
++ ret = asix_write_cmd(dev, AX_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
++ data->mac_addr);
++ if (ret < 0)
++ return ret;
++
+ ret = asix_write_rx_ctl(dev, AX_DEFAULT_RX_CTL);
+ if (ret < 0)
+ return ret;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch
new file mode 100644
index 0000000..05e1512
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch
@@ -0,0 +1,53 @@
+From 25a43c8a8f51501928b5d209ab3880ecd5b180fe Mon Sep 17 00:00:00 2001
+From: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+Date: Tue, 10 Jan 2012 06:40:17 +0000
+Subject: [PATCH 045/130] asix: fix setting custom MAC address on Asix 88772
+ devices
+
+commit 8ef66bdc4bda6aac2dae73b84d79dc8c2db33637 upstream.
+
+In kernel v3.2 initialization sequence for Asix 88772 devices was changed so
+that hardware is reseted on every time interface is brought up (ifconfig up),
+instead just at USB probe time. This causes problem with setting custom MAC
+address to device as ax88772_reset causes reload of MAC address from EEPROM.
+
+This patch fixes the issue by rewriting MAC address at end of ax88772_reset.
+
+Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+Acked-by: Grant Grundler <grundler@chromium.org>
+Cc: Allan Chou <allan@asix.com.tw>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/usb/asix.c | 8 ++++++++
+ 1 files changed, 8 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
+index b495821..f5e063a 100644
+--- a/drivers/net/usb/asix.c
++++ b/drivers/net/usb/asix.c
+@@ -974,6 +974,7 @@ static int ax88772_link_reset(struct usbnet *dev)
+
+ static int ax88772_reset(struct usbnet *dev)
+ {
++ struct asix_data *data = (struct asix_data *)&dev->data;
+ int ret, embd_phy;
+ u16 rx_ctl;
+
+@@ -1051,6 +1052,13 @@ static int ax88772_reset(struct usbnet *dev)
+ goto out;
+ }
+
++ /* Rewrite MAC address */
++ memcpy(data->mac_addr, dev->net->dev_addr, ETH_ALEN);
++ ret = asix_write_cmd(dev, AX_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
++ data->mac_addr);
++ if (ret < 0)
++ goto out;
++
+ /* Set RX_CTL to default values with 2k buffer, and enable cactus */
+ ret = asix_write_rx_ctl(dev, AX_DEFAULT_RX_CTL);
+ if (ret < 0)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch
new file mode 100644
index 0000000..04a4c7e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch
@@ -0,0 +1,54 @@
+From 56d30a3ff947d9e4be88a6083eb257bffb7d059e Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Thu, 12 Jan 2012 17:20:20 -0800
+Subject: [PATCH 046/130] include/linux/crash_dump.h needs elf.h
+
+commit 1f536b9e9f85456df93614b3c2f6a1a2b7d7cb9b upstream.
+
+Building an ARM target we get the following warnings:
+
+ CC arch/arm/kernel/setup.o
+ In file included from arch/arm/kernel/setup.c:39:
+ arch/arm/include/asm/elf.h:102:1: warning: "vmcore_elf64_check_arch" redefined
+ In file included from arch/arm/kernel/setup.c:24:
+ include/linux/crash_dump.h:30:1: warning: this is the location of the previous definition
+
+Quoting Russell King:
+
+"linux/crash_dump.h makes no attempt to include asm/elf.h, but it depends
+on stuff in asm/elf.h to determine how stuff inside this file is defined
+at parse time.
+
+So, if asm/elf.h is included after linux/crash_dump.h or not at all, you
+get a different result from the situation where asm/elf.h is included
+before."
+
+So add elf.h header to crash_dump.h to avoid this problem.
+
+The original discussion about this can be found at:
+http://www.spinics.net/lists/arm-kernel/msg154113.html
+
+Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
+Cc: Russell King <rmk@arm.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/linux/crash_dump.h | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h
+index 5c4abce..b936763 100644
+--- a/include/linux/crash_dump.h
++++ b/include/linux/crash_dump.h
+@@ -5,6 +5,7 @@
+ #include <linux/kexec.h>
+ #include <linux/device.h>
+ #include <linux/proc_fs.h>
++#include <linux/elf.h>
+
+ #define ELFCORE_ADDR_MAX (-1ULL)
+ #define ELFCORE_ADDR_ERR (-2ULL)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch
new file mode 100644
index 0000000..ed8e772
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch
@@ -0,0 +1,44 @@
+From 5b48b119d0d1a2331b6368b4be7e3c1406cbda40 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Wed, 4 Jan 2012 20:50:47 -0600
+Subject: [PATCH 047/130] rtl8192se: Fix BUG caused by failure to check skb
+ allocation
+
+commit d90db4b12bc1b9b8a787ef28550fdb767ee25a49 upstream.
+
+When downloading firmware into the device, the driver fails to check the
+return when allocating an skb. When the allocation fails, a BUG can be
+generated, as seen in https://bugzilla.redhat.com/show_bug.cgi?id=771656.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/rtlwifi/rtl8192se/fw.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.c b/drivers/net/wireless/rtlwifi/rtl8192se/fw.c
+index 6f91a14..3fda6b1 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.c
+@@ -196,6 +196,8 @@ static bool _rtl92s_firmware_downloadcode(struct ieee80211_hw *hw,
+ /* Allocate skb buffer to contain firmware */
+ /* info and tx descriptor info. */
+ skb = dev_alloc_skb(frag_length);
++ if (!skb)
++ return false;
+ skb_reserve(skb, extra_descoffset);
+ seg_ptr = (u8 *)skb_put(skb, (u32)(frag_length -
+ extra_descoffset));
+@@ -573,6 +575,8 @@ static bool _rtl92s_firmware_set_h2c_cmd(struct ieee80211_hw *hw, u8 h2c_cmd,
+
+ len = _rtl92s_get_h2c_cmdlen(MAX_TRANSMIT_BUFFER_SIZE, 1, &cmd_len);
+ skb = dev_alloc_skb(len);
++ if (!skb)
++ return false;
+ cb_desc = (struct rtl_tcb_desc *)(skb->cb);
+ cb_desc->queue_index = TXCMD_QUEUE;
+ cb_desc->cmd_or_init = DESC_PACKET_TYPE_NORMAL;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch
new file mode 100644
index 0000000..1efb1c2
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch
@@ -0,0 +1,52 @@
+From 70f755e08b2df34528ff568bcbe2b856ddd769e1 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 11 Jan 2012 09:26:54 +0100
+Subject: [PATCH 048/130] mac80211: fix rx->key NULL pointer dereference in
+ promiscuous mode
+
+commit 1140afa862842ac3e56678693050760edc4ecde9 upstream.
+
+Since:
+
+commit 816c04fe7ef01dd9649f5ccfe796474db8708be5
+Author: Christian Lamparter <chunkeey@googlemail.com>
+Date: Sat Apr 30 15:24:30 2011 +0200
+
+ mac80211: consolidate MIC failure report handling
+
+is possible to that we dereference rx->key == NULL when driver set
+RX_FLAG_MMIC_STRIPPED and not RX_FLAG_IV_STRIPPED and we are in
+promiscuous mode. This happen with rt73usb and rt61pci at least.
+
+Before the commit we always check rx->key against NULL, so I assume
+fix should be done in mac80211 (also mic_fail path has similar check).
+
+References:
+https://bugzilla.redhat.com/show_bug.cgi?id=769766
+http://rt2x00.serialmonkey.com/pipermail/users_rt2x00.serialmonkey.com/2012-January/004395.html
+
+Reported-by: Stuart D Gathman <stuart@gathman.org>
+Reported-by: Kai Wohlfahrt <kai.scorpio@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/mac80211/wpa.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
+index f614ce7..28a39bb 100644
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -106,7 +106,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
+ if (status->flag & RX_FLAG_MMIC_ERROR)
+ goto mic_fail;
+
+- if (!(status->flag & RX_FLAG_IV_STRIPPED))
++ if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
+ goto update_iv;
+
+ return RX_CONTINUE;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch
new file mode 100644
index 0000000..3fbfd6d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch
@@ -0,0 +1,68 @@
+From 11da5d38bc749c576b8def78827c2ca82d6d6bb6 Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+Date: Mon, 9 Jan 2012 15:37:53 +0530
+Subject: [PATCH 049/130] ath9k: Fix regression in channelwidth switch at the
+ same channel
+
+commit 1a19f77f3642b8194ad9cf55548cc5d92e841766 upstream.
+
+The commit "ath9k: Fix invalid noisefloor reading due to channel update"
+preserves the current channel noisefloor readings before updating
+channel type at the same channel index. It is also updating the curchan
+pointer. As survey updation is also referring curchan pointer to fetch
+the appropriate index, which might leads to invalid memory access. This
+patch partially reverts the change and stores the noise floor history
+buffer before updating channel type w/o updating curchan.
+
+Cc: Gary Morain <gmorain@google.com>
+Cc: Paul Stewart <pstew@google.com>
+Reported-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
+Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/ath/ath9k/calib.c | 1 +
+ drivers/net/wireless/ath/ath9k/main.c | 8 ++------
+ 2 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
+index 9953881..8ddef3e 100644
+--- a/drivers/net/wireless/ath/ath9k/calib.c
++++ b/drivers/net/wireless/ath/ath9k/calib.c
+@@ -402,6 +402,7 @@ bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
+ ah->noise = ath9k_hw_getchan_noise(ah, chan);
+ return true;
+ }
++EXPORT_SYMBOL(ath9k_hw_getnf);
+
+ void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
+ struct ath9k_channel *chan)
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index a9c5ae7..f76a814 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1667,7 +1667,6 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
+
+ if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+ struct ieee80211_channel *curchan = hw->conf.channel;
+- struct ath9k_channel old_chan;
+ int pos = curchan->hw_value;
+ int old_pos = -1;
+ unsigned long flags;
+@@ -1693,11 +1692,8 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
+ * Preserve the current channel values, before updating
+ * the same channel
+ */
+- if (old_pos == pos) {
+- memcpy(&old_chan, &sc->sc_ah->channels[pos],
+- sizeof(struct ath9k_channel));
+- ah->curchan = &old_chan;
+- }
++ if (ah->curchan && (old_pos == pos))
++ ath9k_hw_getnf(ah, ah->curchan);
+
+ ath9k_cmn_update_ichannel(&sc->sc_ah->channels[pos],
+ curchan, conf->channel_type);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch
new file mode 100644
index 0000000..47ee79b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch
@@ -0,0 +1,179 @@
+From 256d142444317960a68e5c5e7a8b41a520b62bd9 Mon Sep 17 00:00:00 2001
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Date: Thu, 12 Jan 2012 17:17:44 -0800
+Subject: [PATCH 050/130] memcg: add mem_cgroup_replace_page_cache() to fix
+ LRU issue
+
+commit ab936cbcd02072a34b60d268f94440fd5cf1970b upstream.
+
+Commit ef6a3c6311 ("mm: add replace_page_cache_page() function") added a
+function replace_page_cache_page(). This function replaces a page in the
+radix-tree with a new page. WHen doing this, memory cgroup needs to fix
+up the accounting information. memcg need to check PCG_USED bit etc.
+
+In some(many?) cases, 'newpage' is on LRU before calling
+replace_page_cache(). So, memcg's LRU accounting information should be
+fixed, too.
+
+This patch adds mem_cgroup_replace_page_cache() and removes the old hooks.
+ In that function, old pages will be unaccounted without touching
+res_counter and new page will be accounted to the memcg (of old page).
+WHen overwriting pc->mem_cgroup of newpage, take zone->lru_lock and avoid
+races with LRU handling.
+
+Background:
+ replace_page_cache_page() is called by FUSE code in its splice() handling.
+ Here, 'newpage' is replacing oldpage but this newpage is not a newly allocated
+ page and may be on LRU. LRU mis-accounting will be critical for memory cgroup
+ because rmdir() checks the whole LRU is empty and there is no account leak.
+ If a page is on the other LRU than it should be, rmdir() will fail.
+
+This bug was added in March 2011, but no bug report yet. I guess there
+are not many people who use memcg and FUSE at the same time with upstream
+kernels.
+
+The result of this bug is that admin cannot destroy a memcg because of
+account leak. So, no panic, no deadlock. And, even if an active cgroup
+exist, umount can succseed. So no problem at shutdown.
+
+Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Michal Hocko <mhocko@suse.cz>
+Cc: Miklos Szeredi <mszeredi@suse.cz>
+Cc: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/linux/memcontrol.h | 6 ++++++
+ mm/filemap.c | 18 ++----------------
+ mm/memcontrol.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 52 insertions(+), 16 deletions(-)
+
+diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
+index b87068a..81572af 100644
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -119,6 +119,8 @@ struct zone_reclaim_stat*
+ mem_cgroup_get_reclaim_stat_from_page(struct page *page);
+ extern void mem_cgroup_print_oom_info(struct mem_cgroup *memcg,
+ struct task_struct *p);
++extern void mem_cgroup_replace_page_cache(struct page *oldpage,
++ struct page *newpage);
+
+ #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
+ extern int do_swap_account;
+@@ -366,6 +368,10 @@ static inline
+ void mem_cgroup_count_vm_event(struct mm_struct *mm, enum vm_event_item idx)
+ {
+ }
++static inline void mem_cgroup_replace_page_cache(struct page *oldpage,
++ struct page *newpage)
++{
++}
+ #endif /* CONFIG_CGROUP_MEM_CONT */
+
+ #if !defined(CONFIG_CGROUP_MEM_RES_CTLR) || !defined(CONFIG_DEBUG_VM)
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 5f0a3c9..90286a4 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -393,24 +393,11 @@ EXPORT_SYMBOL(filemap_write_and_wait_range);
+ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
+ {
+ int error;
+- struct mem_cgroup *memcg = NULL;
+
+ VM_BUG_ON(!PageLocked(old));
+ VM_BUG_ON(!PageLocked(new));
+ VM_BUG_ON(new->mapping);
+
+- /*
+- * This is not page migration, but prepare_migration and
+- * end_migration does enough work for charge replacement.
+- *
+- * In the longer term we probably want a specialized function
+- * for moving the charge from old to new in a more efficient
+- * manner.
+- */
+- error = mem_cgroup_prepare_migration(old, new, &memcg, gfp_mask);
+- if (error)
+- return error;
+-
+ error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
+ if (!error) {
+ struct address_space *mapping = old->mapping;
+@@ -432,13 +419,12 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
+ if (PageSwapBacked(new))
+ __inc_zone_page_state(new, NR_SHMEM);
+ spin_unlock_irq(&mapping->tree_lock);
++ /* mem_cgroup codes must not be called under tree_lock */
++ mem_cgroup_replace_page_cache(old, new);
+ radix_tree_preload_end();
+ if (freepage)
+ freepage(old);
+ page_cache_release(old);
+- mem_cgroup_end_migration(memcg, old, new, true);
+- } else {
+- mem_cgroup_end_migration(memcg, old, new, false);
+ }
+
+ return error;
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index b63f5f7..f538e9b 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -3366,6 +3366,50 @@ void mem_cgroup_end_migration(struct mem_cgroup *memcg,
+ cgroup_release_and_wakeup_rmdir(&memcg->css);
+ }
+
++/*
++ * At replace page cache, newpage is not under any memcg but it's on
++ * LRU. So, this function doesn't touch res_counter but handles LRU
++ * in correct way. Both pages are locked so we cannot race with uncharge.
++ */
++void mem_cgroup_replace_page_cache(struct page *oldpage,
++ struct page *newpage)
++{
++ struct mem_cgroup *memcg;
++ struct page_cgroup *pc;
++ struct zone *zone;
++ enum charge_type type = MEM_CGROUP_CHARGE_TYPE_CACHE;
++ unsigned long flags;
++
++ if (mem_cgroup_disabled())
++ return;
++
++ pc = lookup_page_cgroup(oldpage);
++ /* fix accounting on old pages */
++ lock_page_cgroup(pc);
++ memcg = pc->mem_cgroup;
++ mem_cgroup_charge_statistics(memcg, PageCgroupCache(pc), -1);
++ ClearPageCgroupUsed(pc);
++ unlock_page_cgroup(pc);
++
++ if (PageSwapBacked(oldpage))
++ type = MEM_CGROUP_CHARGE_TYPE_SHMEM;
++
++ zone = page_zone(newpage);
++ pc = lookup_page_cgroup(newpage);
++ /*
++ * Even if newpage->mapping was NULL before starting replacement,
++ * the newpage may be on LRU(or pagevec for LRU) already. We lock
++ * LRU while we overwrite pc->mem_cgroup.
++ */
++ spin_lock_irqsave(&zone->lru_lock, flags);
++ if (PageLRU(newpage))
++ del_page_from_lru_list(zone, newpage, page_lru(newpage));
++ __mem_cgroup_commit_charge(memcg, newpage, 1, pc, type);
++ if (PageLRU(newpage))
++ add_page_to_lru_list(zone, newpage, page_lru(newpage));
++ spin_unlock_irqrestore(&zone->lru_lock, flags);
++}
++
+ #ifdef CONFIG_DEBUG_VM
+ static struct page_cgroup *lookup_page_cgroup_used(struct page *page)
+ {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0051-x86-Fix-mmap-random-address-range.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0051-x86-Fix-mmap-random-address-range.patch
new file mode 100644
index 0000000..828090b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0051-x86-Fix-mmap-random-address-range.patch
@@ -0,0 +1,47 @@
+From 706ade85b9f24b43d5e2b456b2eaf5acf4708fa7 Mon Sep 17 00:00:00 2001
+From: Ludwig Nussel <ludwig.nussel@suse.de>
+Date: Tue, 15 Nov 2011 14:46:46 -0800
+Subject: [PATCH 051/130] x86: Fix mmap random address range
+
+commit 9af0c7a6fa860698d080481f24a342ba74b68982 upstream.
+
+On x86_32 casting the unsigned int result of get_random_int() to
+long may result in a negative value. On x86_32 the range of
+mmap_rnd() therefore was -255 to 255. The 32bit mode on x86_64
+used 0 to 255 as intended.
+
+The bug was introduced by 675a081 ("x86: unify mmap_{32|64}.c")
+in January 2008.
+
+Signed-off-by: Ludwig Nussel <ludwig.nussel@suse.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: harvey.harrison@gmail.com
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Harvey Harrison <harvey.harrison@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Link: http://lkml.kernel.org/r/201111152246.pAFMklOB028527@wpaz5.hot.corp.google.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/mm/mmap.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
+index 4b5ba85..845df68 100644
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -75,9 +75,9 @@ static unsigned long mmap_rnd(void)
+ */
+ if (current->flags & PF_RANDOMIZE) {
+ if (mmap_is_ia32())
+- rnd = (long)get_random_int() % (1<<8);
++ rnd = get_random_int() % (1<<8);
+ else
+- rnd = (long)(get_random_int() % (1<<28));
++ rnd = get_random_int() % (1<<28);
+ }
+ return rnd << PAGE_SHIFT;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0052-UBI-fix-nameless-volumes-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0052-UBI-fix-nameless-volumes-handling.patch
new file mode 100644
index 0000000..ac5f8a8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0052-UBI-fix-nameless-volumes-handling.patch
@@ -0,0 +1,37 @@
+From fb25b1761ccc5ff102d6d4a8b2997437a9f1f999 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 13 Jan 2012 15:07:40 +0100
+Subject: [PATCH 052/130] UBI: fix nameless volumes handling
+
+commit 4a59c797a18917a5cf3ff7ade296b46134d91e6a upstream.
+
+Currently it's possible to create a volume without a name. E.g:
+ubimkvol -n 32 -s 2MiB -t static /dev/ubi0 -N ""
+
+After that vtbl_check() will always fail because it does not permit
+empty strings.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/mtd/ubi/cdev.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
+index 3320a50..ad76592 100644
+--- a/drivers/mtd/ubi/cdev.c
++++ b/drivers/mtd/ubi/cdev.c
+@@ -632,6 +632,9 @@ static int verify_mkvol_req(const struct ubi_device *ubi,
+ if (req->alignment != 1 && n)
+ goto bad;
+
++ if (!req->name[0] || !req->name_len)
++ goto bad;
++
+ if (req->name_len > UBI_VOL_NAME_MAX) {
+ err = -ENAMETOOLONG;
+ goto bad;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0053-UBI-fix-debugging-messages.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0053-UBI-fix-debugging-messages.patch
new file mode 100644
index 0000000..16cccbc
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0053-UBI-fix-debugging-messages.patch
@@ -0,0 +1,42 @@
+From 5aefc74158a4193f8e1f0ee3b9af21fd76ace6ca Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Tue, 10 Jan 2012 19:32:30 +0200
+Subject: [PATCH 053/130] UBI: fix debugging messages
+
+commit 72f0d453d81d35087b1d3ad7c8285628c2be6e1d upstream.
+
+Patch ab50ff684707031ed4bad2fdd313208ae392e5bb broke UBI debugging messages:
+before that commit when UBI debugging was enabled, users saw few useful
+debugging messages after attaching an MTD device. However, that patch turned
+'dbg_msg()' into 'pr_debug()', so to enable the debugging messages users have
+to enable them first via /sys/kernel/debug/dynamic_debug/control, which is
+very impractical.
+
+This commit makes 'dbg_msg()' to use 'printk()' instead of 'pr_debug()', just
+as it was before the breakage.
+
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/mtd/ubi/debug.h | 5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/mtd/ubi/debug.h b/drivers/mtd/ubi/debug.h
+index 64fbb00..ead2cd1 100644
+--- a/drivers/mtd/ubi/debug.h
++++ b/drivers/mtd/ubi/debug.h
+@@ -43,7 +43,10 @@
+ pr_debug("UBI DBG " type ": " fmt "\n", ##__VA_ARGS__)
+
+ /* Just a debugging messages not related to any specific UBI subsystem */
+-#define dbg_msg(fmt, ...) ubi_dbg_msg("msg", fmt, ##__VA_ARGS__)
++#define dbg_msg(fmt, ...) \
++ printk(KERN_DEBUG "UBI DBG (pid %d): %s: " fmt "\n", \
++ current->pid, __func__, ##__VA_ARGS__)
++
+ /* General debugging messages */
+ #define dbg_gen(fmt, ...) ubi_dbg_msg("gen", fmt, ##__VA_ARGS__)
+ /* Messages from the eraseblock association sub-system */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0054-UBI-make-vid_hdr-non-static.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0054-UBI-make-vid_hdr-non-static.patch
new file mode 100644
index 0000000..db26da8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0054-UBI-make-vid_hdr-non-static.patch
@@ -0,0 +1,36 @@
+From 7435d88f019f5550cf2d481b582e17ad65b061c0 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <rw@linutronix.de>
+Date: Thu, 22 Dec 2011 16:12:57 +0100
+Subject: [PATCH 054/130] UBI: make vid_hdr non-static
+
+commit 6bdccffe8c4268d02f71873102131fb6ed37ed9a upstream.
+
+Remove 'static' modifier from the 'vid_hdr' local variable. I do not know
+how it slipped in, but this is a bug and will break UBI if someone attaches
+2 UBI volumes at the same time.
+
+Artem: amended teh commit message, added -stable.
+
+Signed-off-by: Richard Weinberger <rw@linutronix.de>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/mtd/ubi/vtbl.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
+index 9ad18da..890754c 100644
+--- a/drivers/mtd/ubi/vtbl.c
++++ b/drivers/mtd/ubi/vtbl.c
+@@ -306,7 +306,7 @@ static int create_vtbl(struct ubi_device *ubi, struct ubi_scan_info *si,
+ int copy, void *vtbl)
+ {
+ int err, tries = 0;
+- static struct ubi_vid_hdr *vid_hdr;
++ struct ubi_vid_hdr *vid_hdr;
+ struct ubi_scan_leb *new_seb;
+
+ ubi_msg("create volume table (copy #%d)", copy + 1);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0055-UBIFS-fix-debugging-messages.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0055-UBIFS-fix-debugging-messages.patch
new file mode 100644
index 0000000..a27e70f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0055-UBIFS-fix-debugging-messages.patch
@@ -0,0 +1,41 @@
+From 1b3cf92e4f993769ceaf78263ccebc8eaf67a804 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Tue, 10 Jan 2012 19:32:30 +0200
+Subject: [PATCH 055/130] UBIFS: fix debugging messages
+
+commit d34315da9146253351146140ea4b277193ee5e5f upstream.
+
+Patch 56e46742e846e4de167dde0e1e1071ace1c882a5 broke UBIFS debugging messages:
+before that commit when UBIFS debugging was enabled, users saw few useful
+debugging messages after mount. However, that patch turned 'dbg_msg()' into
+'pr_debug()', so to enable the debugging messages users have to enable them
+first via /sys/kernel/debug/dynamic_debug/control, which is very impractical.
+
+This commit makes 'dbg_msg()' to use 'printk()' instead of 'pr_debug()', just
+as it was before the breakage.
+
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/ubifs/debug.h | 5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
+index 8d9c468..3f65829 100644
+--- a/fs/ubifs/debug.h
++++ b/fs/ubifs/debug.h
+@@ -190,7 +190,10 @@ extern spinlock_t dbg_lock;
+ } while (0)
+
+ /* Just a debugging messages not related to any specific UBIFS subsystem */
+-#define dbg_msg(fmt, ...) ubifs_dbg_msg("msg", fmt, ##__VA_ARGS__)
++#define dbg_msg(fmt, ...) \
++ printk(KERN_DEBUG "UBIFS DBG (pid %d): %s: " fmt "\n", current->pid, \
++ __func__, ##__VA_ARGS__)
++
+ /* General messages */
+ #define dbg_gen(fmt, ...) ubifs_dbg_msg("gen", fmt, ##__VA_ARGS__)
+ /* Additional journal messages */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch
new file mode 100644
index 0000000..26a4324
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch
@@ -0,0 +1,57 @@
+From fd7fabbc63907ebe083460603caa1ba54bef0e80 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Wed, 11 Jan 2012 15:13:27 +0200
+Subject: [PATCH 056/130] UBIFS: make debugging messages light again
+
+commit 1f5d78dc4823a85f112aaa2d0f17624f8c2a6c52 upstream.
+
+We switch to dynamic debugging in commit
+56e46742e846e4de167dde0e1e1071ace1c882a5 but did not take into account that
+now we do not control anymore whether a specific message is enabled or not.
+So now we lock the "dbg_lock" and release it in every debugging macro, which
+make them not so light-weight.
+
+This commit removes the "dbg_lock" protection from the debugging macros to
+fix the issue.
+
+The downside is that now our DBGKEY() stuff is broken, but this is not
+critical at all and will be fixed later.
+
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/ubifs/debug.h | 12 +++++-------
+ 1 files changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
+index 3f65829..c9d2941 100644
+--- a/fs/ubifs/debug.h
++++ b/fs/ubifs/debug.h
+@@ -175,19 +175,17 @@ const char *dbg_key_str1(const struct ubifs_info *c,
+ const union ubifs_key *key);
+
+ /*
+- * DBGKEY macros require @dbg_lock to be held, which it is in the dbg message
+- * macros.
++ * TODO: these macros are now broken because there is no locking around them
++ * and we use a global buffer for the key string. This means that in case of
++ * concurrent execution we will end up with incorrect and messy key strings.
+ */
+ #define DBGKEY(key) dbg_key_str0(c, (key))
+ #define DBGKEY1(key) dbg_key_str1(c, (key))
+
+ extern spinlock_t dbg_lock;
+
+-#define ubifs_dbg_msg(type, fmt, ...) do { \
+- spin_lock(&dbg_lock); \
+- pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__); \
+- spin_unlock(&dbg_lock); \
+-} while (0)
++#define ubifs_dbg_msg(type, fmt, ...) \
++ pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__)
+
+ /* Just a debugging messages not related to any specific UBIFS subsystem */
+ #define dbg_msg(fmt, ...) \
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch
new file mode 100644
index 0000000..6ebe7da
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch
@@ -0,0 +1,197 @@
+From 2c28d6c10fef2ab34270bd90ce2b75207cb951ee Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Thu, 12 Jan 2012 20:32:03 +0100
+Subject: [PATCH 057/130] i2c: Fix error value returned by several bus drivers
+
+commit 7c1f59c9d5caf3a84f35549b5d58f3c055a68da5 upstream.
+
+When adding checks for ACPI resource conflicts to many bus drivers,
+not enough attention was paid to the error paths, and for several
+drivers this causes 0 to be returned on error in some cases. Fix this
+by properly returning a non-zero value on every error.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/i2c/busses/i2c-ali1535.c | 11 +++++++----
+ drivers/i2c/busses/i2c-nforce2.c | 2 +-
+ drivers/i2c/busses/i2c-sis5595.c | 4 ++--
+ drivers/i2c/busses/i2c-sis630.c | 6 +++++-
+ drivers/i2c/busses/i2c-viapro.c | 7 +++++--
+ 5 files changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c
+index b6807db..5b667e5 100644
+--- a/drivers/i2c/busses/i2c-ali1535.c
++++ b/drivers/i2c/busses/i2c-ali1535.c
+@@ -140,7 +140,7 @@ static unsigned short ali1535_smba;
+ defined to make the transition easier. */
+ static int __devinit ali1535_setup(struct pci_dev *dev)
+ {
+- int retval = -ENODEV;
++ int retval;
+ unsigned char temp;
+
+ /* Check the following things:
+@@ -155,6 +155,7 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ if (ali1535_smba == 0) {
+ dev_warn(&dev->dev,
+ "ALI1535_smb region uninitialized - upgrade BIOS?\n");
++ retval = -ENODEV;
+ goto exit;
+ }
+
+@@ -167,6 +168,7 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ ali1535_driver.name)) {
+ dev_err(&dev->dev, "ALI1535_smb region 0x%x already in use!\n",
+ ali1535_smba);
++ retval = -EBUSY;
+ goto exit;
+ }
+
+@@ -174,6 +176,7 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ pci_read_config_byte(dev, SMBCFG, &temp);
+ if ((temp & ALI1535_SMBIO_EN) == 0) {
+ dev_err(&dev->dev, "SMB device not enabled - upgrade BIOS?\n");
++ retval = -ENODEV;
+ goto exit_free;
+ }
+
+@@ -181,6 +184,7 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ pci_read_config_byte(dev, SMBHSTCFG, &temp);
+ if ((temp & 1) == 0) {
+ dev_err(&dev->dev, "SMBus controller not enabled - upgrade BIOS?\n");
++ retval = -ENODEV;
+ goto exit_free;
+ }
+
+@@ -198,12 +202,11 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ dev_dbg(&dev->dev, "SMBREV = 0x%X\n", temp);
+ dev_dbg(&dev->dev, "ALI1535_smba = 0x%X\n", ali1535_smba);
+
+- retval = 0;
+-exit:
+- return retval;
++ return 0;
+
+ exit_free:
+ release_region(ali1535_smba, ALI1535_SMB_IOSIZE);
++exit:
+ return retval;
+ }
+
+diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
+index ff1e127..4853b52 100644
+--- a/drivers/i2c/busses/i2c-nforce2.c
++++ b/drivers/i2c/busses/i2c-nforce2.c
+@@ -356,7 +356,7 @@ static int __devinit nforce2_probe_smb (struct pci_dev *dev, int bar,
+ error = acpi_check_region(smbus->base, smbus->size,
+ nforce2_driver.name);
+ if (error)
+- return -1;
++ return error;
+
+ if (!request_region(smbus->base, smbus->size, nforce2_driver.name)) {
+ dev_err(&smbus->adapter.dev, "Error requesting region %02x .. %02X for %s\n",
+diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
+index 4375866..6d60284 100644
+--- a/drivers/i2c/busses/i2c-sis5595.c
++++ b/drivers/i2c/busses/i2c-sis5595.c
+@@ -147,7 +147,7 @@ static int __devinit sis5595_setup(struct pci_dev *SIS5595_dev)
+ u16 a;
+ u8 val;
+ int *i;
+- int retval = -ENODEV;
++ int retval;
+
+ /* Look for imposters */
+ for (i = blacklist; *i != 0; i++) {
+@@ -223,7 +223,7 @@ static int __devinit sis5595_setup(struct pci_dev *SIS5595_dev)
+
+ error:
+ release_region(sis5595_base + SMB_INDEX, 2);
+- return retval;
++ return -ENODEV;
+ }
+
+ static int sis5595_transaction(struct i2c_adapter *adap)
+diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
+index e6f539e..b617fd0 100644
+--- a/drivers/i2c/busses/i2c-sis630.c
++++ b/drivers/i2c/busses/i2c-sis630.c
+@@ -393,7 +393,7 @@ static int __devinit sis630_setup(struct pci_dev *sis630_dev)
+ {
+ unsigned char b;
+ struct pci_dev *dummy = NULL;
+- int retval = -ENODEV, i;
++ int retval, i;
+
+ /* check for supported SiS devices */
+ for (i=0; supported[i] > 0 ; i++) {
+@@ -418,18 +418,21 @@ static int __devinit sis630_setup(struct pci_dev *sis630_dev)
+ */
+ if (pci_read_config_byte(sis630_dev, SIS630_BIOS_CTL_REG,&b)) {
+ dev_err(&sis630_dev->dev, "Error: Can't read bios ctl reg\n");
++ retval = -ENODEV;
+ goto exit;
+ }
+ /* if ACPI already enabled , do nothing */
+ if (!(b & 0x80) &&
+ pci_write_config_byte(sis630_dev, SIS630_BIOS_CTL_REG, b | 0x80)) {
+ dev_err(&sis630_dev->dev, "Error: Can't enable ACPI\n");
++ retval = -ENODEV;
+ goto exit;
+ }
+
+ /* Determine the ACPI base address */
+ if (pci_read_config_word(sis630_dev,SIS630_ACPI_BASE_REG,&acpi_base)) {
+ dev_err(&sis630_dev->dev, "Error: Can't determine ACPI base address\n");
++ retval = -ENODEV;
+ goto exit;
+ }
+
+@@ -445,6 +448,7 @@ static int __devinit sis630_setup(struct pci_dev *sis630_dev)
+ sis630_driver.name)) {
+ dev_err(&sis630_dev->dev, "SMBus registers 0x%04x-0x%04x already "
+ "in use!\n", acpi_base + SMB_STS, acpi_base + SMB_SAA);
++ retval = -EBUSY;
+ goto exit;
+ }
+
+diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
+index 0b012f1..58261d4 100644
+--- a/drivers/i2c/busses/i2c-viapro.c
++++ b/drivers/i2c/busses/i2c-viapro.c
+@@ -324,7 +324,7 @@ static int __devinit vt596_probe(struct pci_dev *pdev,
+ const struct pci_device_id *id)
+ {
+ unsigned char temp;
+- int error = -ENODEV;
++ int error;
+
+ /* Determine the address of the SMBus areas */
+ if (force_addr) {
+@@ -390,6 +390,7 @@ found:
+ dev_err(&pdev->dev, "SMBUS: Error: Host SMBus "
+ "controller not enabled! - upgrade BIOS or "
+ "use force=1\n");
++ error = -ENODEV;
+ goto release_region;
+ }
+ }
+@@ -422,9 +423,11 @@ found:
+ "SMBus Via Pro adapter at %04x", vt596_smba);
+
+ vt596_pdev = pci_dev_get(pdev);
+- if (i2c_add_adapter(&vt596_adapter)) {
++ error = i2c_add_adapter(&vt596_adapter);
++ if (error) {
+ pci_dev_put(vt596_pdev);
+ vt596_pdev = NULL;
++ goto release_region;
+ }
+
+ /* Always return failure here. This is to allow other drivers to bind
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch
new file mode 100644
index 0000000..b164455
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch
@@ -0,0 +1,39 @@
+From ac64016ec74f6fbe586ba55f75a87e6459ba0760 Mon Sep 17 00:00:00 2001
+From: Girish K S <girish.shivananjappa@linaro.org>
+Date: Thu, 15 Dec 2011 17:27:42 +0530
+Subject: [PATCH 058/130] mmc: core: Fix voltage select in DDR mode
+
+commit 913047e9e5787a90696533a9f109552b7694ecc9 upstream.
+
+This patch fixes the wrong comparison before setting the interface
+voltage in DDR mode.
+
+The assignment to the variable ddr before comaprison is either
+ddr = MMC_1_2V_DDR_MODE; or ddr == MMC_1_8V_DDR_MODE. But the comparison
+is done with the extended csd value if ddr == EXT_CSD_CARD_TYPE_DDR_1_2V.
+
+Signed-off-by: Girish K S <girish.shivananjappa@linaro.org>
+Acked-by: Subhash Jadavani <subhashj@codeaurora.org>
+Acked-by: Philip Rakity <prakity@marvell.com>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/mmc/core/mmc.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index d240427..fb7c27f 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1048,7 +1048,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
+ *
+ * WARNING: eMMC rules are NOT the same as SD DDR
+ */
+- if (ddr == EXT_CSD_CARD_TYPE_DDR_1_2V) {
++ if (ddr == MMC_1_2V_DDR_MODE) {
+ err = mmc_set_signal_voltage(host,
+ MMC_SIGNAL_VOLTAGE_120, 0);
+ if (err)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch
new file mode 100644
index 0000000..4f55423
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch
@@ -0,0 +1,39 @@
+From c1e5c579b2911ebddcdd5cbebc91edbe3a82af4d Mon Sep 17 00:00:00 2001
+From: Aaron Lu <aaron.lu@amd.com>
+Date: Wed, 28 Dec 2011 11:11:12 +0800
+Subject: [PATCH 059/130] mmc: sdhci: Fix tuning timer incorrect setting when
+ suspending host
+
+commit c6ced0db08010ed75df221a2946c5228454b38d5 upstream.
+
+When suspending host, the tuning timer shoule be deactivated.
+And the HOST_NEEDS_TUNING flag should be set after tuning timer is
+deactivated.
+
+Signed-off-by: Philip Rakity <prakity@marvell.com>
+Signed-off-by: Aaron Lu <aaron.lu@amd.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/mmc/host/sdhci.c | 3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 19ed580..9279c1b 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -2336,9 +2336,8 @@ int sdhci_suspend_host(struct sdhci_host *host)
+ /* Disable tuning since we are suspending */
+ if (host->version >= SDHCI_SPEC_300 && host->tuning_count &&
+ host->tuning_mode == SDHCI_TUNING_MODE_1) {
++ del_timer_sync(&host->tuning_timer);
+ host->flags &= ~SDHCI_NEEDS_RETUNING;
+- mod_timer(&host->tuning_timer, jiffies +
+- host->tuning_count * HZ);
+ }
+
+ ret = mmc_suspend_host(host->mmc);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch
new file mode 100644
index 0000000..1057d85
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch
@@ -0,0 +1,38 @@
+From 2bcbb8b0e7cecfd753f470dfa9f0780f7c07e28d Mon Sep 17 00:00:00 2001
+From: Alexander Elbs <alex@segv.de>
+Date: Tue, 3 Jan 2012 23:26:53 -0500
+Subject: [PATCH 060/130] mmc: sd: Fix SDR12 timing regression
+
+commit dd8df17fe83483d7ea06ff229895e35a42071599 upstream.
+
+This patch fixes a failure to recognize SD cards reported on a Dell
+Vostro with O2 Micro SD card reader. Patch 49c468f ("mmc: sd: add
+support for uhs bus speed mode selection") caused the problem, by
+setting the SDHCI_CTRL_HISPD flag even for legacy timings.
+
+Signed-off-by: Alexander Elbs <alex@segv.de>
+Acked-by: Philip Rakity <prakity@marvell.com>
+Acked-by: Arindam Nath <arindam.nath@amd.com>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/mmc/host/sdhci.c | 3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 9279c1b..6ce32a7 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1364,8 +1364,7 @@ static void sdhci_do_set_ios(struct sdhci_host *host, struct mmc_ios *ios)
+ if ((ios->timing == MMC_TIMING_UHS_SDR50) ||
+ (ios->timing == MMC_TIMING_UHS_SDR104) ||
+ (ios->timing == MMC_TIMING_UHS_DDR50) ||
+- (ios->timing == MMC_TIMING_UHS_SDR25) ||
+- (ios->timing == MMC_TIMING_UHS_SDR12))
++ (ios->timing == MMC_TIMING_UHS_SDR25))
+ ctrl |= SDHCI_CTRL_HISPD;
+
+ ctrl_2 = sdhci_readw(host, SDHCI_HOST_CONTROL2);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch
new file mode 100644
index 0000000..966eaf4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch
@@ -0,0 +1,54 @@
+From 367f7884638cda94299eb0e38e200031a5d3130d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 5 Jan 2012 02:27:57 -0300
+Subject: [PATCH 061/130] V4L/DVB: v4l2-ioctl: integer overflow in
+ video_usercopy()
+
+commit 6c06108be53ca5e94d8b0e93883d534dd9079646 upstream.
+
+If ctrls->count is too high the multiplication could overflow and
+array_size would be lower than expected. Mauro and Hans Verkuil
+suggested that we cap it at 1024. That comes from the maximum
+number of controls with lots of room for expantion.
+
+$ grep V4L2_CID include/linux/videodev2.h | wc -l
+211
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/media/video/v4l2-ioctl.c | 4 ++++
+ include/linux/videodev2.h | 1 +
+ 2 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
+index e1da8fc..639abee 100644
+--- a/drivers/media/video/v4l2-ioctl.c
++++ b/drivers/media/video/v4l2-ioctl.c
+@@ -2226,6 +2226,10 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
+ struct v4l2_ext_controls *ctrls = parg;
+
+ if (ctrls->count != 0) {
++ if (ctrls->count > V4L2_CID_MAX_CTRLS) {
++ ret = -EINVAL;
++ break;
++ }
+ *user_ptr = (void __user *)ctrls->controls;
+ *kernel_ptr = (void *)&ctrls->controls;
+ *array_size = sizeof(struct v4l2_ext_control)
+diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
+index 4b752d5..45a7698 100644
+--- a/include/linux/videodev2.h
++++ b/include/linux/videodev2.h
+@@ -1131,6 +1131,7 @@ struct v4l2_querymenu {
+ #define V4L2_CTRL_FLAG_NEXT_CTRL 0x80000000
+
+ /* User-class control IDs defined by V4L2 */
++#define V4L2_CID_MAX_CTRLS 1024
+ #define V4L2_CID_BASE (V4L2_CTRL_CLASS_USER | 0x900)
+ #define V4L2_CID_USER_BASE V4L2_CID_BASE
+ /* IDs reserved for driver specific controls */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch
new file mode 100644
index 0000000..ce9352d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch
@@ -0,0 +1,71 @@
+From b8292304bc243db5cc68c27e19c7c14c15e19263 Mon Sep 17 00:00:00 2001
+From: Gleb Natapov <gleb@redhat.com>
+Date: Sun, 8 Jan 2012 17:07:28 +0200
+Subject: [PATCH 062/130] Unused iocbs in a batch should not be accounted as
+ active.
+
+commit 69e4747ee9727d660b88d7e1efe0f4afcb35db1b upstream.
+
+Since commit 080d676de095 ("aio: allocate kiocbs in batches") iocbs are
+allocated in a batch during processing of first iocbs. All iocbs in a
+batch are automatically added to ctx->active_reqs list and accounted in
+ctx->reqs_active.
+
+If one (not the last one) of iocbs submitted by an user fails, further
+iocbs are not processed, but they are still present in ctx->active_reqs
+and accounted in ctx->reqs_active. This causes process to stuck in a D
+state in wait_for_all_aios() on exit since ctx->reqs_active will never
+go down to zero. Furthermore since kiocb_batch_free() frees iocb
+without removing it from active_reqs list the list become corrupted
+which may cause oops.
+
+Fix this by removing iocb from ctx->active_reqs and updating
+ctx->reqs_active in kiocb_batch_free().
+
+Signed-off-by: Gleb Natapov <gleb@redhat.com>
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/aio.c | 11 +++++++++--
+ 1 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/fs/aio.c b/fs/aio.c
+index 78c514c..969beb0 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -476,14 +476,21 @@ static void kiocb_batch_init(struct kiocb_batch *batch, long total)
+ batch->count = total;
+ }
+
+-static void kiocb_batch_free(struct kiocb_batch *batch)
++static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
+ {
+ struct kiocb *req, *n;
+
++ if (list_empty(&batch->head))
++ return;
++
++ spin_lock_irq(&ctx->ctx_lock);
+ list_for_each_entry_safe(req, n, &batch->head, ki_batch) {
+ list_del(&req->ki_batch);
++ list_del(&req->ki_list);
+ kmem_cache_free(kiocb_cachep, req);
++ ctx->reqs_active--;
+ }
++ spin_unlock_irq(&ctx->ctx_lock);
+ }
+
+ /*
+@@ -1742,7 +1749,7 @@ long do_io_submit(aio_context_t ctx_id, long nr,
+ }
+ blk_finish_plug(&plug);
+
+- kiocb_batch_free(&batch);
++ kiocb_batch_free(ctx, &batch);
+ put_ioctx(ctx);
+ return i ? i : ret;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch
new file mode 100644
index 0000000..617f4b3
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch
@@ -0,0 +1,227 @@
+From dedf47c7159cb4b5d1744557aa744145f161eac5 Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@redhat.com>
+Date: Mon, 5 Dec 2011 18:22:48 +0100
+Subject: [PATCH 063/130] ftrace: Fix unregister ftrace_ops accounting
+
+commit 30fb6aa74011dcf595f306ca2727254d708b786e upstream.
+
+Multiple users of the function tracer can register their functions
+with the ftrace_ops structure. The accounting within ftrace will
+update the counter on each function record that is being traced.
+When the ftrace_ops filtering adds or removes functions, the
+function records will be updated accordingly if the ftrace_ops is
+still registered.
+
+When a ftrace_ops is removed, the counter of the function records,
+that the ftrace_ops traces, are decremented. When they reach zero
+the functions that they represent are modified to stop calling the
+mcount code.
+
+When changes are made, the code is updated via stop_machine() with
+a command passed to the function to tell it what to do. There is an
+ENABLE and DISABLE command that tells the called function to enable
+or disable the functions. But the ENABLE is really a misnomer as it
+should just update the records, as records that have been enabled
+and now have a count of zero should be disabled.
+
+The DISABLE command is used to disable all functions regardless of
+their counter values. This is the big off switch and is not the
+complement of the ENABLE command.
+
+To make matters worse, when a ftrace_ops is unregistered and there
+is another ftrace_ops registered, neither the DISABLE nor the
+ENABLE command are set when calling into the stop_machine() function
+and the records will not be updated to match their counter. A command
+is passed to that function that will update the mcount code to call
+the registered callback directly if it is the only one left. This
+means that the ftrace_ops that is still registered will have its callback
+called by all functions that have been set for it as well as the ftrace_ops
+that was just unregistered.
+
+Here's a way to trigger this bug. Compile the kernel with
+CONFIG_FUNCTION_PROFILER set and with CONFIG_FUNCTION_GRAPH not set:
+
+ CONFIG_FUNCTION_PROFILER=y
+ # CONFIG_FUNCTION_GRAPH is not set
+
+This will force the function profiler to use the function tracer instead
+of the function graph tracer.
+
+ # cd /sys/kernel/debug/tracing
+ # echo schedule > set_ftrace_filter
+ # echo function > current_tracer
+ # cat set_ftrace_filter
+ schedule
+ # cat trace
+ # tracer: nop
+ #
+ # entries-in-buffer/entries-written: 692/68108025 #P:4
+ #
+ # _-----=> irqs-off
+ # / _----=> need-resched
+ # | / _---=> hardirq/softirq
+ # || / _--=> preempt-depth
+ # ||| / delay
+ # TASK-PID CPU# |||| TIMESTAMP FUNCTION
+ # | | | |||| | |
+ kworker/0:2-909 [000] .... 531.235574: schedule <-worker_thread
+ <idle>-0 [001] .N.. 531.235575: schedule <-cpu_idle
+ kworker/0:2-909 [000] .... 531.235597: schedule <-worker_thread
+ sshd-2563 [001] .... 531.235647: schedule <-schedule_hrtimeout_range_clock
+
+ # echo 1 > function_profile_enabled
+ # echo 0 > function_porfile_enabled
+ # cat set_ftrace_filter
+ schedule
+ # cat trace
+ # tracer: function
+ #
+ # entries-in-buffer/entries-written: 159701/118821262 #P:4
+ #
+ # _-----=> irqs-off
+ # / _----=> need-resched
+ # | / _---=> hardirq/softirq
+ # || / _--=> preempt-depth
+ # ||| / delay
+ # TASK-PID CPU# |||| TIMESTAMP FUNCTION
+ # | | | |||| | |
+ <idle>-0 [002] ...1 604.870655: local_touch_nmi <-cpu_idle
+ <idle>-0 [002] d..1 604.870655: enter_idle <-cpu_idle
+ <idle>-0 [002] d..1 604.870656: atomic_notifier_call_chain <-enter_idle
+ <idle>-0 [002] d..1 604.870656: __atomic_notifier_call_chain <-atomic_notifier_call_chain
+
+The same problem could have happened with the trace_probe_ops,
+but they are modified with the set_frace_filter file which does the
+update at closure of the file.
+
+The simple solution is to change ENABLE to UPDATE and call it every
+time an ftrace_ops is unregistered.
+
+Link: http://lkml.kernel.org/r/1323105776-26961-3-git-send-email-jolsa@redhat.com
+
+Signed-off-by: Jiri Olsa <jolsa@redhat.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ kernel/trace/ftrace.c | 27 +++++++++++++--------------
+ 1 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index b1e8943..25b4f4d 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -948,7 +948,7 @@ struct ftrace_func_probe {
+ };
+
+ enum {
+- FTRACE_ENABLE_CALLS = (1 << 0),
++ FTRACE_UPDATE_CALLS = (1 << 0),
+ FTRACE_DISABLE_CALLS = (1 << 1),
+ FTRACE_UPDATE_TRACE_FUNC = (1 << 2),
+ FTRACE_START_FUNC_RET = (1 << 3),
+@@ -1519,7 +1519,7 @@ int ftrace_text_reserved(void *start, void *end)
+
+
+ static int
+-__ftrace_replace_code(struct dyn_ftrace *rec, int enable)
++__ftrace_replace_code(struct dyn_ftrace *rec, int update)
+ {
+ unsigned long ftrace_addr;
+ unsigned long flag = 0UL;
+@@ -1527,17 +1527,17 @@ __ftrace_replace_code(struct dyn_ftrace *rec, int enable)
+ ftrace_addr = (unsigned long)FTRACE_ADDR;
+
+ /*
+- * If we are enabling tracing:
++ * If we are updating calls:
+ *
+ * If the record has a ref count, then we need to enable it
+ * because someone is using it.
+ *
+ * Otherwise we make sure its disabled.
+ *
+- * If we are disabling tracing, then disable all records that
++ * If we are disabling calls, then disable all records that
+ * are enabled.
+ */
+- if (enable && (rec->flags & ~FTRACE_FL_MASK))
++ if (update && (rec->flags & ~FTRACE_FL_MASK))
+ flag = FTRACE_FL_ENABLED;
+
+ /* If the state of this record hasn't changed, then do nothing */
+@@ -1553,7 +1553,7 @@ __ftrace_replace_code(struct dyn_ftrace *rec, int enable)
+ return ftrace_make_nop(NULL, rec, ftrace_addr);
+ }
+
+-static void ftrace_replace_code(int enable)
++static void ftrace_replace_code(int update)
+ {
+ struct dyn_ftrace *rec;
+ struct ftrace_page *pg;
+@@ -1567,7 +1567,7 @@ static void ftrace_replace_code(int enable)
+ if (rec->flags & FTRACE_FL_FREE)
+ continue;
+
+- failed = __ftrace_replace_code(rec, enable);
++ failed = __ftrace_replace_code(rec, update);
+ if (failed) {
+ ftrace_bug(failed, rec->ip);
+ /* Stop processing */
+@@ -1623,7 +1623,7 @@ static int __ftrace_modify_code(void *data)
+ */
+ function_trace_stop++;
+
+- if (*command & FTRACE_ENABLE_CALLS)
++ if (*command & FTRACE_UPDATE_CALLS)
+ ftrace_replace_code(1);
+ else if (*command & FTRACE_DISABLE_CALLS)
+ ftrace_replace_code(0);
+@@ -1691,7 +1691,7 @@ static int ftrace_startup(struct ftrace_ops *ops, int command)
+ return -ENODEV;
+
+ ftrace_start_up++;
+- command |= FTRACE_ENABLE_CALLS;
++ command |= FTRACE_UPDATE_CALLS;
+
+ /* ops marked global share the filter hashes */
+ if (ops->flags & FTRACE_OPS_FL_GLOBAL) {
+@@ -1743,8 +1743,7 @@ static void ftrace_shutdown(struct ftrace_ops *ops, int command)
+ if (ops != &global_ops || !global_start_up)
+ ops->flags &= ~FTRACE_OPS_FL_ENABLED;
+
+- if (!ftrace_start_up)
+- command |= FTRACE_DISABLE_CALLS;
++ command |= FTRACE_UPDATE_CALLS;
+
+ if (saved_ftrace_func != ftrace_trace_function) {
+ saved_ftrace_func = ftrace_trace_function;
+@@ -1766,7 +1765,7 @@ static void ftrace_startup_sysctl(void)
+ saved_ftrace_func = NULL;
+ /* ftrace_start_up is true if we want ftrace running */
+ if (ftrace_start_up)
+- ftrace_run_update_code(FTRACE_ENABLE_CALLS);
++ ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+ }
+
+ static void ftrace_shutdown_sysctl(void)
+@@ -2919,7 +2918,7 @@ ftrace_set_regex(struct ftrace_ops *ops, unsigned char *buf, int len,
+ ret = ftrace_hash_move(ops, enable, orig_hash, hash);
+ if (!ret && ops->flags & FTRACE_OPS_FL_ENABLED
+ && ftrace_enabled)
+- ftrace_run_update_code(FTRACE_ENABLE_CALLS);
++ ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+
+ mutex_unlock(&ftrace_lock);
+
+@@ -3107,7 +3106,7 @@ ftrace_regex_release(struct inode *inode, struct file *file)
+ orig_hash, iter->hash);
+ if (!ret && (iter->ops->flags & FTRACE_OPS_FL_ENABLED)
+ && ftrace_enabled)
+- ftrace_run_update_code(FTRACE_ENABLE_CALLS);
++ ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+
+ mutex_unlock(&ftrace_lock);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch
new file mode 100644
index 0000000..8d788a5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch
@@ -0,0 +1,68 @@
+From 700e5b37d0da1b3688992c53abba2ba9c123c547 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt@redhat.com>
+Date: Fri, 13 Jan 2012 17:50:39 -0500
+Subject: [PATCH 064/130] kconfig/streamline-config.pl: Simplify backslash
+ line concatination
+
+commit d060d963e88f3e990cec2fe5214de49de9a49eca upstream.
+
+Simplify the way lines ending with backslashes (continuation) in Makefiles
+is parsed. This is needed to implement a necessary fix.
+
+Tested-by: Thomas Lange <thomas-lange2@gmx.de>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ scripts/kconfig/streamline_config.pl | 25 ++++++++++++-------------
+ 1 files changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
+index ec7afce..42ef5ea 100644
+--- a/scripts/kconfig/streamline_config.pl
++++ b/scripts/kconfig/streamline_config.pl
+@@ -253,17 +253,22 @@ if ($kconfig) {
+ # Read all Makefiles to map the configs to the objects
+ foreach my $makefile (@makefiles) {
+
+- my $cont = 0;
++ my $line = "";
+
+ open(MIN,$makefile) || die "Can't open $makefile";
+ while (<MIN>) {
+- my $objs;
+-
+- # is this a line after a line with a backslash?
+- if ($cont && /(\S.*)$/) {
+- $objs = $1;
++ # if this line ends with a backslash, continue
++ chomp;
++ if (/^(.*)\\$/) {
++ $line .= $1;
++ next;
+ }
+- $cont = 0;
++
++ $line .= $_;
++ $_ = $line;
++ $line = "";
++
++ my $objs;
+
+ # collect objects after obj-$(CONFIG_FOO_BAR)
+ if (/obj-\$\((CONFIG_[^\)]*)\)\s*[+:]?=\s*(.*)/) {
+@@ -271,12 +276,6 @@ foreach my $makefile (@makefiles) {
+ $objs = $2;
+ }
+ if (defined($objs)) {
+- # test if the line ends with a backslash
+- if ($objs =~ m,(.*)\\$,) {
+- $objs = $1;
+- $cont = 1;
+- }
+-
+ foreach my $obj (split /\s+/,$objs) {
+ $obj =~ s/-/_/g;
+ if ($obj =~ /(.*)\.o$/) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch
new file mode 100644
index 0000000..443ada8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch
@@ -0,0 +1,98 @@
+From 4f45c91ec4a5953d1a1bf1d88d8bf4fa5b0273a0 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt@redhat.com>
+Date: Fri, 13 Jan 2012 17:53:40 -0500
+Subject: [PATCH 065/130] kconfig/streamline-config.pl: Fix parsing Makefile
+ with variables
+
+commit 364212fddaaa60c5a64f67a0f5624ad996ecc8a0 upstream.
+
+Thomas Lange reported that when he did a 'make localmodconfig', his
+config was missing the brcmsmac driver, even though he had the module
+loaded.
+
+Looking into this, I found the file:
+drivers/net/wireless/brcm80211/brcmsmac/Makefile
+had the following in the Makefile:
+
+MODULEPFX := brcmsmac
+
+obj-$(CONFIG_BRCMSMAC) += $(MODULEPFX).o
+
+The way streamline-config.pl works, is parsing all the
+ obj-$(CONFIG_FOO) += foo.o
+lines to find that CONFIG_FOO belongs to the module foo.ko.
+
+But in this case, the brcmsmac.o was not used, but a variable in its place.
+
+By changing streamline-config.pl to remember defined variables in Makefiles
+and substituting them when they are used in the obj-X lines, allows
+Thomas (and others) to have their brcmsmac module stay configured
+when it is loaded and running "make localmodconfig".
+
+Reported-by: Thomas Lange <thomas-lange2@gmx.de>
+Tested-by: Thomas Lange <thomas-lange2@gmx.de>
+Cc: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ scripts/kconfig/streamline_config.pl | 29 +++++++++++++++++++++++++++++
+ 1 files changed, 29 insertions(+), 0 deletions(-)
+
+diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
+index 42ef5ea..bccf07d 100644
+--- a/scripts/kconfig/streamline_config.pl
++++ b/scripts/kconfig/streamline_config.pl
+@@ -250,10 +250,33 @@ if ($kconfig) {
+ read_kconfig($kconfig);
+ }
+
++sub convert_vars {
++ my ($line, %vars) = @_;
++
++ my $process = "";
++
++ while ($line =~ s/^(.*?)(\$\((.*?)\))//) {
++ my $start = $1;
++ my $variable = $2;
++ my $var = $3;
++
++ if (defined($vars{$var})) {
++ $process .= $start . $vars{$var};
++ } else {
++ $process .= $start . $variable;
++ }
++ }
++
++ $process .= $line;
++
++ return $process;
++}
++
+ # Read all Makefiles to map the configs to the objects
+ foreach my $makefile (@makefiles) {
+
+ my $line = "";
++ my %make_vars;
+
+ open(MIN,$makefile) || die "Can't open $makefile";
+ while (<MIN>) {
+@@ -270,10 +293,16 @@ foreach my $makefile (@makefiles) {
+
+ my $objs;
+
++ $_ = convert_vars($_, %make_vars);
++
+ # collect objects after obj-$(CONFIG_FOO_BAR)
+ if (/obj-\$\((CONFIG_[^\)]*)\)\s*[+:]?=\s*(.*)/) {
+ $var = $1;
+ $objs = $2;
++
++ # check if variables are set
++ } elsif (/^\s*(\S+)\s*[:]?=\s*(.*\S)/) {
++ $make_vars{$1} = $2;
+ }
+ if (defined($objs)) {
+ foreach my $obj (split /\s+/,$objs) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch
new file mode 100644
index 0000000..5f9ecc3
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch
@@ -0,0 +1,60 @@
+From 843e6d14e855cc86d260b1077a3226d3344376af Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Thu, 22 Dec 2011 18:22:49 -0700
+Subject: [PATCH 066/130] svcrpc: fix double-free on shutdown of nfsd after
+ changing pool mode
+
+commit 61c8504c428edcebf23b97775a129c5b393a302b upstream.
+
+The pool_to and to_pool fields of the global svc_pool_map are freed on
+shutdown, but are initialized in nfsd startup only in the
+SVC_POOL_PERCPU and SVC_POOL_PERNODE cases.
+
+They *are* initialized to zero on kernel startup. So as long as you use
+only SVC_POOL_GLOBAL (the default), this will never be a problem.
+
+You're also OK if you only ever use SVC_POOL_PERCPU or SVC_POOL_PERNODE.
+
+However, the following sequence events leads to a double-free:
+
+ 1. set SVC_POOL_PERCPU or SVC_POOL_PERNODE
+ 2. start nfsd: both fields are initialized.
+ 3. shutdown nfsd: both fields are freed.
+ 4. set SVC_POOL_GLOBAL
+ 5. start nfsd: the fields are left untouched.
+ 6. shutdown nfsd: now we try to free them again.
+
+Step 4 is actually unnecessary, since (for some bizarre reason), nfsd
+automatically resets the pool mode to SVC_POOL_GLOBAL on shutdown.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/sunrpc/svc.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index 6e03888..5443ffd 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -167,6 +167,7 @@ svc_pool_map_alloc_arrays(struct svc_pool_map *m, unsigned int maxpools)
+
+ fail_free:
+ kfree(m->to_pool);
++ m->to_pool = NULL;
+ fail:
+ return -ENOMEM;
+ }
+@@ -287,7 +288,9 @@ svc_pool_map_put(void)
+ if (!--m->count) {
+ m->mode = SVC_POOL_DEFAULT;
+ kfree(m->to_pool);
++ m->to_pool = NULL;
+ kfree(m->pool_to);
++ m->pool_to = NULL;
+ m->npools = 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch
new file mode 100644
index 0000000..021a468
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch
@@ -0,0 +1,85 @@
+From c132bb68434e1dcfc0e148d1e677f4433d6cf075 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 29 Nov 2011 11:35:35 -0500
+Subject: [PATCH 067/130] svcrpc: destroy server sockets all at once
+
+commit 2fefb8a09e7ed251ae8996e0c69066e74c5aa560 upstream.
+
+There's no reason I can see that we need to call sv_shutdown between
+closing the two lists of sockets.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/linux/sunrpc/svcsock.h | 2 +-
+ net/sunrpc/svc.c | 7 +------
+ net/sunrpc/svc_xprt.c | 11 ++++++++++-
+ 3 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/include/linux/sunrpc/svcsock.h b/include/linux/sunrpc/svcsock.h
+index 85c50b4..c84e974 100644
+--- a/include/linux/sunrpc/svcsock.h
++++ b/include/linux/sunrpc/svcsock.h
+@@ -34,7 +34,7 @@ struct svc_sock {
+ /*
+ * Function prototypes.
+ */
+-void svc_close_all(struct list_head *);
++void svc_close_all(struct svc_serv *);
+ int svc_recv(struct svc_rqst *, long);
+ int svc_send(struct svc_rqst *);
+ void svc_drop(struct svc_rqst *);
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index 5443ffd..7ddfb04 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -531,16 +531,11 @@ svc_destroy(struct svc_serv *serv)
+
+ del_timer_sync(&serv->sv_temptimer);
+
+- svc_close_all(&serv->sv_tempsocks);
++ svc_close_all(serv);
+
+ if (serv->sv_shutdown)
+ serv->sv_shutdown(serv);
+
+- svc_close_all(&serv->sv_permsocks);
+-
+- BUG_ON(!list_empty(&serv->sv_permsocks));
+- BUG_ON(!list_empty(&serv->sv_tempsocks));
+-
+ cache_clean_deferred(serv);
+
+ if (svc_serv_is_pooled(serv))
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 447cd0e..dcdc8df 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -928,7 +928,7 @@ void svc_close_xprt(struct svc_xprt *xprt)
+ }
+ EXPORT_SYMBOL_GPL(svc_close_xprt);
+
+-void svc_close_all(struct list_head *xprt_list)
++static void svc_close_list(struct list_head *xprt_list)
+ {
+ struct svc_xprt *xprt;
+ struct svc_xprt *tmp;
+@@ -946,6 +946,15 @@ void svc_close_all(struct list_head *xprt_list)
+ }
+ }
+
++void svc_close_all(struct svc_serv *serv)
++{
++ svc_close_list(&serv->sv_tempsocks);
++ svc_close_list(&serv->sv_permsocks);
++ BUG_ON(!list_empty(&serv->sv_permsocks));
++ BUG_ON(!list_empty(&serv->sv_tempsocks));
++
++}
++
+ /*
+ * Handle defer and revisit of requests
+ */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch
new file mode 100644
index 0000000..e102471
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch
@@ -0,0 +1,156 @@
+From fb5e1630fc3566904898da68a99cc8e764cb420f Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 29 Nov 2011 17:00:26 -0500
+Subject: [PATCH 068/130] svcrpc: avoid memory-corruption on pool shutdown
+
+commit b4f36f88b3ee7cf26bf0be84e6c7fc15f84dcb71 upstream.
+
+Socket callbacks use svc_xprt_enqueue() to add an xprt to a
+pool->sp_sockets list. In normal operation a server thread will later
+come along and take the xprt off that list. On shutdown, after all the
+threads have exited, we instead manually walk the sv_tempsocks and
+sv_permsocks lists to find all the xprt's and delete them.
+
+So the sp_sockets lists don't really matter any more. As a result,
+we've mostly just ignored them and hoped they would go away.
+
+Which has gotten us into trouble; witness for example ebc63e531cc6
+"svcrpc: fix list-corrupting race on nfsd shutdown", the result of Ben
+Greear noticing that a still-running svc_xprt_enqueue() could re-add an
+xprt to an sp_sockets list just before it was deleted. The fix was to
+remove it from the list at the end of svc_delete_xprt(). But that only
+made corruption less likely--I can see nothing that prevents a
+svc_xprt_enqueue() from adding another xprt to the list at the same
+moment that we're removing this xprt from the list. In fact, despite
+the earlier xpo_detach(), I don't even see what guarantees that
+svc_xprt_enqueue() couldn't still be running on this xprt.
+
+So, instead, note that svc_xprt_enqueue() essentially does:
+ lock sp_lock
+ if XPT_BUSY unset
+ add to sp_sockets
+ unlock sp_lock
+
+So, if we do:
+
+ set XPT_BUSY on every xprt.
+ Empty every sp_sockets list, under the sp_socks locks.
+
+Then we're left knowing that the sp_sockets lists are all empty and will
+stay that way, since any svc_xprt_enqueue() will check XPT_BUSY under
+the sp_lock and see it set.
+
+And *then* we can continue deleting the xprt's.
+
+(Thanks to Jeff Layton for being correctly suspicious of this code....)
+
+Cc: Ben Greear <greearb@candelatech.com>
+Cc: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/sunrpc/svc.c | 10 +++++++++-
+ net/sunrpc/svc_xprt.c | 48 +++++++++++++++++++++++++++++-------------------
+ 2 files changed, 38 insertions(+), 20 deletions(-)
+
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index 7ddfb04..d4ad50e 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -530,7 +530,15 @@ svc_destroy(struct svc_serv *serv)
+ printk("svc_destroy: no threads for serv=%p!\n", serv);
+
+ del_timer_sync(&serv->sv_temptimer);
+-
++ /*
++ * The set of xprts (contained in the sv_tempsocks and
++ * sv_permsocks lists) is now constant, since it is modified
++ * only by accepting new sockets (done by service threads in
++ * svc_recv) or aging old ones (done by sv_temptimer), or
++ * configuration changes (excluded by whatever locking the
++ * caller is using--nfsd_mutex in the case of nfsd). So it's
++ * safe to traverse those lists and shut everything down:
++ */
+ svc_close_all(serv);
+
+ if (serv->sv_shutdown)
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index dcdc8df..9ed2cd0 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -893,14 +893,7 @@ void svc_delete_xprt(struct svc_xprt *xprt)
+ spin_lock_bh(&serv->sv_lock);
+ if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
+ list_del_init(&xprt->xpt_list);
+- /*
+- * The only time we're called while xpt_ready is still on a list
+- * is while the list itself is about to be destroyed (in
+- * svc_destroy). BUT svc_xprt_enqueue could still be attempting
+- * to add new entries to the sp_sockets list, so we can't leave
+- * a freed xprt on it.
+- */
+- list_del_init(&xprt->xpt_ready);
++ BUG_ON(!list_empty(&xprt->xpt_ready));
+ if (test_bit(XPT_TEMP, &xprt->xpt_flags))
+ serv->sv_tmpcnt--;
+ spin_unlock_bh(&serv->sv_lock);
+@@ -931,28 +924,45 @@ EXPORT_SYMBOL_GPL(svc_close_xprt);
+ static void svc_close_list(struct list_head *xprt_list)
+ {
+ struct svc_xprt *xprt;
+- struct svc_xprt *tmp;
+
+- /*
+- * The server is shutting down, and no more threads are running.
+- * svc_xprt_enqueue() might still be running, but at worst it
+- * will re-add the xprt to sp_sockets, which will soon get
+- * freed. So we don't bother with any more locking, and don't
+- * leave the close to the (nonexistent) server threads:
+- */
+- list_for_each_entry_safe(xprt, tmp, xprt_list, xpt_list) {
++ list_for_each_entry(xprt, xprt_list, xpt_list) {
+ set_bit(XPT_CLOSE, &xprt->xpt_flags);
+- svc_delete_xprt(xprt);
++ set_bit(XPT_BUSY, &xprt->xpt_flags);
+ }
+ }
+
+ void svc_close_all(struct svc_serv *serv)
+ {
++ struct svc_pool *pool;
++ struct svc_xprt *xprt;
++ struct svc_xprt *tmp;
++ int i;
++
+ svc_close_list(&serv->sv_tempsocks);
+ svc_close_list(&serv->sv_permsocks);
++
++ for (i = 0; i < serv->sv_nrpools; i++) {
++ pool = &serv->sv_pools[i];
++
++ spin_lock_bh(&pool->sp_lock);
++ while (!list_empty(&pool->sp_sockets)) {
++ xprt = list_first_entry(&pool->sp_sockets, struct svc_xprt, xpt_ready);
++ list_del_init(&xprt->xpt_ready);
++ }
++ spin_unlock_bh(&pool->sp_lock);
++ }
++ /*
++ * At this point the sp_sockets lists will stay empty, since
++ * svc_enqueue will not add new entries without taking the
++ * sp_lock and checking XPT_BUSY.
++ */
++ list_for_each_entry_safe(xprt, tmp, &serv->sv_tempsocks, xpt_list)
++ svc_delete_xprt(xprt);
++ list_for_each_entry_safe(xprt, tmp, &serv->sv_permsocks, xpt_list)
++ svc_delete_xprt(xprt);
++
+ BUG_ON(!list_empty(&serv->sv_permsocks));
+ BUG_ON(!list_empty(&serv->sv_tempsocks));
+-
+ }
+
+ /*
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0069-nfsd4-fix-lockowner-matching.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0069-nfsd4-fix-lockowner-matching.patch
new file mode 100644
index 0000000..4025ada
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0069-nfsd4-fix-lockowner-matching.patch
@@ -0,0 +1,59 @@
+From a626caf8192900669acd90726f7e2716a7cb4c8d Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Mon, 7 Nov 2011 16:37:57 -0500
+Subject: [PATCH 069/130] nfsd4: fix lockowner matching
+
+commit b93d87c19821ba7d3ee11557403d782e541071ad upstream.
+
+Lockowners are looked up by file as well as by owner, but we were
+forgetting to do a comparison on the file. This could cause an
+incorrect result from lockt.
+
+(Note looking up the inode from the lockowner is pretty awkward here.
+The data structures need fixing.)
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/nfsd/nfs4state.c | 17 +++++++++++++++--
+ 1 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 47e94e3..5abced7 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3809,16 +3809,29 @@ nevermind:
+ deny->ld_type = NFS4_WRITE_LT;
+ }
+
++static bool same_lockowner_ino(struct nfs4_lockowner *lo, struct inode *inode, clientid_t *clid, struct xdr_netobj *owner)
++{
++ struct nfs4_ol_stateid *lst;
++
++ if (!same_owner_str(&lo->lo_owner, owner, clid))
++ return false;
++ lst = list_first_entry(&lo->lo_owner.so_stateids,
++ struct nfs4_ol_stateid, st_perstateowner);
++ return lst->st_file->fi_inode == inode;
++}
++
+ static struct nfs4_lockowner *
+ find_lockowner_str(struct inode *inode, clientid_t *clid,
+ struct xdr_netobj *owner)
+ {
+ unsigned int hashval = lock_ownerstr_hashval(inode, clid->cl_id, owner);
++ struct nfs4_lockowner *lo;
+ struct nfs4_stateowner *op;
+
+ list_for_each_entry(op, &lock_ownerstr_hashtbl[hashval], so_strhash) {
+- if (same_owner_str(op, owner, clid))
+- return lockowner(op);
++ lo = lockowner(op);
++ if (same_lockowner_ino(lo, inode, clid, owner))
++ return lo;
+ }
+ return NULL;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch
new file mode 100644
index 0000000..cadcd5a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch
@@ -0,0 +1,82 @@
+From 721aa63a8836ec85efe320a384b97ba3c3048740 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <levinsasha928@gmail.com>
+Date: Fri, 18 Nov 2011 12:14:49 +0200
+Subject: [PATCH 070/130] nfsd: Fix oops when parsing a 0 length export
+
+commit b2ea70afade7080360ac55c4e64ff7a5fafdb67b upstream.
+
+expkey_parse() oopses when handling a 0 length export. This is easily
+triggerable from usermode by writing 0 bytes into
+'/proc/[proc id]/net/rpc/nfsd.fh/channel'.
+
+Below is the log:
+
+[ 1402.286893] BUG: unable to handle kernel paging request at ffff880077c49fff
+[ 1402.287632] IP: [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1
+[ 1402.287632] PGD 2206063 PUD 1fdfd067 PMD 1ffbc067 PTE 8000000077c49160
+[ 1402.287632] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
+[ 1402.287632] CPU 1
+[ 1402.287632] Pid: 20198, comm: trinity Not tainted 3.2.0-rc2-sasha-00058-gc65cd37 #6
+[ 1402.287632] RIP: 0010:[<ffffffff812b4b99>] [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1
+[ 1402.287632] RSP: 0018:ffff880077f0fd68 EFLAGS: 00010292
+[ 1402.287632] RAX: ffff880077c49fff RBX: 00000000ffffffea RCX: 0000000001043400
+[ 1402.287632] RDX: 0000000000000000 RSI: ffff880077c4a000 RDI: ffffffff82283de0
+[ 1402.287632] RBP: ffff880077f0fe18 R08: 0000000000000001 R09: ffff880000000000
+[ 1402.287632] R10: 0000000000000000 R11: 0000000000000001 R12: ffff880077c4a000
+[ 1402.287632] R13: ffffffff82283de0 R14: 0000000001043400 R15: ffffffff82283de0
+[ 1402.287632] FS: 00007f25fec3f700(0000) GS:ffff88007d400000(0000) knlGS:0000000000000000
+[ 1402.287632] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+[ 1402.287632] CR2: ffff880077c49fff CR3: 0000000077e1d000 CR4: 00000000000406e0
+[ 1402.287632] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 1402.287632] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+[ 1402.287632] Process trinity (pid: 20198, threadinfo ffff880077f0e000, task ffff880077db17b0)
+[ 1402.287632] Stack:
+[ 1402.287632] ffff880077db17b0 ffff880077c4a000 ffff880077f0fdb8 ffffffff810b411e
+[ 1402.287632] ffff880000000000 ffff880077db17b0 ffff880077c4a000 ffffffff82283de0
+[ 1402.287632] 0000000001043400 ffffffff82283de0 ffff880077f0fde8 ffffffff81111f63
+[ 1402.287632] Call Trace:
+[ 1402.287632] [<ffffffff810b411e>] ? lock_release+0x1af/0x1bc
+[ 1402.287632] [<ffffffff81111f63>] ? might_fault+0x97/0x9e
+[ 1402.287632] [<ffffffff81111f1a>] ? might_fault+0x4e/0x9e
+[ 1402.287632] [<ffffffff81a8bcf2>] cache_do_downcall+0x3e/0x4f
+[ 1402.287632] [<ffffffff81a8c950>] cache_write.clone.16+0xbb/0x130
+[ 1402.287632] [<ffffffff81a8c9df>] ? cache_write_pipefs+0x1a/0x1a
+[ 1402.287632] [<ffffffff81a8c9f8>] cache_write_procfs+0x19/0x1b
+[ 1402.287632] [<ffffffff8118dc54>] proc_reg_write+0x8e/0xad
+[ 1402.287632] [<ffffffff8113fe81>] vfs_write+0xaa/0xfd
+[ 1402.287632] [<ffffffff8114142d>] ? fget_light+0x35/0x9e
+[ 1402.287632] [<ffffffff8113ff8b>] sys_write+0x48/0x6f
+[ 1402.287632] [<ffffffff81bbdb92>] system_call_fastpath+0x16/0x1b
+[ 1402.287632] Code: c0 c9 c3 55 48 63 d2 48 89 e5 48 8d 44 32 ff 41 57 41 56 41 55 41 54 53 bb ea ff ff ff 48 81 ec 88 00 00 00 48 89 b5 58 ff ff ff
+[ 1402.287632] 38 0a 0f 85 89 02 00 00 c6 00 00 48 8b 3d 44 4a e5 01 48 85
+[ 1402.287632] RIP [<ffffffff812b4b99>] expkey_parse+0x28/0x2e1
+[ 1402.287632] RSP <ffff880077f0fd68>
+[ 1402.287632] CR2: ffff880077c49fff
+[ 1402.287632] ---[ end trace 368ef53ff773a5e3 ]---
+
+Cc: "J. Bruce Fields" <bfields@fieldses.org>
+Cc: Neil Brown <neilb@suse.de>
+Cc: linux-nfs@vger.kernel.org
+Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/nfsd/export.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
+index 62f3b90..5f312ab 100644
+--- a/fs/nfsd/export.c
++++ b/fs/nfsd/export.c
+@@ -87,7 +87,7 @@ static int expkey_parse(struct cache_detail *cd, char *mesg, int mlen)
+ struct svc_expkey key;
+ struct svc_expkey *ek = NULL;
+
+- if (mesg[mlen-1] != '\n')
++ if (mlen < 1 || mesg[mlen-1] != '\n')
+ return -EINVAL;
+ mesg[mlen-1] = 0;
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch
new file mode 100644
index 0000000..df126a5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch
@@ -0,0 +1,61 @@
+From 4af0dd80de2155ea9bdd1a691d5a902884639359 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Thu, 12 Jan 2012 17:59:46 +0100
+Subject: [PATCH 071/130] fsnotify: don't BUG in fsnotify_destroy_mark()
+
+commit fed474857efbed79cd390d0aee224231ca718f63 upstream.
+
+Removing the parent of a watched file results in "kernel BUG at
+fs/notify/mark.c:139".
+
+To reproduce
+
+ add "-w /tmp/audit/dir/watched_file" to audit.rules
+ rm -rf /tmp/audit/dir
+
+This is caused by fsnotify_destroy_mark() being called without an
+extra reference taken by the caller.
+
+Reported by Francesco Cosoleto here:
+
+ https://bugzilla.novell.com/show_bug.cgi?id=689860
+
+Fix by removing the BUG_ON and adding a comment about not accessing mark after
+the iput.
+
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/notify/mark.c | 8 +++++---
+ 1 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/notify/mark.c b/fs/notify/mark.c
+index e14587d..f104d56 100644
+--- a/fs/notify/mark.c
++++ b/fs/notify/mark.c
+@@ -135,9 +135,6 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
+
+ mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
+
+- /* 1 from caller and 1 for being on i_list/g_list */
+- BUG_ON(atomic_read(&mark->refcnt) < 2);
+-
+ spin_lock(&group->mark_lock);
+
+ if (mark->flags & FSNOTIFY_MARK_FLAG_INODE) {
+@@ -182,6 +179,11 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
+ iput(inode);
+
+ /*
++ * We don't necessarily have a ref on mark from caller so the above iput
++ * may have already destroyed it. Don't touch from now on.
++ */
++
++ /*
+ * it's possible that this group tried to destroy itself, but this
+ * this mark was simultaneously being freed by inode. If that's the
+ * case, we finish freeing the group here.
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch
new file mode 100644
index 0000000..0fdc59a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch
@@ -0,0 +1,44 @@
+From 9a2eeb78ce5b0f0d7a3a0d0917c10bd128d974d3 Mon Sep 17 00:00:00 2001
+From: Jack Steiner <steiner@sgi.com>
+Date: Fri, 6 Jan 2012 13:19:00 -0600
+Subject: [PATCH 072/130] x86, UV: Update Boot messages for SGI UV2 platform
+
+commit da517a08ac5913cd80ce3507cddd00f2a091b13c upstream.
+
+SGI UV systems print a message during boot:
+
+ UV: Found <num> blades
+
+Due to packaging changes, the blade count is not accurate for
+on the next generation of the platform. This patch corrects the
+count.
+
+Signed-off-by: Jack Steiner <steiner@sgi.com>
+Link: http://lkml.kernel.org/r/20120106191900.GA19772@sgi.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/kernel/apic/x2apic_uv_x.c | 7 ++++++-
+ 1 files changed, 6 insertions(+), 1 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
+index 9d59bba..79b05b8 100644
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -769,7 +769,12 @@ void __init uv_system_init(void)
+ for(i = 0; i < UVH_NODE_PRESENT_TABLE_DEPTH; i++)
+ uv_possible_blades +=
+ hweight64(uv_read_local_mmr( UVH_NODE_PRESENT_TABLE + i * 8));
+- printk(KERN_DEBUG "UV: Found %d blades\n", uv_num_possible_blades());
++
++ /* uv_num_possible_blades() is really the hub count */
++ printk(KERN_INFO "UV: Found %d blades, %d hubs\n",
++ is_uv1_hub() ? uv_num_possible_blades() :
++ (uv_num_possible_blades() + 1) / 2,
++ uv_num_possible_blades());
+
+ bytes = sizeof(struct uv_blade_info) * uv_num_possible_blades();
+ uv_blade_info = kzalloc(bytes, GFP_KERNEL);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch
new file mode 100644
index 0000000..f4bc909
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch
@@ -0,0 +1,46 @@
+From e27a416d10935bfd79c8783a3b3ccf27e1d16230 Mon Sep 17 00:00:00 2001
+From: David Daney <david.daney@cavium.com>
+Date: Mon, 19 Dec 2011 17:42:42 -0800
+Subject: [PATCH 073/130] recordmcount: Fix handling of elf64 big-endian
+ objects.
+
+commit 2e885057b7f75035f0b85e02f737891482815a81 upstream.
+
+In ELF64, the sh_flags field is 64-bits wide. recordmcount was
+erroneously treating it as a 32-bit wide field. For little endian
+objects this works because the flags of interest (SHF_EXECINSTR)
+reside in the lower 32 bits of the word, and you get the same result
+with either a 32-bit or 64-bit read. Big endian objects on the
+other hand do not work at all with this error.
+
+The fix: Correctly treat sh_flags as 64-bits wide in elf64 objects.
+
+The symptom I observed was that my
+__start_mcount_loc..__stop_mcount_loc was empty even though ftrace
+function tracing was enabled.
+
+Link: http://lkml.kernel.org/r/1324345362-12230-1-git-send-email-ddaney.cavm@gmail.com
+
+Signed-off-by: David Daney <david.daney@cavium.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ scripts/recordmcount.h | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
+index f40a6af6..54e35c1 100644
+--- a/scripts/recordmcount.h
++++ b/scripts/recordmcount.h
+@@ -462,7 +462,7 @@ __has_rel_mcount(Elf_Shdr const *const relhdr, /* is SHT_REL or SHT_RELA */
+ succeed_file();
+ }
+ if (w(txthdr->sh_type) != SHT_PROGBITS ||
+- !(w(txthdr->sh_flags) & SHF_EXECINSTR))
++ !(_w(txthdr->sh_flags) & SHF_EXECINSTR))
+ return NULL;
+ return txtname;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch
new file mode 100644
index 0000000..afbd62d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch
@@ -0,0 +1,62 @@
+From 847db7a6053aff7d165a60f10a8cb585a950e6f9 Mon Sep 17 00:00:00 2001
+From: Haogang Chen <haogangchen@gmail.com>
+Date: Tue, 29 Nov 2011 18:32:25 -0300
+Subject: [PATCH 074/130] uvcvideo: Fix integer overflow in
+ uvc_ioctl_ctrl_map()
+
+commit 806e23e95f94a27ee445022d724060b9b45cb64a upstream.
+
+There is a potential integer overflow in uvc_ioctl_ctrl_map(). When a
+large xmap->menu_count is passed from the userspace, the subsequent call
+to kmalloc() will allocate a buffer smaller than expected.
+map->menu_count and map->menu_info would later be used in a loop (e.g.
+in uvc_query_v4l2_ctrl), which leads to out-of-bound access.
+
+The patch checks the ioctl argument and returns -EINVAL for zero or too
+large values in xmap->menu_count.
+
+Signed-off-by: Haogang Chen <haogangchen@gmail.com>
+[laurent.pinchart@ideasonboard.com Prevent excessive memory consumption]
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/media/video/uvc/uvc_v4l2.c | 9 +++++++++
+ drivers/media/video/uvc/uvcvideo.h | 1 +
+ 2 files changed, 10 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
+index dadf11f..cf7788f 100644
+--- a/drivers/media/video/uvc/uvc_v4l2.c
++++ b/drivers/media/video/uvc/uvc_v4l2.c
+@@ -58,6 +58,15 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
+ break;
+
+ case V4L2_CTRL_TYPE_MENU:
++ /* Prevent excessive memory consumption, as well as integer
++ * overflows.
++ */
++ if (xmap->menu_count == 0 ||
++ xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) {
++ ret = -EINVAL;
++ goto done;
++ }
++
+ size = xmap->menu_count * sizeof(*map->menu_info);
+ map->menu_info = kmalloc(size, GFP_KERNEL);
+ if (map->menu_info == NULL) {
+diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
+index 4c1392e..bc446ba 100644
+--- a/drivers/media/video/uvc/uvcvideo.h
++++ b/drivers/media/video/uvc/uvcvideo.h
+@@ -113,6 +113,7 @@
+
+ /* Maximum allowed number of control mappings per device */
+ #define UVC_MAX_CONTROL_MAPPINGS 1024
++#define UVC_MAX_CONTROL_MENU_ENTRIES 32
+
+ /* Devices quirks */
+ #define UVC_QUIRK_STATUS_INTERVAL 0x00000001
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch
new file mode 100644
index 0000000..d369d7a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch
@@ -0,0 +1,172 @@
+From 48a7a2bae38f29f5b231f460dd2852e00e50d549 Mon Sep 17 00:00:00 2001
+From: Dave Chinner <david@fromorbit.com>
+Date: Tue, 23 Aug 2011 18:56:24 +1000
+Subject: [PATCH 075/130] dcache: use a dispose list in select_parent
+
+commit b48f03b319ba78f3abf9a7044d1f436d8d90f4f9 upstream.
+
+select_parent currently abuses the dentry cache LRU to provide
+cleanup features for child dentries that need to be freed. It moves
+them to the tail of the LRU, then tells shrink_dcache_parent() to
+calls __shrink_dcache_sb to unconditionally move them to a dispose
+list (as DCACHE_REFERENCED is ignored). __shrink_dcache_sb() has to
+relock the dentries to move them off the LRU onto the dispose list,
+but otherwise does not touch the dentries that select_parent() moved
+to the tail of the LRU. It then passses the dispose list to
+shrink_dentry_list() which tries to free the dentries.
+
+IOWs, the use of __shrink_dcache_sb() is superfluous - we can build
+exactly the same list of dentries for disposal directly in
+select_parent() and call shrink_dentry_list() instead of calling
+__shrink_dcache_sb() to do that. This means that we avoid long holds
+on the lru lock walking the LRU moving dentries to the dispose list
+We also avoid the need to relock each dentry just to move it off the
+LRU, reducing the numebr of times we lock each dentry to dispose of
+them in shrink_dcache_parent() from 3 to 2 times.
+
+Further, we remove one of the two callers of __shrink_dcache_sb().
+This also means that __shrink_dcache_sb can be moved into back into
+prune_dcache_sb() and we no longer have to handle referenced
+dentries conditionally, simplifying the code.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/dcache.c | 63 +++++++++++++++++++---------------------------------------
+ 1 files changed, 21 insertions(+), 42 deletions(-)
+
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 89509b5..108116e 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -275,15 +275,15 @@ static void dentry_lru_prune(struct dentry *dentry)
+ }
+ }
+
+-static void dentry_lru_move_tail(struct dentry *dentry)
++static void dentry_lru_move_list(struct dentry *dentry, struct list_head *list)
+ {
+ spin_lock(&dcache_lru_lock);
+ if (list_empty(&dentry->d_lru)) {
+- list_add_tail(&dentry->d_lru, &dentry->d_sb->s_dentry_lru);
++ list_add_tail(&dentry->d_lru, list);
+ dentry->d_sb->s_nr_dentry_unused++;
+ dentry_stat.nr_unused++;
+ } else {
+- list_move_tail(&dentry->d_lru, &dentry->d_sb->s_dentry_lru);
++ list_move_tail(&dentry->d_lru, list);
+ }
+ spin_unlock(&dcache_lru_lock);
+ }
+@@ -769,14 +769,18 @@ static void shrink_dentry_list(struct list_head *list)
+ }
+
+ /**
+- * __shrink_dcache_sb - shrink the dentry LRU on a given superblock
+- * @sb: superblock to shrink dentry LRU.
+- * @count: number of entries to prune
+- * @flags: flags to control the dentry processing
++ * prune_dcache_sb - shrink the dcache
++ * @sb: superblock
++ * @count: number of entries to try to free
++ *
++ * Attempt to shrink the superblock dcache LRU by @count entries. This is
++ * done when we need more memory an called from the superblock shrinker
++ * function.
+ *
+- * If flags contains DCACHE_REFERENCED reference dentries will not be pruned.
++ * This function may fail to free any resources if all the dentries are in
++ * use.
+ */
+-static void __shrink_dcache_sb(struct super_block *sb, int count, int flags)
++void prune_dcache_sb(struct super_block *sb, int count)
+ {
+ struct dentry *dentry;
+ LIST_HEAD(referenced);
+@@ -795,13 +799,7 @@ relock:
+ goto relock;
+ }
+
+- /*
+- * If we are honouring the DCACHE_REFERENCED flag and the
+- * dentry has this flag set, don't free it. Clear the flag
+- * and put it back on the LRU.
+- */
+- if (flags & DCACHE_REFERENCED &&
+- dentry->d_flags & DCACHE_REFERENCED) {
++ if (dentry->d_flags & DCACHE_REFERENCED) {
+ dentry->d_flags &= ~DCACHE_REFERENCED;
+ list_move(&dentry->d_lru, &referenced);
+ spin_unlock(&dentry->d_lock);
+@@ -821,23 +819,6 @@ relock:
+ }
+
+ /**
+- * prune_dcache_sb - shrink the dcache
+- * @sb: superblock
+- * @nr_to_scan: number of entries to try to free
+- *
+- * Attempt to shrink the superblock dcache LRU by @nr_to_scan entries. This is
+- * done when we need more memory an called from the superblock shrinker
+- * function.
+- *
+- * This function may fail to free any resources if all the dentries are in
+- * use.
+- */
+-void prune_dcache_sb(struct super_block *sb, int nr_to_scan)
+-{
+- __shrink_dcache_sb(sb, nr_to_scan, DCACHE_REFERENCED);
+-}
+-
+-/**
+ * shrink_dcache_sb - shrink dcache for a superblock
+ * @sb: superblock
+ *
+@@ -1091,7 +1072,7 @@ EXPORT_SYMBOL(have_submounts);
+ * drop the lock and return early due to latency
+ * constraints.
+ */
+-static int select_parent(struct dentry * parent)
++static int select_parent(struct dentry *parent, struct list_head *dispose)
+ {
+ struct dentry *this_parent;
+ struct list_head *next;
+@@ -1113,12 +1094,11 @@ resume:
+
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+
+- /*
+- * move only zero ref count dentries to the end
+- * of the unused list for prune_dcache
++ /*
++ * move only zero ref count dentries to the dispose list.
+ */
+ if (!dentry->d_count) {
+- dentry_lru_move_tail(dentry);
++ dentry_lru_move_list(dentry, dispose);
+ found++;
+ } else {
+ dentry_lru_del(dentry);
+@@ -1180,14 +1160,13 @@ rename_retry:
+ *
+ * Prune the dcache to remove unused children of the parent dentry.
+ */
+-
+ void shrink_dcache_parent(struct dentry * parent)
+ {
+- struct super_block *sb = parent->d_sb;
++ LIST_HEAD(dispose);
+ int found;
+
+- while ((found = select_parent(parent)) != 0)
+- __shrink_dcache_sb(sb, found, 0);
++ while ((found = select_parent(parent, &dispose)) != 0)
++ shrink_dentry_list(&dispose);
+ }
+ EXPORT_SYMBOL(shrink_dcache_parent);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0076-fix-shrink_dcache_parent-livelock.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0076-fix-shrink_dcache_parent-livelock.patch
new file mode 100644
index 0000000..9dd4f0c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0076-fix-shrink_dcache_parent-livelock.patch
@@ -0,0 +1,130 @@
+From 26c9f57c6ada2518c265d0a52b29a26be7bcb746 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <miklos@szeredi.hu>
+Date: Tue, 10 Jan 2012 18:22:25 +0100
+Subject: [PATCH 076/130] fix shrink_dcache_parent() livelock
+
+commit eaf5f9073533cde21c7121c136f1c3f072d9cf59 upstream.
+
+Two (or more) concurrent calls of shrink_dcache_parent() on the same dentry may
+cause shrink_dcache_parent() to loop forever.
+
+Here's what appears to happen:
+
+1 - CPU0: select_parent(P) finds C and puts it on dispose list, returns 1
+
+2 - CPU1: select_parent(P) locks P->d_lock
+
+3 - CPU0: shrink_dentry_list() locks C->d_lock
+ dentry_kill(C) tries to lock P->d_lock but fails, unlocks C->d_lock
+
+4 - CPU1: select_parent(P) locks C->d_lock,
+ moves C from dispose list being processed on CPU0 to the new
+dispose list, returns 1
+
+5 - CPU0: shrink_dentry_list() finds dispose list empty, returns
+
+6 - Goto 2 with CPU0 and CPU1 switched
+
+Basically select_parent() steals the dentry from shrink_dentry_list() and thinks
+it found a new one, causing shrink_dentry_list() to think it's making progress
+and loop over and over.
+
+One way to trigger this is to make udev calls stat() on the sysfs file while it
+is going away.
+
+Having a file in /lib/udev/rules.d/ with only this one rule seems to the trick:
+
+ATTR{vendor}=="0x8086", ATTR{device}=="0x10ca", ENV{PCI_SLOT_NAME}="%k", ENV{MATCHADDR}="$attr{address}", RUN+="/bin/true"
+
+Then execute the following loop:
+
+while true; do
+ echo -bond0 > /sys/class/net/bonding_masters
+ echo +bond0 > /sys/class/net/bonding_masters
+ echo -bond1 > /sys/class/net/bonding_masters
+ echo +bond1 > /sys/class/net/bonding_masters
+done
+
+One fix would be to check all callers and prevent concurrent calls to
+shrink_dcache_parent(). But I think a better solution is to stop the
+stealing behavior.
+
+This patch adds a new dentry flag that is set when the dentry is added to the
+dispose list. The flag is cleared in dentry_lru_del() in case the dentry gets a
+new reference just before being pruned.
+
+If the dentry has this flag, select_parent() will skip it and let
+shrink_dentry_list() retry pruning it. With select_parent() skipping those
+dentries there will not be the appearance of progress (new dentries found) when
+there is none, hence shrink_dcache_parent() will not loop forever.
+
+Set the flag is also set in prune_dcache_sb() for consistency as suggested by
+Linus.
+
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/dcache.c | 15 +++++++++++----
+ include/linux/dcache.h | 1 +
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 108116e..f7908ae 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -242,6 +242,7 @@ static void dentry_lru_add(struct dentry *dentry)
+ static void __dentry_lru_del(struct dentry *dentry)
+ {
+ list_del_init(&dentry->d_lru);
++ dentry->d_flags &= ~DCACHE_SHRINK_LIST;
+ dentry->d_sb->s_nr_dentry_unused--;
+ dentry_stat.nr_unused--;
+ }
+@@ -805,6 +806,7 @@ relock:
+ spin_unlock(&dentry->d_lock);
+ } else {
+ list_move_tail(&dentry->d_lru, &tmp);
++ dentry->d_flags |= DCACHE_SHRINK_LIST;
+ spin_unlock(&dentry->d_lock);
+ if (!--count)
+ break;
+@@ -1096,14 +1098,19 @@ resume:
+
+ /*
+ * move only zero ref count dentries to the dispose list.
++ *
++ * Those which are presently on the shrink list, being processed
++ * by shrink_dentry_list(), shouldn't be moved. Otherwise the
++ * loop in shrink_dcache_parent() might not make any progress
++ * and loop forever.
+ */
+- if (!dentry->d_count) {
++ if (dentry->d_count) {
++ dentry_lru_del(dentry);
++ } else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
+ dentry_lru_move_list(dentry, dispose);
++ dentry->d_flags |= DCACHE_SHRINK_LIST;
+ found++;
+- } else {
+- dentry_lru_del(dentry);
+ }
+-
+ /*
+ * We can return to the caller if we have found some (this
+ * ensures forward progress). We'll be coming back to find
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index ed9f74f..4eb8c80 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -203,6 +203,7 @@ struct dentry_operations {
+
+ #define DCACHE_CANT_MOUNT 0x0100
+ #define DCACHE_GENOCIDE 0x0200
++#define DCACHE_SHRINK_LIST 0x0400
+
+ #define DCACHE_NFSFS_RENAMED 0x1000
+ /* this dentry has been "silly renamed" and has to be deleted on the last
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch
new file mode 100644
index 0000000..1bcc272
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch
@@ -0,0 +1,64 @@
+From 6feb42647758cf08e5707c9f6a2f0d78d6fb3cc8 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Thu, 12 Jan 2012 23:18:41 +0800
+Subject: [PATCH 077/130] pnfsblock: acquire im_lock in _preload_range
+
+commit 39e567ae36fe03c2b446e1b83ee3d39bea08f90b upstream.
+
+When calling _add_entry, we should take the im_lock to protect
+agains other modifiers.
+
+Signed-off-by: Peng Tao <peng_tao@emc.com>
+Signed-off-by: Benny Halevy <bhalevy@tonian.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/nfs/blocklayout/extents.c | 11 ++++++-----
+ 1 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/nfs/blocklayout/extents.c b/fs/nfs/blocklayout/extents.c
+index 19fa7b0..c69682a 100644
+--- a/fs/nfs/blocklayout/extents.c
++++ b/fs/nfs/blocklayout/extents.c
+@@ -139,11 +139,13 @@ static int _set_range(struct my_tree *tree, int32_t tag, u64 s, u64 length)
+ }
+
+ /* Ensure that future operations on given range of tree will not malloc */
+-static int _preload_range(struct my_tree *tree, u64 offset, u64 length)
++static int _preload_range(struct pnfs_inval_markings *marks,
++ u64 offset, u64 length)
+ {
+ u64 start, end, s;
+ int count, i, used = 0, status = -ENOMEM;
+ struct pnfs_inval_tracking **storage;
++ struct my_tree *tree = &marks->im_tree;
+
+ dprintk("%s(%llu, %llu) enter\n", __func__, offset, length);
+ start = normalize(offset, tree->mtt_step_size);
+@@ -161,12 +163,11 @@ static int _preload_range(struct my_tree *tree, u64 offset, u64 length)
+ goto out_cleanup;
+ }
+
+- /* Now need lock - HOW??? */
+-
++ spin_lock(&marks->im_lock);
+ for (s = start; s < end; s += tree->mtt_step_size)
+ used += _add_entry(tree, s, INTERNAL_EXISTS, storage[used]);
++ spin_unlock(&marks->im_lock);
+
+- /* Unlock - HOW??? */
+ status = 0;
+
+ out_cleanup:
+@@ -286,7 +287,7 @@ int bl_mark_sectors_init(struct pnfs_inval_markings *marks,
+
+ start = normalize(offset, marks->im_block_size);
+ end = normalize_up(offset + length, marks->im_block_size);
+- if (_preload_range(&marks->im_tree, start, end - start))
++ if (_preload_range(marks, start, end - start))
+ goto outerr;
+
+ spin_lock(&marks->im_lock);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch
new file mode 100644
index 0000000..99b0428
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch
@@ -0,0 +1,46 @@
+From b6fd682adf525b6766b8e16b39e39412153d19da Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Thu, 12 Jan 2012 23:18:47 +0800
+Subject: [PATCH 078/130] pnfsblock: don't spinlock when freeing block_dev
+
+commit 93a3844ee0f843b05a1df4b52e1a19ff26b98d24 upstream.
+
+bl_free_block_dev() may sleep. We can not call it with spinlock held.
+Besides, there is no need to take bm_lock as we are last user freeing bm_devlist.
+
+Signed-off-by: Peng Tao <peng_tao@emc.com>
+Signed-off-by: Benny Halevy <bhalevy@tonian.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/nfs/blocklayout/blocklayout.c | 11 ++++-------
+ 1 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
+index 281ae95..ce8129d 100644
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -779,16 +779,13 @@ bl_cleanup_layoutcommit(struct nfs4_layoutcommit_data *lcdata)
+ static void free_blk_mountid(struct block_mount_id *mid)
+ {
+ if (mid) {
+- struct pnfs_block_dev *dev;
+- spin_lock(&mid->bm_lock);
+- while (!list_empty(&mid->bm_devlist)) {
+- dev = list_first_entry(&mid->bm_devlist,
+- struct pnfs_block_dev,
+- bm_node);
++ struct pnfs_block_dev *dev, *tmp;
++
++ /* No need to take bm_lock as we are last user freeing bm_devlist */
++ list_for_each_entry_safe(dev, tmp, &mid->bm_devlist, bm_node) {
+ list_del(&dev->bm_node);
+ bl_free_block_dev(dev);
+ }
+- spin_unlock(&mid->bm_lock);
+ kfree(mid);
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0079-pnfsblock-limit-bio-page-count.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0079-pnfsblock-limit-bio-page-count.patch
new file mode 100644
index 0000000..74d1d69
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0079-pnfsblock-limit-bio-page-count.patch
@@ -0,0 +1,51 @@
+From 4ebc5f6665b0d03c9488fafb7ac6f8bd2f104d70 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Thu, 12 Jan 2012 23:18:48 +0800
+Subject: [PATCH 079/130] pnfsblock: limit bio page count
+
+commit 74a6eeb44ca6174d9cc93b9b8b4d58211c57bc80 upstream.
+
+One bio can have at most BIO_MAX_PAGES pages. We should limit it bec otherwise
+bio_alloc will fail when there are many pages in one read/write_pagelist.
+
+Signed-off-by: Peng Tao <peng_tao@emc.com>
+Signed-off-by: Benny Halevy <bhalevy@tonian.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/nfs/blocklayout/blocklayout.c | 17 +++++++++++------
+ 1 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
+index ce8129d..3db6b82 100644
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -146,14 +146,19 @@ static struct bio *bl_alloc_init_bio(int npg, sector_t isect,
+ {
+ struct bio *bio;
+
++ npg = min(npg, BIO_MAX_PAGES);
+ bio = bio_alloc(GFP_NOIO, npg);
+- if (!bio)
+- return NULL;
++ if (!bio && (current->flags & PF_MEMALLOC)) {
++ while (!bio && (npg /= 2))
++ bio = bio_alloc(GFP_NOIO, npg);
++ }
+
+- bio->bi_sector = isect - be->be_f_offset + be->be_v_offset;
+- bio->bi_bdev = be->be_mdev;
+- bio->bi_end_io = end_io;
+- bio->bi_private = par;
++ if (bio) {
++ bio->bi_sector = isect - be->be_f_offset + be->be_v_offset;
++ bio->bi_bdev = be->be_mdev;
++ bio->bi_end_io = end_io;
++ bio->bi_private = par;
++ }
+ return bio;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch
new file mode 100644
index 0000000..eca2dda
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch
@@ -0,0 +1,635 @@
+From 5b8206fb91b97732d80ada2e494e060d50ab30bd Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 29 Nov 2011 10:20:02 +0100
+Subject: [PATCH 080/130] mac80211: revert on-channel work optimisations
+
+commit e76aadc572288a158ae18ae1c10fe395c7bca066 upstream.
+
+Backport note:
+This patch it's a full revert of commit b23b025f "mac80211: Optimize
+scans on current operating channel.". On upstrem revert e76aadc5 we
+keep some bits from that commit, which are needed for upstream version
+of mac80211.
+
+The on-channel work optimisations have caused a
+number of issues, and the code is unfortunately
+very complex and almost impossible to follow.
+Instead of attempting to put in more workarounds
+let's just remove those optimisations, we can
+work on them again later, after we change the
+whole auth/assoc design.
+
+This should fix rate_control_send_low() warnings,
+see RH bug 731365.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/mac80211/ieee80211_i.h | 13 +++----
+ net/mac80211/main.c | 58 +++-----------------------------
+ net/mac80211/offchannel.c | 68 +++++++++++++++++---------------------
+ net/mac80211/rx.c | 10 ++++-
+ net/mac80211/scan.c | 77 ++++++++++++-------------------------------
+ net/mac80211/tx.c | 3 +-
+ net/mac80211/work.c | 77 ++++++-------------------------------------
+ 7 files changed, 85 insertions(+), 221 deletions(-)
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index ea10a51..73495f1 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -702,6 +702,8 @@ struct tpt_led_trigger {
+ * well be on the operating channel
+ * @SCAN_HW_SCANNING: The hardware is scanning for us, we have no way to
+ * determine if we are on the operating channel or not
++ * @SCAN_OFF_CHANNEL: We're off our operating channel for scanning,
++ * gets only set in conjunction with SCAN_SW_SCANNING
+ * @SCAN_COMPLETED: Set for our scan work function when the driver reported
+ * that the scan completed.
+ * @SCAN_ABORTED: Set for our scan work function when the driver reported
+@@ -710,6 +712,7 @@ struct tpt_led_trigger {
+ enum {
+ SCAN_SW_SCANNING,
+ SCAN_HW_SCANNING,
++ SCAN_OFF_CHANNEL,
+ SCAN_COMPLETED,
+ SCAN_ABORTED,
+ };
+@@ -1140,14 +1143,10 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
+ void ieee80211_sched_scan_stopped_work(struct work_struct *work);
+
+ /* off-channel helpers */
+-bool ieee80211_cfg_on_oper_channel(struct ieee80211_local *local);
+-void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
+- bool tell_ap);
+-void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
+- bool offchannel_ps_enable);
++void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local);
++void ieee80211_offchannel_stop_station(struct ieee80211_local *local);
+ void ieee80211_offchannel_return(struct ieee80211_local *local,
+- bool enable_beaconing,
+- bool offchannel_ps_disable);
++ bool enable_beaconing);
+ void ieee80211_hw_roc_setup(struct ieee80211_local *local);
+
+ /* interface handling */
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index cae4435..a7536fd 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -92,47 +92,6 @@ static void ieee80211_reconfig_filter(struct work_struct *work)
+ ieee80211_configure_filter(local);
+ }
+
+-/*
+- * Returns true if we are logically configured to be on
+- * the operating channel AND the hardware-conf is currently
+- * configured on the operating channel. Compares channel-type
+- * as well.
+- */
+-bool ieee80211_cfg_on_oper_channel(struct ieee80211_local *local)
+-{
+- struct ieee80211_channel *chan, *scan_chan;
+- enum nl80211_channel_type channel_type;
+-
+- /* This logic needs to match logic in ieee80211_hw_config */
+- if (local->scan_channel) {
+- chan = local->scan_channel;
+- /* If scanning on oper channel, use whatever channel-type
+- * is currently in use.
+- */
+- if (chan == local->oper_channel)
+- channel_type = local->_oper_channel_type;
+- else
+- channel_type = NL80211_CHAN_NO_HT;
+- } else if (local->tmp_channel) {
+- chan = scan_chan = local->tmp_channel;
+- channel_type = local->tmp_channel_type;
+- } else {
+- chan = local->oper_channel;
+- channel_type = local->_oper_channel_type;
+- }
+-
+- if (chan != local->oper_channel ||
+- channel_type != local->_oper_channel_type)
+- return false;
+-
+- /* Check current hardware-config against oper_channel. */
+- if ((local->oper_channel != local->hw.conf.channel) ||
+- (local->_oper_channel_type != local->hw.conf.channel_type))
+- return false;
+-
+- return true;
+-}
+-
+ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
+ {
+ struct ieee80211_channel *chan, *scan_chan;
+@@ -145,9 +104,6 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
+
+ scan_chan = local->scan_channel;
+
+- /* If this off-channel logic ever changes, ieee80211_on_oper_channel
+- * may need to change as well.
+- */
+ offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
+ if (scan_chan) {
+ chan = scan_chan;
+@@ -158,19 +114,17 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
+ channel_type = local->_oper_channel_type;
+ else
+ channel_type = NL80211_CHAN_NO_HT;
+- } else if (local->tmp_channel) {
++ local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
++ } else if (local->tmp_channel &&
++ local->oper_channel != local->tmp_channel) {
+ chan = scan_chan = local->tmp_channel;
+ channel_type = local->tmp_channel_type;
++ local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
+ } else {
+ chan = local->oper_channel;
+ channel_type = local->_oper_channel_type;
+- }
+-
+- if (chan != local->oper_channel ||
+- channel_type != local->_oper_channel_type)
+- local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
+- else
+ local->hw.conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
++ }
+
+ offchannel_flag ^= local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
+
+@@ -279,7 +233,7 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
+
+ if (changed & BSS_CHANGED_BEACON_ENABLED) {
+ if (local->quiescing || !ieee80211_sdata_running(sdata) ||
+- test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)) {
++ test_bit(SCAN_SW_SCANNING, &local->scanning)) {
+ sdata->vif.bss_conf.enable_beacon = false;
+ } else {
+ /*
+diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
+index 3d41441..1b239be 100644
+--- a/net/mac80211/offchannel.c
++++ b/net/mac80211/offchannel.c
+@@ -18,14 +18,10 @@
+ #include "driver-trace.h"
+
+ /*
+- * Tell our hardware to disable PS.
+- * Optionally inform AP that we will go to sleep so that it will buffer
+- * the frames while we are doing off-channel work. This is optional
+- * because we *may* be doing work on-operating channel, and want our
+- * hardware unconditionally awake, but still let the AP send us normal frames.
++ * inform AP that we will go to sleep so that it will buffer the frames
++ * while we scan
+ */
+-static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata,
+- bool tell_ap)
++static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
+ {
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+@@ -46,8 +42,8 @@ static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata,
+ ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+ }
+
+- if (tell_ap && (!local->offchannel_ps_enabled ||
+- !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)))
++ if (!(local->offchannel_ps_enabled) ||
++ !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
+ /*
+ * If power save was enabled, no need to send a nullfunc
+ * frame because AP knows that we are sleeping. But if the
+@@ -82,9 +78,6 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
+ * we are sleeping, let's just enable power save mode in
+ * hardware.
+ */
+- /* TODO: Only set hardware if CONF_PS changed?
+- * TODO: Should we set offchannel_ps_enabled to false?
+- */
+ local->hw.conf.flags |= IEEE80211_CONF_PS;
+ ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+ } else if (local->hw.conf.dynamic_ps_timeout > 0) {
+@@ -103,61 +96,63 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
+ ieee80211_sta_reset_conn_monitor(sdata);
+ }
+
+-void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
+- bool offchannel_ps_enable)
++void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local)
+ {
+ struct ieee80211_sub_if_data *sdata;
+
+- /*
+- * notify the AP about us leaving the channel and stop all
+- * STA interfaces.
+- */
+ mutex_lock(&local->iflist_mtx);
+ list_for_each_entry(sdata, &local->interfaces, list) {
+ if (!ieee80211_sdata_running(sdata))
+ continue;
+
+- if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
+- set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+-
+- /* Check to see if we should disable beaconing. */
++ /* disable beaconing */
+ if (sdata->vif.type == NL80211_IFTYPE_AP ||
+ sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+ sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+ ieee80211_bss_info_change_notify(
+ sdata, BSS_CHANGED_BEACON_ENABLED);
+
+- if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
++ /*
++ * only handle non-STA interfaces here, STA interfaces
++ * are handled in ieee80211_offchannel_stop_station(),
++ * e.g., from the background scan state machine.
++ *
++ * In addition, do not stop monitor interface to allow it to be
++ * used from user space controlled off-channel operations.
++ */
++ if (sdata->vif.type != NL80211_IFTYPE_STATION &&
++ sdata->vif.type != NL80211_IFTYPE_MONITOR) {
++ set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+ netif_tx_stop_all_queues(sdata->dev);
+- if (offchannel_ps_enable &&
+- (sdata->vif.type == NL80211_IFTYPE_STATION) &&
+- sdata->u.mgd.associated)
+- ieee80211_offchannel_ps_enable(sdata, true);
+ }
+ }
+ mutex_unlock(&local->iflist_mtx);
+ }
+
+-void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
+- bool tell_ap)
++void ieee80211_offchannel_stop_station(struct ieee80211_local *local)
+ {
+ struct ieee80211_sub_if_data *sdata;
+
++ /*
++ * notify the AP about us leaving the channel and stop all STA interfaces
++ */
+ mutex_lock(&local->iflist_mtx);
+ list_for_each_entry(sdata, &local->interfaces, list) {
+ if (!ieee80211_sdata_running(sdata))
+ continue;
+
+- if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+- sdata->u.mgd.associated)
+- ieee80211_offchannel_ps_enable(sdata, tell_ap);
++ if (sdata->vif.type == NL80211_IFTYPE_STATION) {
++ set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
++ netif_tx_stop_all_queues(sdata->dev);
++ if (sdata->u.mgd.associated)
++ ieee80211_offchannel_ps_enable(sdata);
++ }
+ }
+ mutex_unlock(&local->iflist_mtx);
+ }
+
+ void ieee80211_offchannel_return(struct ieee80211_local *local,
+- bool enable_beaconing,
+- bool offchannel_ps_disable)
++ bool enable_beaconing)
+ {
+ struct ieee80211_sub_if_data *sdata;
+
+@@ -167,8 +162,7 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
+ continue;
+
+ /* Tell AP we're back */
+- if (offchannel_ps_disable &&
+- sdata->vif.type == NL80211_IFTYPE_STATION) {
++ if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+ if (sdata->u.mgd.associated)
+ ieee80211_offchannel_ps_disable(sdata);
+ }
+@@ -188,7 +182,7 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
+ netif_tx_wake_all_queues(sdata->dev);
+ }
+
+- /* Check to see if we should re-enable beaconing */
++ /* re-enable beaconing */
+ if (enable_beaconing &&
+ (sdata->vif.type == NL80211_IFTYPE_AP ||
+ sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index fb123e2..5c51607 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -421,10 +421,16 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
+ return RX_CONTINUE;
+
+ if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
+- test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+ local->sched_scanning)
+ return ieee80211_scan_rx(rx->sdata, skb);
+
++ if (test_bit(SCAN_SW_SCANNING, &local->scanning)) {
++ /* drop all the other packets during a software scan anyway */
++ if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
++ dev_kfree_skb(skb);
++ return RX_QUEUED;
++ }
++
+ /* scanning finished during invoking of handlers */
+ I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
+ return RX_DROP_UNUSABLE;
+@@ -2858,7 +2864,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+ local->dot11ReceivedFragmentCount++;
+
+ if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
+- test_bit(SCAN_SW_SCANNING, &local->scanning)))
++ test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
+ status->rx_flags |= IEEE80211_RX_IN_SCAN;
+
+ if (ieee80211_is_mgmt(fc))
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index 105436d..5279300 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -213,14 +213,6 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
+ if (bss)
+ ieee80211_rx_bss_put(sdata->local, bss);
+
+- /* If we are on-operating-channel, and this packet is for the
+- * current channel, pass the pkt on up the stack so that
+- * the rest of the stack can make use of it.
+- */
+- if (ieee80211_cfg_on_oper_channel(sdata->local)
+- && (channel == sdata->local->oper_channel))
+- return RX_CONTINUE;
+-
+ dev_kfree_skb(skb);
+ return RX_QUEUED;
+ }
+@@ -264,8 +256,6 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
+ bool was_hw_scan)
+ {
+ struct ieee80211_local *local = hw_to_local(hw);
+- bool on_oper_chan;
+- bool enable_beacons = false;
+
+ lockdep_assert_held(&local->mtx);
+
+@@ -298,25 +288,11 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
+ local->scanning = 0;
+ local->scan_channel = NULL;
+
+- on_oper_chan = ieee80211_cfg_on_oper_channel(local);
+-
+- if (was_hw_scan || !on_oper_chan)
+- ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+- else
+- /* Set power back to normal operating levels. */
+- ieee80211_hw_config(local, 0);
+-
++ ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+ if (!was_hw_scan) {
+- bool on_oper_chan2;
+ ieee80211_configure_filter(local);
+ drv_sw_scan_complete(local);
+- on_oper_chan2 = ieee80211_cfg_on_oper_channel(local);
+- /* We should always be on-channel at this point. */
+- WARN_ON(!on_oper_chan2);
+- if (on_oper_chan2 && (on_oper_chan != on_oper_chan2))
+- enable_beacons = true;
+-
+- ieee80211_offchannel_return(local, enable_beacons, true);
++ ieee80211_offchannel_return(local, true);
+ }
+
+ ieee80211_recalc_idle(local);
+@@ -357,15 +333,13 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
+ */
+ drv_sw_scan_start(local);
+
++ ieee80211_offchannel_stop_beaconing(local);
++
+ local->leave_oper_channel_time = 0;
+ local->next_scan_state = SCAN_DECISION;
+ local->scan_channel_idx = 0;
+
+- /* We always want to use off-channel PS, even if we
+- * are not really leaving oper-channel. Don't
+- * tell the AP though, as long as we are on-channel.
+- */
+- ieee80211_offchannel_enable_all_ps(local, false);
++ drv_flush(local, false);
+
+ ieee80211_configure_filter(local);
+
+@@ -508,20 +482,7 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
+ }
+ mutex_unlock(&local->iflist_mtx);
+
+- next_chan = local->scan_req->channels[local->scan_channel_idx];
+-
+- if (ieee80211_cfg_on_oper_channel(local)) {
+- /* We're currently on operating channel. */
+- if (next_chan == local->oper_channel)
+- /* We don't need to move off of operating channel. */
+- local->next_scan_state = SCAN_SET_CHANNEL;
+- else
+- /*
+- * We do need to leave operating channel, as next
+- * scan is somewhere else.
+- */
+- local->next_scan_state = SCAN_LEAVE_OPER_CHANNEL;
+- } else {
++ if (local->scan_channel) {
+ /*
+ * we're currently scanning a different channel, let's
+ * see if we can scan another channel without interfering
+@@ -537,6 +498,7 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
+ *
+ * Otherwise switch back to the operating channel.
+ */
++ next_chan = local->scan_req->channels[local->scan_channel_idx];
+
+ bad_latency = time_after(jiffies +
+ ieee80211_scan_get_channel_time(next_chan),
+@@ -554,6 +516,12 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
+ local->next_scan_state = SCAN_ENTER_OPER_CHANNEL;
+ else
+ local->next_scan_state = SCAN_SET_CHANNEL;
++ } else {
++ /*
++ * we're on the operating channel currently, let's
++ * leave that channel now to scan another one
++ */
++ local->next_scan_state = SCAN_LEAVE_OPER_CHANNEL;
+ }
+
+ *next_delay = 0;
+@@ -562,10 +530,9 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
+ static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *local,
+ unsigned long *next_delay)
+ {
+- /* PS will already be in off-channel mode,
+- * we do that once at the beginning of scanning.
+- */
+- ieee80211_offchannel_stop_vifs(local, false);
++ ieee80211_offchannel_stop_station(local);
++
++ __set_bit(SCAN_OFF_CHANNEL, &local->scanning);
+
+ /*
+ * What if the nullfunc frames didn't arrive?
+@@ -588,15 +555,15 @@ static void ieee80211_scan_state_enter_oper_channel(struct ieee80211_local *loca
+ {
+ /* switch back to the operating channel */
+ local->scan_channel = NULL;
+- if (!ieee80211_cfg_on_oper_channel(local))
+- ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
++ ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+
+ /*
+- * Re-enable vifs and beaconing. Leave PS
+- * in off-channel state..will put that back
+- * on-channel at the end of scanning.
++ * Only re-enable station mode interface now; beaconing will be
++ * re-enabled once the full scan has been completed.
+ */
+- ieee80211_offchannel_return(local, true, false);
++ ieee80211_offchannel_return(local, false);
++
++ __clear_bit(SCAN_OFF_CHANNEL, &local->scanning);
+
+ *next_delay = HZ / 5;
+ local->next_scan_state = SCAN_DECISION;
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 1f8b120..eff1f4e 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -259,8 +259,7 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
+ if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
+ return TX_CONTINUE;
+
+- if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
+- test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
++ if (unlikely(test_bit(SCAN_OFF_CHANNEL, &tx->local->scanning)) &&
+ !ieee80211_is_probe_req(hdr->frame_control) &&
+ !ieee80211_is_nullfunc(hdr->frame_control))
+ /*
+diff --git a/net/mac80211/work.c b/net/mac80211/work.c
+index 6c53b6d..99165ef 100644
+--- a/net/mac80211/work.c
++++ b/net/mac80211/work.c
+@@ -899,26 +899,6 @@ static bool ieee80211_work_ct_coexists(enum nl80211_channel_type wk_ct,
+ return false;
+ }
+
+-static enum nl80211_channel_type
+-ieee80211_calc_ct(enum nl80211_channel_type wk_ct,
+- enum nl80211_channel_type oper_ct)
+-{
+- switch (wk_ct) {
+- case NL80211_CHAN_NO_HT:
+- return oper_ct;
+- case NL80211_CHAN_HT20:
+- if (oper_ct != NL80211_CHAN_NO_HT)
+- return oper_ct;
+- return wk_ct;
+- case NL80211_CHAN_HT40MINUS:
+- case NL80211_CHAN_HT40PLUS:
+- return wk_ct;
+- }
+- WARN_ON(1); /* shouldn't get here */
+- return wk_ct;
+-}
+-
+-
+ static void ieee80211_work_timer(unsigned long data)
+ {
+ struct ieee80211_local *local = (void *) data;
+@@ -969,52 +949,18 @@ static void ieee80211_work_work(struct work_struct *work)
+ }
+
+ if (!started && !local->tmp_channel) {
+- bool on_oper_chan;
+- bool tmp_chan_changed = false;
+- bool on_oper_chan2;
+- enum nl80211_channel_type wk_ct;
+- on_oper_chan = ieee80211_cfg_on_oper_channel(local);
+-
+- /* Work with existing channel type if possible. */
+- wk_ct = wk->chan_type;
+- if (wk->chan == local->hw.conf.channel)
+- wk_ct = ieee80211_calc_ct(wk->chan_type,
+- local->hw.conf.channel_type);
+-
+- if (local->tmp_channel)
+- if ((local->tmp_channel != wk->chan) ||
+- (local->tmp_channel_type != wk_ct))
+- tmp_chan_changed = true;
+-
+- local->tmp_channel = wk->chan;
+- local->tmp_channel_type = wk_ct;
+ /*
+- * Leave the station vifs in awake mode if they
+- * happen to be on the same channel as
+- * the requested channel.
++ * TODO: could optimize this by leaving the
++ * station vifs in awake mode if they
++ * happen to be on the same channel as
++ * the requested channel
+ */
+- on_oper_chan2 = ieee80211_cfg_on_oper_channel(local);
+- if (on_oper_chan != on_oper_chan2) {
+- if (on_oper_chan2) {
+- /* going off oper channel, PS too */
+- ieee80211_offchannel_stop_vifs(local,
+- true);
+- ieee80211_hw_config(local, 0);
+- } else {
+- /* going on channel, but leave PS
+- * off-channel. */
+- ieee80211_hw_config(local, 0);
+- ieee80211_offchannel_return(local,
+- true,
+- false);
+- }
+- } else if (tmp_chan_changed)
+- /* Still off-channel, but on some other
+- * channel, so update hardware.
+- * PS should already be off-channel.
+- */
+- ieee80211_hw_config(local, 0);
++ ieee80211_offchannel_stop_beaconing(local);
++ ieee80211_offchannel_stop_station(local);
+
++ local->tmp_channel = wk->chan;
++ local->tmp_channel_type = wk->chan_type;
++ ieee80211_hw_config(local, 0);
+ started = true;
+ wk->timeout = jiffies;
+ }
+@@ -1100,8 +1046,7 @@ static void ieee80211_work_work(struct work_struct *work)
+ * we still need to do a hardware config. Currently,
+ * we cannot be here while scanning, however.
+ */
+- if (!ieee80211_cfg_on_oper_channel(local))
+- ieee80211_hw_config(local, 0);
++ ieee80211_hw_config(local, 0);
+
+ /* At the least, we need to disable offchannel_ps,
+ * so just go ahead and run the entire offchannel
+@@ -1109,7 +1054,7 @@ static void ieee80211_work_work(struct work_struct *work)
+ * beaconing if we were already on-oper-channel
+ * as a future optimization.
+ */
+- ieee80211_offchannel_return(local, true, true);
++ ieee80211_offchannel_return(local, true);
+
+ /* give connection some time to breathe */
+ run_again(local, jiffies + HZ/2);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch
new file mode 100644
index 0000000..92f4403
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch
@@ -0,0 +1,60 @@
+From 4b66a35b31fdc078582e40ec3cc0ee12abbffd17 Mon Sep 17 00:00:00 2001
+From: Chris Bagwell <chris@cnpbagwell.com>
+Date: Wed, 23 Nov 2011 10:54:27 +0100
+Subject: [PATCH 081/130] HID: hid-multitouch - add another eGalax id
+
+commit 1fd8f047490dd0ec4e4db710fcbc1bd4798d944c upstream.
+
+This allows ASUS Eee Slate touchscreens to work.
+
+Signed-off-by: Chris Bagwell <chris@cnpbagwell.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hid/hid-core.c | 1 +
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 3 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 1473067..b51cbf2 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1409,6 +1409,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH5) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2515) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_EMS, USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 4a441a6..4c9a342 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -235,6 +235,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2 0x72a1
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3 0x480e
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4 0x726b
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH5 0xa001
+
+ #define USB_VENDOR_ID_ELECOM 0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084 0x0061
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index f1c909f..a59d939 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -662,6 +662,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4) },
++ { .driver_data = MT_CLS_EGALAX,
++ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH5) },
+
+ /* Elo TouchSystems IntelliTouch Plus panel */
+ { .driver_data = MT_CLS_DUAL_NSMU_CONTACTID,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch
new file mode 100644
index 0000000..db1d435
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch
@@ -0,0 +1,112 @@
+From e5664bb7172d41e38788a503d6e33d14af866fb5 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+Date: Wed, 23 Nov 2011 10:54:31 +0100
+Subject: [PATCH 082/130] HID: multitouch: cleanup with eGalax PID definitions
+
+commit e36f690b37945e0a9bb1554e1546eeec93f7d1f6 upstream.
+
+This is just a renaming of USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH{N}
+to USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_{PID} to handle more eGalax
+devices.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hid/hid-core.c | 12 ++++++------
+ drivers/hid/hid-ids.h | 12 ++++++------
+ drivers/hid/hid-multitouch.c | 24 ++++++++++++------------
+ 3 files changed, 24 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index b51cbf2..4434aba 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1404,12 +1404,12 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_TRUETOUCH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0006) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0011) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH1) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH5) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480D) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480E) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2515) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_EMS, USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 4c9a342..9db8789 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -230,12 +230,12 @@
+
+ #define USB_VENDOR_ID_DWAV 0x0eef
+ #define USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER 0x0001
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH 0x480d
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH1 0x720c
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2 0x72a1
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3 0x480e
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4 0x726b
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH5 0xa001
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480D 0x480d
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480E 0x480e
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C 0x720c
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B 0x726b
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1 0x72a1
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
+
+ #define USB_VENDOR_ID_ELECOM 0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084 0x0061
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index a59d939..815bd22 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -645,26 +645,26 @@ static const struct hid_device_id mt_devices[] = {
+ USB_DEVICE_ID_CYPRESS_TRUETOUCH) },
+
+ /* eGalax devices (resistive) */
+- { .driver_data = MT_CLS_EGALAX,
++ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+- USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH) },
+- { .driver_data = MT_CLS_EGALAX,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480D) },
++ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+- USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3) },
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480E) },
+
+ /* eGalax devices (capacitive) */
+- { .driver_data = MT_CLS_EGALAX,
++ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+- USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH1) },
+- { .driver_data = MT_CLS_EGALAX,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C) },
++ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+- USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2) },
+- { .driver_data = MT_CLS_EGALAX,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B) },
++ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+- USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4) },
+- { .driver_data = MT_CLS_EGALAX,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1) },
++ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+- USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH5) },
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+
+ /* Elo TouchSystems IntelliTouch Plus panel */
+ { .driver_data = MT_CLS_DUAL_NSMU_CONTACTID,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch
new file mode 100644
index 0000000..086ffed
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch
@@ -0,0 +1,62 @@
+From f8c7a53e06ce63f80f74db3c6582be6d07ad0318 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marek.vasut@gmail.com>
+Date: Wed, 23 Nov 2011 10:54:32 +0100
+Subject: [PATCH 083/130] HID: multitouch: Add egalax ID for Acer Iconia W500
+
+commit bb9ff21072043634f147c05ac65dbf8185d4af6d upstream.
+
+This patch adds USB ID for the touchpanel in Acer Iconia W500. The panel
+supports up to five fingers, therefore the need for a new addition of panel
+types.
+
+Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hid/hid-core.c | 1 +
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 3 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 4434aba..9cee7b2 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1409,6 +1409,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2515) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 9db8789..9eb90b1 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -235,6 +235,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C 0x720c
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B 0x726b
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1 0x72a1
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302 0x7302
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
+
+ #define USB_VENDOR_ID_ELECOM 0x056e
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 815bd22..c77d495 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -664,6 +664,9 @@ static const struct hid_device_id mt_devices[] = {
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1) },
+ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302) },
++ { .driver_data = MT_CLS_EGALAX,
++ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+
+ /* Elo TouchSystems IntelliTouch Plus panel */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch
new file mode 100644
index 0000000..885ca10
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch
@@ -0,0 +1,49 @@
+From 5b2c651d5496aad3c5359e72fc6eb6efcadecc4e Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+Date: Wed, 23 Nov 2011 10:54:33 +0100
+Subject: [PATCH 084/130] HID: multitouch: add support for the MSI Windpad
+ 110W
+
+commit 66f06127f34ad6e8a1b24a2c03144b694d19f99f upstream.
+
+Just another eGalax device.
+Please note that adding this device to have_special_driver
+in hid-core.c is not required anymore.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 2 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 9eb90b1..6ccd7df 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -235,6 +235,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C 0x720c
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B 0x726b
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1 0x72a1
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72FA 0x72fa
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302 0x7302
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index c77d495..6f6b1d9 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -664,6 +664,9 @@ static const struct hid_device_id mt_devices[] = {
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1) },
+ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72FA) },
++ { .driver_data = MT_CLS_EGALAX,
++ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302) },
+ { .driver_data = MT_CLS_EGALAX,
+ HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch
new file mode 100644
index 0000000..e67f925
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch
@@ -0,0 +1,63 @@
+From 6da88efbdd98ef411f670b51ad6ab0ca5e3a753b Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+Date: Tue, 29 Nov 2011 13:13:12 +0100
+Subject: [PATCH 085/130] HID: hid-multitouch: add support for new Hanvon
+ panels
+
+commit 545803651da8dde248eeb8ce3ed1e547e9e4ac0a upstream.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+Acked-by: Henrik Rydberg <rydberg@euromail.se>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hid/hid-core.c | 1 +
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-multitouch.c | 5 +++++
+ 3 files changed, 9 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 9cee7b2..a1cb906 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1425,6 +1425,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HANVON, USB_DEVICE_ID_HANVON_MULTITOUCH) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_HANVON_ALT, USB_DEVICE_ID_HANVON_ALT_MULTITOUCH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6650) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK, USB_DEVICE_ID_HOLTEK_ON_LINE_GRIP) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ILITEK, USB_DEVICE_ID_ILITEK_MULTITOUCH) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 6ccd7df..56df290 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -359,6 +359,9 @@
+ #define USB_VENDOR_ID_HANVON 0x20b3
+ #define USB_DEVICE_ID_HANVON_MULTITOUCH 0x0a18
+
++#define USB_VENDOR_ID_HANVON_ALT 0x22ed
++#define USB_DEVICE_ID_HANVON_ALT_MULTITOUCH 0x1010
++
+ #define USB_VENDOR_ID_HAPP 0x078b
+ #define USB_DEVICE_ID_UGCI_DRIVING 0x0010
+ #define USB_DEVICE_ID_UGCI_FLYING 0x0020
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 6f6b1d9..ea20c8e 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -687,6 +687,11 @@ static const struct hid_device_id mt_devices[] = {
+ HID_USB_DEVICE(USB_VENDOR_ID_GOODTOUCH,
+ USB_DEVICE_ID_GOODTOUCH_000f) },
+
++ /* Hanvon panels */
++ { .driver_data = MT_CLS_DUAL_INRANGE_CONTACTID,
++ HID_USB_DEVICE(USB_VENDOR_ID_HANVON_ALT,
++ USB_DEVICE_ID_HANVON_ALT_MULTITOUCH) },
++
+ /* Ideacom panel */
+ { .driver_data = MT_CLS_SERIAL,
+ HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch
new file mode 100644
index 0000000..1c03e1d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch
@@ -0,0 +1,63 @@
+From ba791aa0bf69b20ba364329edc62dc04ddb86dfc Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@gmail.com>
+Date: Fri, 23 Dec 2011 15:40:59 +0100
+Subject: [PATCH 086/130] HID: multitouch: add support of Atmel multitouch
+ panels
+
+commit b105712469d957cf1ab223c1ea72b7ba88edb926 upstream.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
+Acked-by: Henrik Rydberg <rydberg@euromail.se>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hid/Kconfig | 1 +
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-multitouch.c | 5 +++++
+ 3 files changed, 9 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 332c22a..36f5df3 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -335,6 +335,7 @@ config HID_MULTITOUCH
+ Say Y here if you have one of the following devices:
+ - 3M PCT touch screens
+ - ActionStar dual touch panels
++ - Atmel panels
+ - Cando dual touch panels
+ - Chunghwa panels
+ - CVTouch panels
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 56df290..bf95a50 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -145,6 +145,9 @@
+ #define USB_DEVICE_ID_ATEN_4PORTKVM 0x2205
+ #define USB_DEVICE_ID_ATEN_4PORTKVMC 0x2208
+
++#define USB_VENDOR_ID_ATMEL 0x03eb
++#define USB_DEVICE_ID_ATMEL_MULTITOUCH 0x211c
++
+ #define USB_VENDOR_ID_AVERMEDIA 0x07ca
+ #define USB_DEVICE_ID_AVER_FM_MR800 0xb800
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index ea20c8e..7f83024 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -615,6 +615,11 @@ static const struct hid_device_id mt_devices[] = {
+ HID_USB_DEVICE(USB_VENDOR_ID_ACTIONSTAR,
+ USB_DEVICE_ID_ACTIONSTAR_1011) },
+
++ /* Atmel panels */
++ { .driver_data = MT_CLS_SERIAL,
++ HID_USB_DEVICE(USB_VENDOR_ID_ATMEL,
++ USB_DEVICE_ID_ATMEL_MULTITOUCH) },
++
+ /* Cando panels */
+ { .driver_data = MT_CLS_DUAL_INRANGE_CONTACTNUMBER,
+ HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch
new file mode 100644
index 0000000..e87a408
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch
@@ -0,0 +1,45 @@
+From 59e1439e23925a4029af1ba09e54e57d6824d6af Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@gmail.com>
+Date: Fri, 23 Dec 2011 15:41:00 +0100
+Subject: [PATCH 087/130] HID: multitouch: add support for 3M 32"
+
+commit c4fad877cd0efb51d8180ae2eaa791c99c92051c upstream.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
+Acked-by: Henrik Rydberg <rydberg@euromail.se>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 2 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index bf95a50..6e53391a 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -21,6 +21,7 @@
+ #define USB_VENDOR_ID_3M 0x0596
+ #define USB_DEVICE_ID_3M1968 0x0500
+ #define USB_DEVICE_ID_3M2256 0x0502
++#define USB_DEVICE_ID_3M3266 0x0506
+
+ #define USB_VENDOR_ID_A4TECH 0x09da
+ #define USB_DEVICE_ID_A4TECH_WCP32PU 0x0006
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 7f83024..4a63dee 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -609,6 +609,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_3M,
+ HID_USB_DEVICE(USB_VENDOR_ID_3M,
+ USB_DEVICE_ID_3M2256) },
++ { .driver_data = MT_CLS_3M,
++ HID_USB_DEVICE(USB_VENDOR_ID_3M,
++ USB_DEVICE_ID_3M3266) },
+
+ /* ActionStar panels */
+ { .driver_data = MT_CLS_DEFAULT,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch
new file mode 100644
index 0000000..9a51d31
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch
@@ -0,0 +1,117 @@
+From 9f0708248c8226860e4fbb4492575f7128e593d5 Mon Sep 17 00:00:00 2001
+From: Masatoshi Hoshikawa <hoshikawa@xiroku.com>
+Date: Thu, 5 Jan 2012 11:53:46 +0900
+Subject: [PATCH 088/130] HID: hid-multitouch: add support 9 new Xiroku
+ devices
+
+commit 11576c6114c3b6505aea2e0c988bedb856a0e20c upstream.
+
+This patch adds support for the Xiroku Inc. panels (SPX/MPX/CSR/etc.).
+
+Signed-off-by: Masatoshi Hoshikawa <hoshikawa@xiroku.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hid/Kconfig | 1 +
+ drivers/hid/hid-core.c | 9 +++++++++
+ drivers/hid/hid-ids.h | 11 +++++++++++
+ drivers/hid/hid-multitouch.c | 29 +++++++++++++++++++++++++++++
+ 4 files changed, 50 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 36f5df3..d21f6d0 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -356,6 +356,7 @@ config HID_MULTITOUCH
+ - Touch International Panels
+ - Unitec Panels
+ - XAT optical touch panels
++ - Xiroku optical touch panels
+
+ If unsure, say N.
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index a1cb906..bb656d8 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1552,6 +1552,15 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_XAT, USB_DEVICE_ID_XAT_CSR) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_SPX) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_MPX) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_CSR) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_SPX1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_MPX1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_CSR1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_SPX2) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_MPX2) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIROKU, USB_DEVICE_ID_XIROKU_CSR2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 6e53391a..00cabb3 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -717,6 +717,17 @@
+ #define USB_VENDOR_ID_XAT 0x2505
+ #define USB_DEVICE_ID_XAT_CSR 0x0220
+
++#define USB_VENDOR_ID_XIROKU 0x1477
++#define USB_DEVICE_ID_XIROKU_SPX 0x1006
++#define USB_DEVICE_ID_XIROKU_MPX 0x1007
++#define USB_DEVICE_ID_XIROKU_CSR 0x100e
++#define USB_DEVICE_ID_XIROKU_SPX1 0x1021
++#define USB_DEVICE_ID_XIROKU_CSR1 0x1022
++#define USB_DEVICE_ID_XIROKU_MPX1 0x1023
++#define USB_DEVICE_ID_XIROKU_SPX2 0x1024
++#define USB_DEVICE_ID_XIROKU_CSR2 0x1025
++#define USB_DEVICE_ID_XIROKU_MPX2 0x1026
++
+ #define USB_VENDOR_ID_YEALINK 0x6993
+ #define USB_DEVICE_ID_YEALINK_P1K_P4K_B2K 0xb001
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 4a63dee..995fc4c 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -780,6 +780,35 @@ static const struct hid_device_id mt_devices[] = {
+ HID_USB_DEVICE(USB_VENDOR_ID_XAT,
+ USB_DEVICE_ID_XAT_CSR) },
+
++ /* Xiroku */
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_SPX) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_MPX) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_CSR) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_SPX1) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_MPX1) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_CSR1) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_SPX2) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_MPX2) },
++ { .driver_data = MT_CLS_DEFAULT,
++ HID_USB_DEVICE(USB_VENDOR_ID_XIROKU,
++ USB_DEVICE_ID_XIROKU_CSR2) },
++
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, mt_devices);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch
new file mode 100644
index 0000000..ba211f0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch
@@ -0,0 +1,49 @@
+From 7d6b552faf6a591c44f680e3e897a1bd6471985a Mon Sep 17 00:00:00 2001
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Thu, 15 Dec 2011 14:56:10 +0100
+Subject: [PATCH 089/130] fix cputime overflow in uptime_proc_show
+
+commit c3e0ef9a298e028a82ada28101ccd5cf64d209ee upstream.
+
+For 32-bit architectures using standard jiffies the idletime calculation
+in uptime_proc_show will quickly overflow. It takes (2^32 / HZ) seconds
+of idle-time, or e.g. 12.45 days with no load on a quad-core with HZ=1000.
+Switch to 64-bit calculations.
+
+Cc: Michael Abbott <michael.abbott@diamond.ac.uk>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/proc/uptime.c | 9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/fs/proc/uptime.c b/fs/proc/uptime.c
+index 766b1d4..29166ec 100644
+--- a/fs/proc/uptime.c
++++ b/fs/proc/uptime.c
+@@ -11,15 +11,20 @@ static int uptime_proc_show(struct seq_file *m, void *v)
+ {
+ struct timespec uptime;
+ struct timespec idle;
++ cputime64_t idletime;
++ u64 nsec;
++ u32 rem;
+ int i;
+- cputime_t idletime = cputime_zero;
+
++ idletime = 0;
+ for_each_possible_cpu(i)
+ idletime = cputime64_add(idletime, kstat_cpu(i).cpustat.idle);
+
+ do_posix_clock_monotonic_gettime(&uptime);
+ monotonic_to_bootbased(&uptime);
+- cputime_to_timespec(idletime, &idle);
++ nsec = cputime64_to_jiffies64(idletime) * TICK_NSEC;
++ idle.tv_sec = div_u64_rem(nsec, NSEC_PER_SEC, &rem);
++ idle.tv_nsec = rem;
+ seq_printf(m, "%lu.%02lu %lu.%02lu\n",
+ (unsigned long) uptime.tv_sec,
+ (uptime.tv_nsec / (NSEC_PER_SEC / 100)),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch
new file mode 100644
index 0000000..943cf41
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch
@@ -0,0 +1,166 @@
+From 4adb778fc31d3c9c7707167165b07138f31c78c4 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 12 Jan 2012 16:01:27 +0100
+Subject: [PATCH 090/130] block: add and use scsi_blk_cmd_ioctl
+
+commit 577ebb374c78314ac4617242f509e2f5e7156649 upstream.
+
+Introduce a wrapper around scsi_cmd_ioctl that takes a block device.
+
+The function will then be enhanced to detect partition block devices
+and, in that case, subject the ioctls to whitelisting.
+
+Cc: linux-scsi@vger.kernel.org
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: James Bottomley <JBottomley@parallels.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ block/scsi_ioctl.c | 7 +++++++
+ drivers/block/cciss.c | 6 +++---
+ drivers/block/ub.c | 3 +--
+ drivers/block/virtio_blk.c | 4 ++--
+ drivers/cdrom/cdrom.c | 3 +--
+ drivers/ide/ide-floppy_ioctl.c | 3 +--
+ drivers/scsi/sd.c | 2 +-
+ include/linux/blkdev.h | 2 ++
+ 8 files changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
+index fbdf0d8..a2c11f3 100644
+--- a/block/scsi_ioctl.c
++++ b/block/scsi_ioctl.c
+@@ -690,6 +690,13 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod
+ }
+ EXPORT_SYMBOL(scsi_cmd_ioctl);
+
++int scsi_cmd_blk_ioctl(struct block_device *bd, fmode_t mode,
++ unsigned int cmd, void __user *arg)
++{
++ return scsi_cmd_ioctl(bd->bd_disk->queue, bd->bd_disk, mode, cmd, arg);
++}
++EXPORT_SYMBOL(scsi_cmd_blk_ioctl);
++
+ static int __init blk_scsi_ioctl_init(void)
+ {
+ blk_set_cmd_filter_defaults(&blk_default_cmd_filter);
+diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
+index 587cce5..b0f553b 100644
+--- a/drivers/block/cciss.c
++++ b/drivers/block/cciss.c
+@@ -1735,7 +1735,7 @@ static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
+ case CCISS_BIG_PASSTHRU:
+ return cciss_bigpassthru(h, argp);
+
+- /* scsi_cmd_ioctl handles these, below, though some are not */
++ /* scsi_cmd_blk_ioctl handles these, below, though some are not */
+ /* very meaningful for cciss. SG_IO is the main one people want. */
+
+ case SG_GET_VERSION_NUM:
+@@ -1746,9 +1746,9 @@ static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
+ case SG_EMULATED_HOST:
+ case SG_IO:
+ case SCSI_IOCTL_SEND_COMMAND:
+- return scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
++ return scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
+
+- /* scsi_cmd_ioctl would normally handle these, below, but */
++ /* scsi_cmd_blk_ioctl would normally handle these, below, but */
+ /* they aren't a good fit for cciss, as CD-ROMs are */
+ /* not supported, and we don't have any bus/target/lun */
+ /* which we present to the kernel. */
+diff --git a/drivers/block/ub.c b/drivers/block/ub.c
+index 0e376d4..7333b9e 100644
+--- a/drivers/block/ub.c
++++ b/drivers/block/ub.c
+@@ -1744,12 +1744,11 @@ static int ub_bd_release(struct gendisk *disk, fmode_t mode)
+ static int ub_bd_ioctl(struct block_device *bdev, fmode_t mode,
+ unsigned int cmd, unsigned long arg)
+ {
+- struct gendisk *disk = bdev->bd_disk;
+ void __user *usermem = (void __user *) arg;
+ int ret;
+
+ mutex_lock(&ub_mutex);
+- ret = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, usermem);
++ ret = scsi_cmd_blk_ioctl(bdev, mode, cmd, usermem);
+ mutex_unlock(&ub_mutex);
+
+ return ret;
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 4d0b70a..e46f2f7 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -243,8 +243,8 @@ static int virtblk_ioctl(struct block_device *bdev, fmode_t mode,
+ if (!virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_SCSI))
+ return -ENOTTY;
+
+- return scsi_cmd_ioctl(disk->queue, disk, mode, cmd,
+- (void __user *)data);
++ return scsi_cmd_blk_ioctl(bdev, mode, cmd,
++ (void __user *)data);
+ }
+
+ /* We provide getgeo only to please some old bootloader/partitioning tools */
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index f997c27..cedb231 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2747,12 +2747,11 @@ int cdrom_ioctl(struct cdrom_device_info *cdi, struct block_device *bdev,
+ {
+ void __user *argp = (void __user *)arg;
+ int ret;
+- struct gendisk *disk = bdev->bd_disk;
+
+ /*
+ * Try the generic SCSI command ioctl's first.
+ */
+- ret = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
++ ret = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
+ if (ret != -ENOTTY)
+ return ret;
+
+diff --git a/drivers/ide/ide-floppy_ioctl.c b/drivers/ide/ide-floppy_ioctl.c
+index d267b7a..a22ca84 100644
+--- a/drivers/ide/ide-floppy_ioctl.c
++++ b/drivers/ide/ide-floppy_ioctl.c
+@@ -292,8 +292,7 @@ int ide_floppy_ioctl(ide_drive_t *drive, struct block_device *bdev,
+ * and CDROM_SEND_PACKET (legacy) ioctls
+ */
+ if (cmd != CDROM_SEND_PACKET && cmd != SCSI_IOCTL_SEND_COMMAND)
+- err = scsi_cmd_ioctl(bdev->bd_disk->queue, bdev->bd_disk,
+- mode, cmd, argp);
++ err = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
+
+ if (err == -ENOTTY)
+ err = generic_ide_ioctl(drive, bdev, cmd, arg);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index fa3a591..ffa1c79 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1096,7 +1096,7 @@ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
+ error = scsi_ioctl(sdp, cmd, p);
+ break;
+ default:
+- error = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, p);
++ error = scsi_cmd_blk_ioctl(bdev, mode, cmd, p);
+ if (error != -ENOTTY)
+ break;
+ error = scsi_ioctl(sdp, cmd, p);
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 94acd81..ca7b869 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -675,6 +675,8 @@ extern int blk_insert_cloned_request(struct request_queue *q,
+ struct request *rq);
+ extern void blk_delay_queue(struct request_queue *, unsigned long);
+ extern void blk_recount_segments(struct request_queue *, struct bio *);
++extern int scsi_cmd_blk_ioctl(struct block_device *, fmode_t,
++ unsigned int, void __user *);
+ extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t,
+ unsigned int, void __user *);
+ extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch
new file mode 100644
index 0000000..5074770
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch
@@ -0,0 +1,166 @@
+From b4bc30558b98e2eba6f6d86239d49bf3d60015cb Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 12 Jan 2012 16:01:28 +0100
+Subject: [PATCH 091/130] block: fail SCSI passthrough ioctls on partition
+ devices
+
+commit 0bfc96cb77224736dfa35c3c555d37b3646ef35e upstream.
+
+[ Changes with respect to 3.3: return -ENOTTY from scsi_verify_blk_ioctl
+ and -ENOIOCTLCMD from sd_compat_ioctl. ]
+
+Linux allows executing the SG_IO ioctl on a partition or LVM volume, and
+will pass the command to the underlying block device. This is
+well-known, but it is also a large security problem when (via Unix
+permissions, ACLs, SELinux or a combination thereof) a program or user
+needs to be granted access only to part of the disk.
+
+This patch lets partitions forward a small set of harmless ioctls;
+others are logged with printk so that we can see which ioctls are
+actually sent. In my tests only CDROM_GET_CAPABILITY actually occurred.
+Of course it was being sent to a (partition on a) hard disk, so it would
+have failed with ENOTTY and the patch isn't changing anything in
+practice. Still, I'm treating it specially to avoid spamming the logs.
+
+In principle, this restriction should include programs running with
+CAP_SYS_RAWIO. If for example I let a program access /dev/sda2 and
+/dev/sdb, it still should not be able to read/write outside the
+boundaries of /dev/sda2 independent of the capabilities. However, for
+now programs with CAP_SYS_RAWIO will still be allowed to send the
+ioctls. Their actions will still be logged.
+
+This patch does not affect the non-libata IDE driver. That driver
+however already tests for bd != bd->bd_contains before issuing some
+ioctl; it could be restricted further to forbid these ioctls even for
+programs running with CAP_SYS_ADMIN/CAP_SYS_RAWIO.
+
+Cc: linux-scsi@vger.kernel.org
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: James Bottomley <JBottomley@parallels.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+[ Make it also print the command name when warning - Linus ]
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ block/scsi_ioctl.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
+ drivers/scsi/sd.c | 11 +++++++++--
+ include/linux/blkdev.h | 1 +
+ 3 files changed, 55 insertions(+), 2 deletions(-)
+
+diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
+index a2c11f3..688be8a 100644
+--- a/block/scsi_ioctl.c
++++ b/block/scsi_ioctl.c
+@@ -24,6 +24,7 @@
+ #include <linux/capability.h>
+ #include <linux/completion.h>
+ #include <linux/cdrom.h>
++#include <linux/ratelimit.h>
+ #include <linux/slab.h>
+ #include <linux/times.h>
+ #include <asm/uaccess.h>
+@@ -690,9 +691,53 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod
+ }
+ EXPORT_SYMBOL(scsi_cmd_ioctl);
+
++int scsi_verify_blk_ioctl(struct block_device *bd, unsigned int cmd)
++{
++ if (bd && bd == bd->bd_contains)
++ return 0;
++
++ /* Actually none of these is particularly useful on a partition,
++ * but they are safe.
++ */
++ switch (cmd) {
++ case SCSI_IOCTL_GET_IDLUN:
++ case SCSI_IOCTL_GET_BUS_NUMBER:
++ case SCSI_IOCTL_GET_PCI:
++ case SCSI_IOCTL_PROBE_HOST:
++ case SG_GET_VERSION_NUM:
++ case SG_SET_TIMEOUT:
++ case SG_GET_TIMEOUT:
++ case SG_GET_RESERVED_SIZE:
++ case SG_SET_RESERVED_SIZE:
++ case SG_EMULATED_HOST:
++ return 0;
++ case CDROM_GET_CAPABILITY:
++ /* Keep this until we remove the printk below. udev sends it
++ * and we do not want to spam dmesg about it. CD-ROMs do
++ * not have partitions, so we get here only for disks.
++ */
++ return -ENOTTY;
++ default:
++ break;
++ }
++
++ /* In particular, rule out all resets and host-specific ioctls. */
++ printk_ratelimited(KERN_WARNING
++ "%s: sending ioctl %x to a partition!\n", current->comm, cmd);
++
++ return capable(CAP_SYS_RAWIO) ? 0 : -ENOTTY;
++}
++EXPORT_SYMBOL(scsi_verify_blk_ioctl);
++
+ int scsi_cmd_blk_ioctl(struct block_device *bd, fmode_t mode,
+ unsigned int cmd, void __user *arg)
+ {
++ int ret;
++
++ ret = scsi_verify_blk_ioctl(bd, cmd);
++ if (ret < 0)
++ return ret;
++
+ return scsi_cmd_ioctl(bd->bd_disk->queue, bd->bd_disk, mode, cmd, arg);
+ }
+ EXPORT_SYMBOL(scsi_cmd_blk_ioctl);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index ffa1c79..4b63c73 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1074,6 +1074,10 @@ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
+ SCSI_LOG_IOCTL(1, sd_printk(KERN_INFO, sdkp, "sd_ioctl: disk=%s, "
+ "cmd=0x%x\n", disk->disk_name, cmd));
+
++ error = scsi_verify_blk_ioctl(bdev, cmd);
++ if (error < 0)
++ return error;
++
+ /*
+ * If we are in the middle of error recovery, don't let anyone
+ * else try and use this device. Also, if error recovery fails, it
+@@ -1266,6 +1270,11 @@ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
+ unsigned int cmd, unsigned long arg)
+ {
+ struct scsi_device *sdev = scsi_disk(bdev->bd_disk)->device;
++ int ret;
++
++ ret = scsi_verify_blk_ioctl(bdev, cmd);
++ if (ret < 0)
++ return -ENOIOCTLCMD;
+
+ /*
+ * If we are in the middle of error recovery, don't let anyone
+@@ -1277,8 +1286,6 @@ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
+ return -ENODEV;
+
+ if (sdev->host->hostt->compat_ioctl) {
+- int ret;
+-
+ ret = sdev->host->hostt->compat_ioctl(sdev, cmd, (void __user *)arg);
+
+ return ret;
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index ca7b869..0ed1eb0 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -675,6 +675,7 @@ extern int blk_insert_cloned_request(struct request_queue *q,
+ struct request *rq);
+ extern void blk_delay_queue(struct request_queue *, unsigned long);
+ extern void blk_recount_segments(struct request_queue *, struct bio *);
++extern int scsi_verify_blk_ioctl(struct block_device *, unsigned int);
+ extern int scsi_cmd_blk_ioctl(struct block_device *, fmode_t,
+ unsigned int, void __user *);
+ extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch
new file mode 100644
index 0000000..6cf7708
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch
@@ -0,0 +1,90 @@
+From eb8de39f8d8116261b98f971f3e3e2230fa3abcf Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 12 Jan 2012 16:01:29 +0100
+Subject: [PATCH 092/130] dm: do not forward ioctls from logical volumes to
+ the underlying device
+
+commit ec8013beddd717d1740cfefb1a9b900deef85462 upstream.
+
+A logical volume can map to just part of underlying physical volume.
+In this case, it must be treated like a partition.
+
+Based on a patch from Alasdair G Kergon.
+
+Cc: Alasdair G Kergon <agk@redhat.com>
+Cc: dm-devel@redhat.com
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/md/dm-flakey.c | 11 ++++++++++-
+ drivers/md/dm-linear.c | 12 +++++++++++-
+ drivers/md/dm-mpath.c | 6 ++++++
+ 3 files changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index f84c080..9fb18c1 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -368,8 +368,17 @@ static int flakey_status(struct dm_target *ti, status_type_t type,
+ static int flakey_ioctl(struct dm_target *ti, unsigned int cmd, unsigned long arg)
+ {
+ struct flakey_c *fc = ti->private;
++ struct dm_dev *dev = fc->dev;
++ int r = 0;
+
+- return __blkdev_driver_ioctl(fc->dev->bdev, fc->dev->mode, cmd, arg);
++ /*
++ * Only pass ioctls through if the device sizes match exactly.
++ */
++ if (fc->start ||
++ ti->len != i_size_read(dev->bdev->bd_inode) >> SECTOR_SHIFT)
++ r = scsi_verify_blk_ioctl(NULL, cmd);
++
++ return r ? : __blkdev_driver_ioctl(dev->bdev, dev->mode, cmd, arg);
+ }
+
+ static int flakey_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
+diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c
+index 3921e3b..9728839 100644
+--- a/drivers/md/dm-linear.c
++++ b/drivers/md/dm-linear.c
+@@ -116,7 +116,17 @@ static int linear_ioctl(struct dm_target *ti, unsigned int cmd,
+ unsigned long arg)
+ {
+ struct linear_c *lc = (struct linear_c *) ti->private;
+- return __blkdev_driver_ioctl(lc->dev->bdev, lc->dev->mode, cmd, arg);
++ struct dm_dev *dev = lc->dev;
++ int r = 0;
++
++ /*
++ * Only pass ioctls through if the device sizes match exactly.
++ */
++ if (lc->start ||
++ ti->len != i_size_read(dev->bdev->bd_inode) >> SECTOR_SHIFT)
++ r = scsi_verify_blk_ioctl(NULL, cmd);
++
++ return r ? : __blkdev_driver_ioctl(dev->bdev, dev->mode, cmd, arg);
+ }
+
+ static int linear_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 5e0090e..801d92d 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -1520,6 +1520,12 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
+
+ spin_unlock_irqrestore(&m->lock, flags);
+
++ /*
++ * Only pass ioctls through if the device sizes match exactly.
++ */
++ if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT)
++ r = scsi_verify_blk_ioctl(NULL, cmd);
++
+ return r ? : __blkdev_driver_ioctl(bdev, mode, cmd, arg);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch
new file mode 100644
index 0000000..7189318
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch
@@ -0,0 +1,271 @@
+From 483f23031ea337d0abf4392186bdfd2b8ae5dce3 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Tue, 17 Jan 2012 15:21:19 -0800
+Subject: [PATCH 093/130] proc: clean up and fix /proc/<pid>/mem handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit e268337dfe26dfc7efd422a804dbb27977a3cccc upstream.
+
+Jüri Aedla reported that the /proc/<pid>/mem handling really isn't very
+robust, and it also doesn't match the permission checking of any of the
+other related files.
+
+This changes it to do the permission checks at open time, and instead of
+tracking the process, it tracks the VM at the time of the open. That
+simplifies the code a lot, but does mean that if you hold the file
+descriptor open over an execve(), you'll continue to read from the _old_
+VM.
+
+That is different from our previous behavior, but much simpler. If
+somebody actually finds a load where this matters, we'll need to revert
+this commit.
+
+I suspect that nobody will ever notice - because the process mapping
+addresses will also have changed as part of the execve. So you cannot
+actually usefully access the fd across a VM change simply because all
+the offsets for IO would have changed too.
+
+Reported-by: Jüri Aedla <asd@ut.ee>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/proc/base.c | 145 +++++++++++++++-----------------------------------------
+ 1 files changed, 39 insertions(+), 106 deletions(-)
+
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 851ba3d..1fc1dca 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -194,65 +194,7 @@ static int proc_root_link(struct inode *inode, struct path *path)
+ return result;
+ }
+
+-static struct mm_struct *__check_mem_permission(struct task_struct *task)
+-{
+- struct mm_struct *mm;
+-
+- mm = get_task_mm(task);
+- if (!mm)
+- return ERR_PTR(-EINVAL);
+-
+- /*
+- * A task can always look at itself, in case it chooses
+- * to use system calls instead of load instructions.
+- */
+- if (task == current)
+- return mm;
+-
+- /*
+- * If current is actively ptrace'ing, and would also be
+- * permitted to freshly attach with ptrace now, permit it.
+- */
+- if (task_is_stopped_or_traced(task)) {
+- int match;
+- rcu_read_lock();
+- match = (ptrace_parent(task) == current);
+- rcu_read_unlock();
+- if (match && ptrace_may_access(task, PTRACE_MODE_ATTACH))
+- return mm;
+- }
+-
+- /*
+- * No one else is allowed.
+- */
+- mmput(mm);
+- return ERR_PTR(-EPERM);
+-}
+-
+-/*
+- * If current may access user memory in @task return a reference to the
+- * corresponding mm, otherwise ERR_PTR.
+- */
+-static struct mm_struct *check_mem_permission(struct task_struct *task)
+-{
+- struct mm_struct *mm;
+- int err;
+-
+- /*
+- * Avoid racing if task exec's as we might get a new mm but validate
+- * against old credentials.
+- */
+- err = mutex_lock_killable(&task->signal->cred_guard_mutex);
+- if (err)
+- return ERR_PTR(err);
+-
+- mm = __check_mem_permission(task);
+- mutex_unlock(&task->signal->cred_guard_mutex);
+-
+- return mm;
+-}
+-
+-struct mm_struct *mm_for_maps(struct task_struct *task)
++static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
+ {
+ struct mm_struct *mm;
+ int err;
+@@ -263,7 +205,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
+
+ mm = get_task_mm(task);
+ if (mm && mm != current->mm &&
+- !ptrace_may_access(task, PTRACE_MODE_READ)) {
++ !ptrace_may_access(task, mode)) {
+ mmput(mm);
+ mm = ERR_PTR(-EACCES);
+ }
+@@ -272,6 +214,11 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
+ return mm;
+ }
+
++struct mm_struct *mm_for_maps(struct task_struct *task)
++{
++ return mm_access(task, PTRACE_MODE_READ);
++}
++
+ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
+ {
+ int res = 0;
+@@ -816,38 +763,39 @@ static const struct file_operations proc_single_file_operations = {
+
+ static int mem_open(struct inode* inode, struct file* file)
+ {
+- file->private_data = (void*)((long)current->self_exec_id);
++ struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
++ struct mm_struct *mm;
++
++ if (!task)
++ return -ESRCH;
++
++ mm = mm_access(task, PTRACE_MODE_ATTACH);
++ put_task_struct(task);
++
++ if (IS_ERR(mm))
++ return PTR_ERR(mm);
++
+ /* OK to pass negative loff_t, we can catch out-of-range */
+ file->f_mode |= FMODE_UNSIGNED_OFFSET;
++ file->private_data = mm;
++
+ return 0;
+ }
+
+ static ssize_t mem_read(struct file * file, char __user * buf,
+ size_t count, loff_t *ppos)
+ {
+- struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
++ int ret;
+ char *page;
+ unsigned long src = *ppos;
+- int ret = -ESRCH;
+- struct mm_struct *mm;
++ struct mm_struct *mm = file->private_data;
+
+- if (!task)
+- goto out_no_task;
++ if (!mm)
++ return 0;
+
+- ret = -ENOMEM;
+ page = (char *)__get_free_page(GFP_TEMPORARY);
+ if (!page)
+- goto out;
+-
+- mm = check_mem_permission(task);
+- ret = PTR_ERR(mm);
+- if (IS_ERR(mm))
+- goto out_free;
+-
+- ret = -EIO;
+-
+- if (file->private_data != (void*)((long)current->self_exec_id))
+- goto out_put;
++ return -ENOMEM;
+
+ ret = 0;
+
+@@ -874,13 +822,7 @@ static ssize_t mem_read(struct file * file, char __user * buf,
+ }
+ *ppos = src;
+
+-out_put:
+- mmput(mm);
+-out_free:
+ free_page((unsigned long) page);
+-out:
+- put_task_struct(task);
+-out_no_task:
+ return ret;
+ }
+
+@@ -889,27 +831,15 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
+ {
+ int copied;
+ char *page;
+- struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
+ unsigned long dst = *ppos;
+- struct mm_struct *mm;
++ struct mm_struct *mm = file->private_data;
+
+- copied = -ESRCH;
+- if (!task)
+- goto out_no_task;
++ if (!mm)
++ return 0;
+
+- copied = -ENOMEM;
+ page = (char *)__get_free_page(GFP_TEMPORARY);
+ if (!page)
+- goto out_task;
+-
+- mm = check_mem_permission(task);
+- copied = PTR_ERR(mm);
+- if (IS_ERR(mm))
+- goto out_free;
+-
+- copied = -EIO;
+- if (file->private_data != (void *)((long)current->self_exec_id))
+- goto out_mm;
++ return -ENOMEM;
+
+ copied = 0;
+ while (count > 0) {
+@@ -933,13 +863,7 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
+ }
+ *ppos = dst;
+
+-out_mm:
+- mmput(mm);
+-out_free:
+ free_page((unsigned long) page);
+-out_task:
+- put_task_struct(task);
+-out_no_task:
+ return copied;
+ }
+
+@@ -959,11 +883,20 @@ loff_t mem_lseek(struct file *file, loff_t offset, int orig)
+ return file->f_pos;
+ }
+
++static int mem_release(struct inode *inode, struct file *file)
++{
++ struct mm_struct *mm = file->private_data;
++
++ mmput(mm);
++ return 0;
++}
++
+ static const struct file_operations proc_mem_operations = {
+ .llseek = mem_lseek,
+ .read = mem_read,
+ .write = mem_write,
+ .open = mem_open,
++ .release = mem_release,
+ };
+
+ static ssize_t environ_read(struct file *file, char __user *buf,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch
new file mode 100644
index 0000000..85652b0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch
@@ -0,0 +1,35 @@
+From 19c9fdb5e8d481a2a13b437ef124486808a35726 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Thu, 12 Jan 2012 16:31:14 +0100
+Subject: [PATCH 094/130] ALSA: HDA: Use LPIB position fix for Macbook Pro 7,1
+
+commit b01de4fb40137fbda7530550ff0cd37171dafb0c upstream.
+
+Several users have reported "choppy" audio under the 3.2 kernel,
+and that changing position_fix to 1 has resolved their problem.
+The chip is an nVidia Corporation MCP89 High Definition Audio,
+[10de:0d94] (rev a2).
+
+BugLink: https://bugs.launchpad.net/bugs/909419
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ sound/pci/hda/hda_intel.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index c2f79e6..5b2b75b 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2509,6 +2509,7 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
+ SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS M2V", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS 1101HA", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB),
++ SND_PCI_QUIRK(0x10de, 0xcb89, "Macbook Pro 7,1", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1297, 0x3166, "Shuttle", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch
new file mode 100644
index 0000000..aa94381
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch
@@ -0,0 +1,37 @@
+From a199c605727cb1fd45800b12ede56637c027e0a2 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Sat, 14 Jan 2012 16:42:24 +0100
+Subject: [PATCH 095/130] ALSA: virtuoso: Xonar DS: fix polarity of front
+ output
+
+commit f0e48b6bd4e407459715240cd241ddb6b89bdf81 upstream.
+
+The two DACs for the front output and the surround/center/LFE/back
+outputs are wired up out of phase, so when channels are duplicated,
+their sound can cancel out each other and result in a weaker bass
+response. To fix this, reverse the polarity of the neutron flow to
+the front output.
+
+Reported-any-tested-by: Daniel Hill <daniel@enemyplanet.geek.nz>
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ sound/pci/oxygen/xonar_wm87x6.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/sound/pci/oxygen/xonar_wm87x6.c b/sound/pci/oxygen/xonar_wm87x6.c
+index 42d1ab1..915546a 100644
+--- a/sound/pci/oxygen/xonar_wm87x6.c
++++ b/sound/pci/oxygen/xonar_wm87x6.c
+@@ -177,6 +177,7 @@ static void wm8776_registers_init(struct oxygen *chip)
+ struct xonar_wm87x6 *data = chip->model_data;
+
+ wm8776_write(chip, WM8776_RESET, 0);
++ wm8776_write(chip, WM8776_PHASESWAP, WM8776_PH_MASK);
+ wm8776_write(chip, WM8776_DACCTRL1, WM8776_DZCEN |
+ WM8776_PL_LEFT_LEFT | WM8776_PL_RIGHT_RIGHT);
+ wm8776_write(chip, WM8776_DACMUTE, chip->dac_mute ? WM8776_DMUTE : 0);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch
new file mode 100644
index 0000000..80bf14e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch
@@ -0,0 +1,36 @@
+From 6ddbb15e9a2b460a42697a83ab2b4119978af8c8 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 16 Jan 2012 10:52:20 +0100
+Subject: [PATCH 096/130] ALSA: HDA: Fix internal microphone on Dell Studio 16
+ XPS 1645
+
+commit ffe535edb9a9c5b4d5fe03dfa3d89a1495580f1b upstream.
+
+More than one user reports that changing the model from "both" to
+"dmic" makes their Internal Mic work.
+
+Tested-by: Martin Ling <martin-launchpad@earth.li>
+BugLink: https://bugs.launchpad.net/bugs/795823
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ sound/pci/hda/patch_sigmatel.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index a87b260..f3c73a9 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1631,7 +1631,7 @@ static const struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = {
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02bd,
+ "Dell Studio 1557", STAC_DELL_M6_DMIC),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02fe,
+- "Dell Studio XPS 1645", STAC_DELL_M6_BOTH),
++ "Dell Studio XPS 1645", STAC_DELL_M6_DMIC),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0413,
+ "Dell Studio 1558", STAC_DELL_M6_DMIC),
+ {} /* terminator */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch
new file mode 100644
index 0000000..b6908ae
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch
@@ -0,0 +1,43 @@
+From 4e99d3453e09872ef6979dfe1518b80377fa5134 Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <from-tomoyo-users-en@I-love.SAKURA.ne.jp>
+Date: Sun, 15 Jan 2012 11:05:59 +0900
+Subject: [PATCH 097/130] TOMOYO: Accept \000 as a valid character.
+
+commit 25add8cf99c9ec8b8dc0acd8b9241e963fc0d29c upstream.
+
+TOMOYO 2.5 in Linux 3.2 and later handles Unix domain socket's address.
+Thus, tomoyo_correct_word2() needs to accept \000 as a valid character, or
+TOMOYO 2.5 cannot handle Unix domain's abstract socket address.
+
+Reported-by: Steven Allen <steven@stebalien.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ security/tomoyo/util.c | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c
+index 4a9b4b2..867558c 100644
+--- a/security/tomoyo/util.c
++++ b/security/tomoyo/util.c
+@@ -492,13 +492,13 @@ static bool tomoyo_correct_word2(const char *string, size_t len)
+ if (d < '0' || d > '7' || e < '0' || e > '7')
+ break;
+ c = tomoyo_make_byte(c, d, e);
+- if (tomoyo_invalid(c))
+- continue; /* pattern is not \000 */
++ if (c <= ' ' || c >= 127)
++ continue;
+ }
+ goto out;
+ } else if (in_repetition && c == '/') {
+ goto out;
+- } else if (tomoyo_invalid(c)) {
++ } else if (c <= ' ' || c >= 127) {
+ goto out;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch
new file mode 100644
index 0000000..b800a3e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch
@@ -0,0 +1,53 @@
+From 1ca189655bf3edf14c4837eba5873fc9c50f7e15 Mon Sep 17 00:00:00 2001
+From: Thomas Renninger <trenn@suse.de>
+Date: Sun, 4 Dec 2011 22:17:29 +0100
+Subject: [PATCH 098/130] intel idle: Make idle driver more robust
+
+commit 5c2a9f06a9cd7194f884cdc88144866235dec07d upstream.
+
+kvm -cpu host passes the original cpuid info to the guest.
+
+Latest kvm version seem to return true for mwait_leaf cpuid
+function on recent Intel CPUs. But it does not return mwait
+C-states (mwait_substates), instead zero is returned.
+
+While real CPUs seem to always return non-zero values, the intel
+idle driver should not get active in kvm (mwait_substates == 0)
+case and bail out.
+Otherwise a Null pointer exception will happen later when the
+cpuidle subsystem tries to get active:
+[0.984807] BUG: unable to handle kernel NULL pointer dereference at (null)
+[0.984807] IP: [<(null)>] (null)
+...
+[0.984807][<ffffffff8143cf34>] ? cpuidle_idle_call+0xb4/0x340
+[0.984807][<ffffffff8159e7bc>] ? __atomic_notifier_call_chain+0x4c/0x70
+[0.984807][<ffffffff81001198>] ? cpu_idle+0x78/0xd0
+
+Reference:
+https://bugzilla.novell.com/show_bug.cgi?id=726296
+
+Signed-off-by: Thomas Renninger <trenn@suse.de>
+CC: Bruno Friedmann <bruno@ioda-net.ch>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/idle/intel_idle.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index 5d2f8e1..1dafcc3 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -348,7 +348,8 @@ static int intel_idle_probe(void)
+ cpuid(CPUID_MWAIT_LEAF, &eax, &ebx, &ecx, &mwait_substates);
+
+ if (!(ecx & CPUID5_ECX_EXTENSIONS_SUPPORTED) ||
+- !(ecx & CPUID5_ECX_INTERRUPT_BREAK))
++ !(ecx & CPUID5_ECX_INTERRUPT_BREAK) ||
++ !mwait_substates)
+ return -ENODEV;
+
+ pr_debug(PREFIX "MWAIT substates: 0x%x\n", mwait_substates);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0099-intel_idle-fix-API-misuse.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0099-intel_idle-fix-API-misuse.patch
new file mode 100644
index 0000000..2a171be
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0099-intel_idle-fix-API-misuse.patch
@@ -0,0 +1,56 @@
+From aaeec055d714b03aededdf7bd4eb75415e16f1ce Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Tue, 10 Jan 2012 15:48:19 -0800
+Subject: [PATCH 099/130] intel_idle: fix API misuse
+
+commit 39a74fdedd1c1461d6fb6d330b5266886513c98f upstream.
+
+smp_call_function() only lets all other CPUs execute a specific function,
+while we expect all CPUs do in intel_idle. Without the fix, we could have
+one cpu which has auto_demotion enabled or has no broadcast timer setup.
+Usually we don't see impact because auto demotion just harms power and the
+intel_idle init is called in CPU 0, where boradcast timer delivers
+interrupt, but this still could be a problem.
+
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/idle/intel_idle.c | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index 1dafcc3..5b39216 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -395,7 +395,7 @@ static int intel_idle_probe(void)
+ if (boot_cpu_has(X86_FEATURE_ARAT)) /* Always Reliable APIC Timer */
+ lapic_timer_reliable_states = LAPIC_TIMER_ALWAYS_RELIABLE;
+ else {
+- smp_call_function(__setup_broadcast_timer, (void *)true, 1);
++ on_each_cpu(__setup_broadcast_timer, (void *)true, 1);
+ register_cpu_notifier(&setup_broadcast_notifier);
+ }
+
+@@ -472,7 +472,7 @@ static int intel_idle_cpuidle_driver_init(void)
+ }
+
+ if (auto_demotion_disable_flags)
+- smp_call_function(auto_demotion_disable, NULL, 1);
++ on_each_cpu(auto_demotion_disable, NULL, 1);
+
+ return 0;
+ }
+@@ -569,7 +569,7 @@ static void __exit intel_idle_exit(void)
+ cpuidle_unregister_driver(&intel_idle_driver);
+
+ if (lapic_timer_reliable_states != LAPIC_TIMER_ALWAYS_RELIABLE) {
+- smp_call_function(__setup_broadcast_timer, (void *)false, 1);
++ on_each_cpu(__setup_broadcast_timer, (void *)false, 1);
+ unregister_cpu_notifier(&setup_broadcast_notifier);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0100-ACPI-Store-SRAT-table-revision.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0100-ACPI-Store-SRAT-table-revision.patch
new file mode 100644
index 0000000..b729f78
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0100-ACPI-Store-SRAT-table-revision.patch
@@ -0,0 +1,66 @@
+From 30301eff41ac5268c71f2790e22d600785cd2664 Mon Sep 17 00:00:00 2001
+From: Kurt Garloff <kurt@garloff.de>
+Date: Tue, 17 Jan 2012 04:18:02 -0500
+Subject: [PATCH 100/130] ACPI: Store SRAT table revision
+
+commit 8df0eb7c9d96f9e82f233ee8b74e0f0c8471f868 upstream.
+
+In SRAT v1, we had 8bit proximity domain (PXM) fields; SRAT v2 provides
+32bits for these. The new fields were reserved before.
+According to the ACPI spec, the OS must disregrard reserved fields.
+In order to know whether or not, we must know what version the SRAT
+table has.
+
+This patch stores the SRAT table revision for later consumption
+by arch specific __init functions.
+
+Signed-off-by: Kurt Garloff <kurt@garloff.de>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/acpi/numa.c | 6 ++++++
+ include/acpi/acpi_numa.h | 1 +
+ 2 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
+index 3b5c318..e56f3be 100644
+--- a/drivers/acpi/numa.c
++++ b/drivers/acpi/numa.c
+@@ -45,6 +45,8 @@ static int pxm_to_node_map[MAX_PXM_DOMAINS]
+ static int node_to_pxm_map[MAX_NUMNODES]
+ = { [0 ... MAX_NUMNODES - 1] = PXM_INVAL };
+
++unsigned char acpi_srat_revision __initdata;
++
+ int pxm_to_node(int pxm)
+ {
+ if (pxm < 0)
+@@ -255,9 +257,13 @@ acpi_parse_memory_affinity(struct acpi_subtable_header * header,
+
+ static int __init acpi_parse_srat(struct acpi_table_header *table)
+ {
++ struct acpi_table_srat *srat;
+ if (!table)
+ return -EINVAL;
+
++ srat = (struct acpi_table_srat *)table;
++ acpi_srat_revision = srat->header.revision;
++
+ /* Real work done in acpi_table_parse_srat below. */
+
+ return 0;
+diff --git a/include/acpi/acpi_numa.h b/include/acpi/acpi_numa.h
+index 1739726..451823c 100644
+--- a/include/acpi/acpi_numa.h
++++ b/include/acpi/acpi_numa.h
+@@ -15,6 +15,7 @@ extern int pxm_to_node(int);
+ extern int node_to_pxm(int);
+ extern void __acpi_map_pxm_to_node(int, int);
+ extern int acpi_map_pxm_to_node(int);
++extern unsigned char acpi_srat_revision;
+
+ #endif /* CONFIG_ACPI_NUMA */
+ #endif /* __ACP_NUMA_H */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch
new file mode 100644
index 0000000..7cee68e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch
@@ -0,0 +1,50 @@
+From 0e45b514e46f9eff94b28f527e63141cc5690f53 Mon Sep 17 00:00:00 2001
+From: Kurt Garloff <kurt@garloff.de>
+Date: Tue, 17 Jan 2012 04:20:31 -0500
+Subject: [PATCH 101/130] ACPI, x86: Use SRAT table rev to use 8bit or 32bit
+ PXM fields (x86/x86-64)
+
+commit cd298f60a2451a16e0f077404bf69b62ec868733 upstream.
+
+In SRAT v1, we had 8bit proximity domain (PXM) fields; SRAT v2 provides
+32bits for these. The new fields were reserved before.
+According to the ACPI spec, the OS must disregrard reserved fields.
+
+x86/x86-64 was rather inconsistent prior to this patch; it used 8 bits
+for the pxm field in cpu_affinity, but 32 bits in mem_affinity.
+This patch makes it consistent: Either use 8 bits consistently (SRAT
+rev 1 or lower) or 32 bits (SRAT rev 2 or higher).
+
+cc: x86@kernel.org
+Signed-off-by: Kurt Garloff <kurt@garloff.de>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/mm/srat.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/arch/x86/mm/srat.c b/arch/x86/mm/srat.c
+index 81dbfde..7efd0c6 100644
+--- a/arch/x86/mm/srat.c
++++ b/arch/x86/mm/srat.c
+@@ -104,6 +104,8 @@ acpi_numa_processor_affinity_init(struct acpi_srat_cpu_affinity *pa)
+ if ((pa->flags & ACPI_SRAT_CPU_ENABLED) == 0)
+ return;
+ pxm = pa->proximity_domain_lo;
++ if (acpi_srat_revision >= 2)
++ pxm |= *((unsigned int*)pa->proximity_domain_hi) << 8;
+ node = setup_node(pxm);
+ if (node < 0) {
+ printk(KERN_ERR "SRAT: Too many proximity domains %x\n", pxm);
+@@ -155,6 +157,8 @@ acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
+ start = ma->base_address;
+ end = start + ma->length;
+ pxm = ma->proximity_domain;
++ if (acpi_srat_revision <= 1)
++ pxm &= 0xff;
+ node = setup_node(pxm);
+ if (node < 0) {
+ printk(KERN_ERR "SRAT: Too many proximity domains.\n");
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch
new file mode 100644
index 0000000..0c45ecd
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch
@@ -0,0 +1,66 @@
+From 559618f3ecbf0414d42fdf0d752e86e05b989847 Mon Sep 17 00:00:00 2001
+From: Kurt Garloff <kurt@garloff.de>
+Date: Tue, 17 Jan 2012 04:21:49 -0500
+Subject: [PATCH 102/130] ACPI, ia64: Use SRAT table rev to use 8bit or
+ 16/32bit PXM fields (ia64)
+
+commit 9f10f6a520deb3639fac78d81151a3ade88b4e7f upstream.
+
+In SRAT v1, we had 8bit proximity domain (PXM) fields; SRAT v2 provides
+32bits for these. The new fields were reserved before.
+According to the ACPI spec, the OS must disregrard reserved fields.
+
+ia64 did handle the PXM fields almost consistently, but depending on
+sgi's sn2 platform. This patch leaves the sn2 logic in, but does also
+use 16/32 bits for PXM if the SRAT has rev 2 or higher.
+
+The patch also adds __init to the two pxm accessor functions, as they
+access __initdata now and are called from an __init function only anyway.
+
+Note that the code only uses 16 bits for the PXM field in the processor
+proximity field; the patch does not address this as 16 bits are more than
+enough.
+
+Signed-off-by: Kurt Garloff <kurt@garloff.de>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/ia64/kernel/acpi.c | 10 ++++++----
+ 1 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
+index bfb4d01..5207035 100644
+--- a/arch/ia64/kernel/acpi.c
++++ b/arch/ia64/kernel/acpi.c
+@@ -429,22 +429,24 @@ static u32 __devinitdata pxm_flag[PXM_FLAG_LEN];
+ static struct acpi_table_slit __initdata *slit_table;
+ cpumask_t early_cpu_possible_map = CPU_MASK_NONE;
+
+-static int get_processor_proximity_domain(struct acpi_srat_cpu_affinity *pa)
++static int __init
++get_processor_proximity_domain(struct acpi_srat_cpu_affinity *pa)
+ {
+ int pxm;
+
+ pxm = pa->proximity_domain_lo;
+- if (ia64_platform_is("sn2"))
++ if (ia64_platform_is("sn2") || acpi_srat_revision >= 2)
+ pxm += pa->proximity_domain_hi[0] << 8;
+ return pxm;
+ }
+
+-static int get_memory_proximity_domain(struct acpi_srat_mem_affinity *ma)
++static int __init
++get_memory_proximity_domain(struct acpi_srat_mem_affinity *ma)
+ {
+ int pxm;
+
+ pxm = ma->proximity_domain;
+- if (!ia64_platform_is("sn2"))
++ if (!ia64_platform_is("sn2") && acpi_srat_revision <= 1)
+ pxm &= 0xff;
+
+ return pxm;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch
new file mode 100644
index 0000000..100721e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch
@@ -0,0 +1,59 @@
+From 41a419ec07d2a21659f9258e614ead0a80cf23a8 Mon Sep 17 00:00:00 2001
+From: Lin Ming <ming.m.lin@intel.com>
+Date: Tue, 29 Nov 2011 22:13:35 +0800
+Subject: [PATCH 103/130] ACPICA: Put back the call to
+ acpi_os_validate_address
+
+commit da4d8b287abe783d30e968155614531a0937d090 upstream.
+
+The call to acpi_os_validate_address in acpi_ds_get_region_arguments was
+removed by mistake in commit 9ad19ac(ACPICA: Split large dsopcode and
+dsload.c files).
+
+Put it back.
+
+Reported-and-bisected-by: Luca Tettamanti <kronos.it@gmail.com>
+Signed-off-by: Lin Ming <ming.m.lin@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/acpi/acpica/dsargs.c | 24 ++++++++++++++++++++++++
+ 1 files changed, 24 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsargs.c b/drivers/acpi/acpica/dsargs.c
+index 8c7b997..42163d8 100644
+--- a/drivers/acpi/acpica/dsargs.c
++++ b/drivers/acpi/acpica/dsargs.c
+@@ -387,5 +387,29 @@ acpi_status acpi_ds_get_region_arguments(union acpi_operand_object *obj_desc)
+ status = acpi_ds_execute_arguments(node, node->parent,
+ extra_desc->extra.aml_length,
+ extra_desc->extra.aml_start);
++ if (ACPI_FAILURE(status)) {
++ return_ACPI_STATUS(status);
++ }
++
++ /* Validate the region address/length via the host OS */
++
++ status = acpi_os_validate_address(obj_desc->region.space_id,
++ obj_desc->region.address,
++ (acpi_size) obj_desc->region.length,
++ acpi_ut_get_node_name(node));
++
++ if (ACPI_FAILURE(status)) {
++ /*
++ * Invalid address/length. We will emit an error message and mark
++ * the region as invalid, so that it will cause an additional error if
++ * it is ever used. Then return AE_OK.
++ */
++ ACPI_EXCEPTION((AE_INFO, status,
++ "During address validation of OpRegion [%4.4s]",
++ node->name.ascii));
++ obj_desc->common.flags |= AOPOBJ_INVALID;
++ status = AE_OK;
++ }
++
+ return_ACPI_STATUS(status);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch
new file mode 100644
index 0000000..da6b2f8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch
@@ -0,0 +1,75 @@
+From 8f8ad292bbb34d56fdf612c13fb6f24da376c007 Mon Sep 17 00:00:00 2001
+From: Lin Ming <ming.m.lin@intel.com>
+Date: Tue, 13 Dec 2011 09:36:03 +0800
+Subject: [PATCH 104/130] ACPI: processor: fix acpi_get_cpuid for UP processor
+
+commit d640113fe80e45ebd4a5b420b220d3f6bf37f682 upstream.
+
+For UP processor, it is likely that no _MAT method or MADT table defined.
+So currently acpi_get_cpuid(...) always return -1 for UP processor.
+This is wrong. It should return valid value for CPU0.
+
+In the other hand, BIOS may define multiple CPU handles even for UP
+processor, for example
+
+ Scope (_PR)
+ {
+ Processor (CPU0, 0x00, 0x00000410, 0x06) {}
+ Processor (CPU1, 0x01, 0x00000410, 0x06) {}
+ Processor (CPU2, 0x02, 0x00000410, 0x06) {}
+ Processor (CPU3, 0x03, 0x00000410, 0x06) {}
+ }
+
+We should only return valid value for CPU0's acpi handle.
+And return invalid value for others.
+
+http://marc.info/?t=132329819900003&r=1&w=2
+
+Reported-and-tested-by: wallak@free.fr
+Signed-off-by: Lin Ming <ming.m.lin@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/acpi/processor_core.c | 26 ++++++++++++++++++++++++--
+ 1 files changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
+index 3a0428e..c850de4 100644
+--- a/drivers/acpi/processor_core.c
++++ b/drivers/acpi/processor_core.c
+@@ -173,8 +173,30 @@ int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
+ apic_id = map_mat_entry(handle, type, acpi_id);
+ if (apic_id == -1)
+ apic_id = map_madt_entry(type, acpi_id);
+- if (apic_id == -1)
+- return apic_id;
++ if (apic_id == -1) {
++ /*
++ * On UP processor, there is no _MAT or MADT table.
++ * So above apic_id is always set to -1.
++ *
++ * BIOS may define multiple CPU handles even for UP processor.
++ * For example,
++ *
++ * Scope (_PR)
++ * {
++ * Processor (CPU0, 0x00, 0x00000410, 0x06) {}
++ * Processor (CPU1, 0x01, 0x00000410, 0x06) {}
++ * Processor (CPU2, 0x02, 0x00000410, 0x06) {}
++ * Processor (CPU3, 0x03, 0x00000410, 0x06) {}
++ * }
++ *
++ * Ignores apic_id and always return 0 for CPU0's handle.
++ * Return -1 for other CPU's handle.
++ */
++ if (acpi_id == 0)
++ return acpi_id;
++ else
++ return apic_id;
++ }
+
+ #ifdef CONFIG_SMP
+ for_each_possible_cpu(i) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch
new file mode 100644
index 0000000..c17898a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch
@@ -0,0 +1,37 @@
+From 40922e4e53c0eaef6473c1cf8ef15fea5076e4b5 Mon Sep 17 00:00:00 2001
+From: Stratos Psomadakis <psomas@gentoo.org>
+Date: Sun, 4 Dec 2011 02:23:54 +0200
+Subject: [PATCH 105/130] sym53c8xx: Fix NULL pointer dereference in
+ slave_destroy
+
+commit cced5041ed5a2d1352186510944b0ddfbdbe4c0b upstream.
+
+sym53c8xx_slave_destroy unconditionally assumes that sym53c8xx_slave_alloc has
+succesesfully allocated a sym_lcb. This can lead to a NULL pointer dereference
+(exposed by commit 4e6c82b).
+
+Signed-off-by: Stratos Psomadakis <psomas@gentoo.org>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/scsi/sym53c8xx_2/sym_glue.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
+index b4543f5..36d1ed7 100644
+--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
++++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
+@@ -839,6 +839,10 @@ static void sym53c8xx_slave_destroy(struct scsi_device *sdev)
+ struct sym_lcb *lp = sym_lp(tp, sdev->lun);
+ unsigned long flags;
+
++ /* if slave_alloc returned before allocating a sym_lcb, return */
++ if (!lp)
++ return;
++
+ spin_lock_irqsave(np->s.host->host_lock, flags);
+
+ if (lp->busy_itlq || lp->busy_itl) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch
new file mode 100644
index 0000000..8c83cb5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch
@@ -0,0 +1,44 @@
+From 93a9397c36390facb429c34a7bca31b7c6c5df39 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Tue, 6 Dec 2011 10:02:09 -0800
+Subject: [PATCH 106/130] target: Set response format in INQUIRY response
+
+commit ce136176fea522fc8f4c16dcae7e8ed1d890ca39 upstream.
+
+Current SCSI specs say that the "response format" field in the standard
+INQUIRY response should be set to 2, and all the real SCSI devices I
+have do put 2 here. So let's do that too.
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/target/target_core_cdb.c | 12 ++++++++++++
+ 1 files changed, 12 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
+index 831468b..2e8c1be 100644
+--- a/drivers/target/target_core_cdb.c
++++ b/drivers/target/target_core_cdb.c
+@@ -94,6 +94,18 @@ target_emulate_inquiry_std(struct se_cmd *cmd)
+ buf[2] = dev->transport->get_device_rev(dev);
+
+ /*
++ * NORMACA and HISUP = 0, RESPONSE DATA FORMAT = 2
++ *
++ * SPC4 says:
++ * A RESPONSE DATA FORMAT field set to 2h indicates that the
++ * standard INQUIRY data is in the format defined in this
++ * standard. Response data format values less than 2h are
++ * obsolete. Response data format values greater than 2h are
++ * reserved.
++ */
++ buf[3] = 2;
++
++ /*
+ * Enable SCCS and TPGS fields for Emulated ALUA
+ */
+ if (dev->se_sub_dev->t10_alua.alua_type == SPC3_ALUA_EMULATED)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch
new file mode 100644
index 0000000..ccf6a35
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch
@@ -0,0 +1,177 @@
+From 894360c2f0b3fca21a3e663f60746476a185f100 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Tue, 13 Dec 2011 14:55:33 -0800
+Subject: [PATCH 107/130] target: Set additional sense length field in sense
+ data
+
+commit 895f3022523361e9b383cf48f51feb1f7d5e7e53 upstream.
+
+The target code was not setting the additional sense length field in the
+sense data it returned, which meant that at least the Linux stack
+ignored the ASC/ASCQ fields. For example, without this patch, on a
+tcm_loop device:
+
+ # sg_raw -v /dev/sda 2 0 0 0 0 0
+
+gives
+
+ cdb to send: 02 00 00 00 00 00
+ SCSI Status: Check Condition
+
+ Sense Information:
+ Fixed format, current; Sense key: Illegal Request
+ Raw sense data (in hex):
+ 70 00 05 00 00 00 00 00
+
+while after the patch we correctly get the following (which matches what
+a regular disk returns):
+
+ cdb to send: 02 00 00 00 00 00
+ SCSI Status: Check Condition
+
+ Sense Information:
+ Fixed format, current; Sense key: Illegal Request
+ Additional sense: Invalid command operation code
+ Raw sense data (in hex):
+ 70 00 05 00 00 00 00 0a 00 00 00 00 20 00 00 00
+ 00 00
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/target/target_core_transport.c | 14 ++++++++++++++
+ include/target/target_core_base.h | 1 +
+ 2 files changed, 15 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 0257658..e87d0eb 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -4353,6 +4353,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_NON_EXISTENT_LUN:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ILLEGAL REQUEST */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* LOGICAL UNIT NOT SUPPORTED */
+@@ -4362,6 +4363,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_SECTOR_COUNT_TOO_MANY:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ILLEGAL REQUEST */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* INVALID COMMAND OPERATION CODE */
+@@ -4370,6 +4372,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_UNKNOWN_MODE_PAGE:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ILLEGAL REQUEST */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* INVALID FIELD IN CDB */
+@@ -4378,6 +4381,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_CHECK_CONDITION_ABORT_CMD:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* BUS DEVICE RESET FUNCTION OCCURRED */
+@@ -4387,6 +4391,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_INCORRECT_AMOUNT_OF_DATA:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* WRITE ERROR */
+@@ -4397,6 +4402,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_INVALID_CDB_FIELD:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* INVALID FIELD IN CDB */
+@@ -4405,6 +4411,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_INVALID_PARAMETER_LIST:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* INVALID FIELD IN PARAMETER LIST */
+@@ -4413,6 +4420,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_UNEXPECTED_UNSOLICITED_DATA:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* WRITE ERROR */
+@@ -4423,6 +4431,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_SERVICE_CRC_ERROR:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* PROTOCOL SERVICE CRC ERROR */
+@@ -4433,6 +4442,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_SNACK_REJECTED:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ABORTED COMMAND */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ /* READ ERROR */
+@@ -4443,6 +4453,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_WRITE_PROTECTED:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* DATA PROTECT */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = DATA_PROTECT;
+ /* WRITE PROTECTED */
+@@ -4451,6 +4462,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_CHECK_CONDITION_UNIT_ATTENTION:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* UNIT ATTENTION */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = UNIT_ATTENTION;
+ core_scsi3_ua_for_check_condition(cmd, &asc, &ascq);
+@@ -4460,6 +4472,7 @@ int transport_send_check_condition_and_sense(
+ case TCM_CHECK_CONDITION_NOT_READY:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* Not Ready */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = NOT_READY;
+ transport_get_sense_codes(cmd, &asc, &ascq);
+@@ -4470,6 +4483,7 @@ int transport_send_check_condition_and_sense(
+ default:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ /* ILLEGAL REQUEST */
+ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* LOGICAL UNIT COMMUNICATION FAILURE */
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 6873c7d..a79886c 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -34,6 +34,7 @@
+ #define TRANSPORT_SENSE_BUFFER SCSI_SENSE_BUFFERSIZE
+ /* Used by transport_send_check_condition_and_sense() */
+ #define SPC_SENSE_KEY_OFFSET 2
++#define SPC_ADD_SENSE_LEN_OFFSET 7
+ #define SPC_ASC_KEY_OFFSET 12
+ #define SPC_ASCQ_KEY_OFFSET 13
+ #define TRANSPORT_IQN_LEN 224
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch
new file mode 100644
index 0000000..5ea191a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch
@@ -0,0 +1,44 @@
+From 48f4e889aa88368a9ac548bba39c37663d012739 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Fri, 13 Jan 2012 23:58:38 +0100
+Subject: [PATCH 108/130] bcma: invalidate the mapped core over suspend/resume
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 28e7d218da975f6ae1751e293aed938952c55c98 upstream.
+
+This clears the currently mapped core when suspending, to force
+re-mapping after resume. Without that we were touching default core
+registers believing some other core is mapped. Such a behaviour
+resulted in lockups on some machines.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/bcma/host_pci.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
+index 990f5a8..48e06be 100644
+--- a/drivers/bcma/host_pci.c
++++ b/drivers/bcma/host_pci.c
+@@ -227,11 +227,14 @@ static void bcma_host_pci_remove(struct pci_dev *dev)
+ #ifdef CONFIG_PM
+ static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
+ {
++ struct bcma_bus *bus = pci_get_drvdata(dev);
++
+ /* Host specific */
+ pci_save_state(dev);
+ pci_disable_device(dev);
+ pci_set_power_state(dev, pci_choose_state(dev, state));
+
++ bus->mapped_core = NULL;
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch
new file mode 100644
index 0000000..210ff01
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch
@@ -0,0 +1,36 @@
+From 1d2015b35f096926482fe3c1b5b3b84c0f8a34b3 Mon Sep 17 00:00:00 2001
+From: Miroslav Slugen <thunder.mmm@gmail.com>
+Date: Sun, 11 Dec 2011 18:57:58 -0300
+Subject: [PATCH 109/130] cx23885-dvb: check if dvb_attach() succeded
+
+commit a7c8aadad39428b64d26c3971d967f8314e2397d upstream.
+
+Fix possible null dereference for Leadtek DTV 3200H
+XC4000 tuner when no firmware file available.
+
+Signed-off-by: Miroslav Slugen <thunder.mmm@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/media/video/cx23885/cx23885-dvb.c | 5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/media/video/cx23885/cx23885-dvb.c b/drivers/media/video/cx23885/cx23885-dvb.c
+index bcb45be..f0482b2 100644
+--- a/drivers/media/video/cx23885/cx23885-dvb.c
++++ b/drivers/media/video/cx23885/cx23885-dvb.c
+@@ -940,6 +940,11 @@ static int dvb_register(struct cx23885_tsport *port)
+
+ fe = dvb_attach(xc4000_attach, fe0->dvb.frontend,
+ &dev->i2c_bus[1].i2c_adap, &cfg);
++ if (!fe) {
++ printk(KERN_ERR "%s/2: xc4000 attach failed\n",
++ dev->name);
++ goto frontend_detach;
++ }
+ }
+ break;
+ case CX23885_BOARD_TBS_6920:
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch
new file mode 100644
index 0000000..20dd5ec
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch
@@ -0,0 +1,95 @@
+From 62b69534abbda46006d5372502ae08e2df541e58 Mon Sep 17 00:00:00 2001
+From: Miroslav Slugen <thunder.mmm@gmail.com>
+Date: Sun, 11 Dec 2011 19:00:06 -0300
+Subject: [PATCH 110/130] cx88: fix: don't duplicate xc4000 entry for radio
+
+commit b6854e3f31402476bcc9d2f41570389fa491de17 upstream.
+
+All radio tuners in cx88 driver using same address for radio and tuner,
+so there is no need to probe it twice for same tuner and we can use
+radio_type UNSET, this also fix broken radio since kernel 2.6.39-rc1
+for those tuners.
+
+Signed-off-by: Miroslav Slugen <thunder.mmm@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/media/video/cx88/cx88-cards.c | 24 ++++++++++++------------
+ 1 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
+index 0d719fa..3929d93 100644
+--- a/drivers/media/video/cx88/cx88-cards.c
++++ b/drivers/media/video/cx88/cx88-cards.c
+@@ -1573,8 +1573,8 @@ static const struct cx88_board cx88_boards[] = {
+ .name = "Pinnacle Hybrid PCTV",
+ .tuner_type = TUNER_XC2028,
+ .tuner_addr = 0x61,
+- .radio_type = TUNER_XC2028,
+- .radio_addr = 0x61,
++ .radio_type = UNSET,
++ .radio_addr = ADDR_UNSET,
+ .input = { {
+ .type = CX88_VMUX_TELEVISION,
+ .vmux = 0,
+@@ -1611,8 +1611,8 @@ static const struct cx88_board cx88_boards[] = {
+ .name = "Leadtek TV2000 XP Global",
+ .tuner_type = TUNER_XC2028,
+ .tuner_addr = 0x61,
+- .radio_type = TUNER_XC2028,
+- .radio_addr = 0x61,
++ .radio_type = UNSET,
++ .radio_addr = ADDR_UNSET,
+ .input = { {
+ .type = CX88_VMUX_TELEVISION,
+ .vmux = 0,
+@@ -2043,8 +2043,8 @@ static const struct cx88_board cx88_boards[] = {
+ .name = "Terratec Cinergy HT PCI MKII",
+ .tuner_type = TUNER_XC2028,
+ .tuner_addr = 0x61,
+- .radio_type = TUNER_XC2028,
+- .radio_addr = 0x61,
++ .radio_type = UNSET,
++ .radio_addr = ADDR_UNSET,
+ .input = { {
+ .type = CX88_VMUX_TELEVISION,
+ .vmux = 0,
+@@ -2082,9 +2082,9 @@ static const struct cx88_board cx88_boards[] = {
+ [CX88_BOARD_WINFAST_DTV1800H] = {
+ .name = "Leadtek WinFast DTV1800 Hybrid",
+ .tuner_type = TUNER_XC2028,
+- .radio_type = TUNER_XC2028,
++ .radio_type = UNSET,
+ .tuner_addr = 0x61,
+- .radio_addr = 0x61,
++ .radio_addr = ADDR_UNSET,
+ /*
+ * GPIO setting
+ *
+@@ -2123,9 +2123,9 @@ static const struct cx88_board cx88_boards[] = {
+ [CX88_BOARD_WINFAST_DTV1800H_XC4000] = {
+ .name = "Leadtek WinFast DTV1800 H (XC4000)",
+ .tuner_type = TUNER_XC4000,
+- .radio_type = TUNER_XC4000,
++ .radio_type = UNSET,
+ .tuner_addr = 0x61,
+- .radio_addr = 0x61,
++ .radio_addr = ADDR_UNSET,
+ /*
+ * GPIO setting
+ *
+@@ -2164,9 +2164,9 @@ static const struct cx88_board cx88_boards[] = {
+ [CX88_BOARD_WINFAST_DTV2000H_PLUS] = {
+ .name = "Leadtek WinFast DTV2000 H PLUS",
+ .tuner_type = TUNER_XC4000,
+- .radio_type = TUNER_XC4000,
++ .radio_type = UNSET,
+ .tuner_addr = 0x61,
+- .radio_addr = 0x61,
++ .radio_addr = ADDR_UNSET,
+ /*
+ * GPIO
+ * 2: 1: mute audio
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch
new file mode 100644
index 0000000..8111a5a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch
@@ -0,0 +1,42 @@
+From d713ae5fcd06e723ac059ae03311b10d5508a272 Mon Sep 17 00:00:00 2001
+From: Miroslav Slugen <thunder.mmm@gmail.com>
+Date: Sun, 11 Dec 2011 18:47:32 -0300
+Subject: [PATCH 111/130] tuner: Fix numberspace conflict between xc4000 and
+ pti 5nf05 tuners
+
+commit cd4ca7afc61d3b18fcd635002459fb6b1d701099 upstream.
+
+Update xc4000 tuner definition, number 81 is already in use by
+TUNER_PARTSNIC_PTI_5NF05.
+
+Signed-off-by: Miroslav Slugen <thunder.mmm@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/media/tuner.h | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/include/media/tuner.h b/include/media/tuner.h
+index 89c290b..29e1920 100644
+--- a/include/media/tuner.h
++++ b/include/media/tuner.h
+@@ -127,7 +127,6 @@
+ #define TUNER_PHILIPS_FMD1216MEX_MK3 78
+ #define TUNER_PHILIPS_FM1216MK5 79
+ #define TUNER_PHILIPS_FQ1216LME_MK3 80 /* Active loopthrough, no FM */
+-#define TUNER_XC4000 81 /* Xceive Silicon Tuner */
+
+ #define TUNER_PARTSNIC_PTI_5NF05 81
+ #define TUNER_PHILIPS_CU1216L 82
+@@ -136,6 +135,8 @@
+ #define TUNER_PHILIPS_FQ1236_MK5 85 /* NTSC, TDA9885, no FM radio */
+ #define TUNER_TENA_TNF_5337 86
+
++#define TUNER_XC4000 87 /* Xceive Silicon Tuner */
++
+ /* tv card specific */
+ #define TDA9887_PRESENT (1<<0)
+ #define TDA9887_PORT1_INACTIVE (1<<1)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch
new file mode 100644
index 0000000..d6533b7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch
@@ -0,0 +1,50 @@
+From 18a0d839d63af34c8327754de80855fe7f6d9c17 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt@redhat.com>
+Date: Fri, 13 Jan 2012 21:40:59 -0500
+Subject: [PATCH 112/130] tracepoints/module: Fix disabling tracepoints with
+ taint CRAP or OOT
+
+commit c10076c4304083af15a41f6bc5e657e781c1f9a6 upstream.
+
+Tracepoints are disabled for tainted modules, which is usually because the
+module is either proprietary or was forced, and we don't want either of them
+using kernel tracepoints.
+
+But, a module can also be tainted by being in the staging directory or
+compiled out of tree. Either is fine for use with tracepoints, no need
+to punish them. I found this out when I noticed that my sample trace event
+module, when done out of tree, stopped working.
+
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Ben Hutchings <ben@decadent.org.uk>
+Cc: Dave Jones <davej@redhat.com>
+Cc: Greg Kroah-Hartman <gregkh@suse.de>
+Cc: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ kernel/tracepoint.c | 7 ++++---
+ 1 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
+index db110b8..f1539de 100644
+--- a/kernel/tracepoint.c
++++ b/kernel/tracepoint.c
+@@ -634,10 +634,11 @@ static int tracepoint_module_coming(struct module *mod)
+ int ret = 0;
+
+ /*
+- * We skip modules that tain the kernel, especially those with different
+- * module header (for forced load), to make sure we don't cause a crash.
++ * We skip modules that taint the kernel, especially those with different
++ * module headers (for forced load), to make sure we don't cause a crash.
++ * Staging and out-of-tree GPL modules are fine.
+ */
+- if (mod->taints)
++ if (mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP)))
+ return 0;
+ mutex_lock(&tracepoints_mutex);
+ tp_mod = kmalloc(sizeof(struct tp_module), GFP_KERNEL);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch
new file mode 100644
index 0000000..4a8f8cd
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch
@@ -0,0 +1,34 @@
+From 9d4b4b0db1a41d1ec947a28c1bae7685211d934d Mon Sep 17 00:00:00 2001
+From: Alexander Aring <a.aring@phytec.de>
+Date: Thu, 8 Dec 2011 15:43:53 +0100
+Subject: [PATCH 113/130] I2C: OMAP: correct SYSC register offset for OMAP4
+
+commit 2727b1753934e154931d6b3bdf20c9b2398457a2 upstream.
+
+Correct OMAP_I2C_SYSC_REG offset in omap4 register map.
+Offset 0x20 is reserved and OMAP_I2C_SYSC_REG has 0x10 as offset.
+
+Signed-off-by: Alexander Aring <a.aring@phytec.de>
+[khilman@ti.com: minor changelog edits]
+Signed-off-by: Kevin Hilman <khilman@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/i2c/busses/i2c-omap.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
+index 82fff06..e0733b7 100644
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -235,7 +235,7 @@ static const u8 reg_map_ip_v2[] = {
+ [OMAP_I2C_BUF_REG] = 0x94,
+ [OMAP_I2C_CNT_REG] = 0x98,
+ [OMAP_I2C_DATA_REG] = 0x9c,
+- [OMAP_I2C_SYSC_REG] = 0x20,
++ [OMAP_I2C_SYSC_REG] = 0x10,
+ [OMAP_I2C_CON_REG] = 0xa4,
+ [OMAP_I2C_OA_REG] = 0xa8,
+ [OMAP_I2C_SA_REG] = 0xac,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch
new file mode 100644
index 0000000..2e48040
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch
@@ -0,0 +1,350 @@
+From 0046f18e8ee26577b8b75d678ee353a9ab31773b Mon Sep 17 00:00:00 2001
+From: Cliff Wickman <cpw@sgi.com>
+Date: Mon, 16 Jan 2012 15:17:50 -0600
+Subject: [PATCH 114/130] x86/UV2: Fix new UV2 hardware by using native UV2
+ broadcast mode
+
+commit da87c937e5a2374686edd58df06cfd5050b125fa upstream.
+
+Update the use of the Broadcast Assist Unit on SGI Altix UV2 to
+the use of native UV2 mode on new hardware (not the legacy mode).
+
+UV2 native mode has a different format for a broadcast message.
+We also need quick differentiaton between UV1 and UV2.
+
+Signed-off-by: Cliff Wickman <cpw@sgi.com>
+Link: http://lkml.kernel.org/r/20120116211750.GA5767@sgi.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/include/asm/uv/uv_bau.h | 93 +++++++++++++++++++++++++++++++++++---
+ arch/x86/platform/uv/tlb_uv.c | 88 ++++++++++++++++++++++++++---------
+ 2 files changed, 151 insertions(+), 30 deletions(-)
+
+diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
+index 8e862aa..4a46b27 100644
+--- a/arch/x86/include/asm/uv/uv_bau.h
++++ b/arch/x86/include/asm/uv/uv_bau.h
+@@ -65,7 +65,7 @@
+ * UV2: Bit 19 selects between
+ * (0): 10 microsecond timebase and
+ * (1): 80 microseconds
+- * we're using 655us, similar to UV1: 65 units of 10us
++ * we're using 560us, similar to UV1: 65 units of 10us
+ */
+ #define UV1_INTD_SOFT_ACK_TIMEOUT_PERIOD (9UL)
+ #define UV2_INTD_SOFT_ACK_TIMEOUT_PERIOD (15UL)
+@@ -235,10 +235,10 @@ struct bau_msg_payload {
+
+
+ /*
+- * Message header: 16 bytes (128 bits) (bytes 0x30-0x3f of descriptor)
++ * UV1 Message header: 16 bytes (128 bits) (bytes 0x30-0x3f of descriptor)
+ * see table 4.2.3.0.1 in broacast_assist spec.
+ */
+-struct bau_msg_header {
++struct uv1_bau_msg_header {
+ unsigned int dest_subnodeid:6; /* must be 0x10, for the LB */
+ /* bits 5:0 */
+ unsigned int base_dest_nasid:15; /* nasid of the first bit */
+@@ -318,19 +318,87 @@ struct bau_msg_header {
+ };
+
+ /*
++ * UV2 Message header: 16 bytes (128 bits) (bytes 0x30-0x3f of descriptor)
++ * see figure 9-2 of harp_sys.pdf
++ */
++struct uv2_bau_msg_header {
++ unsigned int base_dest_nasid:15; /* nasid of the first bit */
++ /* bits 14:0 */ /* in uvhub map */
++ unsigned int dest_subnodeid:5; /* must be 0x10, for the LB */
++ /* bits 19:15 */
++ unsigned int rsvd_1:1; /* must be zero */
++ /* bit 20 */
++ /* Address bits 59:21 */
++ /* bits 25:2 of address (44:21) are payload */
++ /* these next 24 bits become bytes 12-14 of msg */
++ /* bits 28:21 land in byte 12 */
++ unsigned int replied_to:1; /* sent as 0 by the source to
++ byte 12 */
++ /* bit 21 */
++ unsigned int msg_type:3; /* software type of the
++ message */
++ /* bits 24:22 */
++ unsigned int canceled:1; /* message canceled, resource
++ is to be freed*/
++ /* bit 25 */
++ unsigned int payload_1:3; /* not currently used */
++ /* bits 28:26 */
++
++ /* bits 36:29 land in byte 13 */
++ unsigned int payload_2a:3; /* not currently used */
++ unsigned int payload_2b:5; /* not currently used */
++ /* bits 36:29 */
++
++ /* bits 44:37 land in byte 14 */
++ unsigned int payload_3:8; /* not currently used */
++ /* bits 44:37 */
++
++ unsigned int rsvd_2:7; /* reserved */
++ /* bits 51:45 */
++ unsigned int swack_flag:1; /* software acknowledge flag */
++ /* bit 52 */
++ unsigned int rsvd_3a:3; /* must be zero */
++ unsigned int rsvd_3b:8; /* must be zero */
++ unsigned int rsvd_3c:8; /* must be zero */
++ unsigned int rsvd_3d:3; /* must be zero */
++ /* bits 74:53 */
++ unsigned int fairness:3; /* usually zero */
++ /* bits 77:75 */
++
++ unsigned int sequence:16; /* message sequence number */
++ /* bits 93:78 Suppl_A */
++ unsigned int chaining:1; /* next descriptor is part of
++ this activation*/
++ /* bit 94 */
++ unsigned int multilevel:1; /* multi-level multicast
++ format */
++ /* bit 95 */
++ unsigned int rsvd_4:24; /* ordered / source node /
++ source subnode / aging
++ must be zero */
++ /* bits 119:96 */
++ unsigned int command:8; /* message type */
++ /* bits 127:120 */
++};
++
++/*
+ * The activation descriptor:
+ * The format of the message to send, plus all accompanying control
+ * Should be 64 bytes
+ */
+ struct bau_desc {
+- struct pnmask distribution;
++ struct pnmask distribution;
+ /*
+ * message template, consisting of header and payload:
+ */
+- struct bau_msg_header header;
+- struct bau_msg_payload payload;
++ union bau_msg_header {
++ struct uv1_bau_msg_header uv1_hdr;
++ struct uv2_bau_msg_header uv2_hdr;
++ } header;
++
++ struct bau_msg_payload payload;
+ };
+-/*
++/* UV1:
+ * -payload-- ---------header------
+ * bytes 0-11 bits 41-56 bits 58-81
+ * A B (2) C (3)
+@@ -340,6 +408,16 @@ struct bau_desc {
+ * bytes 0-11 bytes 12-14 bytes 16-17 (byte 15 filled in by hw as vector)
+ * ------------payload queue-----------
+ */
++/* UV2:
++ * -payload-- ---------header------
++ * bytes 0-11 bits 70-78 bits 21-44
++ * A B (2) C (3)
++ *
++ * A/B/C are moved to:
++ * A C B
++ * bytes 0-11 bytes 12-14 bytes 16-17 (byte 15 filled in by hw as vector)
++ * ------------payload queue-----------
++ */
+
+ /*
+ * The payload queue on the destination side is an array of these.
+@@ -511,6 +589,7 @@ struct bau_control {
+ short osnode;
+ short uvhub_cpu;
+ short uvhub;
++ short uvhub_version;
+ short cpus_in_socket;
+ short cpus_in_uvhub;
+ short partition_base_pnode;
+diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
+index 5b55219..1341a2e 100644
+--- a/arch/x86/platform/uv/tlb_uv.c
++++ b/arch/x86/platform/uv/tlb_uv.c
+@@ -573,7 +573,7 @@ static int wait_completion(struct bau_desc *bau_desc,
+ right_shift = ((cpu - UV_CPUS_PER_AS) * UV_ACT_STATUS_SIZE);
+ }
+
+- if (is_uv1_hub())
++ if (bcp->uvhub_version == 1)
+ return uv1_wait_completion(bau_desc, mmr_offset, right_shift,
+ bcp, try);
+ else
+@@ -757,15 +757,22 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+ {
+ int seq_number = 0;
+ int completion_stat = 0;
++ int uv1 = 0;
+ long try = 0;
+ unsigned long index;
+ cycles_t time1;
+ cycles_t time2;
+ struct ptc_stats *stat = bcp->statp;
+ struct bau_control *hmaster = bcp->uvhub_master;
++ struct uv1_bau_msg_header *uv1_hdr = NULL;
++ struct uv2_bau_msg_header *uv2_hdr = NULL;
+
+- if (is_uv1_hub())
++ if (bcp->uvhub_version == 1) {
++ uv1 = 1;
+ uv1_throttle(hmaster, stat);
++ uv1_hdr = &bau_desc->header.uv1_hdr;
++ } else
++ uv2_hdr = &bau_desc->header.uv2_hdr;
+
+ while (hmaster->uvhub_quiesce)
+ cpu_relax();
+@@ -773,14 +780,23 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+ time1 = get_cycles();
+ do {
+ if (try == 0) {
+- bau_desc->header.msg_type = MSG_REGULAR;
++ if (uv1)
++ uv1_hdr->msg_type = MSG_REGULAR;
++ else
++ uv2_hdr->msg_type = MSG_REGULAR;
+ seq_number = bcp->message_number++;
+ } else {
+- bau_desc->header.msg_type = MSG_RETRY;
++ if (uv1)
++ uv1_hdr->msg_type = MSG_RETRY;
++ else
++ uv2_hdr->msg_type = MSG_RETRY;
+ stat->s_retry_messages++;
+ }
+
+- bau_desc->header.sequence = seq_number;
++ if (uv1)
++ uv1_hdr->sequence = seq_number;
++ else
++ uv2_hdr->sequence = seq_number;
+ index = (1UL << AS_PUSH_SHIFT) | bcp->uvhub_cpu;
+ bcp->send_message = get_cycles();
+
+@@ -967,7 +983,7 @@ const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
+ stat->s_ntargself++;
+
+ bau_desc = bcp->descriptor_base;
+- bau_desc += ITEMS_PER_DESC * bcp->uvhub_cpu;
++ bau_desc += (ITEMS_PER_DESC * bcp->uvhub_cpu);
+ bau_uvhubs_clear(&bau_desc->distribution, UV_DISTRIBUTION_SIZE);
+ if (set_distrib_bits(flush_mask, bcp, bau_desc, &locals, &remotes))
+ return NULL;
+@@ -1083,7 +1099,7 @@ static void __init enable_timeouts(void)
+ */
+ mmr_image |= (1L << SOFTACK_MSHIFT);
+ if (is_uv2_hub()) {
+- mmr_image |= (1L << UV2_LEG_SHFT);
++ mmr_image &= ~(1L << UV2_LEG_SHFT);
+ mmr_image |= (1L << UV2_EXT_SHFT);
+ }
+ write_mmr_misc_control(pnode, mmr_image);
+@@ -1432,12 +1448,15 @@ static void activation_descriptor_init(int node, int pnode, int base_pnode)
+ {
+ int i;
+ int cpu;
++ int uv1 = 0;
+ unsigned long gpa;
+ unsigned long m;
+ unsigned long n;
+ size_t dsize;
+ struct bau_desc *bau_desc;
+ struct bau_desc *bd2;
++ struct uv1_bau_msg_header *uv1_hdr;
++ struct uv2_bau_msg_header *uv2_hdr;
+ struct bau_control *bcp;
+
+ /*
+@@ -1451,6 +1470,8 @@ static void activation_descriptor_init(int node, int pnode, int base_pnode)
+ gpa = uv_gpa(bau_desc);
+ n = uv_gpa_to_gnode(gpa);
+ m = uv_gpa_to_offset(gpa);
++ if (is_uv1_hub())
++ uv1 = 1;
+
+ /* the 14-bit pnode */
+ write_mmr_descriptor_base(pnode, (n << UV_DESC_PSHIFT | m));
+@@ -1461,21 +1482,33 @@ static void activation_descriptor_init(int node, int pnode, int base_pnode)
+ */
+ for (i = 0, bd2 = bau_desc; i < (ADP_SZ * ITEMS_PER_DESC); i++, bd2++) {
+ memset(bd2, 0, sizeof(struct bau_desc));
+- bd2->header.swack_flag = 1;
+- /*
+- * The base_dest_nasid set in the message header is the nasid
+- * of the first uvhub in the partition. The bit map will
+- * indicate destination pnode numbers relative to that base.
+- * They may not be consecutive if nasid striding is being used.
+- */
+- bd2->header.base_dest_nasid = UV_PNODE_TO_NASID(base_pnode);
+- bd2->header.dest_subnodeid = UV_LB_SUBNODEID;
+- bd2->header.command = UV_NET_ENDPOINT_INTD;
+- bd2->header.int_both = 1;
+- /*
+- * all others need to be set to zero:
+- * fairness chaining multilevel count replied_to
+- */
++ if (uv1) {
++ uv1_hdr = &bd2->header.uv1_hdr;
++ uv1_hdr->swack_flag = 1;
++ /*
++ * The base_dest_nasid set in the message header
++ * is the nasid of the first uvhub in the partition.
++ * The bit map will indicate destination pnode numbers
++ * relative to that base. They may not be consecutive
++ * if nasid striding is being used.
++ */
++ uv1_hdr->base_dest_nasid =
++ UV_PNODE_TO_NASID(base_pnode);
++ uv1_hdr->dest_subnodeid = UV_LB_SUBNODEID;
++ uv1_hdr->command = UV_NET_ENDPOINT_INTD;
++ uv1_hdr->int_both = 1;
++ /*
++ * all others need to be set to zero:
++ * fairness chaining multilevel count replied_to
++ */
++ } else {
++ uv2_hdr = &bd2->header.uv2_hdr;
++ uv2_hdr->swack_flag = 1;
++ uv2_hdr->base_dest_nasid =
++ UV_PNODE_TO_NASID(base_pnode);
++ uv2_hdr->dest_subnodeid = UV_LB_SUBNODEID;
++ uv2_hdr->command = UV_NET_ENDPOINT_INTD;
++ }
+ }
+ for_each_present_cpu(cpu) {
+ if (pnode != uv_blade_to_pnode(uv_cpu_to_blade_id(cpu)))
+@@ -1728,6 +1761,14 @@ static int scan_sock(struct socket_desc *sdp, struct uvhub_desc *bdp,
+ bcp->cpus_in_socket = sdp->num_cpus;
+ bcp->socket_master = *smasterp;
+ bcp->uvhub = bdp->uvhub;
++ if (is_uv1_hub())
++ bcp->uvhub_version = 1;
++ else if (is_uv2_hub())
++ bcp->uvhub_version = 2;
++ else {
++ printk(KERN_EMERG "uvhub version not 1 or 2\n");
++ return 1;
++ }
+ bcp->uvhub_master = *hmasterp;
+ bcp->uvhub_cpu = uv_cpu_hub_info(cpu)->blade_processor_id;
+ if (bcp->uvhub_cpu >= MAX_CPUS_PER_UVHUB) {
+@@ -1867,7 +1908,8 @@ static int __init uv_bau_init(void)
+ val = 1L << 63;
+ write_gmmr_activation(pnode, val);
+ mmr = 1; /* should be 1 to broadcast to both sockets */
+- write_mmr_data_broadcast(pnode, mmr);
++ if (!is_uv1_hub())
++ write_mmr_data_broadcast(pnode, mmr);
+ }
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch
new file mode 100644
index 0000000..0a00db8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch
@@ -0,0 +1,66 @@
+From 84ceb690db1ed535deb88880d45fa193a65ac637 Mon Sep 17 00:00:00 2001
+From: Cliff Wickman <cpw@sgi.com>
+Date: Mon, 16 Jan 2012 15:18:48 -0600
+Subject: [PATCH 115/130] x86/UV2: Fix BAU destination timeout initialization
+
+commit d059f9fa84a30e04279c6ff615e9e2cf3b260191 upstream.
+
+Move the call to enable_timeouts() forward so that
+BAU_MISC_CONTROL is initialized before using it in
+calculate_destination_timeout().
+
+Fix the calculation of a BAU destination timeout
+for UV2 (in calculate_destination_timeout()).
+
+Signed-off-by: Cliff Wickman <cpw@sgi.com>
+Link: http://lkml.kernel.org/r/20120116211848.GB5767@sgi.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/platform/uv/tlb_uv.c | 13 +++++++------
+ 1 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
+index 1341a2e..c425ff1 100644
+--- a/arch/x86/platform/uv/tlb_uv.c
++++ b/arch/x86/platform/uv/tlb_uv.c
+@@ -1617,14 +1617,14 @@ static int calculate_destination_timeout(void)
+ ts_ns = base * mult1 * mult2;
+ ret = ts_ns / 1000;
+ } else {
+- /* 4 bits 0/1 for 10/80us, 3 bits of multiplier */
+- mmr_image = uv_read_local_mmr(UVH_AGING_PRESCALE_SEL);
++ /* 4 bits 0/1 for 10/80us base, 3 bits of multiplier */
++ mmr_image = uv_read_local_mmr(UVH_LB_BAU_MISC_CONTROL);
+ mmr_image = (mmr_image & UV_SA_MASK) >> UV_SA_SHFT;
+ if (mmr_image & (1L << UV2_ACK_UNITS_SHFT))
+- mult1 = 80;
++ base = 80;
+ else
+- mult1 = 10;
+- base = mmr_image & UV2_ACK_MASK;
++ base = 10;
++ mult1 = mmr_image & UV2_ACK_MASK;
+ ret = mult1 * base;
+ }
+ return ret;
+@@ -1886,6 +1886,8 @@ static int __init uv_bau_init(void)
+ uv_base_pnode = uv_blade_to_pnode(uvhub);
+ }
+
++ enable_timeouts();
++
+ if (init_per_cpu(nuvhubs, uv_base_pnode)) {
+ nobau = 1;
+ return 0;
+@@ -1896,7 +1898,6 @@ static int __init uv_bau_init(void)
+ if (uv_blade_nr_possible_cpus(uvhub))
+ init_uvhub(uvhub, vector, uv_base_pnode);
+
+- enable_timeouts();
+ alloc_intr_gate(vector, uv_bau_message_intr1);
+
+ for_each_possible_blade(uvhub) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch
new file mode 100644
index 0000000..a729b18
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch
@@ -0,0 +1,570 @@
+From da205d30c924b3f41e37510f9a3727741ebfbc44 Mon Sep 17 00:00:00 2001
+From: Cliff Wickman <cpw@sgi.com>
+Date: Mon, 16 Jan 2012 15:19:47 -0600
+Subject: [PATCH 116/130] x86/UV2: Work around BAU bug
+
+commit c5d35d399e685acccc85a675e8765c26b2a9813a upstream.
+
+This patch implements a workaround for a UV2 hardware bug.
+The bug is a non-atomic update of a memory-mapped register. When
+hardware message delivery and software message acknowledge occur
+simultaneously the pending message acknowledge for the arriving
+message may be lost. This causes the sender's message status to
+stay busy.
+
+Part of the workaround is to not acknowledge a completed message
+until it is verified that no other message is actually using the
+resource that is mistakenly recorded in the completed message.
+
+Part of the workaround is to test for long elapsed time in such
+a busy condition, then handle it by using a spare sending
+descriptor. The stay-busy condition is eventually timed out by
+hardware, and then the original sending descriptor can be
+re-used. Most of that logic change is in keeping track of the
+current descriptor and the state of the spares.
+
+The occurrences of the workaround are added to the BAU
+statistics.
+
+Signed-off-by: Cliff Wickman <cpw@sgi.com>
+Link: http://lkml.kernel.org/r/20120116211947.GC5767@sgi.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/include/asm/uv/uv_bau.h | 13 ++-
+ arch/x86/platform/uv/tlb_uv.c | 274 +++++++++++++++++++++++++++++++++-----
+ 2 files changed, 254 insertions(+), 33 deletions(-)
+
+diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
+index 4a46b27..1b82f7e 100644
+--- a/arch/x86/include/asm/uv/uv_bau.h
++++ b/arch/x86/include/asm/uv/uv_bau.h
+@@ -167,6 +167,7 @@
+ #define FLUSH_RETRY_TIMEOUT 2
+ #define FLUSH_GIVEUP 3
+ #define FLUSH_COMPLETE 4
++#define FLUSH_RETRY_BUSYBUG 5
+
+ /*
+ * tuning the action when the numalink network is extremely delayed
+@@ -463,7 +464,6 @@ struct bau_pq_entry {
+ struct msg_desc {
+ struct bau_pq_entry *msg;
+ int msg_slot;
+- int swack_slot;
+ struct bau_pq_entry *queue_first;
+ struct bau_pq_entry *queue_last;
+ };
+@@ -517,6 +517,9 @@ struct ptc_stats {
+ unsigned long s_retry_messages; /* retry broadcasts */
+ unsigned long s_bau_reenabled; /* for bau enable/disable */
+ unsigned long s_bau_disabled; /* for bau enable/disable */
++ unsigned long s_uv2_wars; /* uv2 workaround, perm. busy */
++ unsigned long s_uv2_wars_hw; /* uv2 workaround, hiwater */
++ unsigned long s_uv2_war_waits; /* uv2 workaround, long waits */
+ /* destination statistics */
+ unsigned long d_alltlb; /* times all tlb's on this
+ cpu were flushed */
+@@ -593,6 +596,8 @@ struct bau_control {
+ short cpus_in_socket;
+ short cpus_in_uvhub;
+ short partition_base_pnode;
++ short using_desc; /* an index, like uvhub_cpu */
++ unsigned int inuse_map;
+ unsigned short message_number;
+ unsigned short uvhub_quiesce;
+ short socket_acknowledge_count[DEST_Q_SIZE];
+@@ -610,6 +615,7 @@ struct bau_control {
+ int cong_response_us;
+ int cong_reps;
+ int cong_period;
++ unsigned long clocks_per_100_usec;
+ cycles_t period_time;
+ long period_requests;
+ struct hub_and_pnode *thp;
+@@ -670,6 +676,11 @@ static inline void write_mmr_sw_ack(unsigned long mr)
+ uv_write_local_mmr(UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE_ALIAS, mr);
+ }
+
++static inline void write_gmmr_sw_ack(int pnode, unsigned long mr)
++{
++ write_gmmr(pnode, UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE_ALIAS, mr);
++}
++
+ static inline unsigned long read_mmr_sw_ack(void)
+ {
+ return read_lmmr(UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE);
+diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
+index c425ff1..9010ca7 100644
+--- a/arch/x86/platform/uv/tlb_uv.c
++++ b/arch/x86/platform/uv/tlb_uv.c
+@@ -157,13 +157,14 @@ static int __init uvhub_to_first_apicid(int uvhub)
+ * clear of the Timeout bit (as well) will free the resource. No reply will
+ * be sent (the hardware will only do one reply per message).
+ */
+-static void reply_to_message(struct msg_desc *mdp, struct bau_control *bcp)
++static void reply_to_message(struct msg_desc *mdp, struct bau_control *bcp,
++ int do_acknowledge)
+ {
+ unsigned long dw;
+ struct bau_pq_entry *msg;
+
+ msg = mdp->msg;
+- if (!msg->canceled) {
++ if (!msg->canceled && do_acknowledge) {
+ dw = (msg->swack_vec << UV_SW_ACK_NPENDING) | msg->swack_vec;
+ write_mmr_sw_ack(dw);
+ }
+@@ -212,8 +213,8 @@ static void bau_process_retry_msg(struct msg_desc *mdp,
+ if (mmr & (msg_res << UV_SW_ACK_NPENDING)) {
+ unsigned long mr;
+ /*
+- * is the resource timed out?
+- * make everyone ignore the cancelled message.
++ * Is the resource timed out?
++ * Make everyone ignore the cancelled message.
+ */
+ msg2->canceled = 1;
+ stat->d_canceled++;
+@@ -231,8 +232,8 @@ static void bau_process_retry_msg(struct msg_desc *mdp,
+ * Do all the things a cpu should do for a TLB shootdown message.
+ * Other cpu's may come here at the same time for this message.
+ */
+-static void bau_process_message(struct msg_desc *mdp,
+- struct bau_control *bcp)
++static void bau_process_message(struct msg_desc *mdp, struct bau_control *bcp,
++ int do_acknowledge)
+ {
+ short socket_ack_count = 0;
+ short *sp;
+@@ -284,8 +285,9 @@ static void bau_process_message(struct msg_desc *mdp,
+ if (msg_ack_count == bcp->cpus_in_uvhub) {
+ /*
+ * All cpus in uvhub saw it; reply
++ * (unless we are in the UV2 workaround)
+ */
+- reply_to_message(mdp, bcp);
++ reply_to_message(mdp, bcp, do_acknowledge);
+ }
+ }
+
+@@ -491,27 +493,138 @@ static int uv1_wait_completion(struct bau_desc *bau_desc,
+ /*
+ * UV2 has an extra bit of status in the ACTIVATION_STATUS_2 register.
+ */
+-static unsigned long uv2_read_status(unsigned long offset, int rshft, int cpu)
++static unsigned long uv2_read_status(unsigned long offset, int rshft, int desc)
+ {
+ unsigned long descriptor_status;
+ unsigned long descriptor_status2;
+
+ descriptor_status = ((read_lmmr(offset) >> rshft) & UV_ACT_STATUS_MASK);
+- descriptor_status2 = (read_mmr_uv2_status() >> cpu) & 0x1UL;
++ descriptor_status2 = (read_mmr_uv2_status() >> desc) & 0x1UL;
+ descriptor_status = (descriptor_status << 1) | descriptor_status2;
+ return descriptor_status;
+ }
+
++/*
++ * Return whether the status of the descriptor that is normally used for this
++ * cpu (the one indexed by its hub-relative cpu number) is busy.
++ * The status of the original 32 descriptors is always reflected in the 64
++ * bits of UVH_LB_BAU_SB_ACTIVATION_STATUS_0.
++ * The bit provided by the activation_status_2 register is irrelevant to
++ * the status if it is only being tested for busy or not busy.
++ */
++int normal_busy(struct bau_control *bcp)
++{
++ int cpu = bcp->uvhub_cpu;
++ int mmr_offset;
++ int right_shift;
++
++ mmr_offset = UVH_LB_BAU_SB_ACTIVATION_STATUS_0;
++ right_shift = cpu * UV_ACT_STATUS_SIZE;
++ return (((((read_lmmr(mmr_offset) >> right_shift) &
++ UV_ACT_STATUS_MASK)) << 1) == UV2H_DESC_BUSY);
++}
++
++/*
++ * Entered when a bau descriptor has gone into a permanent busy wait because
++ * of a hardware bug.
++ * Workaround the bug.
++ */
++int handle_uv2_busy(struct bau_control *bcp)
++{
++ int busy_one = bcp->using_desc;
++ int normal = bcp->uvhub_cpu;
++ int selected = -1;
++ int i;
++ unsigned long descriptor_status;
++ unsigned long status;
++ int mmr_offset;
++ struct bau_desc *bau_desc_old;
++ struct bau_desc *bau_desc_new;
++ struct bau_control *hmaster = bcp->uvhub_master;
++ struct ptc_stats *stat = bcp->statp;
++ cycles_t ttm;
++
++ stat->s_uv2_wars++;
++ spin_lock(&hmaster->uvhub_lock);
++ /* try for the original first */
++ if (busy_one != normal) {
++ if (!normal_busy(bcp))
++ selected = normal;
++ }
++ if (selected < 0) {
++ /* can't use the normal, select an alternate */
++ mmr_offset = UVH_LB_BAU_SB_ACTIVATION_STATUS_1;
++ descriptor_status = read_lmmr(mmr_offset);
++
++ /* scan available descriptors 32-63 */
++ for (i = 0; i < UV_CPUS_PER_AS; i++) {
++ if ((hmaster->inuse_map & (1 << i)) == 0) {
++ status = ((descriptor_status >>
++ (i * UV_ACT_STATUS_SIZE)) &
++ UV_ACT_STATUS_MASK) << 1;
++ if (status != UV2H_DESC_BUSY) {
++ selected = i + UV_CPUS_PER_AS;
++ break;
++ }
++ }
++ }
++ }
++
++ if (busy_one != normal)
++ /* mark the busy alternate as not in-use */
++ hmaster->inuse_map &= ~(1 << (busy_one - UV_CPUS_PER_AS));
++
++ if (selected >= 0) {
++ /* switch to the selected descriptor */
++ if (selected != normal) {
++ /* set the selected alternate as in-use */
++ hmaster->inuse_map |=
++ (1 << (selected - UV_CPUS_PER_AS));
++ if (selected > stat->s_uv2_wars_hw)
++ stat->s_uv2_wars_hw = selected;
++ }
++ bau_desc_old = bcp->descriptor_base;
++ bau_desc_old += (ITEMS_PER_DESC * busy_one);
++ bcp->using_desc = selected;
++ bau_desc_new = bcp->descriptor_base;
++ bau_desc_new += (ITEMS_PER_DESC * selected);
++ *bau_desc_new = *bau_desc_old;
++ } else {
++ /*
++ * All are busy. Wait for the normal one for this cpu to
++ * free up.
++ */
++ stat->s_uv2_war_waits++;
++ spin_unlock(&hmaster->uvhub_lock);
++ ttm = get_cycles();
++ do {
++ cpu_relax();
++ } while (normal_busy(bcp));
++ spin_lock(&hmaster->uvhub_lock);
++ /* switch to the original descriptor */
++ bcp->using_desc = normal;
++ bau_desc_old = bcp->descriptor_base;
++ bau_desc_old += (ITEMS_PER_DESC * bcp->using_desc);
++ bcp->using_desc = (ITEMS_PER_DESC * normal);
++ bau_desc_new = bcp->descriptor_base;
++ bau_desc_new += (ITEMS_PER_DESC * normal);
++ *bau_desc_new = *bau_desc_old; /* copy the entire descriptor */
++ }
++ spin_unlock(&hmaster->uvhub_lock);
++ return FLUSH_RETRY_BUSYBUG;
++}
++
+ static int uv2_wait_completion(struct bau_desc *bau_desc,
+ unsigned long mmr_offset, int right_shift,
+ struct bau_control *bcp, long try)
+ {
+ unsigned long descriptor_stat;
+ cycles_t ttm;
+- int cpu = bcp->uvhub_cpu;
++ int desc = bcp->using_desc;
++ long busy_reps = 0;
+ struct ptc_stats *stat = bcp->statp;
+
+- descriptor_stat = uv2_read_status(mmr_offset, right_shift, cpu);
++ descriptor_stat = uv2_read_status(mmr_offset, right_shift, desc);
+
+ /* spin on the status MMR, waiting for it to go idle */
+ while (descriptor_stat != UV2H_DESC_IDLE) {
+@@ -542,12 +655,23 @@ static int uv2_wait_completion(struct bau_desc *bau_desc,
+ bcp->conseccompletes = 0;
+ return FLUSH_RETRY_TIMEOUT;
+ } else {
++ busy_reps++;
++ if (busy_reps > 1000000) {
++ /* not to hammer on the clock */
++ busy_reps = 0;
++ ttm = get_cycles();
++ if ((ttm - bcp->send_message) >
++ (bcp->clocks_per_100_usec)) {
++ return handle_uv2_busy(bcp);
++ }
++ }
+ /*
+ * descriptor_stat is still BUSY
+ */
+ cpu_relax();
+ }
+- descriptor_stat = uv2_read_status(mmr_offset, right_shift, cpu);
++ descriptor_stat = uv2_read_status(mmr_offset, right_shift,
++ desc);
+ }
+ bcp->conseccompletes++;
+ return FLUSH_COMPLETE;
+@@ -563,14 +687,14 @@ static int wait_completion(struct bau_desc *bau_desc,
+ {
+ int right_shift;
+ unsigned long mmr_offset;
+- int cpu = bcp->uvhub_cpu;
++ int desc = bcp->using_desc;
+
+- if (cpu < UV_CPUS_PER_AS) {
++ if (desc < UV_CPUS_PER_AS) {
+ mmr_offset = UVH_LB_BAU_SB_ACTIVATION_STATUS_0;
+- right_shift = cpu * UV_ACT_STATUS_SIZE;
++ right_shift = desc * UV_ACT_STATUS_SIZE;
+ } else {
+ mmr_offset = UVH_LB_BAU_SB_ACTIVATION_STATUS_1;
+- right_shift = ((cpu - UV_CPUS_PER_AS) * UV_ACT_STATUS_SIZE);
++ right_shift = ((desc - UV_CPUS_PER_AS) * UV_ACT_STATUS_SIZE);
+ }
+
+ if (bcp->uvhub_version == 1)
+@@ -752,8 +876,7 @@ static void handle_cmplt(int completion_status, struct bau_desc *bau_desc,
+ * Returns 1 if it gives up entirely and the original cpu mask is to be
+ * returned to the kernel.
+ */
+-int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+- struct cpumask *flush_mask, struct bau_control *bcp)
++int uv_flush_send_and_wait(struct cpumask *flush_mask, struct bau_control *bcp)
+ {
+ int seq_number = 0;
+ int completion_stat = 0;
+@@ -766,20 +889,24 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+ struct bau_control *hmaster = bcp->uvhub_master;
+ struct uv1_bau_msg_header *uv1_hdr = NULL;
+ struct uv2_bau_msg_header *uv2_hdr = NULL;
++ struct bau_desc *bau_desc;
+
+- if (bcp->uvhub_version == 1) {
+- uv1 = 1;
++ if (bcp->uvhub_version == 1)
+ uv1_throttle(hmaster, stat);
+- uv1_hdr = &bau_desc->header.uv1_hdr;
+- } else
+- uv2_hdr = &bau_desc->header.uv2_hdr;
+
+ while (hmaster->uvhub_quiesce)
+ cpu_relax();
+
+ time1 = get_cycles();
+ do {
+- if (try == 0) {
++ bau_desc = bcp->descriptor_base;
++ bau_desc += (ITEMS_PER_DESC * bcp->using_desc);
++ if (bcp->uvhub_version == 1) {
++ uv1 = 1;
++ uv1_hdr = &bau_desc->header.uv1_hdr;
++ } else
++ uv2_hdr = &bau_desc->header.uv2_hdr;
++ if ((try == 0) || (completion_stat == FLUSH_RETRY_BUSYBUG)) {
+ if (uv1)
+ uv1_hdr->msg_type = MSG_REGULAR;
+ else
+@@ -797,13 +924,14 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+ uv1_hdr->sequence = seq_number;
+ else
+ uv2_hdr->sequence = seq_number;
+- index = (1UL << AS_PUSH_SHIFT) | bcp->uvhub_cpu;
++ index = (1UL << AS_PUSH_SHIFT) | bcp->using_desc;
+ bcp->send_message = get_cycles();
+
+ write_mmr_activation(index);
+
+ try++;
+ completion_stat = wait_completion(bau_desc, bcp, try);
++ /* UV2: wait_completion() may change the bcp->using_desc */
+
+ handle_cmplt(completion_stat, bau_desc, bcp, hmaster, stat);
+
+@@ -814,6 +942,7 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+ }
+ cpu_relax();
+ } while ((completion_stat == FLUSH_RETRY_PLUGGED) ||
++ (completion_stat == FLUSH_RETRY_BUSYBUG) ||
+ (completion_stat == FLUSH_RETRY_TIMEOUT));
+
+ time2 = get_cycles();
+@@ -828,6 +957,7 @@ int uv_flush_send_and_wait(struct bau_desc *bau_desc,
+ record_send_stats(time1, time2, bcp, stat, completion_stat, try);
+
+ if (completion_stat == FLUSH_GIVEUP)
++ /* FLUSH_GIVEUP will fall back to using IPI's for tlb flush */
+ return 1;
+ return 0;
+ }
+@@ -983,7 +1113,7 @@ const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
+ stat->s_ntargself++;
+
+ bau_desc = bcp->descriptor_base;
+- bau_desc += (ITEMS_PER_DESC * bcp->uvhub_cpu);
++ bau_desc += (ITEMS_PER_DESC * bcp->using_desc);
+ bau_uvhubs_clear(&bau_desc->distribution, UV_DISTRIBUTION_SIZE);
+ if (set_distrib_bits(flush_mask, bcp, bau_desc, &locals, &remotes))
+ return NULL;
+@@ -996,13 +1126,86 @@ const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
+ * uv_flush_send_and_wait returns 0 if all cpu's were messaged,
+ * or 1 if it gave up and the original cpumask should be returned.
+ */
+- if (!uv_flush_send_and_wait(bau_desc, flush_mask, bcp))
++ if (!uv_flush_send_and_wait(flush_mask, bcp))
+ return NULL;
+ else
+ return cpumask;
+ }
+
+ /*
++ * Search the message queue for any 'other' message with the same software
++ * acknowledge resource bit vector.
++ */
++struct bau_pq_entry *find_another_by_swack(struct bau_pq_entry *msg,
++ struct bau_control *bcp, unsigned char swack_vec)
++{
++ struct bau_pq_entry *msg_next = msg + 1;
++
++ if (msg_next > bcp->queue_last)
++ msg_next = bcp->queue_first;
++ while ((msg_next->swack_vec != 0) && (msg_next != msg)) {
++ if (msg_next->swack_vec == swack_vec)
++ return msg_next;
++ msg_next++;
++ if (msg_next > bcp->queue_last)
++ msg_next = bcp->queue_first;
++ }
++ return NULL;
++}
++
++/*
++ * UV2 needs to work around a bug in which an arriving message has not
++ * set a bit in the UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE register.
++ * Such a message must be ignored.
++ */
++void process_uv2_message(struct msg_desc *mdp, struct bau_control *bcp)
++{
++ unsigned long mmr_image;
++ unsigned char swack_vec;
++ struct bau_pq_entry *msg = mdp->msg;
++ struct bau_pq_entry *other_msg;
++
++ mmr_image = read_mmr_sw_ack();
++ swack_vec = msg->swack_vec;
++
++ if ((swack_vec & mmr_image) == 0) {
++ /*
++ * This message was assigned a swack resource, but no
++ * reserved acknowlegment is pending.
++ * The bug has prevented this message from setting the MMR.
++ * And no other message has used the same sw_ack resource.
++ * Do the requested shootdown but do not reply to the msg.
++ * (the 0 means make no acknowledge)
++ */
++ bau_process_message(mdp, bcp, 0);
++ return;
++ }
++
++ /*
++ * Some message has set the MMR 'pending' bit; it might have been
++ * another message. Look for that message.
++ */
++ other_msg = find_another_by_swack(msg, bcp, msg->swack_vec);
++ if (other_msg) {
++ /* There is another. Do not ack the current one. */
++ bau_process_message(mdp, bcp, 0);
++ /*
++ * Let the natural processing of that message acknowledge
++ * it. Don't get the processing of sw_ack's out of order.
++ */
++ return;
++ }
++
++ /*
++ * There is no other message using this sw_ack, so it is safe to
++ * acknowledge it.
++ */
++ bau_process_message(mdp, bcp, 1);
++
++ return;
++}
++
++/*
+ * The BAU message interrupt comes here. (registered by set_intr_gate)
+ * See entry_64.S
+ *
+@@ -1038,9 +1241,11 @@ void uv_bau_message_interrupt(struct pt_regs *regs)
+ count++;
+
+ msgdesc.msg_slot = msg - msgdesc.queue_first;
+- msgdesc.swack_slot = ffs(msg->swack_vec) - 1;
+ msgdesc.msg = msg;
+- bau_process_message(&msgdesc, bcp);
++ if (bcp->uvhub_version == 2)
++ process_uv2_message(&msgdesc, bcp);
++ else
++ bau_process_message(&msgdesc, bcp, 1);
+
+ msg++;
+ if (msg > msgdesc.queue_last)
+@@ -1158,7 +1363,7 @@ static int ptc_seq_show(struct seq_file *file, void *data)
+ seq_printf(file,
+ "all one mult none retry canc nocan reset rcan ");
+ seq_printf(file,
+- "disable enable\n");
++ "disable enable wars warshw warwaits\n");
+ }
+ if (cpu < num_possible_cpus() && cpu_online(cpu)) {
+ stat = &per_cpu(ptcstats, cpu);
+@@ -1189,8 +1394,10 @@ static int ptc_seq_show(struct seq_file *file, void *data)
+ stat->d_nomsg, stat->d_retries, stat->d_canceled,
+ stat->d_nocanceled, stat->d_resets,
+ stat->d_rcanceled);
+- seq_printf(file, "%ld %ld\n",
+- stat->s_bau_disabled, stat->s_bau_reenabled);
++ seq_printf(file, "%ld %ld %ld %ld %ld\n",
++ stat->s_bau_disabled, stat->s_bau_reenabled,
++ stat->s_uv2_wars, stat->s_uv2_wars_hw,
++ stat->s_uv2_war_waits);
+ }
+ return 0;
+ }
+@@ -1564,6 +1771,7 @@ static void pq_init(int node, int pnode)
+ write_mmr_payload_first(pnode, pn_first);
+ write_mmr_payload_tail(pnode, first);
+ write_mmr_payload_last(pnode, last);
++ write_gmmr_sw_ack(pnode, 0xffffUL);
+
+ /* in effect, all msg_type's are set to MSG_NOOP */
+ memset(pqp, 0, sizeof(struct bau_pq_entry) * DEST_Q_SIZE);
+@@ -1651,6 +1859,7 @@ static void __init init_per_cpu_tunables(void)
+ bcp->cong_response_us = congested_respns_us;
+ bcp->cong_reps = congested_reps;
+ bcp->cong_period = congested_period;
++ bcp->clocks_per_100_usec = usec_2_cycles(100);
+ }
+ }
+
+@@ -1771,6 +1980,7 @@ static int scan_sock(struct socket_desc *sdp, struct uvhub_desc *bdp,
+ }
+ bcp->uvhub_master = *hmasterp;
+ bcp->uvhub_cpu = uv_cpu_hub_info(cpu)->blade_processor_id;
++ bcp->using_desc = bcp->uvhub_cpu;
+ if (bcp->uvhub_cpu >= MAX_CPUS_PER_UVHUB) {
+ printk(KERN_EMERG "%d cpus per uvhub invalid\n",
+ bcp->uvhub_cpu);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch
new file mode 100644
index 0000000..7545566
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch
@@ -0,0 +1,61 @@
+From 6e66c39b4394d812895bbeaa0dce566ca86a7d72 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sat, 14 Jan 2012 15:08:34 +0100
+Subject: [PATCH 117/130] ath9k_hw: fix interpretation of the rx KeyMiss flag
+
+commit 7a532fe7131216a02c81a6c1b1f8632da1195a58 upstream.
+
+Documentation states that the KeyMiss flag is only valid if RxFrameOK is
+unset, however empirical evidence has shown that this is false.
+When KeyMiss is set (and RxFrameOK is 1), the hardware passes a valid frame
+which has not been decrypted. The driver then falsely marks the frame
+as decrypted, and when using CCMP this corrupts the rx CCMP PN, leading
+to connection hangs.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/ath/ath9k/ar9003_mac.c | 5 +++--
+ drivers/net/wireless/ath/ath9k/mac.c | 5 +++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+index ccde784..f5ae3c6 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+@@ -526,10 +526,11 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
+ rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+ else if (rxsp->status11 & AR_MichaelErr)
+ rxs->rs_status |= ATH9K_RXERR_MIC;
+- if (rxsp->status11 & AR_KeyMiss)
+- rxs->rs_status |= ATH9K_RXERR_KEYMISS;
+ }
+
++ if (rxsp->status11 & AR_KeyMiss)
++ rxs->rs_status |= ATH9K_RXERR_KEYMISS;
++
+ return 0;
+ }
+ EXPORT_SYMBOL(ath9k_hw_process_rxdesc_edma);
+diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
+index ecdb6fd..bbcb777 100644
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -621,10 +621,11 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
+ rs->rs_status |= ATH9K_RXERR_DECRYPT;
+ else if (ads.ds_rxstatus8 & AR_MichaelErr)
+ rs->rs_status |= ATH9K_RXERR_MIC;
+- if (ads.ds_rxstatus8 & AR_KeyMiss)
+- rs->rs_status |= ATH9K_RXERR_KEYMISS;
+ }
+
++ if (ads.ds_rxstatus8 & AR_KeyMiss)
++ rs->rs_status |= ATH9K_RXERR_KEYMISS;
++
+ return 0;
+ }
+ EXPORT_SYMBOL(ath9k_hw_rxprocdesc);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch
new file mode 100644
index 0000000..c27d03d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch
@@ -0,0 +1,86 @@
+From a72bbcd57d9b63d480ab61b5429458b10ed6595f Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Fri, 13 Jan 2012 12:59:32 +0100
+Subject: [PATCH 118/130] rt2800pci: fix spurious interrupts generation
+
+commit dfd00c4c8f3dfa1fd7cec45f83d98b2a49743dcd upstream.
+
+Same devices can generate interrupt without properly setting bit in
+INT_SOURCE_CSR register (spurious interrupt), what will cause IRQ line
+will be disabled by interrupts controller driver.
+
+We discovered that clearing INT_MASK_CSR stops such behaviour. We
+previously first read that register, and then clear all know interrupt
+sources bits and do not touch reserved bits. After this patch, we write
+to all register content (I believe writing to reserved bits on that
+register will not cause any problems, I tested that on my rt2800pci
+device).
+
+This fix very bad performance problem, practically making device
+unusable (since worked without interrupts), reported in:
+https://bugzilla.redhat.com/show_bug.cgi?id=658451
+
+We previously tried to workaround that issue in commit
+4ba7d9997869d25bd223dea7536fc1ce9fab3b3b "rt2800pci: handle spurious
+interrupts", but it was reverted in commit
+82e5fc2a34fa9ffea38f00c4066b7e600a0ca5e6
+as thing, that will prevent to detect real spurious interrupts.
+
+Reported-and-tested-by: Amir Hedayaty <hedayaty@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/rt2x00/rt2800pci.c | 28 ++++++++--------------------
+ 1 files changed, 8 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
+index da48c8a..837b460 100644
+--- a/drivers/net/wireless/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/rt2x00/rt2800pci.c
+@@ -422,7 +422,6 @@ static int rt2800pci_init_queues(struct rt2x00_dev *rt2x00dev)
+ static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
+ enum dev_state state)
+ {
+- int mask = (state == STATE_RADIO_IRQ_ON);
+ u32 reg;
+ unsigned long flags;
+
+@@ -436,25 +435,14 @@ static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
+ }
+
+ spin_lock_irqsave(&rt2x00dev->irqmask_lock, flags);
+- rt2x00pci_register_read(rt2x00dev, INT_MASK_CSR, ®);
+- rt2x00_set_field32(®, INT_MASK_CSR_RXDELAYINT, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_TXDELAYINT, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_RX_DONE, mask);
+- rt2x00_set_field32(®, INT_MASK_CSR_AC0_DMA_DONE, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_AC1_DMA_DONE, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_AC2_DMA_DONE, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_AC3_DMA_DONE, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_HCCA_DMA_DONE, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_MGMT_DMA_DONE, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_MCU_COMMAND, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_RXTX_COHERENT, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_TBTT, mask);
+- rt2x00_set_field32(®, INT_MASK_CSR_PRE_TBTT, mask);
+- rt2x00_set_field32(®, INT_MASK_CSR_TX_FIFO_STATUS, mask);
+- rt2x00_set_field32(®, INT_MASK_CSR_AUTO_WAKEUP, mask);
+- rt2x00_set_field32(®, INT_MASK_CSR_GPTIMER, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_RX_COHERENT, 0);
+- rt2x00_set_field32(®, INT_MASK_CSR_TX_COHERENT, 0);
++ reg = 0;
++ if (state == STATE_RADIO_IRQ_ON) {
++ rt2x00_set_field32(®, INT_MASK_CSR_RX_DONE, 1);
++ rt2x00_set_field32(®, INT_MASK_CSR_TBTT, 1);
++ rt2x00_set_field32(®, INT_MASK_CSR_PRE_TBTT, 1);
++ rt2x00_set_field32(®, INT_MASK_CSR_TX_FIFO_STATUS, 1);
++ rt2x00_set_field32(®, INT_MASK_CSR_AUTO_WAKEUP, 1);
++ }
+ rt2x00pci_register_write(rt2x00dev, INT_MASK_CSR, reg);
+ spin_unlock_irqrestore(&rt2x00dev->irqmask_lock, flags);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch
new file mode 100644
index 0000000..abb918e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch
@@ -0,0 +1,45 @@
+From f245d82f78e86e6c7ac4965cfc272a8c95ab8cac Mon Sep 17 00:00:00 2001
+From: Dave Chinner <dchinner@redhat.com>
+Date: Wed, 18 Jan 2012 14:41:45 -0600
+Subject: [PATCH 119/130] xfs: fix endian conversion issue in discard code
+
+commit b1c770c273a4787069306fc82aab245e9ac72e9d upstream
+
+When finding the longest extent in an AG, we read the value directly
+out of the AGF buffer without endian conversion. This will give an
+incorrect length, resulting in FITRIM operations potentially not
+trimming everything that it should.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/xfs/xfs_discard.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
+index 8a24f0c..286a051 100644
+--- a/fs/xfs/xfs_discard.c
++++ b/fs/xfs/xfs_discard.c
+@@ -68,7 +68,7 @@ xfs_trim_extents(
+ * Look up the longest btree in the AGF and start with it.
+ */
+ error = xfs_alloc_lookup_le(cur, 0,
+- XFS_BUF_TO_AGF(agbp)->agf_longest, &i);
++ be32_to_cpu(XFS_BUF_TO_AGF(agbp)->agf_longest), &i);
+ if (error)
+ goto out_del_cursor;
+
+@@ -84,7 +84,7 @@ xfs_trim_extents(
+ if (error)
+ goto out_del_cursor;
+ XFS_WANT_CORRUPTED_GOTO(i == 1, out_del_cursor);
+- ASSERT(flen <= XFS_BUF_TO_AGF(agbp)->agf_longest);
++ ASSERT(flen <= be32_to_cpu(XFS_BUF_TO_AGF(agbp)->agf_longest));
+
+ /*
+ * Too small? Give up.
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch
new file mode 100644
index 0000000..9b8897e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch
@@ -0,0 +1,33 @@
+From 6bbe2a11996ac0900c43c0729b2574d96d191608 Mon Sep 17 00:00:00 2001
+From: Toshiharu Okada <toshiharu-linux@dsn.okisemi.com>
+Date: Mon, 26 Sep 2011 16:16:23 +0900
+Subject: [PATCH 120/130] i2c-eg20t: modified the setting of transfer rate.
+
+commit ff35e8b18984ad2a82cbd259fc07f0be4b34b1aa upstream.
+
+This patch modified the setting value of
+I2C Bus Transfer Rate Setting Counter regisrer.
+
+Signed-off-by: Toshiharu Okada <toshiharu-linux@dsn.okisemi.com>
+Signed-off-by: Ben Dooks <ben-linux@fluff.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/i2c/busses/i2c-eg20t.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
+index 18936ac..730215e 100644
+--- a/drivers/i2c/busses/i2c-eg20t.c
++++ b/drivers/i2c/busses/i2c-eg20t.c
+@@ -243,7 +243,7 @@ static void pch_i2c_init(struct i2c_algo_pch_data *adap)
+ if (pch_clk > PCH_MAX_CLK)
+ pch_clk = 62500;
+
+- pch_i2cbc = (pch_clk + (pch_i2c_speed * 4)) / pch_i2c_speed * 8;
++ pch_i2cbc = (pch_clk + (pch_i2c_speed * 4)) / (pch_i2c_speed * 8);
+ /* Set transfer speed in I2CBC */
+ iowrite32(pch_i2cbc, p + PCH_I2CBC);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch
new file mode 100644
index 0000000..04b2480
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch
@@ -0,0 +1,46 @@
+From 51602e17c8a1318c938a53ac13af73255ddb8a25 Mon Sep 17 00:00:00 2001
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+Date: Fri, 20 Jan 2012 14:34:27 -0800
+Subject: [PATCH 121/130] score: fix off-by-one index into syscall table
+
+commit c25a785d6647984505fa165b5cd84cfc9a95970b upstream.
+
+If the provided system call number is equal to __NR_syscalls, the
+current check will pass and a function pointer just after the system
+call table may be called, since sys_call_table is an array with total
+size __NR_syscalls.
+
+Whether or not this is a security bug depends on what the compiler puts
+immediately after the system call table. It's likely that this won't do
+anything bad because there is an additional NULL check on the syscall
+entry, but if there happens to be a non-NULL value immediately after the
+system call table, this may result in local privilege escalation.
+
+Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
+Cc: Chen Liqin <liqin.chen@sunplusct.com>
+Cc: Lennox Wu <lennox.wu@gmail.com>
+Cc: Eugene Teo <eugeneteo@kernel.sg>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/score/kernel/entry.S | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/arch/score/kernel/entry.S b/arch/score/kernel/entry.S
+index 577abba..83bb960 100644
+--- a/arch/score/kernel/entry.S
++++ b/arch/score/kernel/entry.S
+@@ -408,7 +408,7 @@ ENTRY(handle_sys)
+ sw r9, [r0, PT_EPC]
+
+ cmpi.c r27, __NR_syscalls # check syscall number
+- bgtu illegal_syscall
++ bgeu illegal_syscall
+
+ slli r8, r27, 2 # get syscall routine
+ la r11, sys_call_table
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch
new file mode 100644
index 0000000..cd300c6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch
@@ -0,0 +1,67 @@
+From c851c03d3c252029f2d0a4b96439fb2e7baf0071 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 17 Jan 2012 16:08:51 -0500
+Subject: [PATCH 122/130] cifs: lower default wsize when unix extensions are
+ not used
+
+commit ce91acb3acae26f4163c5a6f1f695d1a1e8d9009 upstream.
+
+We've had some reports of servers (namely, the Solaris in-kernel CIFS
+server) that don't deal properly with writes that are "too large" even
+though they set CAP_LARGE_WRITE_ANDX. Change the default to better
+mirror what windows clients do.
+
+Cc: Pavel Shilovsky <piastry@etersoft.ru>
+Reported-by: Nick Davis <phireph0x@yahoo.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <smfrench@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/cifs/connect.c | 23 +++++++++++++++++++----
+ 1 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index f3670cf..63e4be4 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2914,18 +2914,33 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
+ #define CIFS_DEFAULT_IOSIZE (1024 * 1024)
+
+ /*
+- * Windows only supports a max of 60k reads. Default to that when posix
+- * extensions aren't in force.
++ * Windows only supports a max of 60kb reads and 65535 byte writes. Default to
++ * those values when posix extensions aren't in force. In actuality here, we
++ * use 65536 to allow for a write that is a multiple of 4k. Most servers seem
++ * to be ok with the extra byte even though Windows doesn't send writes that
++ * are that large.
++ *
++ * Citation:
++ *
++ * http://blogs.msdn.com/b/openspecification/archive/2009/04/10/smb-maximum-transmit-buffer-size-and-performance-tuning.aspx
+ */
+ #define CIFS_DEFAULT_NON_POSIX_RSIZE (60 * 1024)
++#define CIFS_DEFAULT_NON_POSIX_WSIZE (65536)
+
+ static unsigned int
+ cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
+ {
+ __u64 unix_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
+ struct TCP_Server_Info *server = tcon->ses->server;
+- unsigned int wsize = pvolume_info->wsize ? pvolume_info->wsize :
+- CIFS_DEFAULT_IOSIZE;
++ unsigned int wsize;
++
++ /* start with specified wsize, or default */
++ if (pvolume_info->wsize)
++ wsize = pvolume_info->wsize;
++ else if (tcon->unix_ext && (unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
++ wsize = CIFS_DEFAULT_IOSIZE;
++ else
++ wsize = CIFS_DEFAULT_NON_POSIX_WSIZE;
+
+ /* can server support 24-bit write sizes? (via UNIX extensions) */
+ if (!tcon->unix_ext || !(unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch
new file mode 100644
index 0000000..9311e08
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch
@@ -0,0 +1,49 @@
+From 4dbd29bd7e0b2a712370f8d0c25d025d996edbc1 Mon Sep 17 00:00:00 2001
+From: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
+Date: Fri, 20 Jan 2012 14:34:04 -0800
+Subject: [PATCH 123/130] kprobes: initialize before using a hlist
+
+commit d496aab567e7e52b3e974c9192a5de6e77dce32c upstream.
+
+Commit ef53d9c5e ("kprobes: improve kretprobe scalability with hashed
+locking") introduced a bug where we can potentially leak
+kretprobe_instances since we initialize a hlist head after having used
+it.
+
+Initialize the hlist head before using it.
+
+Reported by: Jim Keniston <jkenisto@us.ibm.com>
+Acked-by: Jim Keniston <jkenisto@us.ibm.com>
+Signed-off-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
+Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
+Cc: Srinivasa D S <srinivasa@in.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ kernel/kprobes.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index e5d8464..52fd049 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1077,6 +1077,7 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
+ /* Early boot. kretprobe_table_locks not yet initialized. */
+ return;
+
++ INIT_HLIST_HEAD(&empty_rp);
+ hash = hash_ptr(tk, KPROBE_HASH_BITS);
+ head = &kretprobe_inst_table[hash];
+ kretprobe_table_lock(hash, &flags);
+@@ -1085,7 +1086,6 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
+ recycle_rp_inst(ri, &empty_rp);
+ }
+ kretprobe_table_unlock(hash, &flags);
+- INIT_HLIST_HEAD(&empty_rp);
+ hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+ hlist_del(&ri->hlist);
+ kfree(ri);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch
new file mode 100644
index 0000000..c27ca94
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch
@@ -0,0 +1,64 @@
+From 6568c3dad4c19c7cfbd948fbf3f4935f0ab8d0ef Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 20 Jan 2012 14:34:09 -0800
+Subject: [PATCH 124/130] proc: clear_refs: do not clear reserved pages
+
+commit 85e72aa5384b1a614563ad63257ded0e91d1a620 upstream.
+
+/proc/pid/clear_refs is used to clear the Referenced and YOUNG bits for
+pages and corresponding page table entries of the task with PID pid, which
+includes any special mappings inserted into the page tables in order to
+provide things like vDSOs and user helper functions.
+
+On ARM this causes a problem because the vectors page is mapped as a
+global mapping and since ec706dab ("ARM: add a vma entry for the user
+accessible vector page"), a VMA is also inserted into each task for this
+page to aid unwinding through signals and syscall restarts. Since the
+vectors page is required for handling faults, clearing the YOUNG bit (and
+subsequently writing a faulting pte) means that we lose the vectors page
+*globally* and cannot fault it back in. This results in a system deadlock
+on the next exception.
+
+To see this problem in action, just run:
+
+ $ echo 1 > /proc/self/clear_refs
+
+on an ARM platform (as any user) and watch your system hang. I think this
+has been the case since 2.6.37
+
+This patch avoids clearing the aforementioned bits for reserved pages,
+therefore leaving the vectors page intact on ARM. Since reserved pages
+are not candidates for swap, this change should not have any impact on the
+usefulness of clear_refs.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Reported-by: Moussa Ba <moussaba@micron.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Russell King <rmk@arm.linux.org.uk>
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Cc: Matt Mackall <mpm@selenic.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/proc/task_mmu.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index e418c5a..7dcd2a2 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -518,6 +518,9 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
+ if (!page)
+ continue;
+
++ if (PageReserved(page))
++ continue;
++
+ /* Clear accessed and referenced bits. */
+ ptep_test_and_clear_young(vma, addr, pte);
+ ClearPageReferenced(page);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch
new file mode 100644
index 0000000..752f80f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch
@@ -0,0 +1,91 @@
+From e7a0d73a0a0ba69a8969852286911f0e89a2b2dd Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.cz>
+Date: Fri, 20 Jan 2012 14:33:55 -0800
+Subject: [PATCH 125/130] mm: fix NULL ptr dereference in
+ __count_immobile_pages
+
+commit 687875fb7de4a95223af20ee024282fa9099f860 upstream.
+
+Fix the following NULL ptr dereference caused by
+
+ cat /sys/devices/system/memory/memory0/removable
+
+Pid: 13979, comm: sed Not tainted 3.0.13-0.5-default #1 IBM BladeCenter LS21 -[7971PAM]-/Server Blade
+RIP: __count_immobile_pages+0x4/0x100
+Process sed (pid: 13979, threadinfo ffff880221c36000, task ffff88022e788480)
+Call Trace:
+ is_pageblock_removable_nolock+0x34/0x40
+ is_mem_section_removable+0x74/0xf0
+ show_mem_removable+0x41/0x70
+ sysfs_read_file+0xfe/0x1c0
+ vfs_read+0xc7/0x130
+ sys_read+0x53/0xa0
+ system_call_fastpath+0x16/0x1b
+
+We are crashing because we are trying to dereference NULL zone which
+came from pfn=0 (struct page ffffea0000000000). According to the boot
+log this page is marked reserved:
+e820 update range: 0000000000000000 - 0000000000010000 (usable) ==> (reserved)
+
+and early_node_map confirms that:
+early_node_map[3] active PFN ranges
+ 1: 0x00000010 -> 0x0000009c
+ 1: 0x00000100 -> 0x000bffa3
+ 1: 0x00100000 -> 0x00240000
+
+The problem is that memory_present works in PAGE_SECTION_MASK aligned
+blocks so the reserved range sneaks into the the section as well. This
+also means that free_area_init_node will not take care of those reserved
+pages and they stay uninitialized.
+
+When we try to read the removable status we walk through all available
+sections and hope that the zone is valid for all pages in the section.
+But this is not true in this case as the zone and nid are not initialized.
+
+We have only one node in this particular case and it is marked as node=1
+(rather than 0) and that made the problem visible because page_to_nid will
+return 0 and there are no zones on the node.
+
+Let's check that the zone is valid and that the given pfn falls into its
+boundaries and mark the section not removable. This might cause some
+false positives, probably, but we do not have any sane way to find out
+whether the page is reserved by the platform or it is just not used for
+whatever other reasons.
+
+Signed-off-by: Michal Hocko <mhocko@suse.cz>
+Acked-by: Mel Gorman <mgorman@suse.de>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ mm/page_alloc.c | 11 +++++++++++
+ 1 files changed, 11 insertions(+), 0 deletions(-)
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 2b8ba3a..485be89 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5608,6 +5608,17 @@ __count_immobile_pages(struct zone *zone, struct page *page, int count)
+ bool is_pageblock_removable_nolock(struct page *page)
+ {
+ struct zone *zone = page_zone(page);
++ unsigned long pfn = page_to_pfn(page);
++
++ /*
++ * We have to be careful here because we are iterating over memory
++ * sections which are not zone aware so we might end up outside of
++ * the zone but still within the section.
++ */
++ if (!zone || zone->zone_start_pfn > pfn ||
++ zone->zone_start_pfn + zone->spanned_pages <= pfn)
++ return false;
++
+ return __count_immobile_pages(zone, page, 0);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0126-iwlagn-check-for-SMPS-mode.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0126-iwlagn-check-for-SMPS-mode.patch
new file mode 100644
index 0000000..8290ecd
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0126-iwlagn-check-for-SMPS-mode.patch
@@ -0,0 +1,50 @@
+From a19ea3b8cc51cbeb52d0b2e1aa7d8987f123e3ab Mon Sep 17 00:00:00 2001
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date: Thu, 10 Nov 2011 06:55:04 -0800
+Subject: [PATCH 126/130] iwlagn: check for SMPS mode
+
+commit b2ccccdca46273c7b321ecf5041c362cd950da20 upstream.
+
+Check and report WARN only when its invalid
+
+Resolves:
+https://bugzilla.kernel.org/show_bug.cgi?id=42621
+https://bugzilla.redhat.com/show_bug.cgi?id=766071
+
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/iwlwifi/iwl-agn-lib.c | 1 +
+ drivers/net/wireless/iwlwifi/iwl-agn-rxon.c | 3 +++
+ 2 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+index 1a52ed2..6465983 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+@@ -827,6 +827,7 @@ static int iwl_get_idle_rx_chain_count(struct iwl_priv *priv, int active_cnt)
+ case IEEE80211_SMPS_STATIC:
+ case IEEE80211_SMPS_DYNAMIC:
+ return IWL_NUM_IDLE_CHAINS_SINGLE;
++ case IEEE80211_SMPS_AUTOMATIC:
+ case IEEE80211_SMPS_OFF:
+ return active_cnt;
+ default:
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+index 5c7c17c..d552fa3 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+@@ -559,6 +559,9 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
+
+ mutex_lock(&priv->shrd->mutex);
+
++ if (test_bit(STATUS_EXIT_PENDING, &priv->shrd->status))
++ goto out;
++
+ if (unlikely(test_bit(STATUS_SCANNING, &priv->shrd->status))) {
+ IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
+ goto out;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch
new file mode 100644
index 0000000..8c1b597
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch
@@ -0,0 +1,60 @@
+From 8662eba088f07fc218cd70a54eb75f19dd89121b Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Fri, 23 Dec 2011 08:13:50 +0100
+Subject: [PATCH 127/130] iwlegacy: 3945: fix hw passive scan on radar
+ channels
+
+commit 68acc4afb040d98ddfd2cae0de09e2f4e1ee127f upstream.
+
+Patch fix firmware error on "iw dev wlan0 scan passive" for
+hardware scanning (with disable_hw_scan=0 module parameter).
+
+ iwl3945 0000:03:00.0: Microcode SW error detected. Restarting 0x82000008.
+ iwl3945 0000:03:00.0: Loaded firmware version: 15.32.2.9
+ iwl3945 0000:03:00.0: Start IWL Error Log Dump:
+ iwl3945 0000:03:00.0: Status: 0x0002A2E4, count: 1
+ iwl3945 0000:03:00.0: Desc Time asrtPC blink2 ilink1 nmiPC Line
+ iwl3945 0000:03:00.0: SYSASSERT (0x5) 0041263900 0x13756 0x0031C 0x00000 764
+ iwl3945 0000:03:00.0: Error Reply type 0x000002FC cmd C_SCAN (0x80) seq 0x443E ser 0x00340000
+ iwl3945 0000:03:00.0: Command C_SCAN failed: FW Error
+ iwl3945 0000:03:00.0: Can't stop Rx DMA.
+
+We have disable ability to change passive scanning to active on
+particular channel when traffic is detected on that channel. Otherwise
+firmware will report error, when we try to do passive scan on radar
+channels.
+
+Reported-and-debugged-by: Pedro Francisco <pedrogfrancisco@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/iwlegacy/iwl3945-base.c | 9 ++++-----
+ 1 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
+index b282d86..05f2ad1 100644
+--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
++++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
+@@ -2656,14 +2656,13 @@ int iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
+ IWL_WARN(priv, "Invalid scan band\n");
+ return -EIO;
+ }
+-
+ /*
+- * If active scaning is requested but a certain channel
+- * is marked passive, we can do active scanning if we
+- * detect transmissions.
++ * If active scaning is requested but a certain channel is marked
++ * passive, we can do active scanning if we detect transmissions. For
++ * passive only scanning disable switching to active on any channel.
+ */
+ scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+- IWL_GOOD_CRC_TH_DISABLED;
++ IWL_GOOD_CRC_TH_NEVER;
+
+ len = iwl_legacy_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data,
+ vif->addr, priv->scan_request->ie,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch
new file mode 100644
index 0000000..f6c0efd
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch
@@ -0,0 +1,186 @@
+From 1dc1d2ffffa4b2e00e43573abdb5db9ad08ce53f Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Fri, 20 Jan 2012 14:34:19 -0800
+Subject: [PATCH 128/130] SHM_UNLOCK: fix long unpreemptible section
+
+commit 85046579bde15e532983438f86b36856e358f417 upstream.
+
+scan_mapping_unevictable_pages() is used to make SysV SHM_LOCKed pages
+evictable again once the shared memory is unlocked. It does this with
+pagevec_lookup()s across the whole object (which might occupy most of
+memory), and takes 300ms to unlock 7GB here. A cond_resched() every
+PAGEVEC_SIZE pages would be good.
+
+However, KOSAKI-san points out that this is called under shmem.c's
+info->lock, and it's also under shm.c's shm_lock(), both spinlocks.
+There is no strong reason for that: we need to take these pages off the
+unevictable list soonish, but those locks are not required for it.
+
+So move the call to scan_mapping_unevictable_pages() from shmem.c's
+unlock handling up to shm.c's unlock handling. Remove the recently
+added barrier, not needed now we have spin_unlock() before the scan.
+
+Use get_file(), with subsequent fput(), to make sure we have a reference
+to mapping throughout scan_mapping_unevictable_pages(): that's something
+that was previously guaranteed by the shm_lock().
+
+Remove shmctl's lru_add_drain_all(): we don't fault in pages at SHM_LOCK
+time, and we lazily discover them to be Unevictable later, so it serves
+no purpose for SHM_LOCK; and serves no purpose for SHM_UNLOCK, since
+pages still on pagevec are not marked Unevictable.
+
+The original code avoided redundant rescans by checking VM_LOCKED flag
+at its level: now avoid them by checking shp's SHM_LOCKED.
+
+The original code called scan_mapping_unevictable_pages() on a locked
+area at shm_destroy() time: perhaps we once had accounting cross-checks
+which required that, but not now, so skip the overhead and just let
+inode eviction deal with them.
+
+Put check_move_unevictable_page() and scan_mapping_unevictable_pages()
+under CONFIG_SHMEM (with stub for the TINY case when ramfs is used),
+more as comment than to save space; comment them used for SHM_UNLOCK.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Minchan Kim <minchan.kim@gmail.com>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Shaohua Li <shaohua.li@intel.com>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michel Lespinasse <walken@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ ipc/shm.c | 37 ++++++++++++++++++++++---------------
+ mm/shmem.c | 7 -------
+ mm/vmscan.c | 12 +++++++++++-
+ 3 files changed, 33 insertions(+), 23 deletions(-)
+
+diff --git a/ipc/shm.c b/ipc/shm.c
+index 02ecf2c..854ab58 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -870,9 +870,7 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
+ case SHM_LOCK:
+ case SHM_UNLOCK:
+ {
+- struct file *uninitialized_var(shm_file);
+-
+- lru_add_drain_all(); /* drain pagevecs to lru lists */
++ struct file *shm_file;
+
+ shp = shm_lock_check(ns, shmid);
+ if (IS_ERR(shp)) {
+@@ -895,22 +893,31 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
+ err = security_shm_shmctl(shp, cmd);
+ if (err)
+ goto out_unlock;
+-
+- if(cmd==SHM_LOCK) {
++
++ shm_file = shp->shm_file;
++ if (is_file_hugepages(shm_file))
++ goto out_unlock;
++
++ if (cmd == SHM_LOCK) {
+ struct user_struct *user = current_user();
+- if (!is_file_hugepages(shp->shm_file)) {
+- err = shmem_lock(shp->shm_file, 1, user);
+- if (!err && !(shp->shm_perm.mode & SHM_LOCKED)){
+- shp->shm_perm.mode |= SHM_LOCKED;
+- shp->mlock_user = user;
+- }
++ err = shmem_lock(shm_file, 1, user);
++ if (!err && !(shp->shm_perm.mode & SHM_LOCKED)) {
++ shp->shm_perm.mode |= SHM_LOCKED;
++ shp->mlock_user = user;
+ }
+- } else if (!is_file_hugepages(shp->shm_file)) {
+- shmem_lock(shp->shm_file, 0, shp->mlock_user);
+- shp->shm_perm.mode &= ~SHM_LOCKED;
+- shp->mlock_user = NULL;
++ goto out_unlock;
+ }
++
++ /* SHM_UNLOCK */
++ if (!(shp->shm_perm.mode & SHM_LOCKED))
++ goto out_unlock;
++ shmem_lock(shm_file, 0, shp->mlock_user);
++ shp->shm_perm.mode &= ~SHM_LOCKED;
++ shp->mlock_user = NULL;
++ get_file(shm_file);
+ shm_unlock(shp);
++ scan_mapping_unevictable_pages(shm_file->f_mapping);
++ fput(shm_file);
+ goto out;
+ }
+ case IPC_RMID:
+diff --git a/mm/shmem.c b/mm/shmem.c
+index d672250..cc6d40b2 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1068,13 +1068,6 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
+ user_shm_unlock(inode->i_size, user);
+ info->flags &= ~VM_LOCKED;
+ mapping_clear_unevictable(file->f_mapping);
+- /*
+- * Ensure that a racing putback_lru_page() can see
+- * the pages of this mapping are evictable when we
+- * skip them due to !PageLRU during the scan.
+- */
+- smp_mb__after_clear_bit();
+- scan_mapping_unevictable_pages(file->f_mapping);
+ }
+ retval = 0;
+
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index f54a05b..824676a 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3353,6 +3353,7 @@ int page_evictable(struct page *page, struct vm_area_struct *vma)
+ return 1;
+ }
+
++#ifdef CONFIG_SHMEM
+ /**
+ * check_move_unevictable_page - check page for evictability and move to appropriate zone lru list
+ * @page: page to check evictability and move to appropriate lru list
+@@ -3363,6 +3364,8 @@ int page_evictable(struct page *page, struct vm_area_struct *vma)
+ *
+ * Restrictions: zone->lru_lock must be held, page must be on LRU and must
+ * have PageUnevictable set.
++ *
++ * This function is only used for SysV IPC SHM_UNLOCK.
+ */
+ static void check_move_unevictable_page(struct page *page, struct zone *zone)
+ {
+@@ -3396,6 +3399,8 @@ retry:
+ *
+ * Scan all pages in mapping. Check unevictable pages for
+ * evictability and move them to the appropriate zone lru list.
++ *
++ * This function is only used for SysV IPC SHM_UNLOCK.
+ */
+ void scan_mapping_unevictable_pages(struct address_space *mapping)
+ {
+@@ -3441,9 +3446,14 @@ void scan_mapping_unevictable_pages(struct address_space *mapping)
+ pagevec_release(&pvec);
+
+ count_vm_events(UNEVICTABLE_PGSCANNED, pg_scanned);
++ cond_resched();
+ }
+-
+ }
++#else
++void scan_mapping_unevictable_pages(struct address_space *mapping)
++{
++}
++#endif /* CONFIG_SHMEM */
+
+ static void warn_scan_unevictable_pages(void)
+ {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch
new file mode 100644
index 0000000..bc38964
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch
@@ -0,0 +1,342 @@
+From 0a86d03f1b440a70e86f9ba390c1a1240d963927 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Fri, 20 Jan 2012 14:34:21 -0800
+Subject: [PATCH 129/130] SHM_UNLOCK: fix Unevictable pages stranded after
+ swap
+
+commit 245132643e1cfcd145bbc86a716c1818371fcb93 upstream.
+
+Commit cc39c6a9bbde ("mm: account skipped entries to avoid looping in
+find_get_pages") correctly fixed an infinite loop; but left a problem
+that find_get_pages() on shmem would return 0 (appearing to callers to
+mean end of tree) when it meets a run of nr_pages swap entries.
+
+The only uses of find_get_pages() on shmem are via pagevec_lookup(),
+called from invalidate_mapping_pages(), and from shmctl SHM_UNLOCK's
+scan_mapping_unevictable_pages(). The first is already commented, and
+not worth worrying about; but the second can leave pages on the
+Unevictable list after an unusual sequence of swapping and locking.
+
+Fix that by using shmem_find_get_pages_and_swap() (then ignoring the
+swap) instead of pagevec_lookup().
+
+But I don't want to contaminate vmscan.c with shmem internals, nor
+shmem.c with LRU locking. So move scan_mapping_unevictable_pages() into
+shmem.c, renaming it shmem_unlock_mapping(); and rename
+check_move_unevictable_page() to check_move_unevictable_pages(), looping
+down an array of pages, oftentimes under the same lock.
+
+Leave out the "rotate unevictable list" block: that's a leftover from
+when this was used for /proc/sys/vm/scan_unevictable_pages, whose flawed
+handling involved looking at pages at tail of LRU.
+
+Was there significance to the sequence first ClearPageUnevictable, then
+test page_evictable, then SetPageUnevictable here? I think not, we're
+under LRU lock, and have no barriers between those.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Minchan Kim <minchan.kim@gmail.com>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Shaohua Li <shaohua.li@intel.com>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michel Lespinasse <walken@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/linux/shmem_fs.h | 1 +
+ include/linux/swap.h | 2 +-
+ ipc/shm.c | 2 +-
+ mm/shmem.c | 46 +++++++++++++++--
+ mm/vmscan.c | 122 ++++++++++++++--------------------------------
+ 5 files changed, 81 insertions(+), 92 deletions(-)
+
+diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
+index 9291ac3..6f10c9c 100644
+--- a/include/linux/shmem_fs.h
++++ b/include/linux/shmem_fs.h
+@@ -48,6 +48,7 @@ extern struct file *shmem_file_setup(const char *name,
+ loff_t size, unsigned long flags);
+ extern int shmem_zero_setup(struct vm_area_struct *);
+ extern int shmem_lock(struct file *file, int lock, struct user_struct *user);
++extern void shmem_unlock_mapping(struct address_space *mapping);
+ extern struct page *shmem_read_mapping_page_gfp(struct address_space *mapping,
+ pgoff_t index, gfp_t gfp_mask);
+ extern void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end);
+diff --git a/include/linux/swap.h b/include/linux/swap.h
+index 1e22e12..67b3fa3 100644
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -272,7 +272,7 @@ static inline int zone_reclaim(struct zone *z, gfp_t mask, unsigned int order)
+ #endif
+
+ extern int page_evictable(struct page *page, struct vm_area_struct *vma);
+-extern void scan_mapping_unevictable_pages(struct address_space *);
++extern void check_move_unevictable_pages(struct page **, int nr_pages);
+
+ extern unsigned long scan_unevictable_pages;
+ extern int scan_unevictable_handler(struct ctl_table *, int,
+diff --git a/ipc/shm.c b/ipc/shm.c
+index 854ab58..b76be5b 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -916,7 +916,7 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
+ shp->mlock_user = NULL;
+ get_file(shm_file);
+ shm_unlock(shp);
+- scan_mapping_unevictable_pages(shm_file->f_mapping);
++ shmem_unlock_mapping(shm_file->f_mapping);
+ fput(shm_file);
+ goto out;
+ }
+diff --git a/mm/shmem.c b/mm/shmem.c
+index cc6d40b2..6c253f7 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -379,7 +379,7 @@ static int shmem_free_swap(struct address_space *mapping,
+ /*
+ * Pagevec may contain swap entries, so shuffle up pages before releasing.
+ */
+-static void shmem_pagevec_release(struct pagevec *pvec)
++static void shmem_deswap_pagevec(struct pagevec *pvec)
+ {
+ int i, j;
+
+@@ -389,7 +389,36 @@ static void shmem_pagevec_release(struct pagevec *pvec)
+ pvec->pages[j++] = page;
+ }
+ pvec->nr = j;
+- pagevec_release(pvec);
++}
++
++/*
++ * SysV IPC SHM_UNLOCK restore Unevictable pages to their evictable lists.
++ */
++void shmem_unlock_mapping(struct address_space *mapping)
++{
++ struct pagevec pvec;
++ pgoff_t indices[PAGEVEC_SIZE];
++ pgoff_t index = 0;
++
++ pagevec_init(&pvec, 0);
++ /*
++ * Minor point, but we might as well stop if someone else SHM_LOCKs it.
++ */
++ while (!mapping_unevictable(mapping)) {
++ /*
++ * Avoid pagevec_lookup(): find_get_pages() returns 0 as if it
++ * has finished, if it hits a row of PAGEVEC_SIZE swap entries.
++ */
++ pvec.nr = shmem_find_get_pages_and_swap(mapping, index,
++ PAGEVEC_SIZE, pvec.pages, indices);
++ if (!pvec.nr)
++ break;
++ index = indices[pvec.nr - 1] + 1;
++ shmem_deswap_pagevec(&pvec);
++ check_move_unevictable_pages(pvec.pages, pvec.nr);
++ pagevec_release(&pvec);
++ cond_resched();
++ }
+ }
+
+ /*
+@@ -440,7 +469,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ }
+ unlock_page(page);
+ }
+- shmem_pagevec_release(&pvec);
++ shmem_deswap_pagevec(&pvec);
++ pagevec_release(&pvec);
+ mem_cgroup_uncharge_end();
+ cond_resched();
+ index++;
+@@ -470,7 +500,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ continue;
+ }
+ if (index == start && indices[0] > end) {
+- shmem_pagevec_release(&pvec);
++ shmem_deswap_pagevec(&pvec);
++ pagevec_release(&pvec);
+ break;
+ }
+ mem_cgroup_uncharge_start();
+@@ -494,7 +525,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ }
+ unlock_page(page);
+ }
+- shmem_pagevec_release(&pvec);
++ shmem_deswap_pagevec(&pvec);
++ pagevec_release(&pvec);
+ mem_cgroup_uncharge_end();
+ index++;
+ }
+@@ -2439,6 +2471,10 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
+ return 0;
+ }
+
++void shmem_unlock_mapping(struct address_space *mapping)
++{
++}
++
+ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ {
+ truncate_inode_pages_range(inode->i_mapping, lstart, lend);
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 824676a..cb33d9c 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -636,7 +636,7 @@ redo:
+ * When racing with an mlock or AS_UNEVICTABLE clearing
+ * (page is unlocked) make sure that if the other thread
+ * does not observe our setting of PG_lru and fails
+- * isolation/check_move_unevictable_page,
++ * isolation/check_move_unevictable_pages,
+ * we see PG_mlocked/AS_UNEVICTABLE cleared below and move
+ * the page back to the evictable list.
+ *
+@@ -3355,104 +3355,56 @@ int page_evictable(struct page *page, struct vm_area_struct *vma)
+
+ #ifdef CONFIG_SHMEM
+ /**
+- * check_move_unevictable_page - check page for evictability and move to appropriate zone lru list
+- * @page: page to check evictability and move to appropriate lru list
+- * @zone: zone page is in
++ * check_move_unevictable_pages - check pages for evictability and move to appropriate zone lru list
++ * @pages: array of pages to check
++ * @nr_pages: number of pages to check
+ *
+- * Checks a page for evictability and moves the page to the appropriate
+- * zone lru list.
+- *
+- * Restrictions: zone->lru_lock must be held, page must be on LRU and must
+- * have PageUnevictable set.
++ * Checks pages for evictability and moves them to the appropriate lru list.
+ *
+ * This function is only used for SysV IPC SHM_UNLOCK.
+ */
+-static void check_move_unevictable_page(struct page *page, struct zone *zone)
++void check_move_unevictable_pages(struct page **pages, int nr_pages)
+ {
+- VM_BUG_ON(PageActive(page));
++ struct zone *zone = NULL;
++ int pgscanned = 0;
++ int pgrescued = 0;
++ int i;
+
+-retry:
+- ClearPageUnevictable(page);
+- if (page_evictable(page, NULL)) {
+- enum lru_list l = page_lru_base_type(page);
++ for (i = 0; i < nr_pages; i++) {
++ struct page *page = pages[i];
++ struct zone *pagezone;
+
+- __dec_zone_state(zone, NR_UNEVICTABLE);
+- list_move(&page->lru, &zone->lru[l].list);
+- mem_cgroup_move_lists(page, LRU_UNEVICTABLE, l);
+- __inc_zone_state(zone, NR_INACTIVE_ANON + l);
+- __count_vm_event(UNEVICTABLE_PGRESCUED);
+- } else {
+- /*
+- * rotate unevictable list
+- */
+- SetPageUnevictable(page);
+- list_move(&page->lru, &zone->lru[LRU_UNEVICTABLE].list);
+- mem_cgroup_rotate_lru_list(page, LRU_UNEVICTABLE);
+- if (page_evictable(page, NULL))
+- goto retry;
+- }
+-}
+-
+-/**
+- * scan_mapping_unevictable_pages - scan an address space for evictable pages
+- * @mapping: struct address_space to scan for evictable pages
+- *
+- * Scan all pages in mapping. Check unevictable pages for
+- * evictability and move them to the appropriate zone lru list.
+- *
+- * This function is only used for SysV IPC SHM_UNLOCK.
+- */
+-void scan_mapping_unevictable_pages(struct address_space *mapping)
+-{
+- pgoff_t next = 0;
+- pgoff_t end = (i_size_read(mapping->host) + PAGE_CACHE_SIZE - 1) >>
+- PAGE_CACHE_SHIFT;
+- struct zone *zone;
+- struct pagevec pvec;
++ pgscanned++;
++ pagezone = page_zone(page);
++ if (pagezone != zone) {
++ if (zone)
++ spin_unlock_irq(&zone->lru_lock);
++ zone = pagezone;
++ spin_lock_irq(&zone->lru_lock);
++ }
+
+- if (mapping->nrpages == 0)
+- return;
++ if (!PageLRU(page) || !PageUnevictable(page))
++ continue;
+
+- pagevec_init(&pvec, 0);
+- while (next < end &&
+- pagevec_lookup(&pvec, mapping, next, PAGEVEC_SIZE)) {
+- int i;
+- int pg_scanned = 0;
+-
+- zone = NULL;
+-
+- for (i = 0; i < pagevec_count(&pvec); i++) {
+- struct page *page = pvec.pages[i];
+- pgoff_t page_index = page->index;
+- struct zone *pagezone = page_zone(page);
+-
+- pg_scanned++;
+- if (page_index > next)
+- next = page_index;
+- next++;
+-
+- if (pagezone != zone) {
+- if (zone)
+- spin_unlock_irq(&zone->lru_lock);
+- zone = pagezone;
+- spin_lock_irq(&zone->lru_lock);
+- }
++ if (page_evictable(page, NULL)) {
++ enum lru_list lru = page_lru_base_type(page);
+
+- if (PageLRU(page) && PageUnevictable(page))
+- check_move_unevictable_page(page, zone);
++ VM_BUG_ON(PageActive(page));
++ ClearPageUnevictable(page);
++ __dec_zone_state(zone, NR_UNEVICTABLE);
++ list_move(&page->lru, &zone->lru[lru].list);
++ mem_cgroup_move_lists(page, LRU_UNEVICTABLE, lru);
++ __inc_zone_state(zone, NR_INACTIVE_ANON + lru);
++ pgrescued++;
+ }
+- if (zone)
+- spin_unlock_irq(&zone->lru_lock);
+- pagevec_release(&pvec);
++ }
+
+- count_vm_events(UNEVICTABLE_PGSCANNED, pg_scanned);
+- cond_resched();
++ if (zone) {
++ __count_vm_events(UNEVICTABLE_PGRESCUED, pgrescued);
++ __count_vm_events(UNEVICTABLE_PGSCANNED, pgscanned);
++ spin_unlock_irq(&zone->lru_lock);
+ }
+ }
+-#else
+-void scan_mapping_unevictable_pages(struct address_space *mapping)
+-{
+-}
+ #endif /* CONFIG_SHMEM */
+
+ static void warn_scan_unevictable_pages(void)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0130-Linux-3.2.2.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0130-Linux-3.2.2.patch
new file mode 100644
index 0000000..3a8e28a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.2/0130-Linux-3.2.2.patch
@@ -0,0 +1,24 @@
+From ba50be5b9e68e504f1cb2c3042ee64b9c14a2aa9 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Wed, 25 Jan 2012 16:39:32 -0800
+Subject: [PATCH 130/130] Linux 3.2.2
+
+---
+ Makefile | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index c5edffa..2f684da 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 1
++SUBLEVEL = 2
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch
new file mode 100644
index 0000000..910b347
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch
@@ -0,0 +1,62 @@
+From f0cf0a9c9ff7883ccebb09e7b84000f1c3f8a9b6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 23 Jan 2012 17:10:24 +0100
+Subject: [PATCH 01/90] ALSA: hda - Fix buffer-alignment regression with
+ Nvidia HDMI
+
+commit 52409aa6a0e96337da137c069856298f4dd825a0 upstream.
+
+The commit 2ae66c26550cd94b0e2606a9275eb0ab7070ad0e
+ ALSA: hda: option to enable arbitrary buffer/period sizes
+introduced a regression on machines with Intel controller and Nvidia
+HDMI. The reason is that the driver modifies the global variable
+align_buffer_size when an Intel controller is found, and the Nvidia
+HDMI controller is probed after Intel although Nvidia chips require
+the aligned buffers.
+
+This patch fixes the problem by moving the flag into the local struct
+so that it's not affected by other controllers.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42567
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/hda_intel.c | 6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 5b2b75b..192e6c0 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -461,6 +461,7 @@ struct azx {
+ unsigned int irq_pending_warned :1;
+ unsigned int probing :1; /* codec probing phase */
+ unsigned int snoop:1;
++ unsigned int align_buffer_size:1;
+
+ /* for debugging */
+ unsigned int last_cmd[AZX_MAX_CODECS];
+@@ -1697,7 +1698,7 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
+ runtime->hw.rates = hinfo->rates;
+ snd_pcm_limit_hw_rates(runtime);
+ snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS);
+- if (align_buffer_size)
++ if (chip->align_buffer_size)
+ /* constrain buffer sizes to be multiple of 128
+ bytes. This is more efficient in terms of memory
+ access but isn't required by the HDA spec and
+@@ -2753,8 +2754,9 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
+ }
+
+ /* disable buffer size rounding to 128-byte multiples if supported */
++ chip->align_buffer_size = align_buffer_size;
+ if (chip->driver_caps & AZX_DCAPS_BUFSIZE)
+- align_buffer_size = 0;
++ chip->align_buffer_size = 0;
+
+ /* allow 64bit DMA address if supported by H/W */
+ if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch
new file mode 100644
index 0000000..cdffe06
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch
@@ -0,0 +1,64 @@
+From b7b74418ff425c3ae197317ae839ff692b36bc44 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 23 Jan 2012 18:23:36 +0100
+Subject: [PATCH 02/90] ALSA: hda - Fix silent outputs from docking-station
+ jacks of Dell laptops
+
+commit b4ead019afc201f71c39cd0dfcaafed4a97b3dd2 upstream.
+
+The recent change of the power-widget handling for IDT codecs caused
+the silent output from the docking-station line-out jack. This was
+partially fixed by the commit f2cbba7602383cd9cdd21f0a5d0b8bd1aad47b33
+"ALSA: hda - Fix the lost power-setup of seconary pins after PM resume".
+But the line-out on the docking-station is still silent when booted
+with the jack plugged even by this fix.
+
+The remainig bug is that the power-widget is set off in stac92xx_init()
+because the pins in cfg->line_out_pins[] aren't checked there properly
+but only hp_pins[] are checked in is_nid_hp_pin().
+
+This patch fixes the problem by checking both HP and line-out pins
+and leaving the power-map correctly.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42637
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_sigmatel.c | 8 +++++---
+ 1 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index f3c73a9..2141cab 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4253,13 +4253,15 @@ static int enable_pin_detect(struct hda_codec *codec, hda_nid_t nid,
+ return 1;
+ }
+
+-static int is_nid_hp_pin(struct auto_pin_cfg *cfg, hda_nid_t nid)
++static int is_nid_out_jack_pin(struct auto_pin_cfg *cfg, hda_nid_t nid)
+ {
+ int i;
+ for (i = 0; i < cfg->hp_outs; i++)
+ if (cfg->hp_pins[i] == nid)
+ return 1; /* nid is a HP-Out */
+-
++ for (i = 0; i < cfg->line_outs; i++)
++ if (cfg->line_out_pins[i] == nid)
++ return 1; /* nid is a line-Out */
+ return 0; /* nid is not a HP-Out */
+ };
+
+@@ -4465,7 +4467,7 @@ static int stac92xx_init(struct hda_codec *codec)
+ continue;
+ }
+
+- if (is_nid_hp_pin(cfg, nid))
++ if (is_nid_out_jack_pin(cfg, nid))
+ continue; /* already has an unsol event */
+
+ pinctl = snd_hda_codec_read(codec, nid, 0,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch
new file mode 100644
index 0000000..5ce6c2c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch
@@ -0,0 +1,103 @@
+From 07750bbe6fff3f00487746556c6b4914ad3270f0 Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@canonical.com>
+Date: Thu, 12 Jan 2012 11:30:44 +0100
+Subject: [PATCH 03/90] eCryptfs: Sanitize write counts of /dev/ecryptfs
+
+commit db10e556518eb9d21ee92ff944530d84349684f4 upstream.
+
+A malicious count value specified when writing to /dev/ecryptfs may
+result in a a very large kernel memory allocation.
+
+This patch peeks at the specified packet payload size, adds that to the
+size of the packet headers and compares the result with the write count
+value. The resulting maximum memory allocation size is approximately 532
+bytes.
+
+Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
+Reported-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ecryptfs/miscdev.c | 56 +++++++++++++++++++++++++++++++++---------------
+ 1 files changed, 38 insertions(+), 18 deletions(-)
+
+diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
+index 940a82e..0dc5a3d 100644
+--- a/fs/ecryptfs/miscdev.c
++++ b/fs/ecryptfs/miscdev.c
+@@ -409,11 +409,47 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
+ ssize_t sz = 0;
+ char *data;
+ uid_t euid = current_euid();
++ unsigned char packet_size_peek[3];
+ int rc;
+
+- if (count == 0)
++ if (count == 0) {
+ goto out;
++ } else if (count == (1 + 4)) {
++ /* Likely a harmless MSG_HELO or MSG_QUIT - no packet length */
++ goto memdup;
++ } else if (count < (1 + 4 + 1)
++ || count > (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
++ + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES)) {
++ printk(KERN_WARNING "%s: Acceptable packet size range is "
++ "[%d-%lu], but amount of data written is [%zu].",
++ __func__, (1 + 4 + 1),
++ (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
++ + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES), count);
++ return -EINVAL;
++ }
++
++ if (copy_from_user(packet_size_peek, (buf + 1 + 4),
++ sizeof(packet_size_peek))) {
++ printk(KERN_WARNING "%s: Error while inspecting packet size\n",
++ __func__);
++ return -EFAULT;
++ }
++
++ rc = ecryptfs_parse_packet_length(packet_size_peek, &packet_size,
++ &packet_size_length);
++ if (rc) {
++ printk(KERN_WARNING "%s: Error parsing packet length; "
++ "rc = [%d]\n", __func__, rc);
++ return rc;
++ }
++
++ if ((1 + 4 + packet_size_length + packet_size) != count) {
++ printk(KERN_WARNING "%s: Invalid packet size [%zu]\n", __func__,
++ packet_size);
++ return -EINVAL;
++ }
+
++memdup:
+ data = memdup_user(buf, count);
+ if (IS_ERR(data)) {
+ printk(KERN_ERR "%s: memdup_user returned error [%ld]\n",
+@@ -435,23 +471,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
+ }
+ memcpy(&counter_nbo, &data[i], 4);
+ seq = be32_to_cpu(counter_nbo);
+- i += 4;
+- rc = ecryptfs_parse_packet_length(&data[i], &packet_size,
+- &packet_size_length);
+- if (rc) {
+- printk(KERN_WARNING "%s: Error parsing packet length; "
+- "rc = [%d]\n", __func__, rc);
+- goto out_free;
+- }
+- i += packet_size_length;
+- if ((1 + 4 + packet_size_length + packet_size) != count) {
+- printk(KERN_WARNING "%s: (1 + packet_size_length([%zd])"
+- " + packet_size([%zd]))([%zd]) != "
+- "count([%zd]). Invalid packet format.\n",
+- __func__, packet_size_length, packet_size,
+- (1 + packet_size_length + packet_size), count);
+- goto out_free;
+- }
++ i += 4 + packet_size_length;
+ rc = ecryptfs_miscdev_response(&data[i], packet_size,
+ euid, current_user_ns(),
+ task_pid(current), seq);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch
new file mode 100644
index 0000000..edb48da
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch
@@ -0,0 +1,58 @@
+From f5b95f7b4ba8b33f149c045528a030c9e43be2d1 Mon Sep 17 00:00:00 2001
+From: Tim Gardner <tim.gardner@canonical.com>
+Date: Thu, 12 Jan 2012 16:31:55 +0100
+Subject: [PATCH 04/90] ecryptfs: Improve metadata read failure logging
+
+commit 30373dc0c87ffef68d5628e77d56ffb1fa22e1ee upstream.
+
+Print inode on metadata read failure. The only real
+way of dealing with metadata read failures is to delete
+the underlying file system file. Having the inode
+allows one to 'find . -inum INODE`.
+
+[tyhicks@canonical.com: Removed some minor not-for-stable parts]
+Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ecryptfs/crypto.c | 9 ++++++---
+ 1 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index 2a83425..2bf5203 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -1620,7 +1620,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
+ rc = ecryptfs_read_xattr_region(page_virt, ecryptfs_inode);
+ if (rc) {
+ printk(KERN_DEBUG "Valid eCryptfs headers not found in "
+- "file header region or xattr region\n");
++ "file header region or xattr region, inode %lu\n",
++ ecryptfs_inode->i_ino);
+ rc = -EINVAL;
+ goto out;
+ }
+@@ -1629,7 +1630,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
+ ECRYPTFS_DONT_VALIDATE_HEADER_SIZE);
+ if (rc) {
+ printk(KERN_DEBUG "Valid eCryptfs headers not found in "
+- "file xattr region either\n");
++ "file xattr region either, inode %lu\n",
++ ecryptfs_inode->i_ino);
+ rc = -EINVAL;
+ }
+ if (crypt_stat->mount_crypt_stat->flags
+@@ -1640,7 +1642,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
+ "crypto metadata only in the extended attribute "
+ "region, but eCryptfs was mounted without "
+ "xattr support enabled. eCryptfs will not treat "
+- "this like an encrypted file.\n");
++ "this like an encrypted file, inode %lu\n",
++ ecryptfs_inode->i_ino);
+ rc = -EINVAL;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch
new file mode 100644
index 0000000..aeefee1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch
@@ -0,0 +1,71 @@
+From 45320992a2d473d6e518e80ce501cc083c15a54e Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@canonical.com>
+Date: Wed, 18 Jan 2012 18:30:04 -0600
+Subject: [PATCH 05/90] eCryptfs: Make truncate path killable
+
+commit 5e6f0d769017cc49207ef56996e42363ec26c1f0 upstream.
+
+ecryptfs_write() handles the truncation of eCryptfs inodes. It grabs a
+page, zeroes out the appropriate portions, and then encrypts the page
+before writing it to the lower filesystem. It was unkillable and due to
+the lack of sparse file support could result in tying up a large portion
+of system resources, while encrypting pages of zeros, with no way for
+the truncate operation to be stopped from userspace.
+
+This patch adds the ability for ecryptfs_write() to detect a pending
+fatal signal and return as gracefully as possible. The intent is to
+leave the lower file in a useable state, while still allowing a user to
+break out of the encryption loop. If a pending fatal signal is detected,
+the eCryptfs inode size is updated to reflect the modified inode size
+and then -EINTR is returned.
+
+Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ecryptfs/read_write.c | 19 ++++++++++++++-----
+ 1 files changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
+index 3745f7c..54eb14c 100644
+--- a/fs/ecryptfs/read_write.c
++++ b/fs/ecryptfs/read_write.c
+@@ -132,6 +132,11 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
+ size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
+ size_t total_remaining_bytes = ((offset + size) - pos);
+
++ if (fatal_signal_pending(current)) {
++ rc = -EINTR;
++ break;
++ }
++
+ if (num_bytes > total_remaining_bytes)
+ num_bytes = total_remaining_bytes;
+ if (pos < offset) {
+@@ -193,15 +198,19 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
+ }
+ pos += num_bytes;
+ }
+- if ((offset + size) > ecryptfs_file_size) {
+- i_size_write(ecryptfs_inode, (offset + size));
++ if (pos > ecryptfs_file_size) {
++ i_size_write(ecryptfs_inode, pos);
+ if (crypt_stat->flags & ECRYPTFS_ENCRYPTED) {
+- rc = ecryptfs_write_inode_size_to_metadata(
++ int rc2;
++
++ rc2 = ecryptfs_write_inode_size_to_metadata(
+ ecryptfs_inode);
+- if (rc) {
++ if (rc2) {
+ printk(KERN_ERR "Problem with "
+ "ecryptfs_write_inode_size_to_metadata; "
+- "rc = [%d]\n", rc);
++ "rc = [%d]\n", rc2);
++ if (!rc)
++ rc = rc2;
+ goto out;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch
new file mode 100644
index 0000000..04f130b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch
@@ -0,0 +1,122 @@
+From 86977fde23e2c2b4915634d519565a2007b8d339 Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@canonical.com>
+Date: Thu, 19 Jan 2012 20:33:44 -0600
+Subject: [PATCH 06/90] eCryptfs: Check inode changes in setattr
+
+commit a261a03904849c3df50bd0300efb7fb3f865137d upstream.
+
+Most filesystems call inode_change_ok() very early in ->setattr(), but
+eCryptfs didn't call it at all. It allowed the lower filesystem to make
+the call in its ->setattr() function. Then, eCryptfs would copy the
+appropriate inode attributes from the lower inode to the eCryptfs inode.
+
+This patch changes that and actually calls inode_change_ok() on the
+eCryptfs inode, fairly early in ecryptfs_setattr(). Ideally, the call
+would happen earlier in ecryptfs_setattr(), but there are some possible
+inode initialization steps that must happen first.
+
+Since the call was already being made on the lower inode, the change in
+functionality should be minimal, except for the case of a file extending
+truncate call. In that case, inode_newsize_ok() was never being
+called on the eCryptfs inode. Rather than inode_newsize_ok() catching
+maximum file size errors early on, eCryptfs would encrypt zeroed pages
+and write them to the lower filesystem until the lower filesystem's
+write path caught the error in generic_write_checks(). This patch
+introduces a new function, called ecryptfs_inode_newsize_ok(), which
+checks if the new lower file size is within the appropriate limits when
+the truncate operation will be growing the lower file.
+
+In summary this change prevents eCryptfs truncate operations (and the
+resulting page encryptions), which would exceed the lower filesystem
+limits or FSIZE rlimits, from ever starting.
+
+Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
+Reviewed-by: Li Wang <liwang@nudt.edu.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ecryptfs/inode.c | 48 ++++++++++++++++++++++++++++++++++++------------
+ 1 files changed, 36 insertions(+), 12 deletions(-)
+
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index 32f90a3..d2039ca 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -841,18 +841,6 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
+ size_t num_zeros = (PAGE_CACHE_SIZE
+ - (ia->ia_size & ~PAGE_CACHE_MASK));
+
+-
+- /*
+- * XXX(truncate) this should really happen at the begginning
+- * of ->setattr. But the code is too messy to that as part
+- * of a larger patch. ecryptfs is also totally missing out
+- * on the inode_change_ok check at the beginning of
+- * ->setattr while would include this.
+- */
+- rc = inode_newsize_ok(inode, ia->ia_size);
+- if (rc)
+- goto out;
+-
+ if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
+ truncate_setsize(inode, ia->ia_size);
+ lower_ia->ia_size = ia->ia_size;
+@@ -902,6 +890,28 @@ out:
+ return rc;
+ }
+
++static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)
++{
++ struct ecryptfs_crypt_stat *crypt_stat;
++ loff_t lower_oldsize, lower_newsize;
++
++ crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
++ lower_oldsize = upper_size_to_lower_size(crypt_stat,
++ i_size_read(inode));
++ lower_newsize = upper_size_to_lower_size(crypt_stat, offset);
++ if (lower_newsize > lower_oldsize) {
++ /*
++ * The eCryptfs inode and the new *lower* size are mixed here
++ * because we may not have the lower i_mutex held and/or it may
++ * not be appropriate to call inode_newsize_ok() with inodes
++ * from other filesystems.
++ */
++ return inode_newsize_ok(inode, lower_newsize);
++ }
++
++ return 0;
++}
++
+ /**
+ * ecryptfs_truncate
+ * @dentry: The ecryptfs layer dentry
+@@ -918,6 +928,10 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
+ struct iattr lower_ia = { .ia_valid = 0 };
+ int rc;
+
++ rc = ecryptfs_inode_newsize_ok(dentry->d_inode, new_length);
++ if (rc)
++ return rc;
++
+ rc = truncate_upper(dentry, &ia, &lower_ia);
+ if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
+ struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
+@@ -997,6 +1011,16 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
+ }
+ }
+ mutex_unlock(&crypt_stat->cs_mutex);
++
++ rc = inode_change_ok(inode, ia);
++ if (rc)
++ goto out;
++ if (ia->ia_valid & ATTR_SIZE) {
++ rc = ecryptfs_inode_newsize_ok(inode, ia->ia_size);
++ if (rc)
++ goto out;
++ }
++
+ if (S_ISREG(inode->i_mode)) {
+ rc = filemap_write_and_wait(inode->i_mapping);
+ if (rc)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch
new file mode 100644
index 0000000..2125487
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch
@@ -0,0 +1,103 @@
+From ac8cdf4aded6810a3a8a331ad9fe0ffff119323a Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@canonical.com>
+Date: Tue, 24 Jan 2012 10:02:22 -0600
+Subject: [PATCH 07/90] eCryptfs: Fix oops when printing debug info in extent
+ crypto functions
+
+commit 58ded24f0fcb85bddb665baba75892f6ad0f4b8a upstream.
+
+If pages passed to the eCryptfs extent-based crypto functions are not
+mapped and the module parameter ecryptfs_verbosity=1 was specified at
+loading time, a NULL pointer dereference will occur.
+
+Note that this wouldn't happen on a production system, as you wouldn't
+pass ecryptfs_verbosity=1 on a production system. It leaks private
+information to the system logs and is for debugging only.
+
+The debugging info printed in these messages is no longer very useful
+and rather than doing a kmap() in these debugging paths, it will be
+better to simply remove the debugging paths completely.
+
+https://launchpad.net/bugs/913651
+
+Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ecryptfs/crypto.c | 40 ----------------------------------------
+ 1 files changed, 0 insertions(+), 40 deletions(-)
+
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index 2bf5203..68b19ab 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -417,17 +417,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
+ (unsigned long long)(extent_base + extent_offset), rc);
+ goto out;
+ }
+- if (unlikely(ecryptfs_verbosity > 0)) {
+- ecryptfs_printk(KERN_DEBUG, "Encrypting extent "
+- "with iv:\n");
+- ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
+- ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
+- "encryption:\n");
+- ecryptfs_dump_hex((char *)
+- (page_address(page)
+- + (extent_offset * crypt_stat->extent_size)),
+- 8);
+- }
+ rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page, 0,
+ page, (extent_offset
+ * crypt_stat->extent_size),
+@@ -440,14 +429,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
+ goto out;
+ }
+ rc = 0;
+- if (unlikely(ecryptfs_verbosity > 0)) {
+- ecryptfs_printk(KERN_DEBUG, "Encrypt extent [0x%.16llx]; "
+- "rc = [%d]\n",
+- (unsigned long long)(extent_base + extent_offset), rc);
+- ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
+- "encryption:\n");
+- ecryptfs_dump_hex((char *)(page_address(enc_extent_page)), 8);
+- }
+ out:
+ return rc;
+ }
+@@ -543,17 +524,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
+ (unsigned long long)(extent_base + extent_offset), rc);
+ goto out;
+ }
+- if (unlikely(ecryptfs_verbosity > 0)) {
+- ecryptfs_printk(KERN_DEBUG, "Decrypting extent "
+- "with iv:\n");
+- ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
+- ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
+- "decryption:\n");
+- ecryptfs_dump_hex((char *)
+- (page_address(enc_extent_page)
+- + (extent_offset * crypt_stat->extent_size)),
+- 8);
+- }
+ rc = ecryptfs_decrypt_page_offset(crypt_stat, page,
+ (extent_offset
+ * crypt_stat->extent_size),
+@@ -567,16 +537,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
+ goto out;
+ }
+ rc = 0;
+- if (unlikely(ecryptfs_verbosity > 0)) {
+- ecryptfs_printk(KERN_DEBUG, "Decrypt extent [0x%.16llx]; "
+- "rc = [%d]\n",
+- (unsigned long long)(extent_base + extent_offset), rc);
+- ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
+- "decryption:\n");
+- ecryptfs_dump_hex((char *)(page_address(page)
+- + (extent_offset
+- * crypt_stat->extent_size)), 8);
+- }
+ out:
+ return rc;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch
new file mode 100644
index 0000000..21b4761
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch
@@ -0,0 +1,38 @@
+From b838f82f8bc3ece8e4f2f8710629b4900949df28 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Sun, 15 Jan 2012 08:51:12 -0500
+Subject: [PATCH 08/90] drm/radeon/kms: Add an MSI quirk for Dell RS690
+
+commit 44517c44496062180a6376cc704b33129441ce60 upstream.
+
+Interrupts only work with MSIs.
+https://bugs.freedesktop.org/show_bug.cgi?id=37679
+
+Reported-by: Dmitry Podgorny <pasis.uax@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/radeon_irq_kms.c | 6 ++++++
+ 1 files changed, 6 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+index 8f86aeb..e7ddb49 100644
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -134,6 +134,12 @@ static bool radeon_msi_ok(struct radeon_device *rdev)
+ /* Dell RS690 only seems to work with MSIs. */
+ if ((rdev->pdev->device == 0x791f) &&
+ (rdev->pdev->subsystem_vendor == 0x1028) &&
++ (rdev->pdev->subsystem_device == 0x01fc))
++ return true;
++
++ /* Dell RS690 only seems to work with MSIs. */
++ if ((rdev->pdev->device == 0x791f) &&
++ (rdev->pdev->subsystem_vendor == 0x1028) &&
+ (rdev->pdev->subsystem_device == 0x01fd))
+ return true;
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch
new file mode 100644
index 0000000..288c4f9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch
@@ -0,0 +1,130 @@
+From 4a44e7de68c61737b17954db3cadc632db685ed6 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 20 Jan 2012 15:01:29 -0500
+Subject: [PATCH 09/90] drm/radeon/kms: move panel mode setup into encoder
+ mode set
+
+commit 386d4d751e8e0b4b693bb724f09aae064ee5297d upstream.
+
+Needs to happen earlier in the mode set.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/atombios_dp.c | 22 ++++++++++------------
+ drivers/gpu/drm/radeon/atombios_encoders.c | 11 +++++++++++
+ drivers/gpu/drm/radeon/radeon_mode.h | 3 +++
+ 3 files changed, 24 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index 6fb335a..a71557c 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -549,8 +549,8 @@ bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector)
+ return false;
+ }
+
+-static void radeon_dp_set_panel_mode(struct drm_encoder *encoder,
+- struct drm_connector *connector)
++int radeon_dp_get_panel_mode(struct drm_encoder *encoder,
++ struct drm_connector *connector)
+ {
+ struct drm_device *dev = encoder->dev;
+ struct radeon_device *rdev = dev->dev_private;
+@@ -558,7 +558,7 @@ static void radeon_dp_set_panel_mode(struct drm_encoder *encoder,
+ int panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
+
+ if (!ASIC_IS_DCE4(rdev))
+- return;
++ return panel_mode;
+
+ if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) ==
+ ENCODER_OBJECT_ID_NUTMEG)
+@@ -572,14 +572,7 @@ static void radeon_dp_set_panel_mode(struct drm_encoder *encoder,
+ panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
+ }
+
+- atombios_dig_encoder_setup(encoder,
+- ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
+- panel_mode);
+-
+- if ((connector->connector_type == DRM_MODE_CONNECTOR_eDP) &&
+- (panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)) {
+- radeon_write_dpcd_reg(radeon_connector, DP_EDP_CONFIGURATION_SET, 1);
+- }
++ return panel_mode;
+ }
+
+ void radeon_dp_set_link_config(struct drm_connector *connector,
+@@ -717,6 +710,8 @@ static void radeon_dp_set_tp(struct radeon_dp_link_train_info *dp_info, int tp)
+
+ static int radeon_dp_link_train_init(struct radeon_dp_link_train_info *dp_info)
+ {
++ struct radeon_encoder *radeon_encoder = to_radeon_encoder(dp_info->encoder);
++ struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+ u8 tmp;
+
+ /* power up the sink */
+@@ -732,7 +727,10 @@ static int radeon_dp_link_train_init(struct radeon_dp_link_train_info *dp_info)
+ radeon_write_dpcd_reg(dp_info->radeon_connector,
+ DP_DOWNSPREAD_CTRL, 0);
+
+- radeon_dp_set_panel_mode(dp_info->encoder, dp_info->connector);
++ if ((dp_info->connector->connector_type == DRM_MODE_CONNECTOR_eDP) &&
++ (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)) {
++ radeon_write_dpcd_reg(dp_info->radeon_connector, DP_EDP_CONFIGURATION_SET, 1);
++ }
+
+ /* set the lane count on the sink */
+ tmp = dp_info->dp_lane_count;
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index 39c04c1..9dcfba0 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -1822,10 +1822,21 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+ case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+ if (ASIC_IS_DCE4(rdev)) {
++ struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
++ struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
++
++ if (!connector)
++ dig->panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
++ else
++ dig->panel_mode = radeon_dp_get_panel_mode(encoder, connector);
++
+ /* disable the transmitter */
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
+ /* setup and enable the encoder */
+ atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
++ atombios_dig_encoder_setup(encoder,
++ ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
++ dig->panel_mode);
+
+ /* enable the transmitter */
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
+index 2c2e75e..8254d5a 100644
+--- a/drivers/gpu/drm/radeon/radeon_mode.h
++++ b/drivers/gpu/drm/radeon/radeon_mode.h
+@@ -362,6 +362,7 @@ struct radeon_encoder_atom_dig {
+ struct backlight_device *bl_dev;
+ int dpms_mode;
+ uint8_t backlight_level;
++ int panel_mode;
+ };
+
+ struct radeon_encoder_atom_dac {
+@@ -482,6 +483,8 @@ extern void radeon_dp_link_train(struct drm_encoder *encoder,
+ extern bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector);
+ extern u8 radeon_dp_getsinktype(struct radeon_connector *radeon_connector);
+ extern bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector);
++extern int radeon_dp_get_panel_mode(struct drm_encoder *encoder,
++ struct drm_connector *connector);
+ extern void atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mode);
+ extern void radeon_atom_encoder_init(struct radeon_device *rdev);
+ extern void atombios_dig_transmitter_setup(struct drm_encoder *encoder,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch
new file mode 100644
index 0000000..0cf4bb0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch
@@ -0,0 +1,87 @@
+From 053fc3b3f7c773c8fbd7c95887b333deddac4ab5 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 20 Jan 2012 15:01:30 -0500
+Subject: [PATCH 10/90] drm/radeon/kms: rework modeset sequence for DCE41 and
+ DCE5
+
+commit 3a47824d85eeca122895646f027dc63480994199 upstream.
+
+dig transmitter control table only has ENABLE/DISABLE actions
+on DCE4.1/DCE5.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=44955
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/atombios_encoders.c | 19 ++++++++++++-------
+ 1 files changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index 9dcfba0..0f8eb48 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -1352,7 +1352,8 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
+ switch (mode) {
+ case DRM_MODE_DPMS_ON:
+ /* some early dce3.2 boards have a bug in their transmitter control table */
+- if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730))
++ if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730) ||
++ ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev))
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+ else
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+@@ -1362,8 +1363,6 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
+ ATOM_TRANSMITTER_ACTION_POWER_ON);
+ radeon_dig_connector->edp_on = true;
+ }
+- if (ASIC_IS_DCE4(rdev))
+- atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_OFF, 0);
+ radeon_dp_link_train(encoder, connector);
+ if (ASIC_IS_DCE4(rdev))
+ atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_ON, 0);
+@@ -1374,7 +1373,10 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
+ case DRM_MODE_DPMS_STANDBY:
+ case DRM_MODE_DPMS_SUSPEND:
+ case DRM_MODE_DPMS_OFF:
+- atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
++ if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev))
++ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
++ else
++ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
+ if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
+ if (ASIC_IS_DCE4(rdev))
+ atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_OFF, 0);
+@@ -1821,7 +1823,7 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+ case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+- if (ASIC_IS_DCE4(rdev)) {
++ if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
+ struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+ struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+
+@@ -1830,13 +1832,16 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
+ else
+ dig->panel_mode = radeon_dp_get_panel_mode(encoder, connector);
+
+- /* disable the transmitter */
+- atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
+ /* setup and enable the encoder */
+ atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
+ atombios_dig_encoder_setup(encoder,
+ ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
+ dig->panel_mode);
++ } else if (ASIC_IS_DCE4(rdev)) {
++ /* disable the transmitter */
++ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
++ /* setup and enable the encoder */
++ atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
+
+ /* enable the transmitter */
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0011-drm-Fix-authentication-kernel-crash.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0011-drm-Fix-authentication-kernel-crash.patch
new file mode 100644
index 0000000..85f719e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0011-drm-Fix-authentication-kernel-crash.patch
@@ -0,0 +1,91 @@
+From eb46186bf6a5226ef40a011986bd206874a940b6 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Tue, 24 Jan 2012 18:54:21 +0100
+Subject: [PATCH 11/90] drm: Fix authentication kernel crash
+
+commit 598781d71119827b454fd75d46f84755bca6f0c6 upstream.
+
+If the master tries to authenticate a client using drm_authmagic and
+that client has already closed its drm file descriptor,
+either wilfully or because it was terminated, the
+call to drm_authmagic will dereference a stale pointer into kmalloc'ed memory
+and corrupt it.
+
+Typically this results in a hard system hang.
+
+This patch fixes that problem by removing any authentication tokens
+(struct drm_magic_entry) open for a file descriptor when that file
+descriptor is closed.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_auth.c | 6 +++++-
+ drivers/gpu/drm/drm_fops.c | 5 +++++
+ include/drm/drmP.h | 1 +
+ 3 files changed, 11 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
+index 3f46772..ba23790 100644
+--- a/drivers/gpu/drm/drm_auth.c
++++ b/drivers/gpu/drm/drm_auth.c
+@@ -101,7 +101,7 @@ static int drm_add_magic(struct drm_master *master, struct drm_file *priv,
+ * Searches and unlinks the entry in drm_device::magiclist with the magic
+ * number hash key, while holding the drm_device::struct_mutex lock.
+ */
+-static int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
++int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
+ {
+ struct drm_magic_entry *pt;
+ struct drm_hash_item *hash;
+@@ -136,6 +136,8 @@ static int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
+ * If there is a magic number in drm_file::magic then use it, otherwise
+ * searches an unique non-zero magic number and add it associating it with \p
+ * file_priv.
++ * This ioctl needs protection by the drm_global_mutex, which protects
++ * struct drm_file::magic and struct drm_magic_entry::priv.
+ */
+ int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
+ {
+@@ -173,6 +175,8 @@ int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
+ * \return zero if authentication successed, or a negative number otherwise.
+ *
+ * Checks if \p file_priv is associated with the magic number passed in \arg.
++ * This ioctl needs protection by the drm_global_mutex, which protects
++ * struct drm_file::magic and struct drm_magic_entry::priv.
+ */
+ int drm_authmagic(struct drm_device *dev, void *data,
+ struct drm_file *file_priv)
+diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
+index 4911e1d..828bf65 100644
+--- a/drivers/gpu/drm/drm_fops.c
++++ b/drivers/gpu/drm/drm_fops.c
+@@ -487,6 +487,11 @@ int drm_release(struct inode *inode, struct file *filp)
+ (long)old_encode_dev(file_priv->minor->device),
+ dev->open_count);
+
++ /* Release any auth tokens that might point to this file_priv,
++ (do that under the drm_global_mutex) */
++ if (file_priv->magic)
++ (void) drm_remove_magic(file_priv->master, file_priv->magic);
++
+ /* if the master has gone away we can't do anything with the lock */
+ if (file_priv->minor->master)
+ drm_master_release(dev, filp);
+diff --git a/include/drm/drmP.h b/include/drm/drmP.h
+index 1f9e951..bf4b2dc 100644
+--- a/include/drm/drmP.h
++++ b/include/drm/drmP.h
+@@ -1328,6 +1328,7 @@ extern int drm_getmagic(struct drm_device *dev, void *data,
+ struct drm_file *file_priv);
+ extern int drm_authmagic(struct drm_device *dev, void *data,
+ struct drm_file *file_priv);
++extern int drm_remove_magic(struct drm_master *master, drm_magic_t magic);
+
+ /* Cache management (drm_cache.c) */
+ void drm_clflush_pages(struct page *pages[], unsigned long num_pages);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch
new file mode 100644
index 0000000..87c0bce
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch
@@ -0,0 +1,38 @@
+From 2f455c0d809c7c2b9e340feb0e4db1a4a3580762 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 11 Jan 2012 18:52:10 +0000
+Subject: [PATCH 12/90] xfs: Fix missing xfs_iunlock() on error recovery path
+ in xfs_readlink()
+
+commit 9b025eb3a89e041bab6698e3858706be2385d692 upstream.
+
+Commit b52a360b forgot to call xfs_iunlock() when it detected corrupted
+symplink and bailed out. Fix it by jumping to 'out' instead of doing return.
+
+CC: Carlos Maiolino <cmaiolino@redhat.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Alex Elder <elder@kernel.org>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_vnodeops.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
+index ce9268a..ee98d0b 100644
+--- a/fs/xfs/xfs_vnodeops.c
++++ b/fs/xfs/xfs_vnodeops.c
+@@ -131,7 +131,8 @@ xfs_readlink(
+ __func__, (unsigned long long) ip->i_ino,
+ (long long) pathlen);
+ ASSERT(0);
+- return XFS_ERROR(EFSCORRUPTED);
++ error = XFS_ERROR(EFSCORRUPTED);
++ goto out;
+ }
+
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch
new file mode 100644
index 0000000..41352ce
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch
@@ -0,0 +1,32 @@
+From b65a7dc8f10d4f4636b29c0cbaa7528941ccf78c Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Wed, 18 Jan 2012 20:02:38 +0000
+Subject: [PATCH 13/90] ASoC: Mark WM5100 register map cache only when going
+ into BIAS_OFF
+
+commit e53e417331c57b9b97e3f8be870214a02c99265c upstream.
+
+Writing to the registers won't work if we do actually manage to hit a fully
+powered off state.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm5100.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
+index 42d9039..19c26d2 100644
+--- a/sound/soc/codecs/wm5100.c
++++ b/sound/soc/codecs/wm5100.c
+@@ -1404,6 +1404,7 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
+ break;
+
+ case SND_SOC_BIAS_OFF:
++ regcache_cache_only(wm5100->regmap, true);
+ if (wm5100->pdata.ldo_ena)
+ gpio_set_value_cansleep(wm5100->pdata.ldo_ena, 0);
+ regulator_bulk_disable(ARRAY_SIZE(wm5100->core_supplies),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch
new file mode 100644
index 0000000..e3fd411
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch
@@ -0,0 +1,66 @@
+From bcc1fc25bf8a5de125e92da576db7c59550e5df7 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Wed, 18 Jan 2012 19:17:06 +0000
+Subject: [PATCH 14/90] ASoC: Disable register synchronisation for low
+ frequency WM8996 SYSCLK
+
+commit fed22007113cb857e917913ce016d9b539dc3a80 upstream.
+
+With a low frequency SYSCLK and a fast I2C clock register synchronisation
+may occasionally take too long to take effect, causing I/O issues. Disable
+synchronisation in order to avoid any issues.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm8996.c | 4 ++++
+ sound/soc/codecs/wm8996.h | 4 ++++
+ 2 files changed, 8 insertions(+), 0 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8996.c b/sound/soc/codecs/wm8996.c
+index a33b04d..e2afc05 100644
+--- a/sound/soc/codecs/wm8996.c
++++ b/sound/soc/codecs/wm8996.c
+@@ -1932,6 +1932,7 @@ static int wm8996_set_sysclk(struct snd_soc_dai *dai,
+ struct wm8996_priv *wm8996 = snd_soc_codec_get_drvdata(codec);
+ int lfclk = 0;
+ int ratediv = 0;
++ int sync = WM8996_REG_SYNC;
+ int src;
+ int old;
+
+@@ -1976,6 +1977,7 @@ static int wm8996_set_sysclk(struct snd_soc_dai *dai,
+ case 32000:
+ case 32768:
+ lfclk = WM8996_LFCLK_ENA;
++ sync = 0;
+ break;
+ default:
+ dev_warn(codec->dev, "Unsupported clock rate %dHz\n",
+@@ -1989,6 +1991,8 @@ static int wm8996_set_sysclk(struct snd_soc_dai *dai,
+ WM8996_SYSCLK_SRC_MASK | WM8996_SYSCLK_DIV_MASK,
+ src << WM8996_SYSCLK_SRC_SHIFT | ratediv);
+ snd_soc_update_bits(codec, WM8996_CLOCKING_1, WM8996_LFCLK_ENA, lfclk);
++ snd_soc_update_bits(codec, WM8996_CONTROL_INTERFACE_1,
++ WM8996_REG_SYNC, sync);
+ snd_soc_update_bits(codec, WM8996_AIF_CLOCKING_1,
+ WM8996_SYSCLK_ENA, old);
+
+diff --git a/sound/soc/codecs/wm8996.h b/sound/soc/codecs/wm8996.h
+index 0fde643..de9ac3e 100644
+--- a/sound/soc/codecs/wm8996.h
++++ b/sound/soc/codecs/wm8996.h
+@@ -1567,6 +1567,10 @@ int wm8996_detect(struct snd_soc_codec *codec, struct snd_soc_jack *jack,
+ /*
+ * R257 (0x101) - Control Interface (1)
+ */
++#define WM8996_REG_SYNC 0x8000 /* REG_SYNC */
++#define WM8996_REG_SYNC_MASK 0x8000 /* REG_SYNC */
++#define WM8996_REG_SYNC_SHIFT 15 /* REG_SYNC */
++#define WM8996_REG_SYNC_WIDTH 1 /* REG_SYNC */
+ #define WM8996_AUTO_INC 0x0004 /* AUTO_INC */
+ #define WM8996_AUTO_INC_MASK 0x0004 /* AUTO_INC */
+ #define WM8996_AUTO_INC_SHIFT 2 /* AUTO_INC */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch
new file mode 100644
index 0000000..0a55c9b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch
@@ -0,0 +1,41 @@
+From 0930fd68ed08367e18eac171909efe0b6f66ea4a Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Thu, 19 Jan 2012 11:16:37 +0000
+Subject: [PATCH 15/90] ASoC: Don't go through cache when applying WM5100 rev
+ A updates
+
+commit 495174a8ffbaa0d15153d855cf206cdc46d51cf4 upstream.
+
+These are all to either uncached registers or fixes to register defaults,
+in the former case the cache won't do anything and in the latter case
+we're fixing things so the cache sync will do the right thing.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm5100.c | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
+index 19c26d2..d0beeec 100644
+--- a/sound/soc/codecs/wm5100.c
++++ b/sound/soc/codecs/wm5100.c
+@@ -1379,6 +1379,7 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
+
+ switch (wm5100->rev) {
+ case 0:
++ regcache_cache_bypass(wm5100->regmap, true);
+ snd_soc_write(codec, 0x11, 0x3);
+ snd_soc_write(codec, 0x203, 0xc);
+ snd_soc_write(codec, 0x206, 0);
+@@ -1394,6 +1395,7 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
+ snd_soc_write(codec,
+ wm5100_reva_patches[i].reg,
+ wm5100_reva_patches[i].val);
++ regcache_cache_bypass(wm5100->regmap, false);
+ break;
+ default:
+ break;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch
new file mode 100644
index 0000000..ceaf673
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch
@@ -0,0 +1,33 @@
+From b071dfcd22b8e8142129b7aa8da38c6649e9d7dc Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Sat, 21 Jan 2012 21:48:53 +0000
+Subject: [PATCH 16/90] ASoC: wm8996: Call _POST_PMU callback for CPVDD
+
+commit a14304edcd5e8323205db34b08f709feb5357e64 upstream.
+
+We should be allowing a 5ms delay after the charge pump is started in
+order to ensure it has finished ramping.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm8996.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8996.c b/sound/soc/codecs/wm8996.c
+index e2afc05..6d98a57 100644
+--- a/sound/soc/codecs/wm8996.c
++++ b/sound/soc/codecs/wm8996.c
+@@ -1049,7 +1049,8 @@ SND_SOC_DAPM_SUPPLY_S("SYSCLK", 1, WM8996_AIF_CLOCKING_1, 0, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY_S("SYSDSPCLK", 2, WM8996_CLOCKING_1, 1, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY_S("AIFCLK", 2, WM8996_CLOCKING_1, 2, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY_S("Charge Pump", 2, WM8996_CHARGE_PUMP_1, 15, 0, cp_event,
+- SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
++ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
++ SND_SOC_DAPM_POST_PMD),
+ SND_SOC_DAPM_SUPPLY("Bandgap", SND_SOC_NOPM, 0, 0, bg_event,
+ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+ SND_SOC_DAPM_SUPPLY("LDO2", WM8996_POWER_MANAGEMENT_2, 1, 0, NULL, 0),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch
new file mode 100644
index 0000000..78e2557
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch
@@ -0,0 +1,53 @@
+From 786a655cc87f51dcedae8b03d880d3b507aeffc3 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 17 Jan 2012 12:38:50 +0100
+Subject: [PATCH 17/90] brcmsmac: fix tx queue flush infinite loop
+
+commit f96b08a7e6f69c0f0a576554df3df5b1b519c479 upstream.
+
+This patch workaround live deadlock problem caused by infinite loop
+in brcms_c_wait_for_tx_completion(). I do not consider the patch as
+the proper fix, which should fix the real reason of tx queue flush
+failure, but patch helps with system lockup.
+
+Reference:
+https://bugzilla.kernel.org/show_bug.cgi?id=42576
+
+Reported-and-tested-by: Patrick <ragamuffin@datacomm.ch>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/brcm80211/brcmsmac/main.c | 10 +++++++++-
+ 1 files changed, 9 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+index 510e9bb..453f58e 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+@@ -8217,13 +8217,21 @@ int brcms_c_get_curband(struct brcms_c_info *wlc)
+
+ void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop)
+ {
++ int timeout = 20;
++
+ /* flush packet queue when requested */
+ if (drop)
+ brcmu_pktq_flush(&wlc->pkt_queue->q, false, NULL, NULL);
+
+ /* wait for queue and DMA fifos to run dry */
+- while (!pktq_empty(&wlc->pkt_queue->q) || brcms_txpktpendtot(wlc) > 0)
++ while (!pktq_empty(&wlc->pkt_queue->q) || brcms_txpktpendtot(wlc) > 0) {
+ brcms_msleep(wlc->wl, 1);
++
++ if (--timeout == 0)
++ break;
++ }
++
++ WARN_ON_ONCE(timeout == 0);
+ }
+
+ void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch
new file mode 100644
index 0000000..5d0ea85
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch
@@ -0,0 +1,111 @@
+From f9792a6e4ff3605b5821ddbca89ceb4d425a49b7 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 18 Jan 2012 14:10:25 +0100
+Subject: [PATCH 18/90] mac80211: fix work removal on deauth request
+
+commit bc4934bc61d0a11fd62c5187ff83645628f8be8b upstream.
+
+When deauth is requested while an auth or assoc
+work item is in progress, we currently delete it
+without regard for any state it might need to
+clean up. Fix it by cleaning up for those items.
+
+In the case Pontus found, the problem manifested
+itself as such:
+
+authenticate with 00:23:69:aa:dd:7b (try 1)
+authenticated
+failed to insert Dummy STA entry for the AP (error -17)
+deauthenticating from 00:23:69:aa:dd:7b by local choice (reason=2)
+
+It could also happen differently if the driver
+uses the tx_sync callback.
+
+We can't just call the ->done() method of the work
+items because that will lock up due to the locking
+in cfg80211. This fix isn't very clean, but that
+seems acceptable since I have patches pending to
+remove this code completely.
+
+Reported-by: Pontus Fuchs <pontus.fuchs@gmail.com>
+Tested-by: Pontus Fuchs <pontus.fuchs@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/mlme.c | 38 +++++++++++++++++++++++++++-----------
+ 1 files changed, 27 insertions(+), 11 deletions(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index b1b1bb3..9da8626 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2719,7 +2719,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
+ {
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+- struct ieee80211_work *wk;
+ u8 bssid[ETH_ALEN];
+ bool assoc_bss = false;
+
+@@ -2732,30 +2731,47 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
+ assoc_bss = true;
+ } else {
+ bool not_auth_yet = false;
++ struct ieee80211_work *tmp, *wk = NULL;
+
+ mutex_unlock(&ifmgd->mtx);
+
+ mutex_lock(&local->mtx);
+- list_for_each_entry(wk, &local->work_list, list) {
+- if (wk->sdata != sdata)
++ list_for_each_entry(tmp, &local->work_list, list) {
++ if (tmp->sdata != sdata)
+ continue;
+
+- if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
+- wk->type != IEEE80211_WORK_AUTH &&
+- wk->type != IEEE80211_WORK_ASSOC &&
+- wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
++ if (tmp->type != IEEE80211_WORK_DIRECT_PROBE &&
++ tmp->type != IEEE80211_WORK_AUTH &&
++ tmp->type != IEEE80211_WORK_ASSOC &&
++ tmp->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
+ continue;
+
+- if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
++ if (memcmp(req->bss->bssid, tmp->filter_ta, ETH_ALEN))
+ continue;
+
+- not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE;
+- list_del_rcu(&wk->list);
+- free_work(wk);
++ not_auth_yet = tmp->type == IEEE80211_WORK_DIRECT_PROBE;
++ list_del_rcu(&tmp->list);
++ synchronize_rcu();
++ wk = tmp;
+ break;
+ }
+ mutex_unlock(&local->mtx);
+
++ if (wk && wk->type == IEEE80211_WORK_ASSOC) {
++ /* clean up dummy sta & TX sync */
++ sta_info_destroy_addr(wk->sdata, wk->filter_ta);
++ if (wk->assoc.synced)
++ drv_finish_tx_sync(local, wk->sdata,
++ wk->filter_ta,
++ IEEE80211_TX_SYNC_ASSOC);
++ } else if (wk && wk->type == IEEE80211_WORK_AUTH) {
++ if (wk->probe_auth.synced)
++ drv_finish_tx_sync(local, wk->sdata,
++ wk->filter_ta,
++ IEEE80211_TX_SYNC_AUTH);
++ }
++ kfree(wk);
++
+ /*
+ * If somebody requests authentication and we haven't
+ * sent out an auth frame yet there's no need to send
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch
new file mode 100644
index 0000000..59836c7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch
@@ -0,0 +1,118 @@
+From f656782d935b7d59fa7bec23751e5bfb8a22d6e0 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Sat, 26 Nov 2011 00:35:39 +0100
+Subject: [PATCH 19/90] jbd: Issue cache flush after checkpointing
+
+commit 353b67d8ced4dc53281c88150ad295e24bc4b4c5 upstream.
+
+When we reach cleanup_journal_tail(), there is no guarantee that
+checkpointed buffers are on a stable storage - especially if buffers were
+written out by log_do_checkpoint(), they are likely to be only in disk's
+caches. Thus when we update journal superblock, effectively removing old
+transaction from journal, this write of superblock can get to stable storage
+before those checkpointed buffers which can result in filesystem corruption
+after a crash.
+
+A similar problem can happen if we replay the journal and wipe it before
+flushing disk's caches.
+
+Thus we must unconditionally issue a cache flush before we update journal
+superblock in these cases. The fix is slightly complicated by the fact that we
+have to get log tail before we issue cache flush but we can store it in the
+journal superblock only after the cache flush. Otherwise we risk races where
+new tail is written before appropriate cache flush is finished.
+
+I managed to reproduce the corruption using somewhat tweaked Chris Mason's
+barrier-test scheduler. Also this should fix occasional reports of 'Bit already
+freed' filesystem errors which are totally unreproducible but inspection of
+several fs images I've gathered over time points to a problem like this.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/jbd/checkpoint.c | 27 ++++++++++++++++++++++-----
+ fs/jbd/recovery.c | 4 ++++
+ 2 files changed, 26 insertions(+), 5 deletions(-)
+
+diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
+index 5d1a00a..05f0754 100644
+--- a/fs/jbd/checkpoint.c
++++ b/fs/jbd/checkpoint.c
+@@ -453,8 +453,6 @@ out:
+ *
+ * Return <0 on error, 0 on success, 1 if there was nothing to clean up.
+ *
+- * Called with the journal lock held.
+- *
+ * This is the only part of the journaling code which really needs to be
+ * aware of transaction aborts. Checkpointing involves writing to the
+ * main filesystem area rather than to the journal, so it can proceed
+@@ -472,13 +470,14 @@ int cleanup_journal_tail(journal_t *journal)
+ if (is_journal_aborted(journal))
+ return 1;
+
+- /* OK, work out the oldest transaction remaining in the log, and
++ /*
++ * OK, work out the oldest transaction remaining in the log, and
+ * the log block it starts at.
+ *
+ * If the log is now empty, we need to work out which is the
+ * next transaction ID we will write, and where it will
+- * start. */
+-
++ * start.
++ */
+ spin_lock(&journal->j_state_lock);
+ spin_lock(&journal->j_list_lock);
+ transaction = journal->j_checkpoint_transactions;
+@@ -504,7 +503,25 @@ int cleanup_journal_tail(journal_t *journal)
+ spin_unlock(&journal->j_state_lock);
+ return 1;
+ }
++ spin_unlock(&journal->j_state_lock);
++
++ /*
++ * We need to make sure that any blocks that were recently written out
++ * --- perhaps by log_do_checkpoint() --- are flushed out before we
++ * drop the transactions from the journal. It's unlikely this will be
++ * necessary, especially with an appropriately sized journal, but we
++ * need this to guarantee correctness. Fortunately
++ * cleanup_journal_tail() doesn't get called all that often.
++ */
++ if (journal->j_flags & JFS_BARRIER)
++ blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+
++ spin_lock(&journal->j_state_lock);
++ if (!tid_gt(first_tid, journal->j_tail_sequence)) {
++ spin_unlock(&journal->j_state_lock);
++ /* Someone else cleaned up journal so return 0 */
++ return 0;
++ }
+ /* OK, update the superblock to recover the freed space.
+ * Physical blocks come first: have we wrapped beyond the end of
+ * the log? */
+diff --git a/fs/jbd/recovery.c b/fs/jbd/recovery.c
+index 5b43e96..008bf06 100644
+--- a/fs/jbd/recovery.c
++++ b/fs/jbd/recovery.c
+@@ -20,6 +20,7 @@
+ #include <linux/fs.h>
+ #include <linux/jbd.h>
+ #include <linux/errno.h>
++#include <linux/blkdev.h>
+ #endif
+
+ /*
+@@ -263,6 +264,9 @@ int journal_recover(journal_t *journal)
+ err2 = sync_blockdev(journal->j_fs_dev);
+ if (!err)
+ err = err2;
++ /* Flush disk caches to get replayed data on the permanent storage */
++ if (journal->j_flags & JFS_BARRIER)
++ blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+
+ return err;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch
new file mode 100644
index 0000000..de8599a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch
@@ -0,0 +1,78 @@
+From e10bfbc1d5cea0f1fe47ae12a9ecdb83b70947e1 Mon Sep 17 00:00:00 2001
+From: Alexey Dobriyan <adobriyan@gmail.com>
+Date: Sat, 14 Jan 2012 21:27:37 +0300
+Subject: [PATCH 20/90] crypto: sha512 - make it work, undo percpu message
+ schedule
+
+commit 84e31fdb7c797a7303e0cc295cb9bc8b73fb872d upstream.
+
+commit f9e2bca6c22d75a289a349f869701214d63b5060
+aka "crypto: sha512 - Move message schedule W[80] to static percpu area"
+created global message schedule area.
+
+If sha512_update will ever be entered twice, hash will be silently
+calculated incorrectly.
+
+Probably the easiest way to notice incorrect hashes being calculated is
+to run 2 ping floods over AH with hmac(sha512):
+
+ #!/usr/sbin/setkey -f
+ flush;
+ spdflush;
+ add IP1 IP2 ah 25 -A hmac-sha512 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025;
+ add IP2 IP1 ah 52 -A hmac-sha512 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052;
+ spdadd IP1 IP2 any -P out ipsec ah/transport//require;
+ spdadd IP2 IP1 any -P in ipsec ah/transport//require;
+
+XfrmInStateProtoError will start ticking with -EBADMSG being returned
+from ah_input(). This never happens with, say, hmac(sha1).
+
+With patch applied (on BOTH sides), XfrmInStateProtoError does not tick
+with multiple bidirectional ping flood streams like it doesn't tick
+with SHA-1.
+
+After this patch sha512_transform() will start using ~750 bytes of stack on x86_64.
+This is OK for simple loads, for something more heavy, stack reduction will be done
+separatedly.
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/sha512_generic.c | 6 +-----
+ 1 files changed, 1 insertions(+), 5 deletions(-)
+
+diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
+index 9ed9f60..8b9035b 100644
+--- a/crypto/sha512_generic.c
++++ b/crypto/sha512_generic.c
+@@ -21,8 +21,6 @@
+ #include <linux/percpu.h>
+ #include <asm/byteorder.h>
+
+-static DEFINE_PER_CPU(u64[80], msg_schedule);
+-
+ static inline u64 Ch(u64 x, u64 y, u64 z)
+ {
+ return z ^ (x & (y ^ z));
+@@ -89,7 +87,7 @@ sha512_transform(u64 *state, const u8 *input)
+ u64 a, b, c, d, e, f, g, h, t1, t2;
+
+ int i;
+- u64 *W = get_cpu_var(msg_schedule);
++ u64 W[80];
+
+ /* load the input */
+ for (i = 0; i < 16; i++)
+@@ -128,8 +126,6 @@ sha512_transform(u64 *state, const u8 *input)
+
+ /* erase our data */
+ a = b = c = d = e = f = g = h = t1 = t2 = 0;
+- memset(W, 0, sizeof(__get_cpu_var(msg_schedule)));
+- put_cpu_var(msg_schedule);
+ }
+
+ static int
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch
new file mode 100644
index 0000000..720c3e1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch
@@ -0,0 +1,129 @@
+From fed2a3f1c1ae549460ec39ba6492854e066c83d0 Mon Sep 17 00:00:00 2001
+From: Alexey Dobriyan <adobriyan@gmail.com>
+Date: Sat, 14 Jan 2012 21:40:57 +0300
+Subject: [PATCH 21/90] crypto: sha512 - reduce stack usage to safe number
+
+commit 51fc6dc8f948047364f7d42a4ed89b416c6cc0a3 upstream.
+
+For rounds 16--79, W[i] only depends on W[i - 2], W[i - 7], W[i - 15] and W[i - 16].
+Consequently, keeping all W[80] array on stack is unnecessary,
+only 16 values are really needed.
+
+Using W[16] instead of W[80] greatly reduces stack usage
+(~750 bytes to ~340 bytes on x86_64).
+
+Line by line explanation:
+* BLEND_OP
+ array is "circular" now, all indexes have to be modulo 16.
+ Round number is positive, so remainder operation should be
+ without surprises.
+
+* initial full message scheduling is trimmed to first 16 values which
+ come from data block, the rest is calculated before it's needed.
+
+* original loop body is unrolled version of new SHA512_0_15 and
+ SHA512_16_79 macros, unrolling was done to not do explicit variable
+ renaming. Otherwise it's the very same code after preprocessing.
+ See sha1_transform() code which does the same trick.
+
+Patch survives in-tree crypto test and original bugreport test
+(ping flood with hmac(sha512).
+
+See FIPS 180-2 for SHA-512 definition
+http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.pdf
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/sha512_generic.c | 58 +++++++++++++++++++++++++++-------------------
+ 1 files changed, 34 insertions(+), 24 deletions(-)
+
+diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
+index 8b9035b..88f160b 100644
+--- a/crypto/sha512_generic.c
++++ b/crypto/sha512_generic.c
+@@ -78,7 +78,7 @@ static inline void LOAD_OP(int I, u64 *W, const u8 *input)
+
+ static inline void BLEND_OP(int I, u64 *W)
+ {
+- W[I] = s1(W[I-2]) + W[I-7] + s0(W[I-15]) + W[I-16];
++ W[I % 16] += s1(W[(I-2) % 16]) + W[(I-7) % 16] + s0(W[(I-15) % 16]);
+ }
+
+ static void
+@@ -87,38 +87,48 @@ sha512_transform(u64 *state, const u8 *input)
+ u64 a, b, c, d, e, f, g, h, t1, t2;
+
+ int i;
+- u64 W[80];
++ u64 W[16];
+
+ /* load the input */
+ for (i = 0; i < 16; i++)
+ LOAD_OP(i, W, input);
+
+- for (i = 16; i < 80; i++) {
+- BLEND_OP(i, W);
+- }
+-
+ /* load the state into our registers */
+ a=state[0]; b=state[1]; c=state[2]; d=state[3];
+ e=state[4]; f=state[5]; g=state[6]; h=state[7];
+
+- /* now iterate */
+- for (i=0; i<80; i+=8) {
+- t1 = h + e1(e) + Ch(e,f,g) + sha512_K[i ] + W[i ];
+- t2 = e0(a) + Maj(a,b,c); d+=t1; h=t1+t2;
+- t1 = g + e1(d) + Ch(d,e,f) + sha512_K[i+1] + W[i+1];
+- t2 = e0(h) + Maj(h,a,b); c+=t1; g=t1+t2;
+- t1 = f + e1(c) + Ch(c,d,e) + sha512_K[i+2] + W[i+2];
+- t2 = e0(g) + Maj(g,h,a); b+=t1; f=t1+t2;
+- t1 = e + e1(b) + Ch(b,c,d) + sha512_K[i+3] + W[i+3];
+- t2 = e0(f) + Maj(f,g,h); a+=t1; e=t1+t2;
+- t1 = d + e1(a) + Ch(a,b,c) + sha512_K[i+4] + W[i+4];
+- t2 = e0(e) + Maj(e,f,g); h+=t1; d=t1+t2;
+- t1 = c + e1(h) + Ch(h,a,b) + sha512_K[i+5] + W[i+5];
+- t2 = e0(d) + Maj(d,e,f); g+=t1; c=t1+t2;
+- t1 = b + e1(g) + Ch(g,h,a) + sha512_K[i+6] + W[i+6];
+- t2 = e0(c) + Maj(c,d,e); f+=t1; b=t1+t2;
+- t1 = a + e1(f) + Ch(f,g,h) + sha512_K[i+7] + W[i+7];
+- t2 = e0(b) + Maj(b,c,d); e+=t1; a=t1+t2;
++#define SHA512_0_15(i, a, b, c, d, e, f, g, h) \
++ t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[i]; \
++ t2 = e0(a) + Maj(a, b, c); \
++ d += t1; \
++ h = t1 + t2
++
++#define SHA512_16_79(i, a, b, c, d, e, f, g, h) \
++ BLEND_OP(i, W); \
++ t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[(i)%16]; \
++ t2 = e0(a) + Maj(a, b, c); \
++ d += t1; \
++ h = t1 + t2
++
++ for (i = 0; i < 16; i += 8) {
++ SHA512_0_15(i, a, b, c, d, e, f, g, h);
++ SHA512_0_15(i + 1, h, a, b, c, d, e, f, g);
++ SHA512_0_15(i + 2, g, h, a, b, c, d, e, f);
++ SHA512_0_15(i + 3, f, g, h, a, b, c, d, e);
++ SHA512_0_15(i + 4, e, f, g, h, a, b, c, d);
++ SHA512_0_15(i + 5, d, e, f, g, h, a, b, c);
++ SHA512_0_15(i + 6, c, d, e, f, g, h, a, b);
++ SHA512_0_15(i + 7, b, c, d, e, f, g, h, a);
++ }
++ for (i = 16; i < 80; i += 8) {
++ SHA512_16_79(i, a, b, c, d, e, f, g, h);
++ SHA512_16_79(i + 1, h, a, b, c, d, e, f, g);
++ SHA512_16_79(i + 2, g, h, a, b, c, d, e, f);
++ SHA512_16_79(i + 3, f, g, h, a, b, c, d, e);
++ SHA512_16_79(i + 4, e, f, g, h, a, b, c, d);
++ SHA512_16_79(i + 5, d, e, f, g, h, a, b, c);
++ SHA512_16_79(i + 6, c, d, e, f, g, h, a, b);
++ SHA512_16_79(i + 7, b, c, d, e, f, g, h, a);
+ }
+
+ state[0] += a; state[1] += b; state[2] += c; state[3] += d;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch
new file mode 100644
index 0000000..bfdde80
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch
@@ -0,0 +1,37 @@
+From fcbca854dc362b6a14769b89638cda8b0bee8144 Mon Sep 17 00:00:00 2001
+From: Stefan Berger <stefanb@linux.vnet.ibm.com>
+Date: Fri, 11 Nov 2011 12:57:06 -0500
+Subject: [PATCH 22/90] tpm_tis: add delay after aborting command
+
+commit a927b8131794ee449b7f6666e7ab61301949b20f upstream.
+
+This patch adds a delay after aborting a command. Some TPMs need
+this and will not process the subsequent command correctly otherwise.
+
+It's worth noting that a TPM randomly failing to process a command,
+maps to randomly failing suspend/resume operations.
+
+Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
+Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/tpm/tpm_tis.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index 3f4051a..c7e5282 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -432,6 +432,9 @@ static int probe_itpm(struct tpm_chip *chip)
+ out:
+ itpm = rem_itpm;
+ tpm_tis_ready(chip);
++ /* some TPMs need a break here otherwise they will not work
++ * correctly on the immediately subsequent command */
++ msleep(chip->vendor.timeout_b);
+ release_locality(chip, chip->vendor.locality, 0);
+
+ return rc;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch
new file mode 100644
index 0000000..4531752
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch
@@ -0,0 +1,58 @@
+From fc9002e18099fd51f0f120cebc4078db2a221e26 Mon Sep 17 00:00:00 2001
+From: Cliff Wickman <cpw@sgi.com>
+Date: Wed, 18 Jan 2012 09:40:47 -0600
+Subject: [PATCH 23/90] x86/uv: Fix uninitialized spinlocks
+
+commit d2ebc71d472020bc30e29afe8c4d2a85a5b41f56 upstream.
+
+Initialize two spinlocks in tlb_uv.c and also properly define/initialize
+the uv_irq_lock.
+
+The lack of explicit initialization seems to be functionally
+harmless, but it is diagnosed when these are turned on:
+
+ CONFIG_DEBUG_SPINLOCK=y
+ CONFIG_DEBUG_MUTEXES=y
+ CONFIG_DEBUG_LOCK_ALLOC=y
+ CONFIG_LOCKDEP=y
+
+Signed-off-by: Cliff Wickman <cpw@sgi.com>
+Cc: Dimitri Sivanich <sivanich@sgi.com>
+Link: http://lkml.kernel.org/r/E1RnXd1-0003wU-PM@eag09.americas.sgi.com
+[ Added the uv_irq_lock initialization fix by Dimitri Sivanich ]
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/platform/uv/tlb_uv.c | 2 ++
+ arch/x86/platform/uv/uv_irq.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
+index 9010ca7..81aee5a 100644
+--- a/arch/x86/platform/uv/tlb_uv.c
++++ b/arch/x86/platform/uv/tlb_uv.c
+@@ -1860,6 +1860,8 @@ static void __init init_per_cpu_tunables(void)
+ bcp->cong_reps = congested_reps;
+ bcp->cong_period = congested_period;
+ bcp->clocks_per_100_usec = usec_2_cycles(100);
++ spin_lock_init(&bcp->queue_lock);
++ spin_lock_init(&bcp->uvhub_lock);
+ }
+ }
+
+diff --git a/arch/x86/platform/uv/uv_irq.c b/arch/x86/platform/uv/uv_irq.c
+index 374a05d..f25c276 100644
+--- a/arch/x86/platform/uv/uv_irq.c
++++ b/arch/x86/platform/uv/uv_irq.c
+@@ -25,7 +25,7 @@ struct uv_irq_2_mmr_pnode{
+ int irq;
+ };
+
+-static spinlock_t uv_irq_lock;
++static DEFINE_SPINLOCK(uv_irq_lock);
+ static struct rb_root uv_irq_root;
+
+ static int uv_set_irq_affinity(struct irq_data *, const struct cpumask *, bool);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch
new file mode 100644
index 0000000..76fc78e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch
@@ -0,0 +1,41 @@
+From 37927d0a4d690f30ea1e9154f05d20dbace4730b Mon Sep 17 00:00:00 2001
+From: Russ Anderson <rja@sgi.com>
+Date: Wed, 18 Jan 2012 20:07:54 -0600
+Subject: [PATCH 24/90] x86/uv: Fix uv_gpa_to_soc_phys_ram() shift
+
+commit 5a51467b146ab7948d2f6812892eac120a30529c upstream.
+
+uv_gpa_to_soc_phys_ram() was inadvertently ignoring the
+shift values. This fix takes the shift into account.
+
+Signed-off-by: Russ Anderson <rja@sgi.com>
+Link: http://lkml.kernel.org/r/20120119020753.GA7228@sgi.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/uv/uv_hub.h | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/include/asm/uv/uv_hub.h b/arch/x86/include/asm/uv/uv_hub.h
+index 54a13aa..21f7385 100644
+--- a/arch/x86/include/asm/uv/uv_hub.h
++++ b/arch/x86/include/asm/uv/uv_hub.h
+@@ -318,13 +318,13 @@ uv_gpa_in_mmr_space(unsigned long gpa)
+ /* UV global physical address --> socket phys RAM */
+ static inline unsigned long uv_gpa_to_soc_phys_ram(unsigned long gpa)
+ {
+- unsigned long paddr = gpa & uv_hub_info->gpa_mask;
++ unsigned long paddr;
+ unsigned long remap_base = uv_hub_info->lowmem_remap_base;
+ unsigned long remap_top = uv_hub_info->lowmem_remap_top;
+
+ gpa = ((gpa << uv_hub_info->m_shift) >> uv_hub_info->m_shift) |
+ ((gpa >> uv_hub_info->n_lshift) << uv_hub_info->m_val);
+- gpa = gpa & uv_hub_info->gpa_mask;
++ paddr = gpa & uv_hub_info->gpa_mask;
+ if (paddr >= remap_base && paddr < remap_base + remap_top)
+ paddr -= remap_base;
+ return paddr;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch
new file mode 100644
index 0000000..e1b0211
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch
@@ -0,0 +1,75 @@
+From eed23f18d0d070bdece03565185953abb7b03252 Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Fri, 20 Jan 2012 17:44:12 +0100
+Subject: [PATCH 25/90] x86/microcode_amd: Add support for CPU family specific
+ container files
+
+commit 5b68edc91cdc972c46f76f85eded7ffddc3ff5c2 upstream.
+
+We've decided to provide CPU family specific container files
+(starting with CPU family 15h). E.g. for family 15h we have to
+load microcode_amd_fam15h.bin instead of microcode_amd.bin
+
+Rationale is that starting with family 15h patch size is larger
+than 2KB which was hard coded as maximum patch size in various
+microcode loaders (not just Linux).
+
+Container files which include patches larger than 2KB cause
+different kinds of trouble with such old patch loaders. Thus we
+have to ensure that the default container file provides only
+patches with size less than 2KB.
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Cc: Borislav Petkov <borislav.petkov@amd.com>
+Cc: <stable@kernel.org>
+Link: http://lkml.kernel.org/r/20120120164412.GD24508@alberich.amd.com
+[ documented the naming convention and tidied the code a bit. ]
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/microcode_amd.c | 24 ++++++++++++++++++++++--
+ 1 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
+index d494799..ac52c15 100644
+--- a/arch/x86/kernel/microcode_amd.c
++++ b/arch/x86/kernel/microcode_amd.c
+@@ -300,13 +300,33 @@ free_table:
+ return state;
+ }
+
++/*
++ * AMD microcode firmware naming convention, up to family 15h they are in
++ * the legacy file:
++ *
++ * amd-ucode/microcode_amd.bin
++ *
++ * This legacy file is always smaller than 2K in size.
++ *
++ * Starting at family 15h they are in family specific firmware files:
++ *
++ * amd-ucode/microcode_amd_fam15h.bin
++ * amd-ucode/microcode_amd_fam16h.bin
++ * ...
++ *
++ * These might be larger than 2K.
++ */
+ static enum ucode_state request_microcode_amd(int cpu, struct device *device)
+ {
+- const char *fw_name = "amd-ucode/microcode_amd.bin";
++ char fw_name[36] = "amd-ucode/microcode_amd.bin";
+ const struct firmware *fw;
+ enum ucode_state ret = UCODE_NFOUND;
++ struct cpuinfo_x86 *c = &cpu_data(cpu);
++
++ if (c->x86 >= 0x15)
++ snprintf(fw_name, sizeof(fw_name), "amd-ucode/microcode_amd_fam%.2xh.bin", c->x86);
+
+- if (request_firmware(&fw, fw_name, device)) {
++ if (request_firmware(&fw, (const char *)fw_name, device)) {
+ pr_err("failed to load file %s\n", fw_name);
+ goto out;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch
new file mode 100644
index 0000000..95ef043
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch
@@ -0,0 +1,172 @@
+From cf9fd8313b77cb347cc142b4127d01646ab5f4c2 Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@linux-m68k.org>
+Date: Mon, 9 Jan 2012 15:10:15 +0100
+Subject: [PATCH 26/90] m68k: Fix assembler constraint to prevent overeager
+ gcc optimisation
+
+commit 2a3535069e33d8b416f406c159ce924427315303 upstream.
+
+Passing the address of a variable as an operand to an asm statement
+doesn't mark the value of this variable as used, so gcc may optimize its
+initialisation away. Fix this by using the "m" constraint instead.
+
+Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/m68k/atari/config.c | 8 ++++----
+ arch/m68k/kernel/process_mm.c | 4 ++--
+ arch/m68k/kernel/process_no.c | 4 ++--
+ arch/m68k/kernel/traps.c | 36 +++++++++++++++++-------------------
+ arch/m68k/mm/cache.c | 6 +++---
+ 5 files changed, 28 insertions(+), 30 deletions(-)
+
+diff --git a/arch/m68k/atari/config.c b/arch/m68k/atari/config.c
+index 4203d10..c4ac15c 100644
+--- a/arch/m68k/atari/config.c
++++ b/arch/m68k/atari/config.c
+@@ -414,9 +414,9 @@ void __init config_atari(void)
+ * FDC val = 4 -> Supervisor only */
+ asm volatile ("\n"
+ " .chip 68030\n"
+- " pmove %0@,%/tt1\n"
++ " pmove %0,%/tt1\n"
+ " .chip 68k"
+- : : "a" (&tt1_val));
++ : : "m" (tt1_val));
+ } else {
+ asm volatile ("\n"
+ " .chip 68040\n"
+@@ -569,10 +569,10 @@ static void atari_reset(void)
+ : "d0");
+ } else
+ asm volatile ("\n"
+- " pmove %0@,%%tc\n"
++ " pmove %0,%%tc\n"
+ " jmp %1@"
+ : /* no outputs */
+- : "a" (&tc_val), "a" (reset_addr));
++ : "m" (tc_val), "a" (reset_addr));
+ }
+
+
+diff --git a/arch/m68k/kernel/process_mm.c b/arch/m68k/kernel/process_mm.c
+index 1bc223a..aa4ffb8 100644
+--- a/arch/m68k/kernel/process_mm.c
++++ b/arch/m68k/kernel/process_mm.c
+@@ -189,8 +189,8 @@ void flush_thread(void)
+ current->thread.fs = __USER_DS;
+ if (!FPU_IS_EMU)
+ asm volatile (".chip 68k/68881\n\t"
+- "frestore %0@\n\t"
+- ".chip 68k" : : "a" (&zero));
++ "frestore %0\n\t"
++ ".chip 68k" : : "m" (zero));
+ }
+
+ /*
+diff --git a/arch/m68k/kernel/process_no.c b/arch/m68k/kernel/process_no.c
+index 69c1803..5e1078c 100644
+--- a/arch/m68k/kernel/process_no.c
++++ b/arch/m68k/kernel/process_no.c
+@@ -163,8 +163,8 @@ void flush_thread(void)
+ #ifdef CONFIG_FPU
+ if (!FPU_IS_EMU)
+ asm volatile (".chip 68k/68881\n\t"
+- "frestore %0@\n\t"
+- ".chip 68k" : : "a" (&zero));
++ "frestore %0\n\t"
++ ".chip 68k" : : "m" (zero));
+ #endif
+ }
+
+diff --git a/arch/m68k/kernel/traps.c b/arch/m68k/kernel/traps.c
+index 89362f2..eb67469 100644
+--- a/arch/m68k/kernel/traps.c
++++ b/arch/m68k/kernel/traps.c
+@@ -552,13 +552,13 @@ static inline void bus_error030 (struct frame *fp)
+
+ #ifdef DEBUG
+ asm volatile ("ptestr %3,%2@,#7,%0\n\t"
+- "pmove %%psr,%1@"
+- : "=a&" (desc)
+- : "a" (&temp), "a" (addr), "d" (ssw));
++ "pmove %%psr,%1"
++ : "=a&" (desc), "=m" (temp)
++ : "a" (addr), "d" (ssw));
+ #else
+ asm volatile ("ptestr %2,%1@,#7\n\t"
+- "pmove %%psr,%0@"
+- : : "a" (&temp), "a" (addr), "d" (ssw));
++ "pmove %%psr,%0"
++ : "=m" (temp) : "a" (addr), "d" (ssw));
+ #endif
+ mmusr = temp;
+
+@@ -605,20 +605,18 @@ static inline void bus_error030 (struct frame *fp)
+ !(ssw & RW) ? "write" : "read", addr,
+ fp->ptregs.pc, ssw);
+ asm volatile ("ptestr #1,%1@,#0\n\t"
+- "pmove %%psr,%0@"
+- : /* no outputs */
+- : "a" (&temp), "a" (addr));
++ "pmove %%psr,%0"
++ : "=m" (temp)
++ : "a" (addr));
+ mmusr = temp;
+
+ printk ("level 0 mmusr is %#x\n", mmusr);
+ #if 0
+- asm volatile ("pmove %%tt0,%0@"
+- : /* no outputs */
+- : "a" (&tlong));
++ asm volatile ("pmove %%tt0,%0"
++ : "=m" (tlong));
+ printk("tt0 is %#lx, ", tlong);
+- asm volatile ("pmove %%tt1,%0@"
+- : /* no outputs */
+- : "a" (&tlong));
++ asm volatile ("pmove %%tt1,%0"
++ : "=m" (tlong));
+ printk("tt1 is %#lx\n", tlong);
+ #endif
+ #ifdef DEBUG
+@@ -668,13 +666,13 @@ static inline void bus_error030 (struct frame *fp)
+
+ #ifdef DEBUG
+ asm volatile ("ptestr #1,%2@,#7,%0\n\t"
+- "pmove %%psr,%1@"
+- : "=a&" (desc)
+- : "a" (&temp), "a" (addr));
++ "pmove %%psr,%1"
++ : "=a&" (desc), "=m" (temp)
++ : "a" (addr));
+ #else
+ asm volatile ("ptestr #1,%1@,#7\n\t"
+- "pmove %%psr,%0@"
+- : : "a" (&temp), "a" (addr));
++ "pmove %%psr,%0"
++ : "=m" (temp) : "a" (addr));
+ #endif
+ mmusr = temp;
+
+diff --git a/arch/m68k/mm/cache.c b/arch/m68k/mm/cache.c
+index 5437fff..5550aa4 100644
+--- a/arch/m68k/mm/cache.c
++++ b/arch/m68k/mm/cache.c
+@@ -52,9 +52,9 @@ static unsigned long virt_to_phys_slow(unsigned long vaddr)
+ unsigned long *descaddr;
+
+ asm volatile ("ptestr %3,%2@,#7,%0\n\t"
+- "pmove %%psr,%1@"
+- : "=a&" (descaddr)
+- : "a" (&mmusr), "a" (vaddr), "d" (get_fs().seg));
++ "pmove %%psr,%1"
++ : "=a&" (descaddr), "=m" (mmusr)
++ : "a" (vaddr), "d" (get_fs().seg));
+ if (mmusr & (MMU_I|MMU_B|MMU_L))
+ return 0;
+ descaddr = phys_to_virt((unsigned long)descaddr);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch
new file mode 100644
index 0000000..b3b84b6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch
@@ -0,0 +1,43 @@
+From 715f766173e7ebc2b5d2c84397cd0ed2ecd8073a Mon Sep 17 00:00:00 2001
+From: Gustavo Maciel Dias Vieira <gustavo@sagui.org>
+Date: Tue, 24 Jan 2012 13:27:56 -0200
+Subject: [PATCH 27/90] ALSA: hda: set mute led polarity for laptops with
+ buggy BIOS based on SSID
+
+commit a6a600d10aaddf1da38053c4c6b64f50f56176e6 upstream.
+
+HP laptop models with buggy BIOS are apparently frequent, including
+machines with different codecs. Set the polarity of the mute led based
+on the SSID and include an entry for the HP Mini 110-3100.
+
+Signed-off-by: Gustavo Maciel Dias Vieira <gustavo@sagui.org>
+Tested-by: Predrag Ivanovic <predivan@open.telekom.rs>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_sigmatel.c | 9 ++++++++-
+ 1 files changed, 8 insertions(+), 1 deletions(-)
+
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 2141cab..ccdac27 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4952,7 +4952,14 @@ static int find_mute_led_gpio(struct hda_codec *codec, int default_polarity)
+ /* BIOS bug: unfilled OEM string */
+ if (strstr(dev->name, "HP_Mute_LED_P_G")) {
+ set_hp_led_gpio(codec);
+- spec->gpio_led_polarity = 1;
++ switch (codec->subsystem_id) {
++ case 0x103c148a:
++ spec->gpio_led_polarity = 0;
++ break;
++ default:
++ spec->gpio_led_polarity = 1;
++ break;
++ }
+ return 1;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch
new file mode 100644
index 0000000..4a60383
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch
@@ -0,0 +1,55 @@
+From 14b87cff679154f199dfeaa367f781e438197215 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 25 Jan 2012 09:55:46 +0100
+Subject: [PATCH 28/90] ALSA: hda - Fix silent output on ASUS A6Rp
+
+commit 3b25eb690e8c7424eecffe1458c02b87b32aa001 upstream.
+
+The refactoring of Realtek codec driver in 3.2 kernel caused a
+regression for ASUS A6Rp laptop; it doesn't give any output.
+The reason was that this machine has a secret master mute (or EAPD)
+control via NID 0x0f VREF. Setting VREF50 on this node makes the
+sound working again.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42588
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 10 ++++++++++
+ 1 files changed, 10 insertions(+), 0 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1d07e8f..9a63a19 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5223,6 +5223,7 @@ static const struct hda_amp_list alc861_loopbacks[] = {
+ /* Pin config fixes */
+ enum {
+ PINFIX_FSC_AMILO_PI1505,
++ PINFIX_ASUS_A6RP,
+ };
+
+ static const struct alc_fixup alc861_fixups[] = {
+@@ -5234,9 +5235,18 @@ static const struct alc_fixup alc861_fixups[] = {
+ { }
+ }
+ },
++ [PINFIX_ASUS_A6RP] = {
++ .type = ALC_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* node 0x0f VREF seems controlling the master output */
++ { 0x0f, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF50 },
++ { }
++ },
++ },
+ };
+
+ static const struct snd_pci_quirk alc861_fixup_tbl[] = {
++ SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", PINFIX_ASUS_A6RP),
+ SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", PINFIX_FSC_AMILO_PI1505),
+ {}
+ };
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch
new file mode 100644
index 0000000..0e8e433
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch
@@ -0,0 +1,34 @@
+From 7af203863bc49229e342435baa745102849d9c79 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 26 Jan 2012 15:56:16 +0100
+Subject: [PATCH 29/90] ALSA: hda - Fix silent output on Haier W18 laptop
+
+commit b3a81520bd37a28f77cb0f7002086fb14061824d upstream.
+
+The very same problem is seen on Haier W18 laptop with ALC861 as seen
+on ASUS A6Rp, which was fixed by the commit 3b25eb69.
+Now we just need to add a new SSID entry pointing to the same fixup.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42656
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9a63a19..5f03c40 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5247,6 +5247,7 @@ static const struct alc_fixup alc861_fixups[] = {
+
+ static const struct snd_pci_quirk alc861_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", PINFIX_ASUS_A6RP),
++ SND_PCI_QUIRK(0x1584, 0x2b01, "Haier W18", PINFIX_ASUS_A6RP),
+ SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", PINFIX_FSC_AMILO_PI1505),
+ {}
+ };
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch
new file mode 100644
index 0000000..95e1869
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch
@@ -0,0 +1,126 @@
+From 8192adb1ac4be659f5fc3010fa53c7cb3f59a409 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri, 14 Dec 2012 16:01:25 +0100
+Subject: [PATCH 30/90] drm/i915: paper over missed irq issues with force wake
+ voodoo
+
+commit 4cd53c0c8b01fc05c3ad5b2acdad02e37d3c2f55 upstream.
+
+Two things seem to do the trick on my ivb machine here:
+- prevent the gt from powering down while waiting for seqno
+ notification interrupts by grabbing the force_wake in get_irq (and
+ dropping it in put_irq again).
+- ordering writes from the ring's CS by reading a CS register, ACTHD
+ seems to work.
+
+Only the blt&bsd ring on ivb seem to be massively affected by this,
+but for paranoia do this dance also on the render ring and on snb
+(i.e. all gpus with forcewake).
+
+Tested with Eric's glCopyPixels loop which without this patch scores a
+missed irq every few seconds.
+
+This patch needs my forcewake rework to use a spinlock instead of
+dev->struct_mutex.
+
+After crawling through docs a lot I've found the following nugget:
+
+Internal doc "SNB GT PM Programming Guide", Section 4.3.1:
+
+"GT does not generate interrupts while in RC6 (by design)"
+
+So it looks like rc6 and irq generation are indeed related.
+
+v2: Improve the comment per Eugeni Dodonov's suggestion.
+
+v3: Add the documentation snipped. Also restrict the w/a to ivb only
+for -fixes, as suggested by Keith Packard.
+
+Cc: Eric Anholt <eric@anholt.net>
+Cc: Kenneth Graunke <kenneth@whitecape.org>
+Cc: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Tested-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 27 +++++++++++++++++++++++++--
+ 1 files changed, 25 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index ca70e2f..30a9af9 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -631,6 +631,19 @@ render_ring_add_request(struct intel_ring_buffer *ring,
+ }
+
+ static u32
++gen6_ring_get_seqno(struct intel_ring_buffer *ring)
++{
++ struct drm_device *dev = ring->dev;
++
++ /* Workaround to force correct ordering between irq and seqno writes on
++ * ivb (and maybe also on snb) by reading from a CS register (like
++ * ACTHD) before reading the status page. */
++ if (IS_GEN7(dev))
++ intel_ring_get_active_head(ring);
++ return intel_read_status_page(ring, I915_GEM_HWS_INDEX);
++}
++
++static u32
+ ring_get_seqno(struct intel_ring_buffer *ring)
+ {
+ return intel_read_status_page(ring, I915_GEM_HWS_INDEX);
+@@ -795,6 +808,12 @@ gen6_ring_get_irq(struct intel_ring_buffer *ring, u32 gflag, u32 rflag)
+ if (!dev->irq_enabled)
+ return false;
+
++ /* It looks like we need to prevent the gt from suspending while waiting
++ * for an notifiy irq, otherwise irqs seem to get lost on at least the
++ * blt/bsd rings on ivb. */
++ if (IS_GEN7(dev))
++ gen6_gt_force_wake_get(dev_priv);
++
+ spin_lock(&ring->irq_lock);
+ if (ring->irq_refcount++ == 0) {
+ ring->irq_mask &= ~rflag;
+@@ -819,6 +838,9 @@ gen6_ring_put_irq(struct intel_ring_buffer *ring, u32 gflag, u32 rflag)
+ ironlake_disable_irq(dev_priv, gflag);
+ }
+ spin_unlock(&ring->irq_lock);
++
++ if (IS_GEN7(dev))
++ gen6_gt_force_wake_put(dev_priv);
+ }
+
+ static bool
+@@ -1316,7 +1338,7 @@ static const struct intel_ring_buffer gen6_bsd_ring = {
+ .write_tail = gen6_bsd_ring_write_tail,
+ .flush = gen6_ring_flush,
+ .add_request = gen6_add_request,
+- .get_seqno = ring_get_seqno,
++ .get_seqno = gen6_ring_get_seqno,
+ .irq_get = gen6_bsd_ring_get_irq,
+ .irq_put = gen6_bsd_ring_put_irq,
+ .dispatch_execbuffer = gen6_ring_dispatch_execbuffer,
+@@ -1451,7 +1473,7 @@ static const struct intel_ring_buffer gen6_blt_ring = {
+ .write_tail = ring_write_tail,
+ .flush = blt_ring_flush,
+ .add_request = gen6_add_request,
+- .get_seqno = ring_get_seqno,
++ .get_seqno = gen6_ring_get_seqno,
+ .irq_get = blt_ring_get_irq,
+ .irq_put = blt_ring_put_irq,
+ .dispatch_execbuffer = gen6_ring_dispatch_execbuffer,
+@@ -1474,6 +1496,7 @@ int intel_init_render_ring_buffer(struct drm_device *dev)
+ ring->flush = gen6_render_ring_flush;
+ ring->irq_get = gen6_render_ring_get_irq;
+ ring->irq_put = gen6_render_ring_put_irq;
++ ring->get_seqno = gen6_ring_get_seqno;
+ } else if (IS_GEN5(dev)) {
+ ring->add_request = pc_render_add_request;
+ ring->get_seqno = pc_render_get_seqno;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch
new file mode 100644
index 0000000..16b018a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch
@@ -0,0 +1,52 @@
+From eeb7321204f3c1e07a8f4fe750415c0c2c991068 Mon Sep 17 00:00:00 2001
+From: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Date: Fri, 6 Jan 2012 19:45:34 -0200
+Subject: [PATCH 31/90] drm/i915/sdvo: always set positive sync polarity
+
+commit ba68e086223a5f149f37bf8692c8cdbf1b0ba3ef upstream.
+
+This is a revert of 81a14b46846fea0741902e8d8dfcc6c6c78154c8.
+
+We already set the mode polarity using the SDVO commands with struct
+intel_sdvo_dtd. We have at least 3 bugs that get fixed with this patch.
+The documentation, despite not clear, can also be interpreted in a way
+that suggests this patch is needed.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=15766
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=42174
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=43333
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/intel_sdvo.c | 8 +++-----
+ 1 files changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index f7b9268..e334ec3 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -1066,15 +1066,13 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
+
+ /* Set the SDVO control regs. */
+ if (INTEL_INFO(dev)->gen >= 4) {
+- sdvox = 0;
++ /* The real mode polarity is set by the SDVO commands, using
++ * struct intel_sdvo_dtd. */
++ sdvox = SDVO_VSYNC_ACTIVE_HIGH | SDVO_HSYNC_ACTIVE_HIGH;
+ if (intel_sdvo->is_hdmi)
+ sdvox |= intel_sdvo->color_range;
+ if (INTEL_INFO(dev)->gen < 5)
+ sdvox |= SDVO_BORDER_ENABLE;
+- if (adjusted_mode->flags & DRM_MODE_FLAG_PVSYNC)
+- sdvox |= SDVO_VSYNC_ACTIVE_HIGH;
+- if (adjusted_mode->flags & DRM_MODE_FLAG_PHSYNC)
+- sdvox |= SDVO_HSYNC_ACTIVE_HIGH;
+ } else {
+ sdvox = I915_READ(intel_sdvo->sdvo_reg);
+ switch (intel_sdvo->sdvo_reg) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch
new file mode 100644
index 0000000..8d02605
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch
@@ -0,0 +1,43 @@
+From a9dbe8df9f33f70904247f2e263a9647eb8e448a Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Mon, 23 Jan 2012 16:14:06 -0800
+Subject: [PATCH 32/90] drm/i915: Re-enable gen7 RC6 and GPU turbo after
+ resume.
+
+commit 04115a9dee110b52a8eaa556c574022fa3bf4704 upstream.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Reviewed-by: Keith Packard <keithp@keithp.com>
+Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_suspend.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
+index 7886e4f..43cbafe 100644
+--- a/drivers/gpu/drm/i915/i915_suspend.c
++++ b/drivers/gpu/drm/i915/i915_suspend.c
+@@ -822,7 +822,7 @@ int i915_save_state(struct drm_device *dev)
+
+ if (IS_IRONLAKE_M(dev))
+ ironlake_disable_drps(dev);
+- if (IS_GEN6(dev))
++ if (INTEL_INFO(dev)->gen >= 6)
+ gen6_disable_rps(dev);
+
+ /* Cache mode state */
+@@ -881,7 +881,7 @@ int i915_restore_state(struct drm_device *dev)
+ intel_init_emon(dev);
+ }
+
+- if (IS_GEN6(dev)) {
++ if (INTEL_INFO(dev)->gen >= 6) {
+ gen6_enable_rps(dev_priv);
+ gen6_update_ring_freq(dev_priv);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch
new file mode 100644
index 0000000..4667ad7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch
@@ -0,0 +1,46 @@
+From bc5829b31b25a3a6928089594fdab76017d0d622 Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Wed, 28 Dec 2011 13:10:04 +0200
+Subject: [PATCH 33/90] ARM: at91: fix at91rm9200 soc subtype handling
+
+commit 3e90772f76010c315474bde59eaca7cc4c94d645 upstream.
+
+Currently setting it to PQFP changes subtype to BGA as subtypes are
+swapped in at91rm9200_set_type().
+
+Wrong subtype causes GPIO bank D not to work at all.
+
+After this fix, subtype is still set as unknown. But board code should
+fill it in with proper value. Another information is thus printed.
+
+Bug discovery and first implementation made by Veli-Pekka Peltola.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-at91/setup.c | 7 +++++--
+ 1 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c
+index cf98a8f..39d8ea0 100644
+--- a/arch/arm/mach-at91/setup.c
++++ b/arch/arm/mach-at91/setup.c
+@@ -27,9 +27,12 @@ EXPORT_SYMBOL(at91_soc_initdata);
+ void __init at91rm9200_set_type(int type)
+ {
+ if (type == ARCH_REVISON_9200_PQFP)
+- at91_soc_initdata.subtype = AT91_SOC_RM9200_BGA;
+- else
+ at91_soc_initdata.subtype = AT91_SOC_RM9200_PQFP;
++ else
++ at91_soc_initdata.subtype = AT91_SOC_RM9200_BGA;
++
++ pr_info("AT91: filled in soc subtype: %s\n",
++ at91_get_soc_subtype(&at91_soc_initdata));
+ }
+
+ void __init at91_init_irq_default(void)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch
new file mode 100644
index 0000000..ea53d57
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch
@@ -0,0 +1,31 @@
+From 7e7ae7c2a3f4433e2401717a641cab1a86249f94 Mon Sep 17 00:00:00 2001
+From: Srinidhi KASAGAR <srinidhi.kasagar@stericsson.com>
+Date: Thu, 12 Jan 2012 11:07:43 +0530
+Subject: [PATCH 34/90] mach-ux500: enable ARM errata 764369
+
+commit d65015f7c5c5be9fd3f5e567889c844ba81bdc9c upstream.
+
+This applies ARM errata 764369 for all ux500 platforms.
+
+Signed-off-by: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-ux500/Kconfig | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/arch/arm/mach-ux500/Kconfig b/arch/arm/mach-ux500/Kconfig
+index a3e0c86..52af004 100644
+--- a/arch/arm/mach-ux500/Kconfig
++++ b/arch/arm/mach-ux500/Kconfig
+@@ -7,6 +7,7 @@ config UX500_SOC_COMMON
+ select HAS_MTU
+ select ARM_ERRATA_753970
+ select ARM_ERRATA_754322
++ select ARM_ERRATA_764369
+
+ menu "Ux500 SoC"
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch
new file mode 100644
index 0000000..371ead8
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch
@@ -0,0 +1,53 @@
+From edee236502d6e853eddd1ba0698aa1333126527f Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 20 Jan 2012 12:10:18 +0100
+Subject: [PATCH 35/90] ARM: 7296/1: proc-v7.S: remove HARVARD_CACHE
+ preprocessor guards
+
+commit 612539e81f655f6ac73c7af1da8701c1ee618aee upstream.
+
+On v7, we use the same cache maintenance instructions for data lines
+as for unified lines. This was not the case for v6, where HARVARD_CACHE
+was defined to indicate the L1 cache topology.
+
+This patch removes the erroneous compile-time check for HARVARD_CACHE in
+proc-v7.S, ensuring that we perform I-side invalidation at boot.
+
+Reported-and-Acked-by: Shawn Guo <shawn.guo@linaro.org>
+
+Acked-by: Catalin Marinas <Catalin.Marinas@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mm/proc-v7.S | 6 ------
+ 1 files changed, 0 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
+index e70a737..40cc7aa 100644
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -271,10 +271,6 @@ ENDPROC(cpu_v7_do_resume)
+ * Initialise TLB, Caches, and MMU state ready to switch the MMU
+ * on. Return in r0 the new CP15 C1 control register setting.
+ *
+- * We automatically detect if we have a Harvard cache, and use the
+- * Harvard cache control instructions insead of the unified cache
+- * control instructions.
+- *
+ * This should be able to cover all ARMv7 cores.
+ *
+ * It is assumed that:
+@@ -373,9 +369,7 @@ __v7_setup:
+ #endif
+
+ 3: mov r10, #0
+-#ifdef HARVARD_CACHE
+ mcr p15, 0, r10, c7, c5, 0 @ I+BTB cache invalidate
+-#endif
+ dsb
+ #ifdef CONFIG_MMU
+ mcr p15, 0, r10, c8, c7, 0 @ invalidate I + D TLBs
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch
new file mode 100644
index 0000000..492cb43
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch
@@ -0,0 +1,68 @@
+From 03813e1cec3fa5d6011c9e9faefa80ad1f1b7f04 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Fri, 13 Jan 2012 21:32:59 -0800
+Subject: [PATCH 36/90] sysfs: Complain bitterly about attempts to remove
+ files from nonexistent directories.
+
+commit ce597919361dcec97341151690e780eade2a9cf4 upstream.
+
+Recently an OOPS was observed from the usb serial io_ti driver when it tried to remove
+sysfs directories. Upon investigation it turns out this driver was always buggy
+and that a recent sysfs change had stopped guarding itself against removing attributes
+from sysfs directories that had already been removed. :(
+
+Historically we have been silent about attempting to files from nonexistent sysfs
+directories and have politely returned error codes. That has resulted in people writing
+broken code that ignores the error codes.
+
+Issue a kernel WARNING and a stack backtrace to make it clear in no uncertain
+terms that abusing sysfs is not ok, and the callers need to fix their code.
+
+This change transforms the io_ti OOPS into a more comprehensible error message
+and stack backtrace.
+
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Reported-by: Wolfgang Frisch <wfpub@roembden.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/sysfs/file.c | 6 ++++++
+ fs/sysfs/inode.c | 5 ++++-
+ 2 files changed, 10 insertions(+), 1 deletions(-)
+
+diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
+index d4e6080b..779789a 100644
+--- a/fs/sysfs/file.c
++++ b/fs/sysfs/file.c
+@@ -493,6 +493,12 @@ int sysfs_attr_ns(struct kobject *kobj, const struct attribute *attr,
+ const void *ns = NULL;
+ int err;
+
++ if (!dir_sd) {
++ WARN(1, KERN_ERR "sysfs: kobject %s without dirent\n",
++ kobject_name(kobj));
++ return -ENOENT;
++ }
++
+ err = 0;
+ if (!sysfs_ns_type(dir_sd))
+ goto out;
+diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
+index c81b22f..deb804b 100644
+--- a/fs/sysfs/inode.c
++++ b/fs/sysfs/inode.c
+@@ -318,8 +318,11 @@ int sysfs_hash_and_remove(struct sysfs_dirent *dir_sd, const void *ns, const cha
+ struct sysfs_addrm_cxt acxt;
+ struct sysfs_dirent *sd;
+
+- if (!dir_sd)
++ if (!dir_sd) {
++ WARN(1, KERN_WARNING "sysfs: can not remove '%s', no directory\n",
++ name);
+ return -ENOENT;
++ }
+
+ sysfs_addrm_start(&acxt, dir_sd);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch
new file mode 100644
index 0000000..febc945
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch
@@ -0,0 +1,103 @@
+From 0ffbd056d7edbfdeb707161d3953ff65f884c92b Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel@citrix.com>
+Date: Mon, 23 Jan 2012 19:32:25 +0000
+Subject: [PATCH 37/90] x86: xen: size struct xen_spinlock to always fit in
+ arch_spinlock_t
+
+commit 7a7546b377bdaa25ac77f33d9433c59f259b9688 upstream.
+
+If NR_CPUS < 256 then arch_spinlock_t is only 16 bits wide but struct
+xen_spinlock is 32 bits. When a spin lock is contended and
+xl->spinners is modified the two bytes immediately after the spin lock
+would be corrupted.
+
+This is a regression caused by 84eb950db13ca40a0572ce9957e14723500943d6
+(x86, ticketlock: Clean up types and accessors) which reduced the size
+of arch_spinlock_t.
+
+Fix this by making xl->spinners a u8 if NR_CPUS < 256. A
+BUILD_BUG_ON() is also added to check the sizes of the two structures
+are compatible.
+
+In many cases this was not noticable as there would often be padding
+bytes after the lock (e.g., if any of CONFIG_GENERIC_LOCKBREAK,
+CONFIG_DEBUG_SPINLOCK, or CONFIG_DEBUG_LOCK_ALLOC were enabled).
+
+The bnx2 driver is affected. In struct bnx2, phy_lock and
+indirect_lock may have no padding after them. Contention on phy_lock
+would corrupt indirect_lock making it appear locked and the driver
+would deadlock.
+
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy@goop.org>
+Acked-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/xen/spinlock.c | 27 ++++++++++++++++++++++-----
+ 1 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index cc9b1e1..d69cc6c 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -116,9 +116,26 @@ static inline void spin_time_accum_blocked(u64 start)
+ }
+ #endif /* CONFIG_XEN_DEBUG_FS */
+
++/*
++ * Size struct xen_spinlock so it's the same as arch_spinlock_t.
++ */
++#if NR_CPUS < 256
++typedef u8 xen_spinners_t;
++# define inc_spinners(xl) \
++ asm(LOCK_PREFIX " incb %0" : "+m" ((xl)->spinners) : : "memory");
++# define dec_spinners(xl) \
++ asm(LOCK_PREFIX " decb %0" : "+m" ((xl)->spinners) : : "memory");
++#else
++typedef u16 xen_spinners_t;
++# define inc_spinners(xl) \
++ asm(LOCK_PREFIX " incw %0" : "+m" ((xl)->spinners) : : "memory");
++# define dec_spinners(xl) \
++ asm(LOCK_PREFIX " decw %0" : "+m" ((xl)->spinners) : : "memory");
++#endif
++
+ struct xen_spinlock {
+ unsigned char lock; /* 0 -> free; 1 -> locked */
+- unsigned short spinners; /* count of waiting cpus */
++ xen_spinners_t spinners; /* count of waiting cpus */
+ };
+
+ static int xen_spin_is_locked(struct arch_spinlock *lock)
+@@ -164,8 +181,7 @@ static inline struct xen_spinlock *spinning_lock(struct xen_spinlock *xl)
+
+ wmb(); /* set lock of interest before count */
+
+- asm(LOCK_PREFIX " incw %0"
+- : "+m" (xl->spinners) : : "memory");
++ inc_spinners(xl);
+
+ return prev;
+ }
+@@ -176,8 +192,7 @@ static inline struct xen_spinlock *spinning_lock(struct xen_spinlock *xl)
+ */
+ static inline void unspinning_lock(struct xen_spinlock *xl, struct xen_spinlock *prev)
+ {
+- asm(LOCK_PREFIX " decw %0"
+- : "+m" (xl->spinners) : : "memory");
++ dec_spinners(xl);
+ wmb(); /* decrement count before restoring lock */
+ __this_cpu_write(lock_spinners, prev);
+ }
+@@ -373,6 +388,8 @@ void xen_uninit_lock_cpu(int cpu)
+
+ void __init xen_init_spinlocks(void)
+ {
++ BUILD_BUG_ON(sizeof(struct xen_spinlock) > sizeof(arch_spinlock_t));
++
+ pv_lock_ops.spin_is_locked = xen_spin_is_locked;
+ pv_lock_ops.spin_is_contended = xen_spin_is_contended;
+ pv_lock_ops.spin_lock = xen_spin_lock;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch
new file mode 100644
index 0000000..b85e209
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch
@@ -0,0 +1,96 @@
+From 00f1a14e217d9fcb2b568d56192a28d3e89e192b Mon Sep 17 00:00:00 2001
+From: "nagalakshmi.nandigama@lsi.com" <nagalakshmi.nandigama@lsi.com>
+Date: Tue, 13 Dec 2011 09:29:15 +0530
+Subject: [PATCH 38/90] mpt2sas: Removed redundant calling of
+ _scsih_probe_devices() from _scsih_probe
+
+commit 2cb6fc8c014b9b00c4487a79b8f6ed0da4121f45 upstream.
+
+Removed redundant calling of _scsih_probe_devices() from _scsih_probe as
+it is getting called from _scsih_scan_finished.
+
+Also moved the function scsi_scan_host(shost) to get called after the
+volumes on warp drive are reported to the OS. Otherwise by the time
+the (ioc->hide_drives) flags is set, the volumes on warp drive
+are reported to the OS already.
+
+Also modified the initialization of reply queues only in case of driver load
+time in the function _base_make_ioc_operational().
+
+Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c | 20 +++++++-------------
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 3 +--
+ 2 files changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
+index 0794c72..b1ddfef 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -4033,7 +4033,8 @@ _base_make_ioc_operational(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ ioc->reply_free[i] = cpu_to_le32(reply_address);
+
+ /* initialize reply queues */
+- _base_assign_reply_queues(ioc);
++ if (ioc->is_driver_loading)
++ _base_assign_reply_queues(ioc);
+
+ /* initialize Reply Post Free Queue */
+ reply_post_free = (long)ioc->reply_post_free;
+@@ -4081,24 +4082,17 @@ _base_make_ioc_operational(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+
+
+ if (ioc->is_driver_loading) {
+-
+-
+-
+- ioc->wait_for_discovery_to_complete =
+- _base_determine_wait_on_discovery(ioc);
+- return r; /* scan_start and scan_finished support */
+- }
+-
+-
+- if (ioc->wait_for_discovery_to_complete && ioc->is_warpdrive) {
+- if (ioc->manu_pg10.OEMIdentifier == 0x80) {
++ if (ioc->is_warpdrive && ioc->manu_pg10.OEMIdentifier
++ == 0x80) {
+ hide_flag = (u8) (ioc->manu_pg10.OEMSpecificFlags0 &
+ MFG_PAGE10_HIDE_SSDS_MASK);
+ if (hide_flag != MFG_PAGE10_HIDE_SSDS_MASK)
+ ioc->mfg_pg10_hide_flag = hide_flag;
+ }
++ ioc->wait_for_discovery_to_complete =
++ _base_determine_wait_on_discovery(ioc);
++ return r; /* scan_start and scan_finished support */
+ }
+-
+ r = _base_send_port_enable(ioc, sleep_flag);
+ if (r)
+ return r;
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+index 9bc6fb2..2824a90 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -8001,7 +8001,6 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ goto out_attach_fail;
+ }
+
+- scsi_scan_host(shost);
+ if (ioc->is_warpdrive) {
+ if (ioc->mfg_pg10_hide_flag == MFG_PAGE10_EXPOSE_ALL_DISKS)
+ ioc->hide_drives = 0;
+@@ -8015,8 +8014,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ }
+ } else
+ ioc->hide_drives = 0;
++ scsi_scan_host(shost);
+
+- _scsih_probe_devices(ioc);
+ return 0;
+
+ out_attach_fail:
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch
new file mode 100644
index 0000000..bd25975
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch
@@ -0,0 +1,41 @@
+From 1b9d5491e5c2439b3e861d1612eeae258c926b34 Mon Sep 17 00:00:00 2001
+From: Kentaro Matsuyama <kentaro.matsuyama@gmail.com>
+Date: Thu, 12 Jan 2012 23:07:51 +0900
+Subject: [PATCH 39/90] USB: option: Add LG docomo L-02C
+
+commit e423d7401fd0717cb56a6cf51dd8341cc3e800d2 upstream.
+
+Add vendor and product ID for USB 3G/LTE modem of docomo L-02C
+
+Signed-off-by: Kentaro Matsuyama <kentaro.matsuyama@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index c96b6b6..2a9ed6e 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -480,6 +480,10 @@ static void option_instat_callback(struct urb *urb);
+ #define ZD_VENDOR_ID 0x0685
+ #define ZD_PRODUCT_7000 0x7000
+
++/* LG products */
++#define LG_VENDOR_ID 0x1004
++#define LG_PRODUCT_L02C 0x618f
++
+ /* some devices interfaces need special handling due to a number of reasons */
+ enum option_blacklist_reason {
+ OPTION_BLACKLIST_NONE = 0,
+@@ -1183,6 +1187,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
+ { USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) },
++ { USB_DEVICE(LG_VENDOR_ID, LG_PRODUCT_L02C) }, /* docomo L-02C modem */
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch
new file mode 100644
index 0000000..a80c231
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch
@@ -0,0 +1,41 @@
+From f4915de191cac38c002969b2a7b8ca4cda1f8ebb Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Tue, 10 Jan 2012 23:33:37 +0100
+Subject: [PATCH 40/90] USB: ftdi_sio: fix TIOCSSERIAL baud_base handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit eb833a9e0972f60beb4ab8104ad7ef6bf30f02fc upstream.
+
+Return EINVAL if new baud_base does not match the current one.
+
+The baud_base is device specific and can not be changed. This restores
+the old (pre-2005) behaviour which was changed due to a
+misunderstanding regarding this fact (see
+https://lkml.org/lkml/2005/1/20/84).
+
+Reported-by: Torbjörn Lofterud <torbjorn@pi.nxs.se>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index ff3db5d..6a034b3 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1333,8 +1333,7 @@ static int set_serial_info(struct tty_struct *tty,
+ goto check_and_exit;
+ }
+
+- if ((new_serial.baud_base != priv->baud_base) &&
+- (new_serial.baud_base < 9600)) {
++ if (new_serial.baud_base != priv->baud_base) {
+ mutex_unlock(&priv->cfg_lock);
+ return -EINVAL;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch
new file mode 100644
index 0000000..f1c1e75
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch
@@ -0,0 +1,49 @@
+From 6ca78fe06bc778d2a4d82af2fd438bf0ddfc2a2c Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Wed, 18 Jan 2012 01:46:00 +0100
+Subject: [PATCH 41/90] USB: ftdi_sio: fix initial baud rate
+
+commit 108e02b12921078a59dcacd048079ece48a4a983 upstream.
+
+Fix regression introduced by commit b1ffb4c851f1 ("USB: Fix Corruption
+issue in USB ftdi driver ftdi_sio.c") which caused the termios settings
+to no longer be initialised at open. Consequently it was no longer
+possible to set the port to the default speed of 9600 baud without first
+changing to another baud rate and back again.
+
+Reported-by: Roland Ramthun <mail@roland-ramthun.de>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Tested-by: Roland Ramthun <mail@roland-ramthun.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 7 +++++--
+ 1 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 6a034b3..6a40b41 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1823,6 +1823,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
+
+ static int ftdi_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
++ struct ktermios dummy;
+ struct usb_device *dev = port->serial->dev;
+ struct ftdi_private *priv = usb_get_serial_port_data(port);
+ int result;
+@@ -1841,8 +1842,10 @@ static int ftdi_open(struct tty_struct *tty, struct usb_serial_port *port)
+ This is same behaviour as serial.c/rs_open() - Kuba */
+
+ /* ftdi_set_termios will send usb control messages */
+- if (tty)
+- ftdi_set_termios(tty, port, tty->termios);
++ if (tty) {
++ memset(&dummy, 0, sizeof(dummy));
++ ftdi_set_termios(tty, port, &dummy);
++ }
+
+ /* Start reading from the device */
+ result = usb_serial_generic_open(tty, port);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch
new file mode 100644
index 0000000..1ace416
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch
@@ -0,0 +1,50 @@
+From 27fca12db10bf68fb87c3b669be952f88594376c Mon Sep 17 00:00:00 2001
+From: Peter Korsgaard <jacmet@sunsite.dk>
+Date: Wed, 18 Jan 2012 23:43:45 +0100
+Subject: [PATCH 42/90] USB: ftdi_sio: add PID for TI XDS100v2 / BeagleBone A3
+
+commit 55f13aeae0346f0c89bfface91ad9a97653dc433 upstream.
+
+Port A for JTAG, port B for serial.
+
+Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 7 +++++++
+ 2 files changed, 9 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 6a40b41..952570f 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -805,6 +805,8 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+ { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, TI_XDS100V2_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
+ { USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) },
+ { USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 055b64e..b67bee2 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -39,6 +39,13 @@
+ /* www.candapter.com Ewert Energy Systems CANdapter device */
+ #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
+
++/*
++ * Texas Instruments XDS100v2 JTAG / BeagleBone A3
++ * http://processors.wiki.ti.com/index.php/XDS100
++ * http://beagleboard.org/bone
++ */
++#define TI_XDS100V2_PID 0xa6d0
++
+ #define FTDI_NXTCAM_PID 0xABB8 /* NXTCam for Mindstorms NXT */
+
+ /* US Interface Navigator (http://www.usinterface.com/) */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0043-USB-serial-ftdi-additional-IDs.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0043-USB-serial-ftdi-additional-IDs.patch
new file mode 100644
index 0000000..6986c72
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0043-USB-serial-ftdi-additional-IDs.patch
@@ -0,0 +1,49 @@
+From 49b8a8464f7e327e044623da5ba2aa6aaa43b77c Mon Sep 17 00:00:00 2001
+From: Peter Naulls <peter@chocky.org>
+Date: Tue, 17 Jan 2012 18:27:09 -0800
+Subject: [PATCH 43/90] USB: serial: ftdi additional IDs
+
+commit fc216ec363f4d174932df90bbf35c77d0540e561 upstream.
+
+I tested this against 2.6.39 in the Ubuntu kernel, however I see the IDs
+are not in latest 3.2 git.
+
+This adds IDs for the FTDI controller in the Rainforest Automation
+Zigbee dongle.
+
+Signed-off-by: Peter Naulls <peter@chocky.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
+ 2 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 952570f..abd5bd7 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -843,6 +843,7 @@ static struct usb_device_id id_table_combined [] = {
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(ST_VID, ST_STMCLT1030_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk },
++ { USB_DEVICE(FTDI_VID, FTDI_RF_R106) },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index b67bee2..79c5967 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1175,3 +1175,9 @@
+ */
+ /* TagTracer MIFARE*/
+ #define FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID 0xF7C0
++
++/*
++ * Rainforest Automation
++ */
++/* ZigBee controller */
++#define FTDI_RF_R106 0x8A28
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch
new file mode 100644
index 0000000..a856f0c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch
@@ -0,0 +1,48 @@
+From cea8765145bdf3a814070e52c7f348a5e69c76ce Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Thu, 26 Jan 2012 17:41:34 +0000
+Subject: [PATCH 44/90] USB: ftdi_sio: Add more identifiers
+
+commit 2353f806c97020d4c7709f15eebb49b591f7306d upstream.
+
+0x04d8, 0x000a: Hornby Elite
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
+ 2 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index abd5bd7..058b92c 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -797,6 +797,7 @@ static struct usb_device_id id_table_combined [] = {
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(HORNBY_VID, HORNBY_ELITE_PID) },
+ { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
+ { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 79c5967..76d4f31 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -532,6 +532,12 @@
+ #define ADI_GNICEPLUS_PID 0xF001
+
+ /*
++ * Hornby Elite
++ */
++#define HORNBY_VID 0x04D8
++#define HORNBY_ELITE_PID 0x000A
++
++/*
+ * RATOC REX-USB60F
+ */
+ #define RATOC_VENDOR_ID 0x0584
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch
new file mode 100644
index 0000000..a090a1c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch
@@ -0,0 +1,37 @@
+From 54e1d6f4d4781af0b70c3e36d5c6611b5c3d8272 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Mon, 16 Jan 2012 12:41:47 +0100
+Subject: [PATCH 45/90] USB: cdc-wdm: updating desc->length must be protected
+ by spin_lock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit c428b70c1e115c5649707a602742e34130d19428 upstream.
+
+wdm_in_callback() will also touch this field, so we cannot change it without locking
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Acked-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-wdm.c | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index efe6849..7e5e822 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -467,7 +467,9 @@ retry:
+ for (i = 0; i < desc->length - cntr; i++)
+ desc->ubuf[i] = desc->ubuf[i + cntr];
+
++ spin_lock_irq(&desc->iuspin);
+ desc->length -= cntr;
++ spin_unlock_irq(&desc->iuspin);
+ /* in case we had outstanding data */
+ if (!desc->length)
+ clear_bit(WDM_READ, &desc->flags);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch
new file mode 100644
index 0000000..544450e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch
@@ -0,0 +1,178 @@
+From 9d6f338f1fe382275fbd4fee94c0d5a55ed601de Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Mon, 16 Jan 2012 12:41:48 +0100
+Subject: [PATCH 46/90] USB: cdc-wdm: use two mutexes to allow simultaneous
+ read and write
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit e8537bd2c4f325a4796da33564ddcef9489b7feb upstream.
+
+using a separate read and write mutex for locking is sufficient to make the
+driver accept simultaneous read and write. This improves useability a lot.
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Cc: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-wdm.c | 49 +++++++++++++++++++++++++++---------------
+ 1 files changed, 31 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 7e5e822..4a29a80 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -88,7 +88,8 @@ struct wdm_device {
+ int count;
+ dma_addr_t shandle;
+ dma_addr_t ihandle;
+- struct mutex lock;
++ struct mutex wlock;
++ struct mutex rlock;
+ wait_queue_head_t wait;
+ struct work_struct rxwork;
+ int werr;
+@@ -323,7 +324,7 @@ static ssize_t wdm_write
+ }
+
+ /* concurrent writes and disconnect */
+- r = mutex_lock_interruptible(&desc->lock);
++ r = mutex_lock_interruptible(&desc->wlock);
+ rv = -ERESTARTSYS;
+ if (r) {
+ kfree(buf);
+@@ -386,7 +387,7 @@ static ssize_t wdm_write
+ out:
+ usb_autopm_put_interface(desc->intf);
+ outnp:
+- mutex_unlock(&desc->lock);
++ mutex_unlock(&desc->wlock);
+ outnl:
+ return rv < 0 ? rv : count;
+ }
+@@ -399,7 +400,7 @@ static ssize_t wdm_read
+ struct wdm_device *desc = file->private_data;
+
+
+- rv = mutex_lock_interruptible(&desc->lock); /*concurrent reads */
++ rv = mutex_lock_interruptible(&desc->rlock); /*concurrent reads */
+ if (rv < 0)
+ return -ERESTARTSYS;
+
+@@ -476,7 +477,7 @@ retry:
+ rv = cntr;
+
+ err:
+- mutex_unlock(&desc->lock);
++ mutex_unlock(&desc->rlock);
+ return rv;
+ }
+
+@@ -542,7 +543,8 @@ static int wdm_open(struct inode *inode, struct file *file)
+ }
+ intf->needs_remote_wakeup = 1;
+
+- mutex_lock(&desc->lock);
++ /* using write lock to protect desc->count */
++ mutex_lock(&desc->wlock);
+ if (!desc->count++) {
+ desc->werr = 0;
+ desc->rerr = 0;
+@@ -555,7 +557,7 @@ static int wdm_open(struct inode *inode, struct file *file)
+ } else {
+ rv = 0;
+ }
+- mutex_unlock(&desc->lock);
++ mutex_unlock(&desc->wlock);
+ usb_autopm_put_interface(desc->intf);
+ out:
+ mutex_unlock(&wdm_mutex);
+@@ -567,9 +569,11 @@ static int wdm_release(struct inode *inode, struct file *file)
+ struct wdm_device *desc = file->private_data;
+
+ mutex_lock(&wdm_mutex);
+- mutex_lock(&desc->lock);
++
++ /* using write lock to protect desc->count */
++ mutex_lock(&desc->wlock);
+ desc->count--;
+- mutex_unlock(&desc->lock);
++ mutex_unlock(&desc->wlock);
+
+ if (!desc->count) {
+ dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
+@@ -667,7 +671,8 @@ next_desc:
+ desc = kzalloc(sizeof(struct wdm_device), GFP_KERNEL);
+ if (!desc)
+ goto out;
+- mutex_init(&desc->lock);
++ mutex_init(&desc->rlock);
++ mutex_init(&desc->wlock);
+ spin_lock_init(&desc->iuspin);
+ init_waitqueue_head(&desc->wait);
+ desc->wMaxCommand = maxcom;
+@@ -781,10 +786,12 @@ static void wdm_disconnect(struct usb_interface *intf)
+ /* to terminate pending flushes */
+ clear_bit(WDM_IN_USE, &desc->flags);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+- mutex_lock(&desc->lock);
++ mutex_lock(&desc->rlock);
++ mutex_lock(&desc->wlock);
+ kill_urbs(desc);
+ cancel_work_sync(&desc->rxwork);
+- mutex_unlock(&desc->lock);
++ mutex_unlock(&desc->wlock);
++ mutex_unlock(&desc->rlock);
+ wake_up_all(&desc->wait);
+ if (!desc->count)
+ cleanup(desc);
+@@ -800,8 +807,10 @@ static int wdm_suspend(struct usb_interface *intf, pm_message_t message)
+ dev_dbg(&desc->intf->dev, "wdm%d_suspend\n", intf->minor);
+
+ /* if this is an autosuspend the caller does the locking */
+- if (!PMSG_IS_AUTO(message))
+- mutex_lock(&desc->lock);
++ if (!PMSG_IS_AUTO(message)) {
++ mutex_lock(&desc->rlock);
++ mutex_lock(&desc->wlock);
++ }
+ spin_lock_irq(&desc->iuspin);
+
+ if (PMSG_IS_AUTO(message) &&
+@@ -817,8 +826,10 @@ static int wdm_suspend(struct usb_interface *intf, pm_message_t message)
+ kill_urbs(desc);
+ cancel_work_sync(&desc->rxwork);
+ }
+- if (!PMSG_IS_AUTO(message))
+- mutex_unlock(&desc->lock);
++ if (!PMSG_IS_AUTO(message)) {
++ mutex_unlock(&desc->wlock);
++ mutex_unlock(&desc->rlock);
++ }
+
+ return rv;
+ }
+@@ -856,7 +867,8 @@ static int wdm_pre_reset(struct usb_interface *intf)
+ {
+ struct wdm_device *desc = usb_get_intfdata(intf);
+
+- mutex_lock(&desc->lock);
++ mutex_lock(&desc->rlock);
++ mutex_lock(&desc->wlock);
+ kill_urbs(desc);
+
+ /*
+@@ -878,7 +890,8 @@ static int wdm_post_reset(struct usb_interface *intf)
+ int rv;
+
+ rv = recover_from_urb_loss(desc);
+- mutex_unlock(&desc->lock);
++ mutex_unlock(&desc->wlock);
++ mutex_unlock(&desc->rlock);
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch
new file mode 100644
index 0000000..19b4c3e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch
@@ -0,0 +1,43 @@
+From 06053e0177cddb8ac7d4539e69012ef479089126 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Tue, 24 Jan 2012 17:16:54 -0600
+Subject: [PATCH 47/90] qcaux: add more Pantech UML190 and UML290 ports
+
+commit 074cc73506f529f39fef32ad1c9e1d4cdd8acf6c upstream.
+
+More ports we now know how to talk to.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/qcaux.c | 7 ++++++-
+ 1 files changed, 6 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/serial/qcaux.c b/drivers/usb/serial/qcaux.c
+index 30b73e6..a348198 100644
+--- a/drivers/usb/serial/qcaux.c
++++ b/drivers/usb/serial/qcaux.c
+@@ -36,6 +36,7 @@
+ #define UTSTARCOM_PRODUCT_UM175_V1 0x3712
+ #define UTSTARCOM_PRODUCT_UM175_V2 0x3714
+ #define UTSTARCOM_PRODUCT_UM175_ALLTEL 0x3715
++#define PANTECH_PRODUCT_UML190_VZW 0x3716
+ #define PANTECH_PRODUCT_UML290_VZW 0x3718
+
+ /* CMOTECH devices */
+@@ -67,7 +68,11 @@ static struct usb_device_id id_table[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_U520, 0xff, 0x00, 0x00) },
+- { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML190_VZW, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML190_VZW, 0xff, 0xfe, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xfd, 0xff) }, /* NMEA */
++ { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xfe, 0xff) }, /* WMC */
++ { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) }, /* DIAG */
+ { },
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch
new file mode 100644
index 0000000..0d6a5e1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch
@@ -0,0 +1,54 @@
+From cfb67a1e191fa6c59b9d29b5d78fe4bb27a08c5c Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Thu, 29 Dec 2011 06:32:29 +0200
+Subject: [PATCH 48/90] usb: dwc3: ep0: tidy up Pending Request handling
+
+commit 68d8a781575d7be490f97eb2c403fb13b083da6a upstream.
+
+The way our code was written, we should never have
+a DWC3_EP_PENDING_REQUEST flag set out of a Data Phase
+and the code in __dwc3_gadget_ep0_queue() did not
+reflect that situation properly.
+
+Tidy up that case to avoid any possible mistakes
+when starting requests for IRQs which are long
+gone.
+
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/ep0.c | 14 ++++----------
+ 1 files changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index 69a4e43..27bd50a 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -149,20 +149,14 @@ static int __dwc3_gadget_ep0_queue(struct dwc3_ep *dep,
+
+ direction = !!(dep->flags & DWC3_EP0_DIR_IN);
+
+- if (dwc->ep0state == EP0_STATUS_PHASE) {
+- type = dwc->three_stage_setup
+- ? DWC3_TRBCTL_CONTROL_STATUS3
+- : DWC3_TRBCTL_CONTROL_STATUS2;
+- } else if (dwc->ep0state == EP0_DATA_PHASE) {
+- type = DWC3_TRBCTL_CONTROL_DATA;
+- } else {
+- /* should never happen */
+- WARN_ON(1);
++ if (dwc->ep0state != EP0_DATA_PHASE) {
++ dev_WARN(dwc->dev, "Unexpected pending request\n");
+ return 0;
+ }
+
+ ret = dwc3_ep0_start_trans(dwc, direction,
+- req->request.dma, req->request.length, type);
++ req->request.dma, req->request.length,
++ DWC3_TRBCTL_CONTROL_DATA);
+ dep->flags &= ~(DWC3_EP_PENDING_REQUEST |
+ DWC3_EP0_DIR_IN);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch
new file mode 100644
index 0000000..e8508ba
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch
@@ -0,0 +1,60 @@
+From 07f90680975c8ca1d35f7f30f9aee6b832578469 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Fri, 13 Jan 2012 21:32:06 -0800
+Subject: [PATCH 49/90] usb: io_ti: Make edge_remove_sysfs_attrs the
+ port_remove method.
+
+commit 6d443d8499e4e59ffb949759cdded32730f8d2f6 upstream.
+
+Calling edge_remove_sysfs_attrs from edge_disconnect is too late
+as the device has already been removed from sysfs.
+
+Do the simple and obvious thing and make edge_remove_sysfs_attrs
+the port_remove method.
+
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Reported-by: Wolfgang Frisch <wfpub@roembden.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/io_ti.c | 10 ++--------
+ 1 files changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index 0aac00a..8a90d58 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -2677,15 +2677,7 @@ cleanup:
+
+ static void edge_disconnect(struct usb_serial *serial)
+ {
+- int i;
+- struct edgeport_port *edge_port;
+-
+ dbg("%s", __func__);
+-
+- for (i = 0; i < serial->num_ports; ++i) {
+- edge_port = usb_get_serial_port_data(serial->port[i]);
+- edge_remove_sysfs_attrs(edge_port->port);
+- }
+ }
+
+ static void edge_release(struct usb_serial *serial)
+@@ -2764,6 +2756,7 @@ static struct usb_serial_driver edgeport_1port_device = {
+ .disconnect = edge_disconnect,
+ .release = edge_release,
+ .port_probe = edge_create_sysfs_attrs,
++ .port_remove = edge_remove_sysfs_attrs,
+ .ioctl = edge_ioctl,
+ .set_termios = edge_set_termios,
+ .tiocmget = edge_tiocmget,
+@@ -2795,6 +2788,7 @@ static struct usb_serial_driver edgeport_2port_device = {
+ .disconnect = edge_disconnect,
+ .release = edge_release,
+ .port_probe = edge_create_sysfs_attrs,
++ .port_remove = edge_remove_sysfs_attrs,
+ .ioctl = edge_ioctl,
+ .set_termios = edge_set_termios,
+ .tiocmget = edge_tiocmget,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0050-TTY-fix-UV-serial-console-regression.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0050-TTY-fix-UV-serial-console-regression.patch
new file mode 100644
index 0000000..54b2abc
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0050-TTY-fix-UV-serial-console-regression.patch
@@ -0,0 +1,72 @@
+From 40e6ddc8744318ca278e19d1de4772b590fcc38c Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Thu, 12 Jan 2012 22:55:15 +0100
+Subject: [PATCH 50/90] TTY: fix UV serial console regression
+
+commit 0eee50af5b13e00b3fb7a5fe8480419a71b8235d upstream.
+
+Commit 74c2107759d (serial: Use block_til_ready helper) and its fixup
+3f582b8c110 (serial: fix termios settings in open) introduced a
+regression on UV systems. The serial eventually freezes while being
+used. It's completely unpredictable and sometimes needs a heap of
+traffic to happen first.
+
+To reproduce this, yast installation was used as it turned out to be
+pretty reliable in reproducing. Especially during installation process
+where one doesn't have an SSH daemon running. And no monitor as the HW
+is completely headless. So this was fun to find. Given the machine
+doesn't boot on vanilla before 2.6.36 final. (And the commits above
+are older.)
+
+Unless there is some bad race in the code, the hardware seems to be
+pretty broken. Otherwise pure MSR read should not cause such a bug,
+or?
+
+So to prevent the bug, revert to the old behavior. I.e. read modem
+status only if we really have to -- for non-CLOCAL set serials.
+Non-CLOCAL works on this hardware OK, I tried. See? I don't.
+
+And document that shit.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+References: https://lkml.org/lkml/2011/12/6/573
+References: https://bugzilla.novell.com/show_bug.cgi?id=718518
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/tty_port.c | 12 +++++++-----
+ 1 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
+index ef9dd62..bf6e238 100644
+--- a/drivers/tty/tty_port.c
++++ b/drivers/tty/tty_port.c
+@@ -227,7 +227,6 @@ int tty_port_block_til_ready(struct tty_port *port,
+ int do_clocal = 0, retval;
+ unsigned long flags;
+ DEFINE_WAIT(wait);
+- int cd;
+
+ /* block if port is in the process of being closed */
+ if (tty_hung_up_p(filp) || port->flags & ASYNC_CLOSING) {
+@@ -284,11 +283,14 @@ int tty_port_block_til_ready(struct tty_port *port,
+ retval = -ERESTARTSYS;
+ break;
+ }
+- /* Probe the carrier. For devices with no carrier detect this
+- will always return true */
+- cd = tty_port_carrier_raised(port);
++ /*
++ * Probe the carrier. For devices with no carrier detect
++ * tty_port_carrier_raised will always return true.
++ * Never ask drivers if CLOCAL is set, this causes troubles
++ * on some hardware.
++ */
+ if (!(port->flags & ASYNC_CLOSING) &&
+- (do_clocal || cd))
++ (do_clocal || tty_port_carrier_raised(port)))
+ break;
+ if (signal_pending(current)) {
+ retval = -ERESTARTSYS;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch
new file mode 100644
index 0000000..c1a5eb2
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch
@@ -0,0 +1,67 @@
+From de3853e197be72552027661297ae663e2eb66ef1 Mon Sep 17 00:00:00 2001
+From: Rabin Vincent <rabin.vincent@stericsson.com>
+Date: Tue, 17 Jan 2012 11:52:28 +0100
+Subject: [PATCH 51/90] serial: amba-pl011: lock console writes against
+ interrupts
+
+commit ef605fdb33883d687cff5ba75095a91b313b4966 upstream.
+
+Protect against pl011_console_write() and the interrupt for
+the console UART running concurrently on different CPUs.
+
+Otherwise the console_write could spin for a long time
+waiting for the UART to become not busy, while the other
+CPU continuously services UART interrupts and keeps the
+UART busy.
+
+The checks for sysrq and oops_in_progress are taken
+from 8250.c.
+
+Signed-off-by: Rabin Vincent <rabin.vincent@stericsson.com>
+Reviewed-by: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
+Reviewed-by: Bibek Basu <bibek.basu@stericsson.com>
+Reviewed-by: Shreshtha Kumar Sahu <shreshthakumar.sahu@stericsson.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/amba-pl011.c | 14 ++++++++++++++
+ 1 files changed, 14 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index 00233af..8e00926 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1740,9 +1740,19 @@ pl011_console_write(struct console *co, const char *s, unsigned int count)
+ {
+ struct uart_amba_port *uap = amba_ports[co->index];
+ unsigned int status, old_cr, new_cr;
++ unsigned long flags;
++ int locked = 1;
+
+ clk_enable(uap->clk);
+
++ local_irq_save(flags);
++ if (uap->port.sysrq)
++ locked = 0;
++ else if (oops_in_progress)
++ locked = spin_trylock(&uap->port.lock);
++ else
++ spin_lock(&uap->port.lock);
++
+ /*
+ * First save the CR then disable the interrupts
+ */
+@@ -1762,6 +1772,10 @@ pl011_console_write(struct console *co, const char *s, unsigned int count)
+ } while (status & UART01x_FR_BUSY);
+ writew(old_cr, uap->port.membase + UART011_CR);
+
++ if (locked)
++ spin_unlock(&uap->port.lock);
++ local_irq_restore(flags);
++
+ clk_disable(uap->clk);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch
new file mode 100644
index 0000000..4836cc1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch
@@ -0,0 +1,53 @@
+From a4bb82f827dd715b666d2cdf9cae6643da638974 Mon Sep 17 00:00:00 2001
+From: Lucas Kannebley Tavares <lucaskt@linux.vnet.ibm.com>
+Date: Mon, 9 Jan 2012 10:58:06 -0200
+Subject: [PATCH 52/90] jsm: Fixed EEH recovery error
+
+commit 26aa38cafae0dbef3b2fe75ea487c83313c36d45 upstream.
+
+There was an error on the jsm driver that would cause it to be unable to
+recover after a second error is detected.
+
+At the first error, the device recovers properly:
+
+[72521.485691] EEH: Detected PCI bus error on device 0003:02:00.0
+[72521.485695] EEH: This PCI device has failed 1 times in the last hour:
+...
+[72532.035693] ttyn3 at MMIO 0x0 (irq = 49) is a jsm
+[72532.105689] jsm: Port 3 added
+
+However, at the second error, it cascades until EEH disables the device:
+
+[72631.229549] Call Trace:
+...
+[72641.725687] jsm: Port 3 added
+[72641.725695] EEH: Detected PCI bus error on device 0003:02:00.0
+[72641.725698] EEH: This PCI device has failed 3 times in the last hour:
+
+It was caused because the PCI state was not being saved after the first
+restore. Therefore, at the second recovery the PCI state would not be
+restored.
+
+Signed-off-by: Lucas Kannebley Tavares <lucaskt@linux.vnet.ibm.com>
+Signed-off-by: Breno Leitao <brenohl@br.ibm.com>
+Acked-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/jsm/jsm_driver.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/tty/serial/jsm/jsm_driver.c b/drivers/tty/serial/jsm/jsm_driver.c
+index 7c867a0..7545fe1 100644
+--- a/drivers/tty/serial/jsm/jsm_driver.c
++++ b/drivers/tty/serial/jsm/jsm_driver.c
+@@ -251,6 +251,7 @@ static void jsm_io_resume(struct pci_dev *pdev)
+ struct jsm_board *brd = pci_get_drvdata(pdev);
+
+ pci_restore_state(pdev);
++ pci_save_state(pdev);
+
+ jsm_uart_port_init(brd);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch
new file mode 100644
index 0000000..b272ea6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch
@@ -0,0 +1,53 @@
+From 0d33ba8639e38e3d78f9dbeb8fac20ea28684cef Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 19 Jan 2012 08:20:57 -0800
+Subject: [PATCH 53/90] iwlwifi: fix PCI-E transport "inta" race
+
+commit b49ba04a3a0382e7314d990707c21094c410425a upstream.
+
+When an interrupt comes in, we read the reason
+bits and collect them into "trans_pcie->inta".
+This happens with the spinlock held. However,
+there's a bug resetting this variable -- that
+happens after the spinlock has been released.
+This means that it is possible for interrupts
+to be missed if the reset happens after some
+other interrupt reasons were already added to
+the variable.
+
+I found this by code inspection, looking for a
+reason that we sometimes see random commands
+time out. It seems possible that this causes
+such behaviour, but I can't say for sure right
+now since it happens extremely infrequently on
+my test systems.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+index 1920237..1daf01e 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+@@ -957,11 +957,11 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
+ }
+ #endif
+
+- spin_unlock_irqrestore(&trans->shrd->lock, flags);
+-
+ /* saved interrupt in inta variable now we can reset trans_pcie->inta */
+ trans_pcie->inta = 0;
+
++ spin_unlock_irqrestore(&trans->shrd->lock, flags);
++
+ /* Now service all interrupt bits discovered above. */
+ if (inta & CSR_INT_BIT_HW_ERR) {
+ IWL_ERR(trans, "Hardware error detected. Restarting.\n");
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch
new file mode 100644
index 0000000..a502bc6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch
@@ -0,0 +1,34 @@
+From 8f71848d8e5ac400a72eeade1898ecbd99145261 Mon Sep 17 00:00:00 2001
+From: Ryan Mallon <rmallon@gmail.com>
+Date: Sat, 28 Jan 2012 08:51:40 +1100
+Subject: [PATCH 54/90] vmwgfx: Fix assignment in
+ vmw_framebuffer_create_handle
+
+commit bf9c05d5b6d19b3e4c9fe21047694e94f48db89b upstream.
+
+The assignment of handle in vmw_framebuffer_create_handle doesn't actually do anything useful and is incorrectly assigning an integer value to a pointer argument. It appears that this is a typo and should be dereferencing handle rather than assigning to it directly. This fixes a bug where an undefined handle value is potentially returned to user-space.
+
+Signed-off-by: Ryan Mallon <rmallon@gmail.com>
+Reviewed-by: Jakob Bornecrantz<jakob@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index f94b33a..7c88f1f 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -378,7 +378,7 @@ int vmw_framebuffer_create_handle(struct drm_framebuffer *fb,
+ unsigned int *handle)
+ {
+ if (handle)
+- handle = 0;
++ *handle = 0;
+
+ return 0;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch
new file mode 100644
index 0000000..9bed68e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch
@@ -0,0 +1,36 @@
+From 286cad08e0819522e35f30a9a55c8183d32b2b98 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Thu, 26 Jan 2012 12:29:42 +0100
+Subject: [PATCH 55/90] USB: Realtek cr: fix autopm scheduling while atomic
+
+commit b3ef051db763b640d1ff724b616ffba940896b44 upstream.
+
+Resolves:
+https://bugzilla.redhat.com/show_bug.cgi?id=784345
+
+Reported-by: Francis Moreau <francis.moro@gmail.com>
+Reported-and-tested-by: Christian D <chrisudeussen@gmail.com>
+Reported-and-tested-by: Jimmy Dorff <jdorff@phy.duke.edu>
+Reported-and-tested-by: collura@ieee.org
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/storage/realtek_cr.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
+index 0ce5f79..32c93d7 100644
+--- a/drivers/usb/storage/realtek_cr.c
++++ b/drivers/usb/storage/realtek_cr.c
+@@ -791,7 +791,7 @@ static void rts51x_suspend_timer_fn(unsigned long data)
+ rts51x_set_stat(chip, RTS51X_STAT_SS);
+ /* ignore mass storage interface's children */
+ pm_suspend_ignore_children(&us->pusb_intf->dev, true);
+- usb_autopm_put_interface(us->pusb_intf);
++ usb_autopm_put_interface_async(us->pusb_intf);
+ US_DEBUGP("%s: RTS51X_STAT_SS 01,"
+ "intf->pm_usage_cnt:%d, power.usage:%d\n",
+ __func__,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0056-USB-usbsevseg-fix-max-length.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0056-USB-usbsevseg-fix-max-length.patch
new file mode 100644
index 0000000..653b82e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0056-USB-usbsevseg-fix-max-length.patch
@@ -0,0 +1,34 @@
+From 3fa24c74797bced963fb71a175b49db16cac7949 Mon Sep 17 00:00:00 2001
+From: Harrison Metzger <harrisonmetz@gmail.com>
+Date: Sun, 15 Jan 2012 08:43:24 -0600
+Subject: [PATCH 56/90] USB: usbsevseg: fix max length
+
+commit 1097ccebe630170080c41df0edcf88e0626e9c75 upstream.
+
+This changes the max length for the usb seven segment delcom device to 8
+from 6. Delcom has both 6 and 8 variants and having 8 works fine with
+devices which are only 6.
+
+Signed-off-by: Harrison Metzger <harrisonmetz@gmail.com>
+Signed-off-by: Stuart Pook <stuart@acm.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/misc/usbsevseg.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/misc/usbsevseg.c b/drivers/usb/misc/usbsevseg.c
+index 417b8f2..59689fa 100644
+--- a/drivers/usb/misc/usbsevseg.c
++++ b/drivers/usb/misc/usbsevseg.c
+@@ -24,7 +24,7 @@
+
+ #define VENDOR_ID 0x0fc5
+ #define PRODUCT_ID 0x1227
+-#define MAXLEN 6
++#define MAXLEN 8
+
+ /* table of devices that work with this driver */
+ static const struct usb_device_id id_table[] = {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch
new file mode 100644
index 0000000..00eb4ac
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch
@@ -0,0 +1,94 @@
+From b19abe994096a9839b092cbf70a3948468d5fc70 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 21 Dec 2011 10:19:40 +0200
+Subject: [PATCH 57/90] usb: gadget: langwell: don't call gadget's
+ disconnect()
+
+commit 37fd37108449d574da11aa9055c5c8afb39ff226 upstream.
+
+UDC core will call disconnect() and unbind() for us upon the gadget
+removal, so we should not do it ourselves. Otherwise, a composite
+gadget will explode, for example. Others might too.
+
+This was introduced during conversion to new style gadget in 2c7f0989
+(usb: gadget: langwell: convert to new style).
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Cc: linux-usb@vger.kernel.org
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/langwell_udc.c | 18 ++++++++----------
+ 1 files changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/gadget/langwell_udc.c b/drivers/usb/gadget/langwell_udc.c
+index fa0fcc1..b0c5b6d 100644
+--- a/drivers/usb/gadget/langwell_udc.c
++++ b/drivers/usb/gadget/langwell_udc.c
+@@ -1522,8 +1522,7 @@ static void langwell_udc_stop(struct langwell_udc *dev)
+
+
+ /* stop all USB activities */
+-static void stop_activity(struct langwell_udc *dev,
+- struct usb_gadget_driver *driver)
++static void stop_activity(struct langwell_udc *dev)
+ {
+ struct langwell_ep *ep;
+ dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+@@ -1535,9 +1534,9 @@ static void stop_activity(struct langwell_udc *dev,
+ }
+
+ /* report disconnect; the driver is already quiesced */
+- if (driver) {
++ if (dev->driver) {
+ spin_unlock(&dev->lock);
+- driver->disconnect(&dev->gadget);
++ dev->driver->disconnect(&dev->gadget);
+ spin_lock(&dev->lock);
+ }
+
+@@ -1925,11 +1924,10 @@ static int langwell_stop(struct usb_gadget *g,
+
+ /* stop all usb activities */
+ dev->gadget.speed = USB_SPEED_UNKNOWN;
+- stop_activity(dev, driver);
+- spin_unlock_irqrestore(&dev->lock, flags);
+-
+ dev->gadget.dev.driver = NULL;
+ dev->driver = NULL;
++ stop_activity(dev);
++ spin_unlock_irqrestore(&dev->lock, flags);
+
+ device_remove_file(&dev->pdev->dev, &dev_attr_function);
+
+@@ -2733,7 +2731,7 @@ static void handle_usb_reset(struct langwell_udc *dev)
+ dev->bus_reset = 1;
+
+ /* reset all the queues, stop all USB activities */
+- stop_activity(dev, dev->driver);
++ stop_activity(dev);
+ dev->usb_state = USB_STATE_DEFAULT;
+ } else {
+ dev_vdbg(&dev->pdev->dev, "device controller reset\n");
+@@ -2741,7 +2739,7 @@ static void handle_usb_reset(struct langwell_udc *dev)
+ langwell_udc_reset(dev);
+
+ /* reset all the queues, stop all USB activities */
+- stop_activity(dev, dev->driver);
++ stop_activity(dev);
+
+ /* reset ep0 dQH and endptctrl */
+ ep0_reset(dev);
+@@ -3367,7 +3365,7 @@ static int langwell_udc_suspend(struct pci_dev *pdev, pm_message_t state)
+
+ spin_lock_irq(&dev->lock);
+ /* stop all usb activities */
+- stop_activity(dev, dev->driver);
++ stop_activity(dev);
+ spin_unlock_irq(&dev->lock);
+
+ /* free dTD dma_pool and dQH */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0058-usb-gadget-storage-endian-fix.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0058-usb-gadget-storage-endian-fix.patch
new file mode 100644
index 0000000..d3bda65
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0058-usb-gadget-storage-endian-fix.patch
@@ -0,0 +1,43 @@
+From 5e2120eb3e1016b52dbfdaf13b022617ba3252f4 Mon Sep 17 00:00:00 2001
+From: Andiry Xu <andiry.xu@amd.com>
+Date: Wed, 4 Jan 2012 15:18:27 +0800
+Subject: [PATCH 58/90] usb: gadget: storage: endian fix
+
+commit a85016390135d577c457876d0e905095600751de upstream.
+
+Fix some endian issues for storage gadgets.
+
+Signed-off-by: Andiry Xu <andiry.xu@amd.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/storage_common.c | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/storage_common.c b/drivers/usb/gadget/storage_common.c
+index c7f291a..85ea14e 100644
+--- a/drivers/usb/gadget/storage_common.c
++++ b/drivers/usb/gadget/storage_common.c
+@@ -598,16 +598,16 @@ static __maybe_unused struct usb_ss_cap_descriptor fsg_ss_cap_desc = {
+ | USB_5GBPS_OPERATION),
+ .bFunctionalitySupport = USB_LOW_SPEED_OPERATION,
+ .bU1devExitLat = USB_DEFAULT_U1_DEV_EXIT_LAT,
+- .bU2DevExitLat = USB_DEFAULT_U2_DEV_EXIT_LAT,
++ .bU2DevExitLat = cpu_to_le16(USB_DEFAULT_U2_DEV_EXIT_LAT),
+ };
+
+ static __maybe_unused struct usb_bos_descriptor fsg_bos_desc = {
+ .bLength = USB_DT_BOS_SIZE,
+ .bDescriptorType = USB_DT_BOS,
+
+- .wTotalLength = USB_DT_BOS_SIZE
++ .wTotalLength = cpu_to_le16(USB_DT_BOS_SIZE
+ + USB_DT_USB_EXT_CAP_SIZE
+- + USB_DT_USB_SS_CAP_SIZE,
++ + USB_DT_USB_SS_CAP_SIZE),
+
+ .bNumDeviceCaps = 2,
+ };
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch
new file mode 100644
index 0000000..29650a2
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch
@@ -0,0 +1,54 @@
+From 87dd7c175531bdc9938fa7948f75619962991a27 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Thu, 12 Jan 2012 10:55:13 +0100
+Subject: [PATCH 59/90] drivers/usb/host/ehci-fsl.c: add missing iounmap
+
+commit 2492c6e6454ff3edb11e273b071a6ea80a199c71 upstream.
+
+Add missing iounmap in error handling code, in a case where the function
+already preforms iounmap on some other execution path.
+
+A simplified version of the semantic match that finds this problem is as
+follows: (http://coccinelle.lip6.fr/)
+
+// <smpl>
+@@
+expression e;
+statement S,S1;
+int ret;
+@@
+e = \(ioremap\|ioremap_nocache\)(...)
+... when != iounmap(e)
+if (<+...e...+>) S
+... when any
+ when != iounmap(e)
+*if (...)
+ { ... when != iounmap(e)
+ return ...; }
+... when any
+iounmap(e);
+// </smpl>
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/ehci-fsl.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
+index e90344a..b556a72 100644
+--- a/drivers/usb/host/ehci-fsl.c
++++ b/drivers/usb/host/ehci-fsl.c
+@@ -125,7 +125,7 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver,
+ */
+ if (pdata->init && pdata->init(pdev)) {
+ retval = -ENODEV;
+- goto err3;
++ goto err4;
+ }
+
+ /* Enable USB controller, 83xx or 8536 */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch
new file mode 100644
index 0000000..7113e68
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch
@@ -0,0 +1,51 @@
+From b4e67c5c309a96709491f7ac2f57d80999eba389 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Mon, 14 Nov 2011 17:51:39 -0800
+Subject: [PATCH 60/90] xhci: Fix USB 3.0 device restart on resume.
+
+commit d0cd5d482b8a6dc92c6c69a5387baf72ea84f23a upstream.
+
+The xHCI hub port code gets passed a zero-based port number by the USB
+core. It then adds one to in order to find a device slot by port number
+and device speed by calling xhci_find_slot_id_by_port. That function
+clearly states it requires a one-based port number. The xHCI port
+status change event handler was using a zero-based port number that it
+got from find_faked_portnum_from_hw_portnum, not a one-based port
+number. This lead to the doorbells never being rung for a device after
+a resume, or worse, a different device with the same speed having its
+doorbell rung (which could lead to bad power management in the xHCI host
+controller).
+
+This patch should be backported to kernels as old as 2.6.39.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Acked-by: Andiry Xu <andiry.xu@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-ring.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index d28c586..ee0b4d7 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1215,6 +1215,7 @@ static void handle_vendor_event(struct xhci_hcd *xhci,
+ *
+ * Returns a zero-based port number, which is suitable for indexing into each of
+ * the split roothubs' port arrays and bus state arrays.
++ * Add one to it in order to call xhci_find_slot_id_by_port.
+ */
+ static unsigned int find_faked_portnum_from_hw_portnum(struct usb_hcd *hcd,
+ struct xhci_hcd *xhci, u32 port_id)
+@@ -1335,7 +1336,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ xhci_set_link_state(xhci, port_array, faked_port_index,
+ XDEV_U0);
+ slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+- faked_port_index);
++ faked_port_index + 1);
+ if (!slot_id) {
+ xhci_dbg(xhci, "slot_id is zero\n");
+ goto cleanup;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch
new file mode 100644
index 0000000..f906f07
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch
@@ -0,0 +1,40 @@
+From 910e3e93de89b8568e3bfb1c8c08c96f2be325f2 Mon Sep 17 00:00:00 2001
+From: Andiry Xu <andiry.xu@amd.com>
+Date: Wed, 18 Jan 2012 17:47:12 +0800
+Subject: [PATCH 61/90] xHCI: Cleanup isoc transfer ring when TD length
+ mismatch found
+
+commit cf840551a884360841bd3d3ce1ad0868ff0b759a upstream.
+
+When a TD length mismatch is found during isoc TRB enqueue, it directly
+returns -EINVAL. However, isoc transfer is partially enqueued at this time,
+and the ring should be cleared.
+
+This should be backported to kernels as old as 2.6.36, which contain the
+commit 522989a27c7badb608155b1f1dea3487ed431f74 "xhci: Fix failed
+enqueue in the middle of isoch TD."
+
+Signed-off-by: Andiry Xu <andiry.xu@amd.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-ring.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index ee0b4d7..ae92dc4 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3373,7 +3373,8 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ /* Check TD length */
+ if (running_total != td_len) {
+ xhci_err(xhci, "ISOC TD length unmatch\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto cleanup;
+ }
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch
new file mode 100644
index 0000000..e2e4d83
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch
@@ -0,0 +1,41 @@
+From 5dc5545c987453cafa4b441522cf61bbb89e80e4 Mon Sep 17 00:00:00 2001
+From: Sekhar Nori <nsekhar@ti.com>
+Date: Wed, 28 Dec 2011 12:02:57 +0530
+Subject: [PATCH 62/90] usb: musb: davinci: fix build breakage
+
+commit 006896fc612f11bf0624db7814a75d0d5410855f upstream.
+
+Commit 0020afb369859472a461ef4af6410732e929d402 (ARM: mach-davinci:
+remove mach/memory.h) removed mach/memory.h for DaVinci which broke
+DaVinci MUSB build.
+
+mach/memory.h is not actually needed in davinci.c, so remove it.
+While at it, also remove some more machine specific inclulde
+files which are not needed for build.
+
+Tested on DM644x EVM using USB card reader.
+
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/musb/davinci.c | 3 ---
+ 1 files changed, 0 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
+index 4d365d5..3911d9a 100644
+--- a/drivers/usb/musb/davinci.c
++++ b/drivers/usb/musb/davinci.c
+@@ -33,9 +33,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/dma-mapping.h>
+
+-#include <mach/hardware.h>
+-#include <mach/memory.h>
+-#include <asm/gpio.h>
+ #include <mach/cputype.h>
+
+ #include <asm/mach-types.h>
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch
new file mode 100644
index 0000000..f00fa80
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch
@@ -0,0 +1,43 @@
+From 2f13837e2029149d661b66d510f759aac22f4748 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Fri, 20 Jan 2012 10:09:23 -0500
+Subject: [PATCH 63/90] hwmon: (f71805f) Fix clamping of temperature limits
+
+commit 86b2bbfdbd1fcc4a3aa62ccd3f245c40c5ad5b85 upstream.
+
+Properly clamp temperature limits set by the user. Without this fix,
+attempts to write temperature limits above the maximum supported by
+the chip (255 degrees Celsius) would arbitrarily and unexpectedly
+result in the limit being set to 0 degree Celsius.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/f71805f.c | 10 +++++-----
+ 1 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwmon/f71805f.c b/drivers/hwmon/f71805f.c
+index 92f9497..6dbfd3e 100644
+--- a/drivers/hwmon/f71805f.c
++++ b/drivers/hwmon/f71805f.c
+@@ -283,11 +283,11 @@ static inline long temp_from_reg(u8 reg)
+
+ static inline u8 temp_to_reg(long val)
+ {
+- if (val < 0)
+- val = 0;
+- else if (val > 1000 * 0xff)
+- val = 0xff;
+- return ((val + 500) / 1000);
++ if (val <= 0)
++ return 0;
++ if (val >= 1000 * 0xff)
++ return 0xff;
++ return (val + 500) / 1000;
+ }
+
+ /*
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch
new file mode 100644
index 0000000..285534f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch
@@ -0,0 +1,46 @@
+From 99eb79f71c8d3baeb55b7584a11df76740950f22 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Fri, 27 Jan 2012 17:56:06 -0800
+Subject: [PATCH 64/90] hwmon: (w83627ehf) Disable setting DC mode for pwm2,
+ pwm3 on NCT6776F
+
+commit ad77c3e1808f07fa70f707b1c92a683b7c7d3f85 upstream.
+
+NCT6776F only supports pwm mode for pwm2 and pwm3. Return error if an attempt
+is made to set those pwm channels to DC mode.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83627ehf.c | 6 ++++++
+ 1 files changed, 6 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
+index 93f5fc7..4b57ab6 100644
+--- a/drivers/hwmon/w83627ehf.c
++++ b/drivers/hwmon/w83627ehf.c
+@@ -1319,6 +1319,7 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr,
+ {
+ struct w83627ehf_data *data = dev_get_drvdata(dev);
+ struct sensor_device_attribute *sensor_attr = to_sensor_dev_attr(attr);
++ struct w83627ehf_sio_data *sio_data = dev->platform_data;
+ int nr = sensor_attr->index;
+ unsigned long val;
+ int err;
+@@ -1330,6 +1331,11 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr,
+
+ if (val > 1)
+ return -EINVAL;
++
++ /* On NCT67766F, DC mode is only supported for pwm1 */
++ if (sio_data->kind == nct6776 && nr && val != 1)
++ return -EINVAL;
++
+ mutex_lock(&data->update_lock);
+ reg = w83627ehf_read_value(data, W83627EHF_REG_PWM_ENABLE[nr]);
+ data->pwm_mode[nr] = val;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch
new file mode 100644
index 0000000..1ca0623
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch
@@ -0,0 +1,40 @@
+From 8e9da00da23bf9103db8bb4172a89926c58dfb03 Mon Sep 17 00:00:00 2001
+From: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Date: Thu, 26 Jan 2012 15:59:00 -0500
+Subject: [PATCH 65/90] hwmon: (sht15) fix bad error code
+
+commit 6edf3c30af01854c416f8654d3d5d2652470afd4 upstream.
+
+When no platform data was supplied, returned error code was 0.
+
+Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/sht15.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
+index fe4104c..5357925 100644
+--- a/drivers/hwmon/sht15.c
++++ b/drivers/hwmon/sht15.c
+@@ -883,7 +883,7 @@ static int sht15_invalidate_voltage(struct notifier_block *nb,
+
+ static int __devinit sht15_probe(struct platform_device *pdev)
+ {
+- int ret = 0;
++ int ret;
+ struct sht15_data *data = kzalloc(sizeof(*data), GFP_KERNEL);
+ u8 status = 0;
+
+@@ -901,6 +901,7 @@ static int __devinit sht15_probe(struct platform_device *pdev)
+ init_waitqueue_head(&data->wait_queue);
+
+ if (pdev->dev.platform_data == NULL) {
++ ret = -EINVAL;
+ dev_err(&pdev->dev, "no platform data supplied\n");
+ goto err_free_data;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch
new file mode 100644
index 0000000..67a10cb
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch
@@ -0,0 +1,45 @@
+From 700634b182ca70f6b189ae7aa036d75111ce14f7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Mon, 16 Jan 2012 15:11:57 +0100
+Subject: [PATCH 66/90] USB: cdc-wdm: call wake_up_all to allow driver to
+ shutdown on device removal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 62aaf24dc125d7c55c93e313d15611f152b030c7 upstream.
+
+wdm_disconnect() waits for the mutex held by wdm_read() before
+calling wake_up_all(). This causes a deadlock, preventing device removal
+to complete. Do the wake_up_all() before we start waiting for the locks.
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Cc: Oliver Neukum <oliver@neukum.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 4a29a80..d2cda26 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -786,13 +786,13 @@ static void wdm_disconnect(struct usb_interface *intf)
+ /* to terminate pending flushes */
+ clear_bit(WDM_IN_USE, &desc->flags);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
++ wake_up_all(&desc->wait);
+ mutex_lock(&desc->rlock);
+ mutex_lock(&desc->wlock);
+ kill_urbs(desc);
+ cancel_work_sync(&desc->rxwork);
+ mutex_unlock(&desc->wlock);
+ mutex_unlock(&desc->rlock);
+- wake_up_all(&desc->wait);
+ if (!desc->count)
+ cleanup(desc);
+ mutex_unlock(&wdm_mutex);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch
new file mode 100644
index 0000000..4471b13
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch
@@ -0,0 +1,38 @@
+From 46e7b4556cd993a3bb20308498c31dabbe96aceb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Mon, 16 Jan 2012 15:11:59 +0100
+Subject: [PATCH 67/90] USB: cdc-wdm: better allocate a buffer that is at
+ least as big as we tell the USB core
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 655e247daf52b202a6c2d0f8a06dd2051e756ce4 upstream.
+
+As it turns out, there was a mismatch between the allocated inbuf size
+(desc->bMaxPacketSize0, typically something like 64) and the length we
+specified in the URB (desc->wMaxCommand, typically something like 2048)
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Cc: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index d2cda26..f0deb9e 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -723,7 +723,7 @@ next_desc:
+ goto err;
+
+ desc->inbuf = usb_alloc_coherent(interface_to_usbdev(intf),
+- desc->bMaxPacketSize0,
++ desc->wMaxCommand,
+ GFP_KERNEL,
+ &desc->response->transfer_dma);
+ if (!desc->inbuf)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch
new file mode 100644
index 0000000..1e330f9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch
@@ -0,0 +1,53 @@
+From c7d772ceccb6b83acc2c71e0640ac5293e0b2713 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Fri, 20 Jan 2012 01:49:57 +0100
+Subject: [PATCH 68/90] USB: cdc-wdm: Avoid hanging on interface with no
+ USB_CDC_DMM_TYPE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 15699e6fafc3a90e5fdc2ef30555a04dee62286f upstream.
+
+The probe does not strictly require the USB_CDC_DMM_TYPE
+descriptor, which is a good thing as it makes the driver
+usable on non-conforming interfaces. A user could e.g.
+bind to it to a CDC ECM interface by using the new_id and
+bind sysfs files. But this would fail with a 0 buffer length
+due to the missing descriptor.
+
+Fix by defining a reasonable fallback size: The minimum
+device receive buffer size required by the CDC WMC standard,
+revision 1.1
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-wdm.c | 4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index f0deb9e..fd4aee1 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -57,6 +57,8 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
+
+ #define WDM_MAX 16
+
++/* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */
++#define WDM_DEFAULT_BUFSIZE 256
+
+ static DEFINE_MUTEX(wdm_mutex);
+
+@@ -636,7 +638,7 @@ static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ struct usb_cdc_dmm_desc *dmhd;
+ u8 *buffer = intf->altsetting->extra;
+ int buflen = intf->altsetting->extralen;
+- u16 maxcom = 0;
++ u16 maxcom = WDM_DEFAULT_BUFSIZE;
+
+ if (!buffer)
+ goto out;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0069-netns-fix-net_alloc_generic.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0069-netns-fix-net_alloc_generic.patch
new file mode 100644
index 0000000..95e6041
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0069-netns-fix-net_alloc_generic.patch
@@ -0,0 +1,120 @@
+From 0c5f77f70263e78633b63a24692dd6be6cf99732 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Thu, 26 Jan 2012 00:41:38 +0000
+Subject: [PATCH 69/90] netns: fix net_alloc_generic()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 073862ba5d249c20bd5c49fc6d904ff0e1f6a672 ]
+
+When a new net namespace is created, we should attach to it a "struct
+net_generic" with enough slots (even empty), or we can hit the following
+BUG_ON() :
+
+[ 200.752016] kernel BUG at include/net/netns/generic.h:40!
+...
+[ 200.752016] [<ffffffff825c3cea>] ? get_cfcnfg+0x3a/0x180
+[ 200.752016] [<ffffffff821cf0b0>] ? lockdep_rtnl_is_held+0x10/0x20
+[ 200.752016] [<ffffffff825c41be>] caif_device_notify+0x2e/0x530
+[ 200.752016] [<ffffffff810d61b7>] notifier_call_chain+0x67/0x110
+[ 200.752016] [<ffffffff810d67c1>] raw_notifier_call_chain+0x11/0x20
+[ 200.752016] [<ffffffff821bae82>] call_netdevice_notifiers+0x32/0x60
+[ 200.752016] [<ffffffff821c2b26>] register_netdevice+0x196/0x300
+[ 200.752016] [<ffffffff821c2ca9>] register_netdev+0x19/0x30
+[ 200.752016] [<ffffffff81c1c67a>] loopback_net_init+0x4a/0xa0
+[ 200.752016] [<ffffffff821b5e62>] ops_init+0x42/0x180
+[ 200.752016] [<ffffffff821b600b>] setup_net+0x6b/0x100
+[ 200.752016] [<ffffffff821b6466>] copy_net_ns+0x86/0x110
+[ 200.752016] [<ffffffff810d5789>] create_new_namespaces+0xd9/0x190
+
+net_alloc_generic() should take into account the maximum index into the
+ptr array, as a subsystem might use net_generic() anytime.
+
+This also reduces number of reallocations in net_assign_generic()
+
+Reported-by: Sasha Levin <levinsasha928@gmail.com>
+Tested-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Sjur Brændeland <sjur.brandeland@stericsson.com>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Cc: Pavel Emelyanov <xemul@openvz.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net_namespace.c | 31 ++++++++++++++++---------------
+ 1 files changed, 16 insertions(+), 15 deletions(-)
+
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index aefcd7a..0e950fd 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -30,6 +30,20 @@ EXPORT_SYMBOL(init_net);
+
+ #define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */
+
++static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
++
++static struct net_generic *net_alloc_generic(void)
++{
++ struct net_generic *ng;
++ size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
++
++ ng = kzalloc(generic_size, GFP_KERNEL);
++ if (ng)
++ ng->len = max_gen_ptrs;
++
++ return ng;
++}
++
+ static int net_assign_generic(struct net *net, int id, void *data)
+ {
+ struct net_generic *ng, *old_ng;
+@@ -43,8 +57,7 @@ static int net_assign_generic(struct net *net, int id, void *data)
+ if (old_ng->len >= id)
+ goto assign;
+
+- ng = kzalloc(sizeof(struct net_generic) +
+- id * sizeof(void *), GFP_KERNEL);
++ ng = net_alloc_generic();
+ if (ng == NULL)
+ return -ENOMEM;
+
+@@ -59,7 +72,6 @@ static int net_assign_generic(struct net *net, int id, void *data)
+ * the old copy for kfree after a grace period.
+ */
+
+- ng->len = id;
+ memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
+
+ rcu_assign_pointer(net->gen, ng);
+@@ -161,18 +173,6 @@ out_undo:
+ goto out;
+ }
+
+-static struct net_generic *net_alloc_generic(void)
+-{
+- struct net_generic *ng;
+- size_t generic_size = sizeof(struct net_generic) +
+- INITIAL_NET_GEN_PTRS * sizeof(void *);
+-
+- ng = kzalloc(generic_size, GFP_KERNEL);
+- if (ng)
+- ng->len = INITIAL_NET_GEN_PTRS;
+-
+- return ng;
+-}
+
+ #ifdef CONFIG_NET_NS
+ static struct kmem_cache *net_cachep;
+@@ -483,6 +483,7 @@ again:
+ }
+ return error;
+ }
++ max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id);
+ }
+ error = __register_pernet_operations(list, ops);
+ if (error) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch
new file mode 100644
index 0000000..6b4adf3
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch
@@ -0,0 +1,42 @@
+From 8b924dd991cfa0b36c65001ff07050cf2b30bd93 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Thu, 26 Jan 2012 14:02:55 +0000
+Subject: [PATCH 70/90] netns: Fail conspicously if someone uses net_generic
+ at an inappropriate time.
+
+[ Upstream commit 5ee4433efe99b9f39f6eff5052a177bbcfe72cea ]
+
+By definition net_generic should never be called when it can return
+NULL. Fail conspicously with a BUG_ON to make it clear when people mess
+up that a NULL return should never happen.
+
+Recently there was a bug in the CAIF subsystem where it was registered
+with register_pernet_device instead of register_pernet_subsys. It was
+erroneously concluded that net_generic could validly return NULL and
+that net_assign_generic was buggy (when it was just inefficient).
+Hopefully this BUG_ON will prevent people to coming to similar erroneous
+conclusions in the futrue.
+
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Tested-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/netns/generic.h | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/include/net/netns/generic.h b/include/net/netns/generic.h
+index 3419bf5..d55f434 100644
+--- a/include/net/netns/generic.h
++++ b/include/net/netns/generic.h
+@@ -41,6 +41,7 @@ static inline void *net_generic(const struct net *net, int id)
+ ptr = ng->ptr[id - 1];
+ rcu_read_unlock();
+
++ BUG_ON(!ptr);
+ return ptr;
+ }
+ #endif
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch
new file mode 100644
index 0000000..0c9d910
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch
@@ -0,0 +1,117 @@
+From 2483685b34bc96d19111c65b0629add54a29b458 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Thu, 26 Jan 2012 14:04:53 +0000
+Subject: [PATCH 71/90] net caif: Register properly as a pernet subsystem.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 8a8ee9aff6c3077dd9c2c7a77478e8ed362b96c6 ]
+
+caif is a subsystem and as such it needs to register with
+register_pernet_subsys instead of register_pernet_device.
+
+Among other problems using register_pernet_device was resulting in
+net_generic being called before the caif_net structure was allocated.
+Which has been causing net_generic to fail with either BUG_ON's or by
+return NULL pointers.
+
+A more ugly problem that could be caused is packets in flight why the
+subsystem is shutting down.
+
+To remove confusion also remove the cruft cause by inappropriately
+trying to fix this bug.
+
+With the aid of the previous patch I have tested this patch and
+confirmed that using register_pernet_subsys makes the failure go away as
+it should.
+
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Acked-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
+Tested-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/caif/caif_dev.c | 11 ++++-------
+ net/caif/cfcnfg.c | 1 -
+ 2 files changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
+index f1fa1f6..68223e4 100644
+--- a/net/caif/caif_dev.c
++++ b/net/caif/caif_dev.c
+@@ -53,7 +53,6 @@ struct cfcnfg *get_cfcnfg(struct net *net)
+ struct caif_net *caifn;
+ BUG_ON(!net);
+ caifn = net_generic(net, caif_net_id);
+- BUG_ON(!caifn);
+ return caifn->cfg;
+ }
+ EXPORT_SYMBOL(get_cfcnfg);
+@@ -63,7 +62,6 @@ static struct caif_device_entry_list *caif_device_list(struct net *net)
+ struct caif_net *caifn;
+ BUG_ON(!net);
+ caifn = net_generic(net, caif_net_id);
+- BUG_ON(!caifn);
+ return &caifn->caifdevs;
+ }
+
+@@ -92,7 +90,6 @@ static struct caif_device_entry *caif_device_alloc(struct net_device *dev)
+ struct caif_device_entry *caifd;
+
+ caifdevs = caif_device_list(dev_net(dev));
+- BUG_ON(!caifdevs);
+
+ caifd = kzalloc(sizeof(*caifd), GFP_KERNEL);
+ if (!caifd)
+@@ -112,7 +109,7 @@ static struct caif_device_entry *caif_get(struct net_device *dev)
+ struct caif_device_entry_list *caifdevs =
+ caif_device_list(dev_net(dev));
+ struct caif_device_entry *caifd;
+- BUG_ON(!caifdevs);
++
+ list_for_each_entry_rcu(caifd, &caifdevs->list, list) {
+ if (caifd->netdev == dev)
+ return caifd;
+@@ -353,7 +350,7 @@ static struct notifier_block caif_device_notifier = {
+ static int caif_init_net(struct net *net)
+ {
+ struct caif_net *caifn = net_generic(net, caif_net_id);
+- BUG_ON(!caifn);
++
+ INIT_LIST_HEAD(&caifn->caifdevs.list);
+ mutex_init(&caifn->caifdevs.lock);
+
+@@ -418,7 +415,7 @@ static int __init caif_device_init(void)
+ {
+ int result;
+
+- result = register_pernet_device(&caif_net_ops);
++ result = register_pernet_subsys(&caif_net_ops);
+
+ if (result)
+ return result;
+@@ -431,7 +428,7 @@ static int __init caif_device_init(void)
+
+ static void __exit caif_device_exit(void)
+ {
+- unregister_pernet_device(&caif_net_ops);
++ unregister_pernet_subsys(&caif_net_ops);
+ unregister_netdevice_notifier(&caif_device_notifier);
+ dev_remove_pack(&caif_packet_type);
+ }
+diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
+index 00523ec..86ff37c 100644
+--- a/net/caif/cfcnfg.c
++++ b/net/caif/cfcnfg.c
+@@ -309,7 +309,6 @@ int caif_connect_client(struct net *net, struct caif_connect_request *conn_req,
+ int err;
+ struct cfctrl_link_param param;
+ struct cfcnfg *cfg = get_cfcnfg(net);
+- caif_assert(cfg != NULL);
+
+ rcu_read_lock();
+ err = caif_connect_req_to_link_param(cfg, conn_req, ¶m);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch
new file mode 100644
index 0000000..6ddc4a0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch
@@ -0,0 +1,96 @@
+From cfd240df5a18d890c434c05ccff9e12cc83140a4 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Sat, 28 Jan 2012 16:11:03 +0000
+Subject: [PATCH 72/90] af_unix: fix EPOLLET regression for stream sockets
+
+[ Upstream commit 6f01fd6e6f6809061b56e78f1e8d143099716d70 ]
+
+Commit 0884d7aa24 (AF_UNIX: Fix poll blocking problem when reading from
+a stream socket) added a regression for epoll() in Edge Triggered mode
+(EPOLLET)
+
+Appropriate fix is to use skb_peek()/skb_unlink() instead of
+skb_dequeue(), and only call skb_unlink() when skb is fully consumed.
+
+This remove the need to requeue a partial skb into sk_receive_queue head
+and the extra sk->sk_data_ready() calls that added the regression.
+
+This is safe because once skb is given to sk_receive_queue, it is not
+modified by a writer, and readers are serialized by u->readlock mutex.
+
+This also reduce number of spinlock acquisition for small reads or
+MSG_PEEK users so should improve overall performance.
+
+Reported-by: Nick Mathewson <nickm@freehaven.net>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Alexey Moiseytsev <himeraster@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/unix/af_unix.c | 19 ++++---------------
+ 1 files changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index b595a3d..d99678a 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1915,7 +1915,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ struct sk_buff *skb;
+
+ unix_state_lock(sk);
+- skb = skb_dequeue(&sk->sk_receive_queue);
++ skb = skb_peek(&sk->sk_receive_queue);
+ if (skb == NULL) {
+ unix_sk(sk)->recursion_level = 0;
+ if (copied >= target)
+@@ -1955,11 +1955,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ if (check_creds) {
+ /* Never glue messages from different writers */
+ if ((UNIXCB(skb).pid != siocb->scm->pid) ||
+- (UNIXCB(skb).cred != siocb->scm->cred)) {
+- skb_queue_head(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
++ (UNIXCB(skb).cred != siocb->scm->cred))
+ break;
+- }
+ } else {
+ /* Copy credentials */
+ scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).cred);
+@@ -1974,8 +1971,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+
+ chunk = min_t(unsigned int, skb->len, size);
+ if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
+- skb_queue_head(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
+ if (copied == 0)
+ copied = -EFAULT;
+ break;
+@@ -1990,13 +1985,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ if (UNIXCB(skb).fp)
+ unix_detach_fds(siocb->scm, skb);
+
+- /* put the skb back if we didn't use it up.. */
+- if (skb->len) {
+- skb_queue_head(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
++ if (skb->len)
+ break;
+- }
+
++ skb_unlink(skb, &sk->sk_receive_queue);
+ consume_skb(skb);
+
+ if (siocb->scm->fp)
+@@ -2007,9 +1999,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ if (UNIXCB(skb).fp)
+ siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp);
+
+- /* put message back and return */
+- skb_queue_head(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
+ break;
+ }
+ } while (size);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch
new file mode 100644
index 0000000..3c97194
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch
@@ -0,0 +1,116 @@
+From b0f214df7c16b27e302fb5740be5b1f4264e2235 Mon Sep 17 00:00:00 2001
+From: Jiri Bohac <jbohac@suse.cz>
+Date: Wed, 18 Jan 2012 12:24:54 +0000
+Subject: [PATCH 73/90] bonding: fix enslaving in alb mode when link down
+
+[ Upstream commit b924551bed09f61b64f21bffe241afc5526b091a ]
+
+bond_alb_init_slave() is called from bond_enslave() and sets the slave's MAC
+address. This is done differently for TLB and ALB modes.
+bond->alb_info.rlb_enabled is used to discriminate between the two modes but
+this flag may be uninitialized if the slave is being enslaved prior to calling
+bond_open() -> bond_alb_initialize() on the master.
+
+It turns out all the callers of alb_set_slave_mac_addr() pass
+bond->alb_info.rlb_enabled as the hw parameter.
+
+This patch cleans up the unnecessary parameter of alb_set_slave_mac_addr() and
+makes the function decide based on the bonding mode instead, which fixes the
+above problem.
+
+Reported-by: Narendra K <Narendra_K@Dell.com>
+Signed-off-by: Jiri Bohac <jbohac@suse.cz>
+Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_alb.c | 27 +++++++++------------------
+ 1 files changed, 9 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index 106b88a..30431d8 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -871,16 +871,12 @@ static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[])
+ }
+ }
+
+-/* hw is a boolean parameter that determines whether we should try and
+- * set the hw address of the device as well as the hw address of the
+- * net_device
+- */
+-static int alb_set_slave_mac_addr(struct slave *slave, u8 addr[], int hw)
++static int alb_set_slave_mac_addr(struct slave *slave, u8 addr[])
+ {
+ struct net_device *dev = slave->dev;
+ struct sockaddr s_addr;
+
+- if (!hw) {
++ if (slave->bond->params.mode == BOND_MODE_TLB) {
+ memcpy(dev->dev_addr, addr, dev->addr_len);
+ return 0;
+ }
+@@ -910,8 +906,8 @@ static void alb_swap_mac_addr(struct bonding *bond, struct slave *slave1, struct
+ u8 tmp_mac_addr[ETH_ALEN];
+
+ memcpy(tmp_mac_addr, slave1->dev->dev_addr, ETH_ALEN);
+- alb_set_slave_mac_addr(slave1, slave2->dev->dev_addr, bond->alb_info.rlb_enabled);
+- alb_set_slave_mac_addr(slave2, tmp_mac_addr, bond->alb_info.rlb_enabled);
++ alb_set_slave_mac_addr(slave1, slave2->dev->dev_addr);
++ alb_set_slave_mac_addr(slave2, tmp_mac_addr);
+
+ }
+
+@@ -1058,8 +1054,7 @@ static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slav
+
+ /* Try setting slave mac to bond address and fall-through
+ to code handling that situation below... */
+- alb_set_slave_mac_addr(slave, bond->dev->dev_addr,
+- bond->alb_info.rlb_enabled);
++ alb_set_slave_mac_addr(slave, bond->dev->dev_addr);
+ }
+
+ /* The slave's address is equal to the address of the bond.
+@@ -1095,8 +1090,7 @@ static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slav
+ }
+
+ if (free_mac_slave) {
+- alb_set_slave_mac_addr(slave, free_mac_slave->perm_hwaddr,
+- bond->alb_info.rlb_enabled);
++ alb_set_slave_mac_addr(slave, free_mac_slave->perm_hwaddr);
+
+ pr_warning("%s: Warning: the hw address of slave %s is in use by the bond; giving it the hw address of %s\n",
+ bond->dev->name, slave->dev->name,
+@@ -1451,8 +1445,7 @@ int bond_alb_init_slave(struct bonding *bond, struct slave *slave)
+ {
+ int res;
+
+- res = alb_set_slave_mac_addr(slave, slave->perm_hwaddr,
+- bond->alb_info.rlb_enabled);
++ res = alb_set_slave_mac_addr(slave, slave->perm_hwaddr);
+ if (res) {
+ return res;
+ }
+@@ -1603,8 +1596,7 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
+ alb_swap_mac_addr(bond, swap_slave, new_slave);
+ } else {
+ /* set the new_slave to the bond mac address */
+- alb_set_slave_mac_addr(new_slave, bond->dev->dev_addr,
+- bond->alb_info.rlb_enabled);
++ alb_set_slave_mac_addr(new_slave, bond->dev->dev_addr);
+ }
+
+ if (swap_slave) {
+@@ -1664,8 +1656,7 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
+ alb_swap_mac_addr(bond, swap_slave, bond->curr_active_slave);
+ alb_fasten_mac_swap(bond, swap_slave, bond->curr_active_slave);
+ } else {
+- alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr,
+- bond->alb_info.rlb_enabled);
++ alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr);
+
+ read_lock(&bond->lock);
+ alb_send_learning_packets(bond->curr_active_slave, bond_dev->dev_addr);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch
new file mode 100644
index 0000000..8851dd4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch
@@ -0,0 +1,73 @@
+From 992c1eea6e2a220a7e157952fe30a4963bbb7c43 Mon Sep 17 00:00:00 2001
+From: James Chapman <jchapman@katalix.com>
+Date: Wed, 25 Jan 2012 02:39:05 +0000
+Subject: [PATCH 74/90] l2tp: l2tp_ip - fix possible oops on packet receive
+
+[ Upstream commit 68315801dbf3ab2001679fd2074c9dc5dcf87dfa ]
+
+When a packet is received on an L2TP IP socket (L2TPv3 IP link
+encapsulation), the l2tpip socket's backlog_rcv function calls
+xfrm4_policy_check(). This is not necessary, since it was called
+before the skb was added to the backlog. With CONFIG_NET_NS enabled,
+xfrm4_policy_check() will oops if skb->dev is null, so this trivial
+patch removes the call.
+
+This bug has always been present, but only when CONFIG_NET_NS is
+enabled does it cause problems. Most users are probably using UDP
+encapsulation for L2TP, hence the problem has only recently
+surfaced.
+
+EIP: 0060:[<c12bb62b>] EFLAGS: 00210246 CPU: 0
+EIP is at l2tp_ip_recvmsg+0xd4/0x2a7
+EAX: 00000001 EBX: d77b5180 ECX: 00000000 EDX: 00200246
+ESI: 00000000 EDI: d63cbd30 EBP: d63cbd18 ESP: d63cbcf4
+ DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
+Call Trace:
+ [<c1218568>] sock_common_recvmsg+0x31/0x46
+ [<c1215c92>] __sock_recvmsg_nosec+0x45/0x4d
+ [<c12163a1>] __sock_recvmsg+0x31/0x3b
+ [<c1216828>] sock_recvmsg+0x96/0xab
+ [<c10b2693>] ? might_fault+0x47/0x81
+ [<c10b2693>] ? might_fault+0x47/0x81
+ [<c1167fd0>] ? _copy_from_user+0x31/0x115
+ [<c121e8c8>] ? copy_from_user+0x8/0xa
+ [<c121ebd6>] ? verify_iovec+0x3e/0x78
+ [<c1216604>] __sys_recvmsg+0x10a/0x1aa
+ [<c1216792>] ? sock_recvmsg+0x0/0xab
+ [<c105a99b>] ? __lock_acquire+0xbdf/0xbee
+ [<c12d5a99>] ? do_page_fault+0x193/0x375
+ [<c10d1200>] ? fcheck_files+0x9b/0xca
+ [<c10d1259>] ? fget_light+0x2a/0x9c
+ [<c1216bbb>] sys_recvmsg+0x2b/0x43
+ [<c1218145>] sys_socketcall+0x16d/0x1a5
+ [<c11679f0>] ? trace_hardirqs_on_thunk+0xc/0x10
+ [<c100305f>] sysenter_do_call+0x12/0x38
+Code: c6 05 8c ea a8 c1 01 e8 0c d4 d9 ff 85 f6 74 07 3e ff 86 80 00 00 00 b9 17 b6 2b c1 ba 01 00 00 00 b8 78 ed 48 c1 e8 23 f6 d9 ff <ff> 76 0c 68 28 e3 30 c1 68 2d 44 41 c1 e8 89 57 01 00 83 c4 0c
+
+Signed-off-by: James Chapman <jchapman@katalix.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/l2tp/l2tp_ip.c | 5 -----
+ 1 files changed, 0 insertions(+), 5 deletions(-)
+
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index d21e7eb..55670ec 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -393,11 +393,6 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
+ {
+ int rc;
+
+- if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
+- goto drop;
+-
+- nf_reset(skb);
+-
+ /* Charge it to the socket, dropping if the queue is full. */
+ rc = sock_queue_rcv_skb(sk, skb);
+ if (rc < 0)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch
new file mode 100644
index 0000000..b2c541a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch
@@ -0,0 +1,34 @@
+From 9a5ecd485e43ba300c72a2c44a4e966b23750c5e Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Mon, 23 Jan 2012 05:38:59 +0000
+Subject: [PATCH 75/90] macvlan: fix a possible use after free
+
+[ Upstream commit 4ec7ac1203bcf21f5e3d977c9818b1a56c9ef40d ]
+
+Commit bc416d9768 (macvlan: handle fragmented multicast frames) added a
+possible use after free in macvlan_handle_frame(), since
+ip_check_defrag() uses pskb_may_pull() : skb header can be reallocated.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Ben Greear <greearb@candelatech.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/macvlan.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 7413497..959d448 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -172,6 +172,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
+ skb = ip_check_defrag(skb, IP_DEFRAG_MACVLAN);
+ if (!skb)
+ return RX_HANDLER_CONSUMED;
++ eth = eth_hdr(skb);
+ src = macvlan_hash_lookup(port, eth->h_source);
+ if (!src)
+ /* frame comes from an external address */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch
new file mode 100644
index 0000000..aaf9a46
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch
@@ -0,0 +1,129 @@
+From ad23030b9029340bee87a03793aaaa98b1df8a18 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Wed, 18 Jan 2012 07:21:42 +0000
+Subject: [PATCH 76/90] net: bpf_jit: fix divide by 0 generation
+
+[ Upstream commit d00a9dd21bdf7908b70866794c8313ee8a5abd5c ]
+
+Several problems fixed in this patch :
+
+1) Target of the conditional jump in case a divide by 0 is performed
+ by a bpf is wrong.
+
+2) Must 'generate' the full function prologue/epilogue at pass=0,
+ or else we can stop too early in pass=1 if the proglen doesnt change.
+ (if the increase of prologue/epilogue equals decrease of all
+ instructions length because some jumps are converted to near jumps)
+
+3) Change the wrong length detection at the end of code generation to
+ issue a more explicit message, no need for a full stack trace.
+
+Reported-by: Phil Oester <kernel@linuxace.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/net/bpf_jit_comp.c | 36 ++++++++++++++++++++++--------------
+ 1 files changed, 22 insertions(+), 14 deletions(-)
+
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 7b65f75..7c1b765 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -151,17 +151,18 @@ void bpf_jit_compile(struct sk_filter *fp)
+ cleanup_addr = proglen; /* epilogue address */
+
+ for (pass = 0; pass < 10; pass++) {
++ u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
+ /* no prologue/epilogue for trivial filters (RET something) */
+ proglen = 0;
+ prog = temp;
+
+- if (seen) {
++ if (seen_or_pass0) {
+ EMIT4(0x55, 0x48, 0x89, 0xe5); /* push %rbp; mov %rsp,%rbp */
+ EMIT4(0x48, 0x83, 0xec, 96); /* subq $96,%rsp */
+ /* note : must save %rbx in case bpf_error is hit */
+- if (seen & (SEEN_XREG | SEEN_DATAREF))
++ if (seen_or_pass0 & (SEEN_XREG | SEEN_DATAREF))
+ EMIT4(0x48, 0x89, 0x5d, 0xf8); /* mov %rbx, -8(%rbp) */
+- if (seen & SEEN_XREG)
++ if (seen_or_pass0 & SEEN_XREG)
+ CLEAR_X(); /* make sure we dont leek kernel memory */
+
+ /*
+@@ -170,7 +171,7 @@ void bpf_jit_compile(struct sk_filter *fp)
+ * r9 = skb->len - skb->data_len
+ * r8 = skb->data
+ */
+- if (seen & SEEN_DATAREF) {
++ if (seen_or_pass0 & SEEN_DATAREF) {
+ if (offsetof(struct sk_buff, len) <= 127)
+ /* mov off8(%rdi),%r9d */
+ EMIT4(0x44, 0x8b, 0x4f, offsetof(struct sk_buff, len));
+@@ -260,9 +261,14 @@ void bpf_jit_compile(struct sk_filter *fp)
+ case BPF_S_ALU_DIV_X: /* A /= X; */
+ seen |= SEEN_XREG;
+ EMIT2(0x85, 0xdb); /* test %ebx,%ebx */
+- if (pc_ret0 != -1)
+- EMIT_COND_JMP(X86_JE, addrs[pc_ret0] - (addrs[i] - 4));
+- else {
++ if (pc_ret0 > 0) {
++ /* addrs[pc_ret0 - 1] is start address of target
++ * (addrs[i] - 4) is the address following this jmp
++ * ("xor %edx,%edx; div %ebx" being 4 bytes long)
++ */
++ EMIT_COND_JMP(X86_JE, addrs[pc_ret0 - 1] -
++ (addrs[i] - 4));
++ } else {
+ EMIT_COND_JMP(X86_JNE, 2 + 5);
+ CLEAR_A();
+ EMIT1_off32(0xe9, cleanup_addr - (addrs[i] - 4)); /* jmp .+off32 */
+@@ -335,12 +341,12 @@ void bpf_jit_compile(struct sk_filter *fp)
+ }
+ /* fallinto */
+ case BPF_S_RET_A:
+- if (seen) {
++ if (seen_or_pass0) {
+ if (i != flen - 1) {
+ EMIT_JMP(cleanup_addr - addrs[i]);
+ break;
+ }
+- if (seen & SEEN_XREG)
++ if (seen_or_pass0 & SEEN_XREG)
+ EMIT4(0x48, 0x8b, 0x5d, 0xf8); /* mov -8(%rbp),%rbx */
+ EMIT1(0xc9); /* leaveq */
+ }
+@@ -483,8 +489,9 @@ common_load: seen |= SEEN_DATAREF;
+ goto common_load;
+ case BPF_S_LDX_B_MSH:
+ if ((int)K < 0) {
+- if (pc_ret0 != -1) {
+- EMIT_JMP(addrs[pc_ret0] - addrs[i]);
++ if (pc_ret0 > 0) {
++ /* addrs[pc_ret0 - 1] is the start address */
++ EMIT_JMP(addrs[pc_ret0 - 1] - addrs[i]);
+ break;
+ }
+ CLEAR_A();
+@@ -599,13 +606,14 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
+ * use it to give the cleanup instruction(s) addr
+ */
+ cleanup_addr = proglen - 1; /* ret */
+- if (seen)
++ if (seen_or_pass0)
+ cleanup_addr -= 1; /* leaveq */
+- if (seen & SEEN_XREG)
++ if (seen_or_pass0 & SEEN_XREG)
+ cleanup_addr -= 4; /* mov -8(%rbp),%rbx */
+
+ if (image) {
+- WARN_ON(proglen != oldproglen);
++ if (proglen != oldproglen)
++ pr_err("bpb_jit_compile proglen=%u != oldproglen=%u\n", proglen, oldproglen);
+ break;
+ }
+ if (proglen == oldproglen) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch
new file mode 100644
index 0000000..71efe19
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch
@@ -0,0 +1,703 @@
+From c0c50d4a259eca186611e172563f5a6a06566b79 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Thu, 12 Jan 2012 04:41:32 +0000
+Subject: [PATCH 77/90] net: reintroduce missing rcu_assign_pointer() calls
+
+[ Upstream commit cf778b00e96df6d64f8e21b8395d1f8a859ecdc7 ]
+
+commit a9b3cd7f32 (rcu: convert uses of rcu_assign_pointer(x, NULL) to
+RCU_INIT_POINTER) did a lot of incorrect changes, since it did a
+complete conversion of rcu_assign_pointer(x, y) to RCU_INIT_POINTER(x,
+y).
+
+We miss needed barriers, even on x86, when y is not NULL.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+CC: Stephen Hemminger <shemminger@vyatta.com>
+CC: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 6 +++---
+ net/core/netpoll.c | 2 +-
+ net/decnet/dn_dev.c | 4 ++--
+ net/ipv4/devinet.c | 2 +-
+ net/ipv4/fib_trie.c | 10 +++++-----
+ net/ipv4/igmp.c | 8 ++++----
+ net/ipv4/ipip.c | 8 ++++----
+ net/ipv4/ipmr.c | 2 +-
+ net/ipv6/addrconf.c | 2 +-
+ net/ipv6/ip6_tunnel.c | 8 ++++----
+ net/ipv6/raw.c | 2 +-
+ net/ipv6/sit.c | 10 +++++-----
+ net/mac80211/agg-rx.c | 2 +-
+ net/mac80211/cfg.c | 4 ++--
+ net/mac80211/ibss.c | 2 +-
+ net/mac80211/sta_info.c | 6 +++---
+ net/netfilter/nf_conntrack_core.c | 2 +-
+ net/netfilter/nf_conntrack_ecache.c | 4 ++--
+ net/netfilter/nf_conntrack_extend.c | 2 +-
+ net/netfilter/nf_conntrack_helper.c | 2 +-
+ net/netfilter/nf_conntrack_netlink.c | 2 +-
+ net/netfilter/nf_log.c | 6 +++---
+ net/netfilter/nf_queue.c | 2 +-
+ net/netfilter/nfnetlink.c | 4 ++--
+ net/netlabel/netlabel_domainhash.c | 4 ++--
+ net/netlabel/netlabel_unlabeled.c | 6 ++----
+ net/phonet/af_phonet.c | 2 +-
+ net/phonet/pn_dev.c | 2 +-
+ net/phonet/socket.c | 2 +-
+ net/socket.c | 2 +-
+ net/sunrpc/auth_gss/auth_gss.c | 2 +-
+ net/xfrm/xfrm_user.c | 2 +-
+ 32 files changed, 61 insertions(+), 63 deletions(-)
+
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index 385aefe..0329404 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -990,9 +990,9 @@ static ssize_t store_xps_map(struct netdev_queue *queue,
+ nonempty = 1;
+ }
+
+- if (nonempty)
+- RCU_INIT_POINTER(dev->xps_maps, new_dev_maps);
+- else {
++ if (nonempty) {
++ rcu_assign_pointer(dev->xps_maps, new_dev_maps);
++ } else {
+ kfree(new_dev_maps);
+ RCU_INIT_POINTER(dev->xps_maps, NULL);
+ }
+diff --git a/net/core/netpoll.c b/net/core/netpoll.c
+index cf64c1f..5d4d896 100644
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -763,7 +763,7 @@ int __netpoll_setup(struct netpoll *np)
+ }
+
+ /* last thing to do is link it to the net device structure */
+- RCU_INIT_POINTER(ndev->npinfo, npinfo);
++ rcu_assign_pointer(ndev->npinfo, npinfo);
+
+ return 0;
+
+diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
+index 2ab16e1..74d321a 100644
+--- a/net/decnet/dn_dev.c
++++ b/net/decnet/dn_dev.c
+@@ -388,7 +388,7 @@ static int dn_dev_insert_ifa(struct dn_dev *dn_db, struct dn_ifaddr *ifa)
+ }
+
+ ifa->ifa_next = dn_db->ifa_list;
+- RCU_INIT_POINTER(dn_db->ifa_list, ifa);
++ rcu_assign_pointer(dn_db->ifa_list, ifa);
+
+ dn_ifaddr_notify(RTM_NEWADDR, ifa);
+ blocking_notifier_call_chain(&dnaddr_chain, NETDEV_UP, ifa);
+@@ -1093,7 +1093,7 @@ static struct dn_dev *dn_dev_create(struct net_device *dev, int *err)
+
+ memcpy(&dn_db->parms, p, sizeof(struct dn_dev_parms));
+
+- RCU_INIT_POINTER(dev->dn_ptr, dn_db);
++ rcu_assign_pointer(dev->dn_ptr, dn_db);
+ dn_db->dev = dev;
+ init_timer(&dn_db->timer);
+
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index 65f01dc..e41c40f 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -258,7 +258,7 @@ static struct in_device *inetdev_init(struct net_device *dev)
+ ip_mc_up(in_dev);
+
+ /* we can receive as soon as ip_ptr is set -- do this last */
+- RCU_INIT_POINTER(dev->ip_ptr, in_dev);
++ rcu_assign_pointer(dev->ip_ptr, in_dev);
+ out:
+ return in_dev;
+ out_kfree:
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 37b6711..3ce23f9 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -205,7 +205,7 @@ static inline struct tnode *node_parent_rcu(const struct rt_trie_node *node)
+ return (struct tnode *)(parent & ~NODE_TYPE_MASK);
+ }
+
+-/* Same as RCU_INIT_POINTER
++/* Same as rcu_assign_pointer
+ * but that macro() assumes that value is a pointer.
+ */
+ static inline void node_set_parent(struct rt_trie_node *node, struct tnode *ptr)
+@@ -529,7 +529,7 @@ static void tnode_put_child_reorg(struct tnode *tn, int i, struct rt_trie_node *
+ if (n)
+ node_set_parent(n, tn);
+
+- RCU_INIT_POINTER(tn->child[i], n);
++ rcu_assign_pointer(tn->child[i], n);
+ }
+
+ #define MAX_WORK 10
+@@ -1015,7 +1015,7 @@ static void trie_rebalance(struct trie *t, struct tnode *tn)
+
+ tp = node_parent((struct rt_trie_node *) tn);
+ if (!tp)
+- RCU_INIT_POINTER(t->trie, (struct rt_trie_node *)tn);
++ rcu_assign_pointer(t->trie, (struct rt_trie_node *)tn);
+
+ tnode_free_flush();
+ if (!tp)
+@@ -1027,7 +1027,7 @@ static void trie_rebalance(struct trie *t, struct tnode *tn)
+ if (IS_TNODE(tn))
+ tn = (struct tnode *)resize(t, (struct tnode *)tn);
+
+- RCU_INIT_POINTER(t->trie, (struct rt_trie_node *)tn);
++ rcu_assign_pointer(t->trie, (struct rt_trie_node *)tn);
+ tnode_free_flush();
+ }
+
+@@ -1164,7 +1164,7 @@ static struct list_head *fib_insert_node(struct trie *t, u32 key, int plen)
+ put_child(t, (struct tnode *)tp, cindex,
+ (struct rt_trie_node *)tn);
+ } else {
+- RCU_INIT_POINTER(t->trie, (struct rt_trie_node *)tn);
++ rcu_assign_pointer(t->trie, (struct rt_trie_node *)tn);
+ tp = tn;
+ }
+ }
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index c3cc64c..c8989a7 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -1244,7 +1244,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
+
+ im->next_rcu = in_dev->mc_list;
+ in_dev->mc_count++;
+- RCU_INIT_POINTER(in_dev->mc_list, im);
++ rcu_assign_pointer(in_dev->mc_list, im);
+
+ #ifdef CONFIG_IP_MULTICAST
+ igmpv3_del_delrec(in_dev, im->multiaddr);
+@@ -1816,7 +1816,7 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
+ iml->next_rcu = inet->mc_list;
+ iml->sflist = NULL;
+ iml->sfmode = MCAST_EXCLUDE;
+- RCU_INIT_POINTER(inet->mc_list, iml);
++ rcu_assign_pointer(inet->mc_list, iml);
+ ip_mc_inc_group(in_dev, addr);
+ err = 0;
+ done:
+@@ -2003,7 +2003,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
+ atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+ kfree_rcu(psl, rcu);
+ }
+- RCU_INIT_POINTER(pmc->sflist, newpsl);
++ rcu_assign_pointer(pmc->sflist, newpsl);
+ psl = newpsl;
+ }
+ rv = 1; /* > 0 for insert logic below if sl_count is 0 */
+@@ -2106,7 +2106,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
+ } else
+ (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
+ 0, NULL, 0);
+- RCU_INIT_POINTER(pmc->sflist, newpsl);
++ rcu_assign_pointer(pmc->sflist, newpsl);
+ pmc->sfmode = msf->imsf_fmode;
+ err = 0;
+ done:
+diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
+index 0b2e732..17ad951 100644
+--- a/net/ipv4/ipip.c
++++ b/net/ipv4/ipip.c
+@@ -231,7 +231,7 @@ static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
+ (iter = rtnl_dereference(*tp)) != NULL;
+ tp = &iter->next) {
+ if (t == iter) {
+- RCU_INIT_POINTER(*tp, t->next);
++ rcu_assign_pointer(*tp, t->next);
+ break;
+ }
+ }
+@@ -241,8 +241,8 @@ static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
+ {
+ struct ip_tunnel __rcu **tp = ipip_bucket(ipn, t);
+
+- RCU_INIT_POINTER(t->next, rtnl_dereference(*tp));
+- RCU_INIT_POINTER(*tp, t);
++ rcu_assign_pointer(t->next, rtnl_dereference(*tp));
++ rcu_assign_pointer(*tp, t);
+ }
+
+ static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
+@@ -792,7 +792,7 @@ static int __net_init ipip_fb_tunnel_init(struct net_device *dev)
+ return -ENOMEM;
+
+ dev_hold(dev);
+- RCU_INIT_POINTER(ipn->tunnels_wc[0], tunnel);
++ rcu_assign_pointer(ipn->tunnels_wc[0], tunnel);
+ return 0;
+ }
+
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 76a7f07..d2aae27 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1225,7 +1225,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
+
+ ret = ip_ra_control(sk, 1, mrtsock_destruct);
+ if (ret == 0) {
+- RCU_INIT_POINTER(mrt->mroute_sk, sk);
++ rcu_assign_pointer(mrt->mroute_sk, sk);
+ IPV4_DEVCONF_ALL(net, MC_FORWARDING)++;
+ }
+ rtnl_unlock();
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 36806de..836c4ea 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -429,7 +429,7 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
+ ndev->tstamp = jiffies;
+ addrconf_sysctl_register(ndev);
+ /* protected by rtnl_lock */
+- RCU_INIT_POINTER(dev->ip6_ptr, ndev);
++ rcu_assign_pointer(dev->ip6_ptr, ndev);
+
+ /* Join all-node multicast group */
+ ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 4e2e9ff..d19f499 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -218,8 +218,8 @@ ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
+ {
+ struct ip6_tnl __rcu **tp = ip6_tnl_bucket(ip6n, &t->parms);
+
+- RCU_INIT_POINTER(t->next , rtnl_dereference(*tp));
+- RCU_INIT_POINTER(*tp, t);
++ rcu_assign_pointer(t->next , rtnl_dereference(*tp));
++ rcu_assign_pointer(*tp, t);
+ }
+
+ /**
+@@ -237,7 +237,7 @@ ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
+ (iter = rtnl_dereference(*tp)) != NULL;
+ tp = &iter->next) {
+ if (t == iter) {
+- RCU_INIT_POINTER(*tp, t->next);
++ rcu_assign_pointer(*tp, t->next);
+ break;
+ }
+ }
+@@ -1450,7 +1450,7 @@ static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
+
+ t->parms.proto = IPPROTO_IPV6;
+ dev_hold(dev);
+- RCU_INIT_POINTER(ip6n->tnls_wc[0], t);
++ rcu_assign_pointer(ip6n->tnls_wc[0], t);
+ return 0;
+ }
+
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 331af3b..361ebf3 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -131,7 +131,7 @@ static mh_filter_t __rcu *mh_filter __read_mostly;
+
+ int rawv6_mh_filter_register(mh_filter_t filter)
+ {
+- RCU_INIT_POINTER(mh_filter, filter);
++ rcu_assign_pointer(mh_filter, filter);
+ return 0;
+ }
+ EXPORT_SYMBOL(rawv6_mh_filter_register);
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 96f3623..72a939d 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -182,7 +182,7 @@ static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
+ (iter = rtnl_dereference(*tp)) != NULL;
+ tp = &iter->next) {
+ if (t == iter) {
+- RCU_INIT_POINTER(*tp, t->next);
++ rcu_assign_pointer(*tp, t->next);
+ break;
+ }
+ }
+@@ -192,8 +192,8 @@ static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
+ {
+ struct ip_tunnel __rcu **tp = ipip6_bucket(sitn, t);
+
+- RCU_INIT_POINTER(t->next, rtnl_dereference(*tp));
+- RCU_INIT_POINTER(*tp, t);
++ rcu_assign_pointer(t->next, rtnl_dereference(*tp));
++ rcu_assign_pointer(*tp, t);
+ }
+
+ static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
+@@ -393,7 +393,7 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
+ p->addr = a->addr;
+ p->flags = a->flags;
+ t->prl_count++;
+- RCU_INIT_POINTER(t->prl, p);
++ rcu_assign_pointer(t->prl, p);
+ out:
+ return err;
+ }
+@@ -1177,7 +1177,7 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
+ if (!dev->tstats)
+ return -ENOMEM;
+ dev_hold(dev);
+- RCU_INIT_POINTER(sitn->tunnels_wc[0], tunnel);
++ rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
+ return 0;
+ }
+
+diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
+index 93b2434..41c2310 100644
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -326,7 +326,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
+ status = WLAN_STATUS_SUCCESS;
+
+ /* activate it for RX */
+- RCU_INIT_POINTER(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
++ rcu_assign_pointer(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
+
+ if (timeout)
+ mod_timer(&tid_agg_rx->session_timer, TU_TO_EXP_TIME(timeout));
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index d06c65f..11cee76 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -575,7 +575,7 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
+
+ sdata->vif.bss_conf.dtim_period = new->dtim_period;
+
+- RCU_INIT_POINTER(sdata->u.ap.beacon, new);
++ rcu_assign_pointer(sdata->u.ap.beacon, new);
+
+ synchronize_rcu();
+
+@@ -922,7 +922,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
+ return -EBUSY;
+ }
+
+- RCU_INIT_POINTER(vlansdata->u.vlan.sta, sta);
++ rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
+ }
+
+ sta->sdata = vlansdata;
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index ede9a8b..3ece106 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -184,7 +184,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+ *pos++ = 0; /* U-APSD no in use */
+ }
+
+- RCU_INIT_POINTER(ifibss->presp, skb);
++ rcu_assign_pointer(ifibss->presp, skb);
+
+ sdata->vif.bss_conf.beacon_int = beacon_int;
+ sdata->vif.bss_conf.basic_rates = basic_rates;
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 8eaa746..1fdd8ff 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -73,7 +73,7 @@ static int sta_info_hash_del(struct ieee80211_local *local,
+ if (!s)
+ return -ENOENT;
+ if (s == sta) {
+- RCU_INIT_POINTER(local->sta_hash[STA_HASH(sta->sta.addr)],
++ rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)],
+ s->hnext);
+ return 0;
+ }
+@@ -83,7 +83,7 @@ static int sta_info_hash_del(struct ieee80211_local *local,
+ s = rcu_dereference_protected(s->hnext,
+ lockdep_is_held(&local->sta_lock));
+ if (rcu_access_pointer(s->hnext)) {
+- RCU_INIT_POINTER(s->hnext, sta->hnext);
++ rcu_assign_pointer(s->hnext, sta->hnext);
+ return 0;
+ }
+
+@@ -232,7 +232,7 @@ static void sta_info_hash_add(struct ieee80211_local *local,
+ struct sta_info *sta)
+ {
+ sta->hnext = local->sta_hash[STA_HASH(sta->sta.addr)];
+- RCU_INIT_POINTER(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
++ rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
+ }
+
+ static void sta_unblock(struct work_struct *wk)
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 7202b06..1d15193 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -776,7 +776,7 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
+ if (exp->helper) {
+ help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
+ if (help)
+- RCU_INIT_POINTER(help->helper, exp->helper);
++ rcu_assign_pointer(help->helper, exp->helper);
+ }
+
+ #ifdef CONFIG_NF_CONNTRACK_MARK
+diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
+index b62c414..14af632 100644
+--- a/net/netfilter/nf_conntrack_ecache.c
++++ b/net/netfilter/nf_conntrack_ecache.c
+@@ -91,7 +91,7 @@ int nf_conntrack_register_notifier(struct net *net,
+ ret = -EBUSY;
+ goto out_unlock;
+ }
+- RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, new);
++ rcu_assign_pointer(net->ct.nf_conntrack_event_cb, new);
+ mutex_unlock(&nf_ct_ecache_mutex);
+ return ret;
+
+@@ -128,7 +128,7 @@ int nf_ct_expect_register_notifier(struct net *net,
+ ret = -EBUSY;
+ goto out_unlock;
+ }
+- RCU_INIT_POINTER(net->ct.nf_expect_event_cb, new);
++ rcu_assign_pointer(net->ct.nf_expect_event_cb, new);
+ mutex_unlock(&nf_ct_ecache_mutex);
+ return ret;
+
+diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
+index 4605c94..641ff5f 100644
+--- a/net/netfilter/nf_conntrack_extend.c
++++ b/net/netfilter/nf_conntrack_extend.c
+@@ -169,7 +169,7 @@ int nf_ct_extend_register(struct nf_ct_ext_type *type)
+ before updating alloc_size */
+ type->alloc_size = ALIGN(sizeof(struct nf_ct_ext), type->align)
+ + type->len;
+- RCU_INIT_POINTER(nf_ct_ext_types[type->id], type);
++ rcu_assign_pointer(nf_ct_ext_types[type->id], type);
+ update_alloc_size(type);
+ out:
+ mutex_unlock(&nf_ct_ext_type_mutex);
+diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
+index 93c4bdb..bbe23ba 100644
+--- a/net/netfilter/nf_conntrack_helper.c
++++ b/net/netfilter/nf_conntrack_helper.c
+@@ -145,7 +145,7 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
+ memset(&help->help, 0, sizeof(help->help));
+ }
+
+- RCU_INIT_POINTER(help->helper, helper);
++ rcu_assign_pointer(help->helper, helper);
+ out:
+ return ret;
+ }
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 257e772..782cdcd 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -1163,7 +1163,7 @@ ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[])
+ return -EOPNOTSUPP;
+ }
+
+- RCU_INIT_POINTER(help->helper, helper);
++ rcu_assign_pointer(help->helper, helper);
+
+ return 0;
+ }
+diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
+index ce0c406..957374a 100644
+--- a/net/netfilter/nf_log.c
++++ b/net/netfilter/nf_log.c
+@@ -55,7 +55,7 @@ int nf_log_register(u_int8_t pf, struct nf_logger *logger)
+ llog = rcu_dereference_protected(nf_loggers[pf],
+ lockdep_is_held(&nf_log_mutex));
+ if (llog == NULL)
+- RCU_INIT_POINTER(nf_loggers[pf], logger);
++ rcu_assign_pointer(nf_loggers[pf], logger);
+ }
+
+ mutex_unlock(&nf_log_mutex);
+@@ -92,7 +92,7 @@ int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger)
+ mutex_unlock(&nf_log_mutex);
+ return -ENOENT;
+ }
+- RCU_INIT_POINTER(nf_loggers[pf], logger);
++ rcu_assign_pointer(nf_loggers[pf], logger);
+ mutex_unlock(&nf_log_mutex);
+ return 0;
+ }
+@@ -250,7 +250,7 @@ static int nf_log_proc_dostring(ctl_table *table, int write,
+ mutex_unlock(&nf_log_mutex);
+ return -ENOENT;
+ }
+- RCU_INIT_POINTER(nf_loggers[tindex], logger);
++ rcu_assign_pointer(nf_loggers[tindex], logger);
+ mutex_unlock(&nf_log_mutex);
+ } else {
+ mutex_lock(&nf_log_mutex);
+diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
+index 99ffd28..b3a7db6 100644
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -40,7 +40,7 @@ int nf_register_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh)
+ else if (old)
+ ret = -EBUSY;
+ else {
+- RCU_INIT_POINTER(queue_handler[pf], qh);
++ rcu_assign_pointer(queue_handler[pf], qh);
+ ret = 0;
+ }
+ mutex_unlock(&queue_handler_mutex);
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index c879c1a..b4f8d84 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -59,7 +59,7 @@ int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n)
+ nfnl_unlock();
+ return -EBUSY;
+ }
+- RCU_INIT_POINTER(subsys_table[n->subsys_id], n);
++ rcu_assign_pointer(subsys_table[n->subsys_id], n);
+ nfnl_unlock();
+
+ return 0;
+@@ -210,7 +210,7 @@ static int __net_init nfnetlink_net_init(struct net *net)
+ if (!nfnl)
+ return -ENOMEM;
+ net->nfnl_stash = nfnl;
+- RCU_INIT_POINTER(net->nfnl, nfnl);
++ rcu_assign_pointer(net->nfnl, nfnl);
+ return 0;
+ }
+
+diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
+index 3f905e5..e5330ed 100644
+--- a/net/netlabel/netlabel_domainhash.c
++++ b/net/netlabel/netlabel_domainhash.c
+@@ -282,7 +282,7 @@ int __init netlbl_domhsh_init(u32 size)
+ INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
+
+ spin_lock(&netlbl_domhsh_lock);
+- RCU_INIT_POINTER(netlbl_domhsh, hsh_tbl);
++ rcu_assign_pointer(netlbl_domhsh, hsh_tbl);
+ spin_unlock(&netlbl_domhsh_lock);
+
+ return 0;
+@@ -330,7 +330,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
+ &rcu_dereference(netlbl_domhsh)->tbl[bkt]);
+ } else {
+ INIT_LIST_HEAD(&entry->list);
+- RCU_INIT_POINTER(netlbl_domhsh_def, entry);
++ rcu_assign_pointer(netlbl_domhsh_def, entry);
+ }
+
+ if (entry->type == NETLBL_NLTYPE_ADDRSELECT) {
+diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
+index e251c2c..d463f5a 100644
+--- a/net/netlabel/netlabel_unlabeled.c
++++ b/net/netlabel/netlabel_unlabeled.c
+@@ -354,7 +354,7 @@ static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
+ INIT_LIST_HEAD(&iface->list);
+ if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL)
+ goto add_iface_failure;
+- RCU_INIT_POINTER(netlbl_unlhsh_def, iface);
++ rcu_assign_pointer(netlbl_unlhsh_def, iface);
+ }
+ spin_unlock(&netlbl_unlhsh_lock);
+
+@@ -1447,11 +1447,9 @@ int __init netlbl_unlabel_init(u32 size)
+ for (iter = 0; iter < hsh_tbl->size; iter++)
+ INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
+
+- rcu_read_lock();
+ spin_lock(&netlbl_unlhsh_lock);
+- RCU_INIT_POINTER(netlbl_unlhsh, hsh_tbl);
++ rcu_assign_pointer(netlbl_unlhsh, hsh_tbl);
+ spin_unlock(&netlbl_unlhsh_lock);
+- rcu_read_unlock();
+
+ register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier);
+
+diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
+index bf10ea8..d65f699 100644
+--- a/net/phonet/af_phonet.c
++++ b/net/phonet/af_phonet.c
+@@ -480,7 +480,7 @@ int __init_or_module phonet_proto_register(unsigned int protocol,
+ if (proto_tab[protocol])
+ err = -EBUSY;
+ else
+- RCU_INIT_POINTER(proto_tab[protocol], pp);
++ rcu_assign_pointer(proto_tab[protocol], pp);
+ mutex_unlock(&proto_tab_lock);
+
+ return err;
+diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
+index c582761..9b9a85e 100644
+--- a/net/phonet/pn_dev.c
++++ b/net/phonet/pn_dev.c
+@@ -390,7 +390,7 @@ int phonet_route_add(struct net_device *dev, u8 daddr)
+ daddr = daddr >> 2;
+ mutex_lock(&routes->lock);
+ if (routes->table[daddr] == NULL) {
+- RCU_INIT_POINTER(routes->table[daddr], dev);
++ rcu_assign_pointer(routes->table[daddr], dev);
+ dev_hold(dev);
+ err = 0;
+ }
+diff --git a/net/phonet/socket.c b/net/phonet/socket.c
+index 3f8d0b1..4c7eff3 100644
+--- a/net/phonet/socket.c
++++ b/net/phonet/socket.c
+@@ -680,7 +680,7 @@ int pn_sock_bind_res(struct sock *sk, u8 res)
+ mutex_lock(&resource_mutex);
+ if (pnres.sk[res] == NULL) {
+ sock_hold(sk);
+- RCU_INIT_POINTER(pnres.sk[res], sk);
++ rcu_assign_pointer(pnres.sk[res], sk);
+ ret = 0;
+ }
+ mutex_unlock(&resource_mutex);
+diff --git a/net/socket.c b/net/socket.c
+index 2877647..2dce67a 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2472,7 +2472,7 @@ int sock_register(const struct net_proto_family *ops)
+ lockdep_is_held(&net_family_lock)))
+ err = -EEXIST;
+ else {
+- RCU_INIT_POINTER(net_families[ops->family], ops);
++ rcu_assign_pointer(net_families[ops->family], ops);
+ err = 0;
+ }
+ spin_unlock(&net_family_lock);
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index afb5655..db0efde 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -122,7 +122,7 @@ gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
+ if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
+ return;
+ gss_get_ctx(ctx);
+- RCU_INIT_POINTER(gss_cred->gc_ctx, ctx);
++ rcu_assign_pointer(gss_cred->gc_ctx, ctx);
+ set_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+ smp_mb__before_clear_bit();
+ clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags);
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index d0a42df..7cae73e 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -2927,7 +2927,7 @@ static int __net_init xfrm_user_net_init(struct net *net)
+ if (nlsk == NULL)
+ return -ENOMEM;
+ net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
+- RCU_INIT_POINTER(net->xfrm.nlsk, nlsk);
++ rcu_assign_pointer(net->xfrm.nlsk, nlsk);
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch
new file mode 100644
index 0000000..f8ed71f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch
@@ -0,0 +1,119 @@
+From cd494e9314acf83a286be19315a4cf99fd8de826 Mon Sep 17 00:00:00 2001
+From: "David S. Miller" <davem@davemloft.net>
+Date: Tue, 24 Jan 2012 17:03:44 -0500
+Subject: [PATCH 78/90] rds: Make rds_sock_lock BH rather than IRQ safe.
+
+[ Upstream commit efc3dbc37412c027e363736b4f4c74ee5e8ecffc ]
+
+rds_sock_info() triggers locking warnings because we try to perform a
+local_bh_enable() (via sock_i_ino()) while hardware interrupts are
+disabled (via taking rds_sock_lock).
+
+There is no reason for rds_sock_lock to be a hardware IRQ disabling
+lock, none of these access paths run in hardware interrupt context.
+
+Therefore making it a BH disabling lock is safe and sufficient to
+fix this bug.
+
+Reported-by: Kumar Sanghvi <kumaras@chelsio.com>
+Reported-by: Josh Boyer <jwboyer@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rds/af_rds.c | 20 ++++++++------------
+ 1 files changed, 8 insertions(+), 12 deletions(-)
+
+diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
+index bb6ad81..424ff62 100644
+--- a/net/rds/af_rds.c
++++ b/net/rds/af_rds.c
+@@ -68,7 +68,6 @@ static int rds_release(struct socket *sock)
+ {
+ struct sock *sk = sock->sk;
+ struct rds_sock *rs;
+- unsigned long flags;
+
+ if (!sk)
+ goto out;
+@@ -94,10 +93,10 @@ static int rds_release(struct socket *sock)
+ rds_rdma_drop_keys(rs);
+ rds_notify_queue_get(rs, NULL);
+
+- spin_lock_irqsave(&rds_sock_lock, flags);
++ spin_lock_bh(&rds_sock_lock);
+ list_del_init(&rs->rs_item);
+ rds_sock_count--;
+- spin_unlock_irqrestore(&rds_sock_lock, flags);
++ spin_unlock_bh(&rds_sock_lock);
+
+ rds_trans_put(rs->rs_transport);
+
+@@ -409,7 +408,6 @@ static const struct proto_ops rds_proto_ops = {
+
+ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
+ {
+- unsigned long flags;
+ struct rds_sock *rs;
+
+ sock_init_data(sock, sk);
+@@ -426,10 +424,10 @@ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
+ spin_lock_init(&rs->rs_rdma_lock);
+ rs->rs_rdma_keys = RB_ROOT;
+
+- spin_lock_irqsave(&rds_sock_lock, flags);
++ spin_lock_bh(&rds_sock_lock);
+ list_add_tail(&rs->rs_item, &rds_sock_list);
+ rds_sock_count++;
+- spin_unlock_irqrestore(&rds_sock_lock, flags);
++ spin_unlock_bh(&rds_sock_lock);
+
+ return 0;
+ }
+@@ -471,12 +469,11 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
+ {
+ struct rds_sock *rs;
+ struct rds_incoming *inc;
+- unsigned long flags;
+ unsigned int total = 0;
+
+ len /= sizeof(struct rds_info_message);
+
+- spin_lock_irqsave(&rds_sock_lock, flags);
++ spin_lock_bh(&rds_sock_lock);
+
+ list_for_each_entry(rs, &rds_sock_list, rs_item) {
+ read_lock(&rs->rs_recv_lock);
+@@ -492,7 +489,7 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
+ read_unlock(&rs->rs_recv_lock);
+ }
+
+- spin_unlock_irqrestore(&rds_sock_lock, flags);
++ spin_unlock_bh(&rds_sock_lock);
+
+ lens->nr = total;
+ lens->each = sizeof(struct rds_info_message);
+@@ -504,11 +501,10 @@ static void rds_sock_info(struct socket *sock, unsigned int len,
+ {
+ struct rds_info_socket sinfo;
+ struct rds_sock *rs;
+- unsigned long flags;
+
+ len /= sizeof(struct rds_info_socket);
+
+- spin_lock_irqsave(&rds_sock_lock, flags);
++ spin_lock_bh(&rds_sock_lock);
+
+ if (len < rds_sock_count)
+ goto out;
+@@ -529,7 +525,7 @@ out:
+ lens->nr = rds_sock_count;
+ lens->each = sizeof(struct rds_info_socket);
+
+- spin_unlock_irqrestore(&rds_sock_lock, flags);
++ spin_unlock_bh(&rds_sock_lock);
+ }
+
+ static void rds_exit(void)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch
new file mode 100644
index 0000000..cea976d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch
@@ -0,0 +1,61 @@
+From 7c06cc6faed622f1060c0d745187d5db147bdcfb Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Sat, 28 Jan 2012 17:29:46 +0000
+Subject: [PATCH 79/90] tcp: fix tcp_trim_head() to adjust segment count with
+ skb MSS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 5b35e1e6e9ca651e6b291c96d1106043c9af314a ]
+
+This commit fixes tcp_trim_head() to recalculate the number of
+segments in the skb with the skb's existing MSS, so trimming the head
+causes the skb segment count to be monotonically non-increasing - it
+should stay the same or go down, but not increase.
+
+Previously tcp_trim_head() used the current MSS of the connection. But
+if there was a decrease in MSS between original transmission and ACK
+(e.g. due to PMTUD), this could cause tcp_trim_head() to
+counter-intuitively increase the segment count when trimming bytes off
+the head of an skb. This violated assumptions in tcp_tso_acked() that
+tcp_trim_head() only decreases the packet count, so that packets_acked
+in tcp_tso_acked() could underflow, leading tcp_clean_rtx_queue() to
+pass u32 pkts_acked values as large as 0xffffffff to
+ca_ops->pkts_acked().
+
+As an aside, if tcp_trim_head() had really wanted the skb to reflect
+the current MSS, it should have called tcp_set_skb_tso_segs()
+unconditionally, since a decrease in MSS would mean that a
+single-packet skb should now be sliced into multiple segments.
+
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Nandita Dukkipati <nanditad@google.com>
+Acked-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_output.c | 6 ++----
+ 1 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 63170e2..097e0c7 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1138,11 +1138,9 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
+ sk_mem_uncharge(sk, len);
+ sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
+
+- /* Any change of skb->len requires recalculation of tso
+- * factor and mss.
+- */
++ /* Any change of skb->len requires recalculation of tso factor. */
+ if (tcp_skb_pcount(skb) > 1)
+- tcp_set_skb_tso_segs(sk, skb, tcp_current_mss(sk));
++ tcp_set_skb_tso_segs(sk, skb, tcp_skb_mss(skb));
+
+ return 0;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch
new file mode 100644
index 0000000..f25290f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch
@@ -0,0 +1,49 @@
+From fa61f0bd02896b7157e8f283aa3865863c22bf6c Mon Sep 17 00:00:00 2001
+From: shawnlu <shawn.lu@ericsson.com>
+Date: Fri, 20 Jan 2012 12:22:04 +0000
+Subject: [PATCH 80/90] tcp: md5: using remote adress for md5 lookup in rst
+ packet
+
+[ Upstream commit 8a622e71f58ec9f092fc99eacae0e6cf14f6e742 ]
+
+md5 key is added in socket through remote address.
+remote address should be used in finding md5 key when
+sending out reset packet.
+
+Signed-off-by: shawnlu <shawn.lu@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_ipv4.c | 2 +-
+ net/ipv6/tcp_ipv6.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index a9db4b1..c89e354 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -630,7 +630,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
+ arg.iov[0].iov_len = sizeof(rep.th);
+
+ #ifdef CONFIG_TCP_MD5SIG
+- key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr) : NULL;
++ key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->saddr) : NULL;
+ if (key) {
+ rep.opt[0] = htonl((TCPOPT_NOP << 24) |
+ (TCPOPT_NOP << 16) |
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 2dea4bb..b859e4a 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1084,7 +1084,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
+
+ #ifdef CONFIG_TCP_MD5SIG
+ if (sk)
+- key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
++ key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr);
+ #endif
+
+ if (th->ack)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch
new file mode 100644
index 0000000..a1a651a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch
@@ -0,0 +1,32 @@
+From 1a6d99718e0d5b2933b160cd5e7a8690e1c73ecd Mon Sep 17 00:00:00 2001
+From: Renato Caldas <rmsc@fe.up.pt>
+Date: Fri, 6 Jan 2012 15:20:51 +0000
+Subject: [PATCH 81/90] USB: serial: CP210x: Added USB-ID for the Link
+ Instruments MSO-19
+
+commit 791b7d7cf69de11275e4dccec2f538eec02cbff6 upstream.
+
+This device is a Oscilloscope/Logic Analizer/Pattern Generator/TDR,
+using a Silabs CP2103 USB to UART Bridge.
+
+Signed-off-by: Renato Caldas <rmsc@fe.up.pt>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index a1a324b..3b43d9b 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -138,6 +138,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+ { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
++ { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
+ { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
+ { } /* Terminating Entry */
+ };
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch
new file mode 100644
index 0000000..b4b68f1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch
@@ -0,0 +1,47 @@
+From 58521f4f0eea9b60818ecf8368fb0da47373e076 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Mon, 16 Jan 2012 00:36:48 +0100
+Subject: [PATCH 82/90] USB: cp210x: call generic open last in open
+
+commit 55b2afbb92ad92e9f6b0aa4354eb1c94589280c3 upstream.
+
+Make sure port is fully initialised before calling generic open.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 9 ++-------
+ 1 files changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 3b43d9b..cbcaddb 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -393,8 +393,6 @@ static unsigned int cp210x_quantise_baudrate(unsigned int baud) {
+
+ static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
+- int result;
+-
+ dbg("%s - port %d", __func__, port->number);
+
+ if (cp210x_set_config_single(port, CP210X_IFC_ENABLE, UART_ENABLE)) {
+@@ -403,13 +401,10 @@ static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port)
+ return -EPROTO;
+ }
+
+- result = usb_serial_generic_open(tty, port);
+- if (result)
+- return result;
+-
+ /* Configure the termios structure */
+ cp210x_get_termios(tty, port);
+- return 0;
++
++ return usb_serial_generic_open(tty, port);
+ }
+
+ static void cp210x_close(struct usb_serial_port *port)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch
new file mode 100644
index 0000000..e81cfb0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch
@@ -0,0 +1,78 @@
+From a9b16102aedd54ff9d2fe79ac4dada6c15cba91d Mon Sep 17 00:00:00 2001
+From: Preston Fick <preston.fick@silabs.com>
+Date: Mon, 16 Jan 2012 18:14:09 -0600
+Subject: [PATCH 83/90] USB: cp210x: fix CP2104 baudrate usage
+
+commit 7f482fc88ac47662228d6b1f05759797c8936a30 upstream.
+
+This fix changes the way baudrates are set on the CP210x devices from
+Silicon Labs. The CP2101/2/3 will respond to both a GET/SET_BAUDDIV
+command, and GET/SET_BAUDRATE command, while CP2104 and higher devices
+only respond to GET/SET_BAUDRATE. The current cp210x.ko driver in
+kernel version 3.2.0 only implements the GET/SET_BAUDDIV command.
+
+This patch implements the two new codes for the GET/SET_BAUDRATE
+commands. Then there is a change in the way that the baudrate is
+assigned or retrieved. This is done according to the CP210x USB
+specification in AN571. This document can be found here:
+http://www.silabs.com/pages/DownloadDoc.aspx?FILEURL=Support%20Documents/TechnicalDocs/AN571.pdf&src=DocumentationWebPart
+
+Sections 5.3/5.4 describe the USB packets for the old baudrate method.
+Sections 5.5/5.6 describe the USB packets for the new method. This
+patch also implements the new request scheme, and eliminates the
+unnecessary baudrate calculations since it uses the "actual baudrate"
+method.
+
+This patch solves the problem reported for the CP2104 in bug 42586,
+and also keeps support for all other devices (CP2101/2/3).
+
+This patchfile is also attached to the bug report on
+bugzilla.kernel.org. This patch has been developed and test on the
+3.2.0 mainline kernel version under Ubuntu 10.11.
+
+Signed-off-by: Preston Fick <preston.fick@silabs.com>
+[duplicate patch also sent by Johan - gregkh]
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 10 ++++------
+ 1 files changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index cbcaddb..60993dc 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -202,6 +202,8 @@ static struct usb_serial_driver cp210x_device = {
+ #define CP210X_EMBED_EVENTS 0x15
+ #define CP210X_GET_EVENTSTATE 0x16
+ #define CP210X_SET_CHARS 0x19
++#define CP210X_GET_BAUDRATE 0x1D
++#define CP210X_SET_BAUDRATE 0x1E
+
+ /* CP210X_IFC_ENABLE */
+ #define UART_ENABLE 0x0001
+@@ -456,10 +458,7 @@ static void cp210x_get_termios_port(struct usb_serial_port *port,
+
+ dbg("%s - port %d", __func__, port->number);
+
+- cp210x_get_config(port, CP210X_GET_BAUDDIV, &baud, 2);
+- /* Convert to baudrate */
+- if (baud)
+- baud = cp210x_quantise_baudrate((BAUD_RATE_GEN_FREQ + baud/2)/ baud);
++ cp210x_get_config(port, CP210X_GET_BAUDRATE, &baud, 4);
+
+ dbg("%s - baud rate = %d", __func__, baud);
+ *baudp = baud;
+@@ -594,8 +593,7 @@ static void cp210x_set_termios(struct tty_struct *tty,
+ if (baud != tty_termios_baud_rate(old_termios) && baud != 0) {
+ dbg("%s - Setting baud rate to %d baud", __func__,
+ baud);
+- if (cp210x_set_config_single(port, CP210X_SET_BAUDDIV,
+- ((BAUD_RATE_GEN_FREQ + baud/2) / baud))) {
++ if (cp210x_set_config(port, CP210X_SET_BAUDRATE, &baud, 4)) {
+ dbg("Baud rate requested not supported by device");
+ baud = tty_termios_baud_rate(old_termios);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch
new file mode 100644
index 0000000..1a934b9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch
@@ -0,0 +1,34 @@
+From 2b7e1cbfd3688396b3be797d2454d6a9f5426f42 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Mon, 16 Jan 2012 00:36:50 +0100
+Subject: [PATCH 84/90] USB: cp210x: do not map baud rates to B0
+
+commit be125d9c8d59560e7cc2d6e2b65c8fd233498ab7 upstream.
+
+We do not implement B0 hangup yet so map low baudrates to 300bps.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Cc: Preston Fick <preston.fick@silabs.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 60993dc..1bac7b9 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -357,8 +357,8 @@ static inline int cp210x_set_config_single(struct usb_serial_port *port,
+ * Quantises the baud rate as per AN205 Table 1
+ */
+ static unsigned int cp210x_quantise_baudrate(unsigned int baud) {
+- if (baud <= 56) baud = 0;
+- else if (baud <= 300) baud = 300;
++ if (baud <= 300)
++ baud = 300;
+ else if (baud <= 600) baud = 600;
+ else if (baud <= 1200) baud = 1200;
+ else if (baud <= 1800) baud = 1800;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch
new file mode 100644
index 0000000..6744226
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch
@@ -0,0 +1,44 @@
+From 921e92f0429586c745c182cea0e8a5ac7dc3ede6 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Mon, 16 Jan 2012 00:36:49 +0100
+Subject: [PATCH 85/90] USB: cp210x: fix up set_termios variables
+
+commit 34b76fcaee574017862ea3fa0efdcd77a9d0e57d upstream.
+
+[Based on a patch from Johan, mangled by gregkh to keep things in line]
+
+Fix up the variable usage in the set_termios call.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Cc: Preston Fick <preston.fick@silabs.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 1bac7b9..5c3b7d1 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -576,7 +576,8 @@ static void cp210x_set_termios(struct tty_struct *tty,
+ struct usb_serial_port *port, struct ktermios *old_termios)
+ {
+ unsigned int cflag, old_cflag;
+- unsigned int baud = 0, bits;
++ u32 baud;
++ unsigned int bits;
+ unsigned int modem_ctl[4];
+
+ dbg("%s - port %d", __func__, port->number);
+@@ -593,7 +594,7 @@ static void cp210x_set_termios(struct tty_struct *tty,
+ if (baud != tty_termios_baud_rate(old_termios) && baud != 0) {
+ dbg("%s - Setting baud rate to %d baud", __func__,
+ baud);
+- if (cp210x_set_config(port, CP210X_SET_BAUDRATE, &baud, 4)) {
++ if (cp210x_set_config(port, CP210X_SET_BAUDRATE, &baud, sizeof(baud))) {
+ dbg("Baud rate requested not supported by device");
+ baud = tty_termios_baud_rate(old_termios);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch
new file mode 100644
index 0000000..a1bd42a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch
@@ -0,0 +1,121 @@
+From ea11e1bb18d77066ee3e17ad703a162993261c69 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Mon, 16 Jan 2012 00:36:51 +0100
+Subject: [PATCH 86/90] USB: cp210x: clean up, refactor and document speed
+ handling
+
+commit e5990874e511d5bbca23b3396419480cb2ca0ee7 upstream.
+
+Clean up and refactor speed handling.
+Document baud rate handling for CP210{1,2,4,5,10}.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Cc: Preston Fick <preston.fick@silabs.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 71 ++++++++++++++++++++++++++++++++++--------
+ 1 files changed, 57 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 5c3b7d1..d2c4080 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -39,6 +39,8 @@ static void cp210x_get_termios(struct tty_struct *,
+ struct usb_serial_port *port);
+ static void cp210x_get_termios_port(struct usb_serial_port *port,
+ unsigned int *cflagp, unsigned int *baudp);
++static void cp210x_change_speed(struct tty_struct *, struct usb_serial_port *,
++ struct ktermios *);
+ static void cp210x_set_termios(struct tty_struct *, struct usb_serial_port *,
+ struct ktermios*);
+ static int cp210x_tiocmget(struct tty_struct *);
+@@ -572,11 +574,62 @@ static void cp210x_get_termios_port(struct usb_serial_port *port,
+ *cflagp = cflag;
+ }
+
++/*
++ * CP2101 supports the following baud rates:
++ *
++ * 300, 600, 1200, 1800, 2400, 4800, 7200, 9600, 14400, 19200, 28800,
++ * 38400, 56000, 57600, 115200, 128000, 230400, 460800, 921600
++ *
++ * CP2102 and CP2103 support the following additional rates:
++ *
++ * 4000, 16000, 51200, 64000, 76800, 153600, 250000, 256000, 500000,
++ * 576000
++ *
++ * The device will map a requested rate to a supported one, but the result
++ * of requests for rates greater than 1053257 is undefined (see AN205).
++ *
++ * CP2104, CP2105 and CP2110 support most rates up to 2M, 921k and 1M baud,
++ * respectively, with an error less than 1%. The actual rates are determined
++ * by
++ *
++ * div = round(freq / (2 x prescale x request))
++ * actual = freq / (2 x prescale x div)
++ *
++ * For CP2104 and CP2105 freq is 48Mhz and prescale is 4 for request <= 365bps
++ * or 1 otherwise.
++ * For CP2110 freq is 24Mhz and prescale is 4 for request <= 300bps or 1
++ * otherwise.
++ */
++static void cp210x_change_speed(struct tty_struct *tty,
++ struct usb_serial_port *port, struct ktermios *old_termios)
++{
++ u32 baud;
++
++ baud = tty->termios->c_ospeed;
++
++ /* This maps the requested rate to a rate valid on cp2102 or cp2103.
++ *
++ * NOTE: B0 is not implemented.
++ */
++ baud = cp210x_quantise_baudrate(baud);
++
++ dbg("%s - setting baud rate to %u", __func__, baud);
++ if (cp210x_set_config(port, CP210X_SET_BAUDRATE, &baud,
++ sizeof(baud))) {
++ dev_warn(&port->dev, "failed to set baud rate to %u\n", baud);
++ if (old_termios)
++ baud = old_termios->c_ospeed;
++ else
++ baud = 9600;
++ }
++
++ tty_encode_baud_rate(tty, baud, baud);
++}
++
+ static void cp210x_set_termios(struct tty_struct *tty,
+ struct usb_serial_port *port, struct ktermios *old_termios)
+ {
+ unsigned int cflag, old_cflag;
+- u32 baud;
+ unsigned int bits;
+ unsigned int modem_ctl[4];
+
+@@ -588,19 +641,9 @@ static void cp210x_set_termios(struct tty_struct *tty,
+ tty->termios->c_cflag &= ~CMSPAR;
+ cflag = tty->termios->c_cflag;
+ old_cflag = old_termios->c_cflag;
+- baud = cp210x_quantise_baudrate(tty_get_baud_rate(tty));
+-
+- /* If the baud rate is to be updated*/
+- if (baud != tty_termios_baud_rate(old_termios) && baud != 0) {
+- dbg("%s - Setting baud rate to %d baud", __func__,
+- baud);
+- if (cp210x_set_config(port, CP210X_SET_BAUDRATE, &baud, sizeof(baud))) {
+- dbg("Baud rate requested not supported by device");
+- baud = tty_termios_baud_rate(old_termios);
+- }
+- }
+- /* Report back the resulting baud rate */
+- tty_encode_baud_rate(tty, baud, baud);
++
++ if (tty->termios->c_ospeed != old_termios->c_ospeed)
++ cp210x_change_speed(tty, port, old_termios);
+
+ /* If the number of data bits is to be updated */
+ if ((cflag & CSIZE) != (old_cflag & CSIZE)) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch
new file mode 100644
index 0000000..85af4e5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch
@@ -0,0 +1,35 @@
+From ee734377c7849fcf39d20c5e2557d39d498622a6 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Mon, 16 Jan 2012 00:36:52 +0100
+Subject: [PATCH 87/90] USB: cp210x: initialise baud rate at open
+
+commit cdc32fd6f7b2b2580d7f1b74563f888e4dd9eb8a upstream.
+
+The newer cp2104 devices require the baud rate to be initialised after
+power on. Make sure it is set when port is opened.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Cc: Preston Fick <preston.fick@silabs.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index d2c4080..07d297f 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -408,6 +408,10 @@ static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port)
+ /* Configure the termios structure */
+ cp210x_get_termios(tty, port);
+
++ /* The baud rate must be initialised on cp2104 */
++ if (tty)
++ cp210x_change_speed(tty, port, NULL);
++
+ return usb_serial_generic_open(tty, port);
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch
new file mode 100644
index 0000000..1c71c50
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch
@@ -0,0 +1,48 @@
+From 2f180035f2cedd14428f7f81f1ab2826e4a56faf Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Mon, 16 Jan 2012 00:36:53 +0100
+Subject: [PATCH 88/90] USB: cp210x: allow more baud rates above 1Mbaud
+
+commit d1620ca9e7bb0030068c3b45b653defde8839dac upstream.
+
+Allow more baud rates to be set in [1M,2M] baud.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Cc: Preston Fick <preston.fick@silabs.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 11 ++++++-----
+ 1 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 07d297f..a515237 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -388,10 +388,10 @@ static unsigned int cp210x_quantise_baudrate(unsigned int baud) {
+ else if (baud <= 491520) baud = 460800;
+ else if (baud <= 567138) baud = 500000;
+ else if (baud <= 670254) baud = 576000;
+- else if (baud <= 1053257) baud = 921600;
+- else if (baud <= 1474560) baud = 1228800;
+- else if (baud <= 2457600) baud = 1843200;
+- else baud = 3686400;
++ else if (baud < 1000000)
++ baud = 921600;
++ else if (baud > 2000000)
++ baud = 2000000;
+ return baud;
+ }
+
+@@ -611,7 +611,8 @@ static void cp210x_change_speed(struct tty_struct *tty,
+
+ baud = tty->termios->c_ospeed;
+
+- /* This maps the requested rate to a rate valid on cp2102 or cp2103.
++ /* This maps the requested rate to a rate valid on cp2102 or cp2103,
++ * or to an arbitrary rate in [1M,2M].
+ *
+ * NOTE: B0 is not implemented.
+ */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch
new file mode 100644
index 0000000..006bf25
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch
@@ -0,0 +1,34 @@
+From 1fd7dd832dba5ee8aa19a3109bff21cf239b1d19 Mon Sep 17 00:00:00 2001
+From: Philippe Langlais <philippe.langlais@linaro.org>
+Date: Fri, 20 Jan 2012 09:20:40 +0100
+Subject: [PATCH 89/90] mach-ux500: no MMC_CAP_SD_HIGHSPEED on Snowball
+
+commit 2ab1159e80e8f416071e9f51e4f77b9173948296 upstream.
+
+MMC_CAP_SD_HIGHSPEED is not supported on Snowball board resulting on
+initialization errors.
+
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Fredrik Soderstedt <fredrik.soderstedt@stericsson.com>
+Signed-off-by: Philippe Langlais <philippe.langlais@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ arch/arm/mach-ux500/board-mop500-sdi.c | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/arch/arm/mach-ux500/board-mop500-sdi.c b/arch/arm/mach-ux500/board-mop500-sdi.c
+index 6826fae..306cff0 100644
+--- a/arch/arm/mach-ux500/board-mop500-sdi.c
++++ b/arch/arm/mach-ux500/board-mop500-sdi.c
+@@ -233,6 +233,8 @@ void __init snowball_sdi_init(void)
+ {
+ u32 periphid = 0x10480180;
+
++ /* On Snowball MMC_CAP_SD_HIGHSPEED isn't supported on sdi0 */
++ mop500_sdi0_data.capabilities &= ~MMC_CAP_SD_HIGHSPEED;
+ mop500_sdi2_data.capabilities |= MMC_CAP_MMC_HIGHSPEED;
+
+ /* On-board eMMC */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0090-Linux-3.2.3.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0090-Linux-3.2.3.patch
new file mode 100644
index 0000000..7cbbd43
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.3/0090-Linux-3.2.3.patch
@@ -0,0 +1,24 @@
+From dbc3ba5c8784f704438c8ac70ae2700b07155703 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 3 Feb 2012 09:23:33 -0800
+Subject: [PATCH 90/90] Linux 3.2.3
+
+---
+ Makefile | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 2f684da..d45e887 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 2
++SUBLEVEL = 3
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch
new file mode 100644
index 0000000..17d5d09
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch
@@ -0,0 +1,32 @@
+From 63fb1539735afe7c76e7ccdf1999f1fc0d7434e1 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 3 Feb 2012 12:26:40 -0800
+Subject: [PATCH 1/3] Revert "ASoC: Mark WM5100 register map cache only when
+ going into BIAS_OFF"
+
+This reverts commit 11a17e56ac9c607c6eaecf64b618cd17c828ade0
+(e53e417331c57b9b97e3f8be870214a02c99265c upstream) as it breaks the
+build.
+
+Reported-by: Tim Gardner <rtg.canonical@gmail.com>
+Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm5100.c | 1 -
+ 1 files changed, 0 insertions(+), 1 deletions(-)
+
+diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
+index d0beeec..c745ce8 100644
+--- a/sound/soc/codecs/wm5100.c
++++ b/sound/soc/codecs/wm5100.c
+@@ -1406,7 +1406,6 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
+ break;
+
+ case SND_SOC_BIAS_OFF:
+- regcache_cache_only(wm5100->regmap, true);
+ if (wm5100->pdata.ldo_ena)
+ gpio_set_value_cansleep(wm5100->pdata.ldo_ena, 0);
+ regulator_bulk_disable(ARRAY_SIZE(wm5100->core_supplies),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch
new file mode 100644
index 0000000..4be9025
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch
@@ -0,0 +1,39 @@
+From 39fcddc24caa8cda5db70ac62ae743a02551fec5 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 3 Feb 2012 12:27:49 -0800
+Subject: [PATCH 2/3] Revert "ASoC: Don't go through cache when applying
+ WM5100 rev A updates"
+
+This reverts commit 78fd75340768980ce6ca646106762a6928289e0c (upstream
+commit 495174a8ffbaa0d15153d855cf206cdc46d51cf4) as it breaks the build.
+
+Reported-by: Tim Gardner <rtg.canonical@gmail.com>
+Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm5100.c | 2 --
+ 1 files changed, 0 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
+index c745ce8..42d9039 100644
+--- a/sound/soc/codecs/wm5100.c
++++ b/sound/soc/codecs/wm5100.c
+@@ -1379,7 +1379,6 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
+
+ switch (wm5100->rev) {
+ case 0:
+- regcache_cache_bypass(wm5100->regmap, true);
+ snd_soc_write(codec, 0x11, 0x3);
+ snd_soc_write(codec, 0x203, 0xc);
+ snd_soc_write(codec, 0x206, 0);
+@@ -1395,7 +1394,6 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
+ snd_soc_write(codec,
+ wm5100_reva_patches[i].reg,
+ wm5100_reva_patches[i].val);
+- regcache_cache_bypass(wm5100->regmap, false);
+ break;
+ default:
+ break;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0003-Linux-3.2.4.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0003-Linux-3.2.4.patch
new file mode 100644
index 0000000..b893e6e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.4/0003-Linux-3.2.4.patch
@@ -0,0 +1,24 @@
+From 141936cc59aaec665841740f2d4290c5b6e3506c Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 3 Feb 2012 12:39:51 -0800
+Subject: [PATCH 3/3] Linux 3.2.4
+
+---
+ Makefile | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index d45e887..c8e187e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0001-PCI-Rework-ASPM-disable-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0001-PCI-Rework-ASPM-disable-code.patch
new file mode 100644
index 0000000..27d41b2
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0001-PCI-Rework-ASPM-disable-code.patch
@@ -0,0 +1,236 @@
+From 2dcce0a318fcc349b50215279290c6cff7ff9379 Mon Sep 17 00:00:00 2001
+From: Matthew Garrett <mjg@redhat.com>
+Date: Thu, 10 Nov 2011 16:38:33 -0500
+Subject: [PATCH 1/2] PCI: Rework ASPM disable code
+
+commit 3c076351c4027a56d5005a39a0b518a4ba393ce2 upstream.
+
+Right now we forcibly clear ASPM state on all devices if the BIOS indicates
+that the feature isn't supported. Based on the Microsoft presentation
+"PCI Express In Depth for Windows Vista and Beyond", I'm starting to think
+that this may be an error. The implication is that unless the platform
+grants full control via _OSC, Windows will not touch any PCIe features -
+including ASPM. In that case clearing ASPM state would be an error unless
+the platform has granted us that control.
+
+This patch reworks the ASPM disabling code such that the actual clearing
+of state is triggered by a successful handoff of PCIe control to the OS.
+The general ASPM code undergoes some changes in order to ensure that the
+ability to clear the bits isn't overridden by ASPM having already been
+disabled. Further, this theoretically now allows for situations where
+only a subset of PCIe roots hand over control, leaving the others in the
+BIOS state.
+
+It's difficult to know for sure that this is the right thing to do -
+there's zero public documentation on the interaction between all of these
+components. But enough vendors enable ASPM on platforms and then set this
+bit that it seems likely that they're expecting the OS to leave them alone.
+
+Measured to save around 5W on an idle Thinkpad X220.
+
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/pci_root.c | 7 +++++
+ drivers/pci/pci-acpi.c | 1 -
+ drivers/pci/pcie/aspm.c | 58 +++++++++++++++++++++++++++++----------------
+ include/linux/pci-aspm.h | 4 +-
+ 4 files changed, 46 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index 2672c79..7aff631 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -596,6 +596,13 @@ static int __devinit acpi_pci_root_add(struct acpi_device *device)
+ if (ACPI_SUCCESS(status)) {
+ dev_info(root->bus->bridge,
+ "ACPI _OSC control (0x%02x) granted\n", flags);
++ if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM) {
++ /*
++ * We have ASPM control, but the FADT indicates
++ * that it's unsupported. Clear it.
++ */
++ pcie_clear_aspm(root->bus);
++ }
+ } else {
+ dev_info(root->bus->bridge,
+ "ACPI _OSC request failed (%s), "
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index 4ecb640..c8e7585 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -395,7 +395,6 @@ static int __init acpi_pci_init(void)
+
+ if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM) {
+ printk(KERN_INFO"ACPI FADT declares the system doesn't support PCIe ASPM, so disable it\n");
+- pcie_clear_aspm();
+ pcie_no_aspm();
+ }
+
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index cbfbab1..1cfbf22 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -68,7 +68,7 @@ struct pcie_link_state {
+ struct aspm_latency acceptable[8];
+ };
+
+-static int aspm_disabled, aspm_force, aspm_clear_state;
++static int aspm_disabled, aspm_force;
+ static bool aspm_support_enabled = true;
+ static DEFINE_MUTEX(aspm_lock);
+ static LIST_HEAD(link_list);
+@@ -500,9 +500,6 @@ static int pcie_aspm_sanity_check(struct pci_dev *pdev)
+ int pos;
+ u32 reg32;
+
+- if (aspm_clear_state)
+- return -EINVAL;
+-
+ /*
+ * Some functions in a slot might not all be PCIe functions,
+ * very strange. Disable ASPM for the whole slot
+@@ -574,9 +571,6 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev)
+ pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM)
+ return;
+
+- if (aspm_disabled && !aspm_clear_state)
+- return;
+-
+ /* VIA has a strange chipset, root port is under a bridge */
+ if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT &&
+ pdev->bus->self)
+@@ -608,7 +602,7 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev)
+ * the BIOS's expectation, we'll do so once pci_enable_device() is
+ * called.
+ */
+- if (aspm_policy != POLICY_POWERSAVE || aspm_clear_state) {
++ if (aspm_policy != POLICY_POWERSAVE) {
+ pcie_config_aspm_path(link);
+ pcie_set_clkpm(link, policy_to_clkpm_state(link));
+ }
+@@ -649,8 +643,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
+ struct pci_dev *parent = pdev->bus->self;
+ struct pcie_link_state *link, *root, *parent_link;
+
+- if ((aspm_disabled && !aspm_clear_state) || !pci_is_pcie(pdev) ||
+- !parent || !parent->link_state)
++ if (!pci_is_pcie(pdev) || !parent || !parent->link_state)
+ return;
+ if ((parent->pcie_type != PCI_EXP_TYPE_ROOT_PORT) &&
+ (parent->pcie_type != PCI_EXP_TYPE_DOWNSTREAM))
+@@ -734,13 +727,18 @@ void pcie_aspm_powersave_config_link(struct pci_dev *pdev)
+ * pci_disable_link_state - disable pci device's link state, so the link will
+ * never enter specific states
+ */
+-static void __pci_disable_link_state(struct pci_dev *pdev, int state, bool sem)
++static void __pci_disable_link_state(struct pci_dev *pdev, int state, bool sem,
++ bool force)
+ {
+ struct pci_dev *parent = pdev->bus->self;
+ struct pcie_link_state *link;
+
+- if (aspm_disabled || !pci_is_pcie(pdev))
++ if (aspm_disabled && !force)
++ return;
++
++ if (!pci_is_pcie(pdev))
+ return;
++
+ if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT ||
+ pdev->pcie_type == PCI_EXP_TYPE_DOWNSTREAM)
+ parent = pdev;
+@@ -768,16 +766,31 @@ static void __pci_disable_link_state(struct pci_dev *pdev, int state, bool sem)
+
+ void pci_disable_link_state_locked(struct pci_dev *pdev, int state)
+ {
+- __pci_disable_link_state(pdev, state, false);
++ __pci_disable_link_state(pdev, state, false, false);
+ }
+ EXPORT_SYMBOL(pci_disable_link_state_locked);
+
+ void pci_disable_link_state(struct pci_dev *pdev, int state)
+ {
+- __pci_disable_link_state(pdev, state, true);
++ __pci_disable_link_state(pdev, state, true, false);
+ }
+ EXPORT_SYMBOL(pci_disable_link_state);
+
++void pcie_clear_aspm(struct pci_bus *bus)
++{
++ struct pci_dev *child;
++
++ /*
++ * Clear any ASPM setup that the firmware has carried out on this bus
++ */
++ list_for_each_entry(child, &bus->devices, bus_list) {
++ __pci_disable_link_state(child, PCIE_LINK_STATE_L0S |
++ PCIE_LINK_STATE_L1 |
++ PCIE_LINK_STATE_CLKPM,
++ false, true);
++ }
++}
++
+ static int pcie_aspm_set_policy(const char *val, struct kernel_param *kp)
+ {
+ int i;
+@@ -935,6 +948,7 @@ void pcie_aspm_remove_sysfs_dev_files(struct pci_dev *pdev)
+ static int __init pcie_aspm_disable(char *str)
+ {
+ if (!strcmp(str, "off")) {
++ aspm_policy = POLICY_DEFAULT;
+ aspm_disabled = 1;
+ aspm_support_enabled = false;
+ printk(KERN_INFO "PCIe ASPM is disabled\n");
+@@ -947,16 +961,18 @@ static int __init pcie_aspm_disable(char *str)
+
+ __setup("pcie_aspm=", pcie_aspm_disable);
+
+-void pcie_clear_aspm(void)
+-{
+- if (!aspm_force)
+- aspm_clear_state = 1;
+-}
+-
+ void pcie_no_aspm(void)
+ {
+- if (!aspm_force)
++ /*
++ * Disabling ASPM is intended to prevent the kernel from modifying
++ * existing hardware state, not to clear existing state. To that end:
++ * (a) set policy to POLICY_DEFAULT in order to avoid changing state
++ * (b) prevent userspace from changing policy
++ */
++ if (!aspm_force) {
++ aspm_policy = POLICY_DEFAULT;
+ aspm_disabled = 1;
++ }
+ }
+
+ /**
+diff --git a/include/linux/pci-aspm.h b/include/linux/pci-aspm.h
+index 7cea7b6..c832014 100644
+--- a/include/linux/pci-aspm.h
++++ b/include/linux/pci-aspm.h
+@@ -29,7 +29,7 @@ extern void pcie_aspm_pm_state_change(struct pci_dev *pdev);
+ extern void pcie_aspm_powersave_config_link(struct pci_dev *pdev);
+ extern void pci_disable_link_state(struct pci_dev *pdev, int state);
+ extern void pci_disable_link_state_locked(struct pci_dev *pdev, int state);
+-extern void pcie_clear_aspm(void);
++extern void pcie_clear_aspm(struct pci_bus *bus);
+ extern void pcie_no_aspm(void);
+ #else
+ static inline void pcie_aspm_init_link_state(struct pci_dev *pdev)
+@@ -47,7 +47,7 @@ static inline void pcie_aspm_powersave_config_link(struct pci_dev *pdev)
+ static inline void pci_disable_link_state(struct pci_dev *pdev, int state)
+ {
+ }
+-static inline void pcie_clear_aspm(void)
++static inline void pcie_clear_aspm(struct pci_bus *bus)
+ {
+ }
+ static inline void pcie_no_aspm(void)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0002-Linux-3.2.5.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0002-Linux-3.2.5.patch
new file mode 100644
index 0000000..8712268
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.5/0002-Linux-3.2.5.patch
@@ -0,0 +1,24 @@
+From 61339713b47d8905f3079bbd63d8e29343dd86ef Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 6 Feb 2012 09:47:00 -0800
+Subject: [PATCH 2/2] Linux 3.2.5
+
+---
+ Makefile | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index c8e187e..e9dd0ff 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt b/recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt
new file mode 100644
index 0000000..916c5c5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt
@@ -0,0 +1,295 @@
+ file://3.2.1/0001-MAINTAINERS-stable-Update-address.patch \
+ file://3.2.1/0002-Documentation-Update-stable-address.patch \
+ file://3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch \
+ file://3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch \
+ file://3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch \
+ file://3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch \
+ file://3.2.1/0007-libertas-clean-up-scan-thread-handling.patch \
+ file://3.2.1/0008-bcma-support-for-suspend-and-resume.patch \
+ file://3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch \
+ file://3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch \
+ file://3.2.1/0011-wl12xx-Restore-testmode-ABI.patch \
+ file://3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch \
+ file://3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch \
+ file://3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch \
+ file://3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch \
+ file://3.2.1/0016-iwlagn-fix-TID-use-bug.patch \
+ file://3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch \
+ file://3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch \
+ file://3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch \
+ file://3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch \
+ file://3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch \
+ file://3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch \
+ file://3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch \
+ file://3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch \
+ file://3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch \
+ file://3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch \
+ file://3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch \
+ file://3.2.1/0028-USB-update-documentation-for-usbmon.patch \
+ file://3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch \
+ file://3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch \
+ file://3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch \
+ file://3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch \
+ file://3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch \
+ file://3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch \
+ file://3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch \
+ file://3.2.1/0036-USB-pxa168-Fix-compilation-error.patch \
+ file://3.2.1/0037-USB-add-quirk-for-another-camera.patch \
+ file://3.2.1/0038-usb-musb-fix-pm_runtime-mismatch.patch \
+ file://3.2.1/0039-USB-omninet-fix-write_room.patch \
+ file://3.2.1/0040-usb-option-add-ZD-Incorporated-HSPA-modem.patch \
+ file://3.2.1/0041-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch \
+ file://3.2.1/0042-usb-fix-number-of-mapped-SG-DMA-entries.patch \
+ file://3.2.1/0043-xhci-Properly-handle-COMP_2ND_BW_ERR.patch \
+ file://3.2.1/0044-usb-ch9-fix-up-MaxStreams-helper.patch \
+ file://3.2.1/0045-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch \
+ file://3.2.1/0046-asix-fix-infinite-loop-in-rx_fixup.patch \
+ file://3.2.1/0047-bonding-fix-error-handling-if-slave-is-busy-v2.patch \
+ file://3.2.1/0048-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch \
+ file://3.2.1/0049-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch \
+ file://3.2.1/0050-Linux-3.2.1.patch \
+ file://3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch \
+ file://3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch \
+ file://3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch \
+ file://3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch \
+ file://3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch \
+ file://3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch \
+ file://3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch \
+ file://3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch \
+ file://3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch \
+ file://3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch \
+ file://3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch \
+ file://3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch \
+ file://3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch \
+ file://3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch \
+ file://3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch \
+ file://3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch \
+ file://3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch \
+ file://3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch \
+ file://3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch \
+ file://3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch \
+ file://3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch \
+ file://3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch \
+ file://3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch \
+ file://3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch \
+ file://3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch \
+ file://3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch \
+ file://3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch \
+ file://3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch \
+ file://3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch \
+ file://3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch \
+ file://3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch \
+ file://3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch \
+ file://3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch \
+ file://3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch \
+ file://3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch \
+ file://3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch \
+ file://3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch \
+ file://3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch \
+ file://3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch \
+ file://3.2.2/0040-ima-free-duplicate-measurement-memory.patch \
+ file://3.2.2/0041-ima-fix-invalid-memory-reference.patch \
+ file://3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch \
+ file://3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch \
+ file://3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch \
+ file://3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch \
+ file://3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch \
+ file://3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch \
+ file://3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch \
+ file://3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch \
+ file://3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch \
+ file://3.2.2/0051-x86-Fix-mmap-random-address-range.patch \
+ file://3.2.2/0052-UBI-fix-nameless-volumes-handling.patch \
+ file://3.2.2/0053-UBI-fix-debugging-messages.patch \
+ file://3.2.2/0054-UBI-make-vid_hdr-non-static.patch \
+ file://3.2.2/0055-UBIFS-fix-debugging-messages.patch \
+ file://3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch \
+ file://3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch \
+ file://3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch \
+ file://3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch \
+ file://3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch \
+ file://3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch \
+ file://3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch \
+ file://3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch \
+ file://3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch \
+ file://3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch \
+ file://3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch \
+ file://3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch \
+ file://3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch \
+ file://3.2.2/0069-nfsd4-fix-lockowner-matching.patch \
+ file://3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch \
+ file://3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch \
+ file://3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch \
+ file://3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch \
+ file://3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch \
+ file://3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch \
+ file://3.2.2/0076-fix-shrink_dcache_parent-livelock.patch \
+ file://3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch \
+ file://3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch \
+ file://3.2.2/0079-pnfsblock-limit-bio-page-count.patch \
+ file://3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch \
+ file://3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch \
+ file://3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch \
+ file://3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch \
+ file://3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch \
+ file://3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch \
+ file://3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch \
+ file://3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch \
+ file://3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch \
+ file://3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch \
+ file://3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch \
+ file://3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch \
+ file://3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch \
+ file://3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch \
+ file://3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch \
+ file://3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch \
+ file://3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch \
+ file://3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch \
+ file://3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch \
+ file://3.2.2/0099-intel_idle-fix-API-misuse.patch \
+ file://3.2.2/0100-ACPI-Store-SRAT-table-revision.patch \
+ file://3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch \
+ file://3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch \
+ file://3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch \
+ file://3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch \
+ file://3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch \
+ file://3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch \
+ file://3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch \
+ file://3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch \
+ file://3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch \
+ file://3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch \
+ file://3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch \
+ file://3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch \
+ file://3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch \
+ file://3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch \
+ file://3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch \
+ file://3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch \
+ file://3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch \
+ file://3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch \
+ file://3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch \
+ file://3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch \
+ file://3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch \
+ file://3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch \
+ file://3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch \
+ file://3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch \
+ file://3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch \
+ file://3.2.2/0126-iwlagn-check-for-SMPS-mode.patch \
+ file://3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch \
+ file://3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch \
+ file://3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch \
+ file://3.2.2/0130-Linux-3.2.2.patch \
+ file://3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch \
+ file://3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch \
+ file://3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch \
+ file://3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch \
+ file://3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch \
+ file://3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch \
+ file://3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch \
+ file://3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch \
+ file://3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch \
+ file://3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch \
+ file://3.2.3/0011-drm-Fix-authentication-kernel-crash.patch \
+ file://3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch \
+ file://3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch \
+ file://3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch \
+ file://3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch \
+ file://3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch \
+ file://3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch \
+ file://3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch \
+ file://3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch \
+ file://3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch \
+ file://3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch \
+ file://3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch \
+ file://3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch \
+ file://3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch \
+ file://3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch \
+ file://3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch \
+ file://3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch \
+ file://3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch \
+ file://3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch \
+ file://3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch \
+ file://3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch \
+ file://3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch \
+ file://3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch \
+ file://3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch \
+ file://3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch \
+ file://3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch \
+ file://3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch \
+ file://3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch \
+ file://3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch \
+ file://3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch \
+ file://3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch \
+ file://3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch \
+ file://3.2.3/0043-USB-serial-ftdi-additional-IDs.patch \
+ file://3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch \
+ file://3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch \
+ file://3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch \
+ file://3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch \
+ file://3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch \
+ file://3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch \
+ file://3.2.3/0050-TTY-fix-UV-serial-console-regression.patch \
+ file://3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch \
+ file://3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch \
+ file://3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch \
+ file://3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch \
+ file://3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch \
+ file://3.2.3/0056-USB-usbsevseg-fix-max-length.patch \
+ file://3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch \
+ file://3.2.3/0058-usb-gadget-storage-endian-fix.patch \
+ file://3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch \
+ file://3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch \
+ file://3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch \
+ file://3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch \
+ file://3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch \
+ file://3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch \
+ file://3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch \
+ file://3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch \
+ file://3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch \
+ file://3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch \
+ file://3.2.3/0069-netns-fix-net_alloc_generic.patch \
+ file://3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch \
+ file://3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch \
+ file://3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch \
+ file://3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch \
+ file://3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch \
+ file://3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch \
+ file://3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch \
+ file://3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch \
+ file://3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch \
+ file://3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch \
+ file://3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch \
+ file://3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch \
+ file://3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch \
+ file://3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch \
+ file://3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch \
+ file://3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch \
+ file://3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch \
+ file://3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch \
+ file://3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch \
+ file://3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch \
+ file://3.2.3/0090-Linux-3.2.3.patch \
+ file://3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch \
+ file://3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch \
+ file://3.2.4/0003-Linux-3.2.4.patch \
+ file://3.2.5/0001-PCI-Rework-ASPM-disable-code.patch \
+ file://3.2.5/0002-Linux-3.2.5.patch \
+ file://0002-f_rndis-HACK-around-undefined-variables.patch \
+ file://0003-da8xx-fb-add-DVI-support-for-beaglebone.patch \
+ file://0004-beaglebone-rebase-everything-onto-3.2-WARNING-MEGAPA.patch \
+ file://0005-more-beaglebone-merges.patch \
+ file://0006-beaglebone-disable-tsadc.patch \
+ file://0007-tscadc-Add-general-purpose-mode-untested-with-touchs.patch \
+ file://0008-tscadc-Add-board-file-mfd-support-fix-warning.patch \
+ file://0009-AM335X-init-tsc-bone-style-for-new-boards.patch \
+ file://0010-tscadc-make-stepconfig-channel-configurable.patch \
+ file://0011-tscadc-Trigger-through-sysfs.patch \
+ file://0012-meta-ti-Remove-debug-messages-for-meta-ti.patch \
+ file://0013-tscadc-switch-to-polling-instead-of-interrupts.patch \
+ file://0014-beaglebone-fix-ADC-init.patch \
+ file://0015-AM335x-MUX-add-ehrpwm1A.patch \
+ file://0016-beaglebone-enable-PWM-for-lcd-backlight-backlight-is.patch \
+ file://0017-omap_hsmmc-Set-dto-to-max-value-of-14-to-avoid-SD-Ca.patch \
+ file://0018-beaglebone-set-default-brightness-to-50-for-pwm-back.patch \
+ file://0019-st7735fb-WIP-framebuffer-driver-supporting-Adafruit-.patch \
+ file://0020-beaglebone-use-P8_6-gpio1_3-as-w1-bus.patch \
+ file://0021-beaglebone-add-support-for-Towertech-TT3201-CAN-cape.patch \
diff --git a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
index f2ba8e0..33ae9bd 100644
--- a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
+++ b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
@@ -11,7 +11,7 @@ MULTI_CONFIG_BASE_SUFFIX = ""
BRANCH = "v3.2-staging"
SRCREV = "09e9651bcf2ee8d86685f2a8075bc6557b1d3b91"
-MACHINE_KERNEL_PR_append = "f+gitr${SRCREV}"
+MACHINE_KERNEL_PR_append = "a+gitr${SRCREV}"
COMPATIBLE_MACHINE = "(ti33x)"
@@ -25,6 +25,280 @@ SRC_URI += "git://arago-project.org/git/projects/linux-am33x.git;protocol=http;b
file://defconfig"
PATCHES_OVER_PSP = " \
+ file://3.2.1/0001-MAINTAINERS-stable-Update-address.patch \
+ file://3.2.1/0002-Documentation-Update-stable-address.patch \
+ file://3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch \
+ file://3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch \
+ file://3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch \
+ file://3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch \
+ file://3.2.1/0007-libertas-clean-up-scan-thread-handling.patch \
+ file://3.2.1/0008-bcma-support-for-suspend-and-resume.patch \
+ file://3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch \
+ file://3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch \
+ file://3.2.1/0011-wl12xx-Restore-testmode-ABI.patch \
+ file://3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch \
+ file://3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch \
+ file://3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch \
+ file://3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch \
+ file://3.2.1/0016-iwlagn-fix-TID-use-bug.patch \
+ file://3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch \
+ file://3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch \
+ file://3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch \
+ file://3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch \
+ file://3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch \
+ file://3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch \
+ file://3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch \
+ file://3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch \
+ file://3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch \
+ file://3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch \
+ file://3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch \
+ file://3.2.1/0028-USB-update-documentation-for-usbmon.patch \
+ file://3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch \
+ file://3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch \
+ file://3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch \
+ file://3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch \
+ file://3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch \
+ file://3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch \
+ file://3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch \
+ file://3.2.1/0036-USB-pxa168-Fix-compilation-error.patch \
+ file://3.2.1/0037-USB-add-quirk-for-another-camera.patch \
+ file://3.2.1/0038-USB-omninet-fix-write_room.patch \
+ file://3.2.1/0039-usb-option-add-ZD-Incorporated-HSPA-modem.patch \
+ file://3.2.1/0040-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch \
+ file://3.2.1/0041-usb-fix-number-of-mapped-SG-DMA-entries.patch \
+ file://3.2.1/0042-xhci-Properly-handle-COMP_2ND_BW_ERR.patch \
+ file://3.2.1/0043-usb-ch9-fix-up-MaxStreams-helper.patch \
+ file://3.2.1/0044-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch \
+ file://3.2.1/0045-asix-fix-infinite-loop-in-rx_fixup.patch \
+ file://3.2.1/0046-bonding-fix-error-handling-if-slave-is-busy-v2.patch \
+ file://3.2.1/0047-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch \
+ file://3.2.1/0048-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch \
+ file://3.2.1/0049-Linux-3.2.1.patch \
+ file://3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch \
+ file://3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch \
+ file://3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch \
+ file://3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch \
+ file://3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch \
+ file://3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch \
+ file://3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch \
+ file://3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch \
+ file://3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch \
+ file://3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch \
+ file://3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch \
+ file://3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch \
+ file://3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch \
+ file://3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch \
+ file://3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch \
+ file://3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch \
+ file://3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch \
+ file://3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch \
+ file://3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch \
+ file://3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch \
+ file://3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch \
+ file://3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch \
+ file://3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch \
+ file://3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch \
+ file://3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch \
+ file://3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch \
+ file://3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch \
+ file://3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch \
+ file://3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch \
+ file://3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch \
+ file://3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch \
+ file://3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch \
+ file://3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch \
+ file://3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch \
+ file://3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch \
+ file://3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch \
+ file://3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch \
+ file://3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch \
+ file://3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch \
+ file://3.2.2/0040-ima-free-duplicate-measurement-memory.patch \
+ file://3.2.2/0041-ima-fix-invalid-memory-reference.patch \
+ file://3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch \
+ file://3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch \
+ file://3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch \
+ file://3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch \
+ file://3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch \
+ file://3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch \
+ file://3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch \
+ file://3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch \
+ file://3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch \
+ file://3.2.2/0051-x86-Fix-mmap-random-address-range.patch \
+ file://3.2.2/0052-UBI-fix-nameless-volumes-handling.patch \
+ file://3.2.2/0053-UBI-fix-debugging-messages.patch \
+ file://3.2.2/0054-UBI-make-vid_hdr-non-static.patch \
+ file://3.2.2/0055-UBIFS-fix-debugging-messages.patch \
+ file://3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch \
+ file://3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch \
+ file://3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch \
+ file://3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch \
+ file://3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch \
+ file://3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch \
+ file://3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch \
+ file://3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch \
+ file://3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch \
+ file://3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch \
+ file://3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch \
+ file://3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch \
+ file://3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch \
+ file://3.2.2/0069-nfsd4-fix-lockowner-matching.patch \
+ file://3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch \
+ file://3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch \
+ file://3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch \
+ file://3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch \
+ file://3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch \
+ file://3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch \
+ file://3.2.2/0076-fix-shrink_dcache_parent-livelock.patch \
+ file://3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch \
+ file://3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch \
+ file://3.2.2/0079-pnfsblock-limit-bio-page-count.patch \
+ file://3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch \
+ file://3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch \
+ file://3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch \
+ file://3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch \
+ file://3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch \
+ file://3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch \
+ file://3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch \
+ file://3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch \
+ file://3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch \
+ file://3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch \
+ file://3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch \
+ file://3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch \
+ file://3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch \
+ file://3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch \
+ file://3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch \
+ file://3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch \
+ file://3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch \
+ file://3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch \
+ file://3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch \
+ file://3.2.2/0099-intel_idle-fix-API-misuse.patch \
+ file://3.2.2/0100-ACPI-Store-SRAT-table-revision.patch \
+ file://3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch \
+ file://3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch \
+ file://3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch \
+ file://3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch \
+ file://3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch \
+ file://3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch \
+ file://3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch \
+ file://3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch \
+ file://3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch \
+ file://3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch \
+ file://3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch \
+ file://3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch \
+ file://3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch \
+ file://3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch \
+ file://3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch \
+ file://3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch \
+ file://3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch \
+ file://3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch \
+ file://3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch \
+ file://3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch \
+ file://3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch \
+ file://3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch \
+ file://3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch \
+ file://3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch \
+ file://3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch \
+ file://3.2.2/0126-iwlagn-check-for-SMPS-mode.patch \
+ file://3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch \
+ file://3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch \
+ file://3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch \
+ file://3.2.2/0130-Linux-3.2.2.patch \
+ file://3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch \
+ file://3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch \
+ file://3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch \
+ file://3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch \
+ file://3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch \
+ file://3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch \
+ file://3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch \
+ file://3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch \
+ file://3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch \
+ file://3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch \
+ file://3.2.3/0011-drm-Fix-authentication-kernel-crash.patch \
+ file://3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch \
+ file://3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch \
+ file://3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch \
+ file://3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch \
+ file://3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch \
+ file://3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch \
+ file://3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch \
+ file://3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch \
+ file://3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch \
+ file://3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch \
+ file://3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch \
+ file://3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch \
+ file://3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch \
+ file://3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch \
+ file://3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch \
+ file://3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch \
+ file://3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch \
+ file://3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch \
+ file://3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch \
+ file://3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch \
+ file://3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch \
+ file://3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch \
+ file://3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch \
+ file://3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch \
+ file://3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch \
+ file://3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch \
+ file://3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch \
+ file://3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch \
+ file://3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch \
+ file://3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch \
+ file://3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch \
+ file://3.2.3/0043-USB-serial-ftdi-additional-IDs.patch \
+ file://3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch \
+ file://3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch \
+ file://3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch \
+ file://3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch \
+ file://3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch \
+ file://3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch \
+ file://3.2.3/0050-TTY-fix-UV-serial-console-regression.patch \
+ file://3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch \
+ file://3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch \
+ file://3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch \
+ file://3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch \
+ file://3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch \
+ file://3.2.3/0056-USB-usbsevseg-fix-max-length.patch \
+ file://3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch \
+ file://3.2.3/0058-usb-gadget-storage-endian-fix.patch \
+ file://3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch \
+ file://3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch \
+ file://3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch \
+ file://3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch \
+ file://3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch \
+ file://3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch \
+ file://3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch \
+ file://3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch \
+ file://3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch \
+ file://3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch \
+ file://3.2.3/0069-netns-fix-net_alloc_generic.patch \
+ file://3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch \
+ file://3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch \
+ file://3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch \
+ file://3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch \
+ file://3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch \
+ file://3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch \
+ file://3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch \
+ file://3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch \
+ file://3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch \
+ file://3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch \
+ file://3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch \
+ file://3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch \
+ file://3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch \
+ file://3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch \
+ file://3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch \
+ file://3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch \
+ file://3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch \
+ file://3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch \
+ file://3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch \
+ file://3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch \
+ file://3.2.3/0090-Linux-3.2.3.patch \
+ file://3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch \
+ file://3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch \
+ file://3.2.4/0003-Linux-3.2.4.patch \
+ file://3.2.5/0001-PCI-Rework-ASPM-disable-code.patch \
+ file://3.2.5/0002-Linux-3.2.5.patch \
file://0002-f_rndis-HACK-around-undefined-variables.patch \
file://0003-da8xx-fb-add-DVI-support-for-beaglebone.patch \
file://0004-beaglebone-rebase-everything-onto-3.2-WARNING-MEGAPA.patch \
--
1.7.2.5
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [BeagleBone][PATCH v3 03/11] linux-ti335x-psp 3.2: update to 3.2.6
2012-02-27 13:40 [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 02/11] linux-ti33x-psp 3.2: update to 3.2.5 Koen Kooi
@ 2012-02-27 13:40 ` Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 04/11] linux 3.0: update from 3.0.17 to 3.0.22 Koen Kooi
` (8 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Koen Kooi @ 2012-02-27 13:40 UTC (permalink / raw)
To: meta-ti
Readahead fixed!
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
conf/machine/include/ti33x.inc | 2 +-
...d-fix-pipeline-break-caused-by-block-plug.patch | 99 +++++++
...x-the-logic-to-detect-VIA-analog-low-curr.patch | 35 +++
...0003-ALSA-HDA-Remove-quirk-for-Asus-N53Jq.patch | 35 +++
...ply-0x0f-VREF-fix-to-all-ASUS-laptops-wit.patch | 117 ++++++++
...x-calling-cs_automic-twice-for-Cirrus-cod.patch | 45 +++
...low-analog-low-current-mode-when-dynamic-.patch | 105 +++++++
...x-duplicated-output-to-more-than-one-code.patch | 36 +++
...sable-dynamic-power-control-for-VIA-as-de.patch | 34 +++
...s-Enable-line-out-VMID-buffer-for-single-.patch | 57 ++++
...ubs-fix-wrong-bits-for-LINEOUT2-N-P-mixer.patch | 32 +++
...vfp-flush-thread-hwstate-before-restoring.patch | 60 ++++
...1-vfp-fix-ptrace-regset-modification-race.patch | 68 +++++
...vfp-flush-thread-hwstate-before-copying-p.patch | 41 +++
...0014-ARM-OMAP2-GPMC-fix-device-size-setup.patch | 43 +++
...-vt-vt_ioctl.c-fix-KDFONTOP-32bit-compati.patch | 44 +++
...016-proc-mem_release-should-check-mm-NULL.patch | 34 +++
.../0017-proc-unify-mem_read-and-mem_write.patch | 148 ++++++++++
...ure-mem_open-doesn-t-pin-the-target-s-mem.patch | 79 ++++++
...ohci-add-reset-packet-quirk-for-SB-Audigy.patch | 43 +++
...ire-ohci-disable-MSI-on-Ricoh-controllers.patch | 43 +++
...s-SMP-vendor-specific-attribute-MADs-to-f.patch | 90 ++++++
...ix-kernel-panic-by-always-initializing-qp.patch | 68 +++++
...-a-memory-leak-in-function-pre_handler_kr.patch | 52 ++++
...nd-bugfix-reset-the-BCH-module-when-it-is.patch | 72 +++++
...atmel_nand-optimize-read-write-buffer-fun.patch | 113 ++++++++
...-at_hdmac-bugfix-for-enabling-channel-irq.patch | 92 ++++++
...xip.c-fix-race-condition-in-xip_file_faul.patch | 58 ++++
...on-check-pfn_valid-when-entering-a-new-MA.patch | 112 ++++++++
...e-Fix-s2disk-regression-related-to-freezi.patch | 100 +++++++
...S-CPU-C-state-breakage-with-PM-Qos-change.patch | 57 ++++
...Set-DESKTOP_HEIGHT-register-to-the-frameb.patch | 55 ++++
...-drm-nouveau-gem-fix-fence_sync-race-oops.patch | 108 +++++++
...kms-disable-output-polling-when-suspended.patch | 44 +++
...034-drm-radeon-kms-fix-TRAVIS-panel-setup.patch | 53 ++++
...x-task-stack-corruption-under-__ARCH_WANT.patch | 94 +++++++
...e-Thaw-processes-in-SNAPSHOT_CREATE_IMAGE.patch | 83 ++++++
...e-Thaw-kernel-threads-in-SNAPSHOT_CREATE_.patch | 48 ++++
.../0038-8139cp-fix-missing-napi_gro_flush.patch | 33 +++
...ID-buffer-as-uptodate-before-marking-it-d.patch | 40 +++
...MI-hot-remove-notification-to-audio-drive.patch | 53 ++++
...splayPort-hot-remove-notification-to-audi.patch | 40 +++
.../0042-drm-i915-check-ACTHD-of-all-rings.patch | 92 ++++++
.../0043-drm-i915-Fix-TV-Out-refresh-rate.patch | 98 +++++++
.../3.2.6/0044-drm-i915-handle-3rd-pipe.patch | 37 +++
...nvert-force_wake_get-to-func-pointer-in-t.patch | 42 +++
...otect-force_wake_-get-put-with-the-gt_loc.patch | 163 +++++++++++
...finite-loop-due-to-overflow-in-ecryptfs_w.patch | 51 ++++
...w83627ehf-Fix-number-of-fans-for-NCT6776F.patch | 55 ++++
...ps-in-session-setup-code-for-null-user-mo.patch | 47 +++
...-fix-usage-of-CONTRAST_CTR-in-suspend-res.patch | 36 +++
...-Exclude-TAINT_FIRMWARE_WORKAROUND-from-d.patch | 56 ++++
...-Exclude-TAINT_OOT_MODULE-from-disabling-.patch | 56 ++++
...t-Fix-reject-release-handling-in-iscsit_f.patch | 79 ++++++
...t-Fix-double-list_add-with-iscsit_alloc_b.patch | 35 +++
...t-Fix-discovery-with-INADDR_ANY-and-IN6AD.patch | 176 ++++++++++++
...s-Fix-routing-of-input-PGAs-to-line-outpu.patch | 46 +++
...s-Correct-line-input-to-line-output-2-pat.patch | 35 +++
...ASoC-wm8962-Fix-word-length-configuration.patch | 38 +++
...-Enabling-VMID-should-take-a-runtime-PM-r.patch | 42 +++
...ASoC-wm8994-Fix-typo-in-VMID-ramp-setting.patch | 31 ++
...socket-refcount-decrementing-on-each-resu.patch | 179 ++++++++++++
...-virtuoso-fix-exchanged-L-R-volumes-of-au.patch | 67 +++++
...-iommu-amd-Work-around-broken-IVRS-tables.patch | 37 +++
...msm-Fix-error-handling-in-msm_iommu_unmap.patch | 62 ++++
...on-check-for-overlapping-nodes-during-iso.patch | 111 ++++++++
.../0066-mm-fix-UP-THP-spin_is_locked-BUGs.patch | 63 +++++
...correct-preempted-registration-sense-code.patch | 59 ++++
...w-PERSISTENT-RESERVE-IN-for-non-reservati.patch | 35 +++
...ect-sense-key-for-INVALID-FIELD-IN-PARAME.patch | 69 +++++
...workaround-for-zero-length-control-CDB-ha.patch | 62 ++++
...rn-correct-ASC-for-unimplemented-VPD-page.patch | 37 +++
...-INQUIRY-commands-with-EVPD-0-but-PAGE-CO.patch | 43 +++
...73-Staging-asus_oled-fix-image-processing.patch | 59 ++++
...asus_oled-fix-NULL-ptr-crash-on-unloading.patch | 59 ++++
...075-staging-r8712u-Add-new-Sitecom-UsB-ID.patch | 32 +++
...-r8712u-Use-asynchronous-firmware-loading.patch | 285 +++++++++++++++++++
...h9.h-usb_endpoint_maxp-uses-__le16_to_cpu.patch | 37 +++
...zero-fix-bug-in-loopback-autoresume-handl.patch | 36 +++
...p-PCI-USB-quirk-handling-for-Netlogic-XLP.patch | 45 +++
...al-add-new-PID-number-0xa951-to-the-ftdi-.patch | 45 +++
...B-add-new-zte-3g-dongle-s-pid-to-option.c.patch | 181 ++++++++++++
...SWIZ_BITS-to-8-to-reduce-tmem-bucket-lock.patch | 46 +++
.../3.2.6/0083-zcache-fix-deadlock-condition.patch | 55 ++++
...ore-Add-missing-spin_lock_init-for-irq_lo.patch | 33 +++
...-Avoid-Pstate-MSR-accesses-on-systems-sup.patch | 60 ++++
.../0086-powernow-k8-Fix-indexing-issue.patch | 86 ++++++
.../3.2.6/0087-Linux-3.2.6.patch | 24 ++
recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt | 295 --------------------
recipes-kernel/linux/linux-ti33x-psp_3.2.bb | 87 ++++++
90 files changed, 5873 insertions(+), 296 deletions(-)
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0001-readahead-fix-pipeline-break-caused-by-block-plug.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0002-ALSA-hda-Fix-the-logic-to-detect-VIA-analog-low-curr.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0003-ALSA-HDA-Remove-quirk-for-Asus-N53Jq.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0004-ALSA-hda-Apply-0x0f-VREF-fix-to-all-ASUS-laptops-wit.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0005-ALSA-hda-Fix-calling-cs_automic-twice-for-Cirrus-cod.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0006-ALSA-hda-Allow-analog-low-current-mode-when-dynamic-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0007-ALSA-HDA-Fix-duplicated-output-to-more-than-one-code.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0008-ALSA-hda-Disable-dynamic-power-control-for-VIA-as-de.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0009-ASoC-wm_hubs-Enable-line-out-VMID-buffer-for-single-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0010-ASoC-wm_hubs-fix-wrong-bits-for-LINEOUT2-N-P-mixer.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0011-ARM-7306-1-vfp-flush-thread-hwstate-before-restoring.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0012-ARM-7307-1-vfp-fix-ptrace-regset-modification-race.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0013-ARM-7308-1-vfp-flush-thread-hwstate-before-copying-p.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0014-ARM-OMAP2-GPMC-fix-device-size-setup.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0015-drivers-tty-vt-vt_ioctl.c-fix-KDFONTOP-32bit-compati.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0016-proc-mem_release-should-check-mm-NULL.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0017-proc-unify-mem_read-and-mem_write.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0018-proc-make-sure-mem_open-doesn-t-pin-the-target-s-mem.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0019-firewire-ohci-add-reset-packet-quirk-for-SB-Audigy.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0020-firewire-ohci-disable-MSI-on-Ricoh-controllers.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0021-IB-mlx4-pass-SMP-vendor-specific-attribute-MADs-to-f.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0022-RDMA-core-Fix-kernel-panic-by-always-initializing-qp.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0023-kprobes-fix-a-memory-leak-in-function-pre_handler_kr.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0024-mtd-gpmi-nand-bugfix-reset-the-BCH-module-when-it-is.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0025-Revert-mtd-atmel_nand-optimize-read-write-buffer-fun.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0026-at_hdmac-bugfix-for-enabling-channel-irq.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0027-mm-filemap_xip.c-fix-race-condition-in-xip_file_faul.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0028-mm-compaction-check-pfn_valid-when-entering-a-new-MA.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0029-PM-Hibernate-Fix-s2disk-regression-related-to-freezi.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0030-PM-QoS-CPU-C-state-breakage-with-PM-Qos-change.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0031-drm-radeon-Set-DESKTOP_HEIGHT-register-to-the-frameb.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0032-drm-nouveau-gem-fix-fence_sync-race-oops.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0033-drm-radeon-kms-disable-output-polling-when-suspended.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0034-drm-radeon-kms-fix-TRAVIS-panel-setup.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0035-sched-rt-Fix-task-stack-corruption-under-__ARCH_WANT.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0036-PM-Hibernate-Thaw-processes-in-SNAPSHOT_CREATE_IMAGE.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0037-PM-Hibernate-Thaw-kernel-threads-in-SNAPSHOT_CREATE_.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0038-8139cp-fix-missing-napi_gro_flush.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0039-udf-Mark-LVID-buffer-as-uptodate-before-marking-it-d.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0040-drm-i915-HDMI-hot-remove-notification-to-audio-drive.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0041-drm-i915-DisplayPort-hot-remove-notification-to-audi.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0042-drm-i915-check-ACTHD-of-all-rings.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0043-drm-i915-Fix-TV-Out-refresh-rate.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0044-drm-i915-handle-3rd-pipe.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0045-drm-i915-convert-force_wake_get-to-func-pointer-in-t.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0046-drm-i915-protect-force_wake_-get-put-with-the-gt_loc.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0047-eCryptfs-Infinite-loop-due-to-overflow-in-ecryptfs_w.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0048-hwmon-w83627ehf-Fix-number-of-fans-for-NCT6776F.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0049-cifs-Fix-oops-in-session-setup-code-for-null-user-mo.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0050-atmel_lcdfb-fix-usage-of-CONTRAST_CTR-in-suspend-res.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0051-lockdep-bug-Exclude-TAINT_FIRMWARE_WORKAROUND-from-d.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0052-lockdep-bug-Exclude-TAINT_OOT_MODULE-from-disabling-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0053-iscsi-target-Fix-reject-release-handling-in-iscsit_f.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0054-iscsi-target-Fix-double-list_add-with-iscsit_alloc_b.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0055-iscsi-target-Fix-discovery-with-INADDR_ANY-and-IN6AD.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0056-ASoC-wm_hubs-Fix-routing-of-input-PGAs-to-line-outpu.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0057-ASoC-wm_hubs-Correct-line-input-to-line-output-2-pat.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0058-ASoC-wm8962-Fix-word-length-configuration.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0059-ASoC-wm8994-Enabling-VMID-should-take-a-runtime-PM-r.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0060-ASoC-wm8994-Fix-typo-in-VMID-ramp-setting.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0061-pcmcia-fix-socket-refcount-decrementing-on-each-resu.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0062-ALSA-oxygen-virtuoso-fix-exchanged-L-R-volumes-of-au.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0063-iommu-amd-Work-around-broken-IVRS-tables.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0064-iommu-msm-Fix-error-handling-in-msm_iommu_unmap.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0065-mm-compaction-check-for-overlapping-nodes-during-iso.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0066-mm-fix-UP-THP-spin_is_locked-BUGs.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0067-target-Use-correct-preempted-registration-sense-code.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0068-target-Allow-PERSISTENT-RESERVE-IN-for-non-reservati.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0069-target-Correct-sense-key-for-INVALID-FIELD-IN-PARAME.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0070-target-Add-workaround-for-zero-length-control-CDB-ha.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0071-target-Return-correct-ASC-for-unimplemented-VPD-page.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0072-target-Fail-INQUIRY-commands-with-EVPD-0-but-PAGE-CO.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0073-Staging-asus_oled-fix-image-processing.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0074-Staging-asus_oled-fix-NULL-ptr-crash-on-unloading.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0075-staging-r8712u-Add-new-Sitecom-UsB-ID.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0076-staging-r8712u-Use-asynchronous-firmware-loading.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0077-usb-ch9.h-usb_endpoint_maxp-uses-__le16_to_cpu.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0078-usb-gadget-zero-fix-bug-in-loopback-autoresume-handl.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0079-usb-Skip-PCI-USB-quirk-handling-for-Netlogic-XLP.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0080-USB-usbserial-add-new-PID-number-0xa951-to-the-ftdi-.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0081-USB-add-new-zte-3g-dongle-s-pid-to-option.c.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0082-zcache-Set-SWIZ_BITS-to-8-to-reduce-tmem-bucket-lock.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0083-zcache-fix-deadlock-condition.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0084-mmc-cb710-core-Add-missing-spin_lock_init-for-irq_lo.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0085-powernow-k8-Avoid-Pstate-MSR-accesses-on-systems-sup.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0086-powernow-k8-Fix-indexing-issue.patch
create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0087-Linux-3.2.6.patch
delete mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt
diff --git a/conf/machine/include/ti33x.inc b/conf/machine/include/ti33x.inc
index fc670d0..f9d8f7a 100644
--- a/conf/machine/include/ti33x.inc
+++ b/conf/machine/include/ti33x.inc
@@ -3,7 +3,7 @@ SOC_FAMILY = "ti33x"
require conf/machine/include/tune-cortexa8.inc
PREFERRED_PROVIDER_virtual/kernel = "linux-ti33x-psp"
# Increase this everytime you change something in the kernel
-MACHINE_KERNEL_PR = "r3"
+MACHINE_KERNEL_PR = "r4"
KERNEL_IMAGETYPE = "uImage"
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0001-readahead-fix-pipeline-break-caused-by-block-plug.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0001-readahead-fix-pipeline-break-caused-by-block-plug.patch
new file mode 100644
index 0000000..b6dcc0f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0001-readahead-fix-pipeline-break-caused-by-block-plug.patch
@@ -0,0 +1,99 @@
+From 76af79f393ad562077f79627a4c719219ef09ee8 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Fri, 3 Feb 2012 15:37:17 -0800
+Subject: [PATCH 01/87] readahead: fix pipeline break caused by block plug
+
+commit 3deaa7190a8da38453c4fabd9dec7f66d17fff67 upstream.
+
+Herbert Poetzl reported a performance regression since 2.6.39. The test
+is a simple dd read, but with big block size. The reason is:
+
+T1: ra (A, A+128k), (A+128k, A+256k)
+T2: lock_page for page A, submit the 256k
+T3: hit page A+128K, ra (A+256k, A+384). the range isn't submitted
+because of plug and there isn't any lock_page till we hit page A+256k
+because all pages from A to A+256k is in memory
+T4: hit page A+256k, ra (A+384, A+ 512). Because of plug, the range isn't
+submitted again.
+T5: lock_page A+256k, so (A+256k, A+512k) will be submitted. The task is
+waitting for (A+256k, A+512k) finish.
+
+There is no request to disk in T3 and T4, so readahead pipeline breaks.
+
+We really don't need block plug for generic_file_aio_read() for buffered
+I/O. The readahead already has plug and has fine grained control when I/O
+should be submitted. Deleting plug for buffered I/O fixes the regression.
+
+One side effect is plug makes the request size 256k, the size is 128k
+without it. This is because default ra size is 128k and not a reason we
+need plug here.
+
+Vivek said:
+
+: We submit some readahead IO to device request queue but because of nested
+: plug, queue never gets unplugged. When read logic reaches a page which is
+: not in page cache, it waits for page to be read from the disk
+: (lock_page_killable()) and that time we flush the plug list.
+:
+: So effectively read ahead logic is kind of broken in parts because of
+: nested plugging. Removing top level plug (generic_file_aio_read()) for
+: buffered reads, will allow unplugging queue earlier for readahead.
+
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
+Reported-by: Herbert Poetzl <herbert@13thfloor.at>
+Tested-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Vivek Goyal <vgoyal@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/filemap.c | 8 ++++----
+ 1 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 90286a4..03c5b0e 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -1400,15 +1400,12 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
+ unsigned long seg = 0;
+ size_t count;
+ loff_t *ppos = &iocb->ki_pos;
+- struct blk_plug plug;
+
+ count = 0;
+ retval = generic_segment_checks(iov, &nr_segs, &count, VERIFY_WRITE);
+ if (retval)
+ return retval;
+
+- blk_start_plug(&plug);
+-
+ /* coalesce the iovecs and go direct-to-BIO for O_DIRECT */
+ if (filp->f_flags & O_DIRECT) {
+ loff_t size;
+@@ -1424,8 +1421,12 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
+ retval = filemap_write_and_wait_range(mapping, pos,
+ pos + iov_length(iov, nr_segs) - 1);
+ if (!retval) {
++ struct blk_plug plug;
++
++ blk_start_plug(&plug);
+ retval = mapping->a_ops->direct_IO(READ, iocb,
+ iov, pos, nr_segs);
++ blk_finish_plug(&plug);
+ }
+ if (retval > 0) {
+ *ppos = pos + retval;
+@@ -1481,7 +1482,6 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
+ break;
+ }
+ out:
+- blk_finish_plug(&plug);
+ return retval;
+ }
+ EXPORT_SYMBOL(generic_file_aio_read);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0002-ALSA-hda-Fix-the-logic-to-detect-VIA-analog-low-curr.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0002-ALSA-hda-Fix-the-logic-to-detect-VIA-analog-low-curr.patch
new file mode 100644
index 0000000..a25fadf
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0002-ALSA-hda-Fix-the-logic-to-detect-VIA-analog-low-curr.patch
@@ -0,0 +1,35 @@
+From 02e85499ffcb080ef11c8cc1b092e033f90651f5 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 24 Jan 2012 13:58:36 +0100
+Subject: [PATCH 02/87] ALSA: hda - Fix the logic to detect VIA analog
+ low-current mode
+
+commit 924339239fd5ba3e505f9420d41f0939196f3530 upstream.
+
+The analog low-current mode must be enabled when the no stream is
+running but the current detection checks it in a wrong way.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=741128
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_via.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index 8d69e59..0684542 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -1041,7 +1041,7 @@ static void analog_low_current_mode(struct hda_codec *codec)
+ bool enable;
+ unsigned int verb, parm;
+
+- enable = is_aa_path_mute(codec) && (spec->opened_streams != 0);
++ enable = is_aa_path_mute(codec) && !spec->opened_streams;
+
+ /* decide low current mode's verb & parameter */
+ switch (spec->codec_type) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0003-ALSA-HDA-Remove-quirk-for-Asus-N53Jq.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0003-ALSA-HDA-Remove-quirk-for-Asus-N53Jq.patch
new file mode 100644
index 0000000..13ad2bc
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0003-ALSA-HDA-Remove-quirk-for-Asus-N53Jq.patch
@@ -0,0 +1,35 @@
+From ab692dfced98f2967cf710941d686e66cf519afb Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Fri, 27 Jan 2012 14:31:19 +0100
+Subject: [PATCH 03/87] ALSA: HDA: Remove quirk for Asus N53Jq
+
+commit a389d67cf9849aff1722ed73186a584e2196a873 upstream.
+
+The user reports that he needs to add model=auto for audio to
+work properly. In fact, since node 0x15 is not even a pin node,
+the existing fixup is definitely wrong. Relevant information can
+be found in the buglink below.
+
+BugLink: https://bugs.launchpad.net/bugs/918254
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 -
+ 1 files changed, 0 insertions(+), 1 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 5f03c40..d02e8e0 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5011,7 +5011,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x8330, "ASUS Eeepc P703 P900A",
+ ALC269_FIXUP_AMIC),
+ SND_PCI_QUIRK(0x1043, 0x1013, "ASUS N61Da", ALC269_FIXUP_AMIC),
+- SND_PCI_QUIRK(0x1043, 0x1113, "ASUS N63Jn", ALC269_FIXUP_AMIC),
+ SND_PCI_QUIRK(0x1043, 0x1143, "ASUS B53f", ALC269_FIXUP_AMIC),
+ SND_PCI_QUIRK(0x1043, 0x1133, "ASUS UJ20ft", ALC269_FIXUP_AMIC),
+ SND_PCI_QUIRK(0x1043, 0x1183, "ASUS K72DR", ALC269_FIXUP_AMIC),
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0004-ALSA-hda-Apply-0x0f-VREF-fix-to-all-ASUS-laptops-wit.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0004-ALSA-hda-Apply-0x0f-VREF-fix-to-all-ASUS-laptops-wit.patch
new file mode 100644
index 0000000..e25d66c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0004-ALSA-hda-Apply-0x0f-VREF-fix-to-all-ASUS-laptops-wit.patch
@@ -0,0 +1,117 @@
+From 4f53e64f2effdcbd8f563411031fdc5172f876ce Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 30 Jan 2012 10:54:08 +0100
+Subject: [PATCH 04/87] ALSA: hda - Apply 0x0f-VREF fix to all ASUS laptops
+ with ALC861/660
+
+commit 31150f2327cbb66363f38e13ca1be973d2f9203a upstream.
+
+It turned out that other ASUS laptops require the similar fix to
+enable the VREF on the pin 0x0f for the secret output amp, not only
+ASUS A6Rp. Moreover, it's required even when the pin is being used
+as the output. Thus, writing a fixed value doesn't work always.
+
+This patch applies the VREF-fix for all ASUS laptops with ALC861/660
+in a fixup function that checks the current value and turns on only
+the VREF value no matter whether input or output direction is set.
+
+The automute function is modified as well to keep the pin VREF upon
+muting/unmuting via pin-control; otherwise the pin VREF is reset at
+plugging/unplugging a jack.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42588
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 43 +++++++++++++++++++++++++++++++++-------
+ 1 files changed, 35 insertions(+), 8 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index d02e8e0..34e5fcc 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -176,6 +176,7 @@ struct alc_spec {
+ unsigned int detect_lo:1; /* Line-out detection enabled */
+ unsigned int automute_speaker_possible:1; /* there are speakers and either LO or HP */
+ unsigned int automute_lo_possible:1; /* there are line outs and HP */
++ unsigned int keep_vref_in_automute:1; /* Don't clear VREF in automute */
+
+ /* other flags */
+ unsigned int no_analog :1; /* digital I/O only */
+@@ -519,13 +520,24 @@ static void do_automute(struct hda_codec *codec, int num_pins, hda_nid_t *pins,
+
+ for (i = 0; i < num_pins; i++) {
+ hda_nid_t nid = pins[i];
++ unsigned int val;
+ if (!nid)
+ break;
+ switch (spec->automute_mode) {
+ case ALC_AUTOMUTE_PIN:
++ /* don't reset VREF value in case it's controlling
++ * the amp (see alc861_fixup_asus_amp_vref_0f())
++ */
++ if (spec->keep_vref_in_automute) {
++ val = snd_hda_codec_read(codec, nid, 0,
++ AC_VERB_GET_PIN_WIDGET_CONTROL, 0);
++ val &= ~PIN_HP;
++ } else
++ val = 0;
++ val |= pin_bits;
+ snd_hda_codec_write(codec, nid, 0,
+ AC_VERB_SET_PIN_WIDGET_CONTROL,
+- pin_bits);
++ val);
+ break;
+ case ALC_AUTOMUTE_AMP:
+ snd_hda_codec_amp_stereo(codec, nid, HDA_OUTPUT, 0,
+@@ -5225,6 +5237,25 @@ enum {
+ PINFIX_ASUS_A6RP,
+ };
+
++/* On some laptops, VREF of pin 0x0f is abused for controlling the main amp */
++static void alc861_fixup_asus_amp_vref_0f(struct hda_codec *codec,
++ const struct alc_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++ unsigned int val;
++
++ if (action != ALC_FIXUP_ACT_INIT)
++ return;
++ val = snd_hda_codec_read(codec, 0x0f, 0,
++ AC_VERB_GET_PIN_WIDGET_CONTROL, 0);
++ if (!(val & (AC_PINCTL_IN_EN | AC_PINCTL_OUT_EN)))
++ val |= AC_PINCTL_IN_EN;
++ val |= AC_PINCTL_VREF_50;
++ snd_hda_codec_write(codec, 0x0f, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, val);
++ spec->keep_vref_in_automute = 1;
++}
++
+ static const struct alc_fixup alc861_fixups[] = {
+ [PINFIX_FSC_AMILO_PI1505] = {
+ .type = ALC_FIXUP_PINS,
+@@ -5235,17 +5266,13 @@ static const struct alc_fixup alc861_fixups[] = {
+ }
+ },
+ [PINFIX_ASUS_A6RP] = {
+- .type = ALC_FIXUP_VERBS,
+- .v.verbs = (const struct hda_verb[]) {
+- /* node 0x0f VREF seems controlling the master output */
+- { 0x0f, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF50 },
+- { }
+- },
++ .type = ALC_FIXUP_FUNC,
++ .v.func = alc861_fixup_asus_amp_vref_0f,
+ },
+ };
+
+ static const struct snd_pci_quirk alc861_fixup_tbl[] = {
+- SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", PINFIX_ASUS_A6RP),
++ SND_PCI_QUIRK_VENDOR(0x1043, "ASUS laptop", PINFIX_ASUS_A6RP),
+ SND_PCI_QUIRK(0x1584, 0x2b01, "Haier W18", PINFIX_ASUS_A6RP),
+ SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", PINFIX_FSC_AMILO_PI1505),
+ {}
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0005-ALSA-hda-Fix-calling-cs_automic-twice-for-Cirrus-cod.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0005-ALSA-hda-Fix-calling-cs_automic-twice-for-Cirrus-cod.patch
new file mode 100644
index 0000000..db90e5d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0005-ALSA-hda-Fix-calling-cs_automic-twice-for-Cirrus-cod.patch
@@ -0,0 +1,45 @@
+From d0f03303d8a9c7c82856c50e6c7ea137c8ca7c83 Mon Sep 17 00:00:00 2001
+From: Dylan Reid <dgreid@chromium.org>
+Date: Tue, 31 Jan 2012 13:04:41 -0800
+Subject: [PATCH 05/87] ALSA: hda - Fix calling cs_automic twice for Cirrus
+ codecs.
+
+commit f70eecde3bca92630d3886496e73316ff353f185 upstream.
+
+If cs_automic is called twice (like it is during init) while the mic
+is present, it will over-write the last_input with the new one,
+causing it to switch back to the automic input when the mic is
+unplugged. This leaves the driver in a state (cur_input, last_input,
+and automix_idx the same) where the internal mic can not be selected
+until it is rebooted without the mic attached.
+
+Check that the mic hasn't already been switched to before setting
+last_input.
+
+Signed-off-by: Dylan Reid <dgreid@chromium.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_cirrus.c | 6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index 5b0a9bb..ec0518e 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -976,8 +976,10 @@ static void cs_automic(struct hda_codec *codec)
+ /* specific to CS421x, single ADC */
+ if (spec->vendor_nid == CS421X_VENDOR_NID) {
+ if (present) {
+- spec->last_input = spec->cur_input;
+- spec->cur_input = spec->automic_idx;
++ if (spec->cur_input != spec->automic_idx) {
++ spec->last_input = spec->cur_input;
++ spec->cur_input = spec->automic_idx;
++ }
+ } else {
+ spec->cur_input = spec->last_input;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0006-ALSA-hda-Allow-analog-low-current-mode-when-dynamic-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0006-ALSA-hda-Allow-analog-low-current-mode-when-dynamic-.patch
new file mode 100644
index 0000000..fba2b6d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0006-ALSA-hda-Allow-analog-low-current-mode-when-dynamic-.patch
@@ -0,0 +1,105 @@
+From cb935a3a4ffa533491976365aa430ad9d586718f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 1 Feb 2012 10:33:23 +0100
+Subject: [PATCH 06/87] ALSA: hda - Allow analog low-current mode when dynamic
+ power-control is on
+
+commit e9d010c2e8f03952e67a6fd8aed0f0dc92084ccc upstream.
+
+VIA codecs have several different power-saving features, and one of
+them is the analog low-current mode. But it turned out that the ALC
+mode causes pop-noises at each on/off time on some machines. As a
+quick workaround, disable the ALC when another power-saving feature,
+the dynamic pin power-control, is turned off, too, since the dynamic
+power-control is already exposed as a mixer enum element so that user
+can turn it on/off freely.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=741128
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_via.c | 27 +++++++++++++++++++++------
+ 1 files changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index 0684542..d2a477d 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -198,6 +198,9 @@ struct via_spec {
+ unsigned int no_pin_power_ctl;
+ enum VIA_HDA_CODEC codec_type;
+
++ /* analog low-power control */
++ bool alc_mode;
++
+ /* smart51 setup */
+ unsigned int smart51_nums;
+ hda_nid_t smart51_pins[2];
+@@ -748,6 +751,7 @@ static int via_pin_power_ctl_put(struct snd_kcontrol *kcontrol,
+ return 0;
+ spec->no_pin_power_ctl = val;
+ set_widgets_power_state(codec);
++ analog_low_current_mode(codec);
+ return 1;
+ }
+
+@@ -1035,13 +1039,19 @@ static bool is_aa_path_mute(struct hda_codec *codec)
+ }
+
+ /* enter/exit analog low-current mode */
+-static void analog_low_current_mode(struct hda_codec *codec)
++static void __analog_low_current_mode(struct hda_codec *codec, bool force)
+ {
+ struct via_spec *spec = codec->spec;
+ bool enable;
+ unsigned int verb, parm;
+
+- enable = is_aa_path_mute(codec) && !spec->opened_streams;
++ if (spec->no_pin_power_ctl)
++ enable = false;
++ else
++ enable = is_aa_path_mute(codec) && !spec->opened_streams;
++ if (enable == spec->alc_mode && !force)
++ return;
++ spec->alc_mode = enable;
+
+ /* decide low current mode's verb & parameter */
+ switch (spec->codec_type) {
+@@ -1073,6 +1083,11 @@ static void analog_low_current_mode(struct hda_codec *codec)
+ snd_hda_codec_write(codec, codec->afg, 0, verb, parm);
+ }
+
++static void analog_low_current_mode(struct hda_codec *codec)
++{
++ return __analog_low_current_mode(codec, false);
++}
++
+ /*
+ * generic initialization of ADC, input mixers and output mixers
+ */
+@@ -1498,10 +1513,6 @@ static int via_build_controls(struct hda_codec *codec)
+ return err;
+ }
+
+- /* init power states */
+- set_widgets_power_state(codec);
+- analog_low_current_mode(codec);
+-
+ via_free_kctls(codec); /* no longer needed */
+ return 0;
+ }
+@@ -2771,6 +2782,10 @@ static int via_init(struct hda_codec *codec)
+ for (i = 0; i < spec->num_iverbs; i++)
+ snd_hda_sequence_write(codec, spec->init_verbs[i]);
+
++ /* init power states */
++ set_widgets_power_state(codec);
++ __analog_low_current_mode(codec, true);
++
+ via_auto_init_multi_out(codec);
+ via_auto_init_hp_out(codec);
+ via_auto_init_speaker_out(codec);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0007-ALSA-HDA-Fix-duplicated-output-to-more-than-one-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0007-ALSA-HDA-Fix-duplicated-output-to-more-than-one-code.patch
new file mode 100644
index 0000000..e3e4e6d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0007-ALSA-HDA-Fix-duplicated-output-to-more-than-one-code.patch
@@ -0,0 +1,36 @@
+From b23a6ba81e42ad2d95afc04840d08b558092ba24 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Wed, 1 Feb 2012 12:05:41 +0100
+Subject: [PATCH 07/87] ALSA: HDA: Fix duplicated output to more than one
+ codec
+
+commit 54c2a89f60fd71b924d0f848ac892442951401a6 upstream.
+
+This typo caused the wrong codec's nid to be checked for wcaps type.
+As a result, sometimes speakers would duplicate the output sent to
+HDMI output.
+
+BugLink: https://bugs.launchpad.net/bugs/924320
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/hda_codec.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 4562e9d..05c8768 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -1446,7 +1446,7 @@ void snd_hda_codec_setup_stream(struct hda_codec *codec, hda_nid_t nid,
+ for (i = 0; i < c->cvt_setups.used; i++) {
+ p = snd_array_elem(&c->cvt_setups, i);
+ if (!p->active && p->stream_tag == stream_tag &&
+- get_wcaps_type(get_wcaps(codec, p->nid)) == type)
++ get_wcaps_type(get_wcaps(c, p->nid)) == type)
+ p->dirty = 1;
+ }
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0008-ALSA-hda-Disable-dynamic-power-control-for-VIA-as-de.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0008-ALSA-hda-Disable-dynamic-power-control-for-VIA-as-de.patch
new file mode 100644
index 0000000..e8afd51
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0008-ALSA-hda-Disable-dynamic-power-control-for-VIA-as-de.patch
@@ -0,0 +1,34 @@
+From 1e7c37777276bcae0ead904309644422bace8608 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 2 Feb 2012 10:30:17 +0100
+Subject: [PATCH 08/87] ALSA: hda - Disable dynamic-power control for VIA as
+ default
+
+commit b5bcc189401c815988b7dd37611fc56f40c9139d upstream.
+
+Since the dynamic pin power-control and the analog low-current mode
+may lead to pop-noise, it's safer to set it off as default.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=741128
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_via.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index d2a477d..a0a3f50 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -1460,6 +1460,7 @@ static int via_build_controls(struct hda_codec *codec)
+ struct snd_kcontrol *kctl;
+ int err, i;
+
++ spec->no_pin_power_ctl = 1;
+ if (spec->set_widgets_power_state)
+ if (!via_clone_control(spec, &via_pin_power_ctl_enum))
+ return -ENOMEM;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0009-ASoC-wm_hubs-Enable-line-out-VMID-buffer-for-single-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0009-ASoC-wm_hubs-Enable-line-out-VMID-buffer-for-single-.patch
new file mode 100644
index 0000000..6e82d4b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0009-ASoC-wm_hubs-Enable-line-out-VMID-buffer-for-single-.patch
@@ -0,0 +1,57 @@
+From 7e1a603295915f189e0b1b2207f5c9297ee65250 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Fri, 20 Jan 2012 12:19:43 +0000
+Subject: [PATCH 09/87] ASoC: wm_hubs: Enable line out VMID buffer for single
+ ended line outputs
+
+commit 77231abe55433aa17eca712718745275853fa66d upstream.
+
+For optimal performance the single ended line outputs require that the
+line output VMID buffer be enabled.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm_hubs.c | 6 ++++++
+ 1 files changed, 6 insertions(+), 0 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
+index 48e61e9..8c26c6d 100644
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -614,6 +614,8 @@ SND_SOC_DAPM_INPUT("IN2RP:VXRP"),
+ SND_SOC_DAPM_MICBIAS("MICBIAS2", WM8993_POWER_MANAGEMENT_1, 5, 0),
+ SND_SOC_DAPM_MICBIAS("MICBIAS1", WM8993_POWER_MANAGEMENT_1, 4, 0),
+
++SND_SOC_DAPM_SUPPLY("LINEOUT_VMID_BUF", WM8993_ANTIPOP1, 7, 0, NULL, 0),
++
+ SND_SOC_DAPM_MIXER("IN1L PGA", WM8993_POWER_MANAGEMENT_2, 6, 0,
+ in1l_pga, ARRAY_SIZE(in1l_pga)),
+ SND_SOC_DAPM_MIXER("IN1R PGA", WM8993_POWER_MANAGEMENT_2, 4, 0,
+@@ -832,9 +834,11 @@ static const struct snd_soc_dapm_route lineout1_diff_routes[] = {
+ };
+
+ static const struct snd_soc_dapm_route lineout1_se_routes[] = {
++ { "LINEOUT1N Mixer", NULL, "LINEOUT_VMID_BUF" },
+ { "LINEOUT1N Mixer", "Left Output Switch", "Left Output PGA" },
+ { "LINEOUT1N Mixer", "Right Output Switch", "Right Output PGA" },
+
++ { "LINEOUT1P Mixer", NULL, "LINEOUT_VMID_BUF" },
+ { "LINEOUT1P Mixer", "Left Output Switch", "Left Output PGA" },
+
+ { "LINEOUT1N Driver", NULL, "LINEOUT1N Mixer" },
+@@ -851,9 +855,11 @@ static const struct snd_soc_dapm_route lineout2_diff_routes[] = {
+ };
+
+ static const struct snd_soc_dapm_route lineout2_se_routes[] = {
++ { "LINEOUT2N Mixer", NULL, "LINEOUT_VMID_BUF" },
+ { "LINEOUT2N Mixer", "Left Output Switch", "Left Output PGA" },
+ { "LINEOUT2N Mixer", "Right Output Switch", "Right Output PGA" },
+
++ { "LINEOUT2P Mixer", NULL, "LINEOUT_VMID_BUF" },
+ { "LINEOUT2P Mixer", "Right Output Switch", "Right Output PGA" },
+
+ { "LINEOUT2N Driver", NULL, "LINEOUT2N Mixer" },
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0010-ASoC-wm_hubs-fix-wrong-bits-for-LINEOUT2-N-P-mixer.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0010-ASoC-wm_hubs-fix-wrong-bits-for-LINEOUT2-N-P-mixer.patch
new file mode 100644
index 0000000..13e5936
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0010-ASoC-wm_hubs-fix-wrong-bits-for-LINEOUT2-N-P-mixer.patch
@@ -0,0 +1,32 @@
+From f886b09222d9ae6a977aa75e7b1e924fddca2d5f Mon Sep 17 00:00:00 2001
+From: UK KIM <w0806.kim@samsung.com>
+Date: Sat, 28 Jan 2012 01:52:22 +0900
+Subject: [PATCH 10/87] ASoC: wm_hubs: fix wrong bits for LINEOUT2 N/P mixer
+
+commit 114395c61ad2eb5a7a5cd163fcadb2414e48245a upstream.
+
+Signed-off-by: UK KIM <w0806.kim@samsung.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm_hubs.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
+index 8c26c6d..8547191 100644
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -593,8 +593,8 @@ SOC_DAPM_SINGLE("Output Switch", WM8993_LINE_MIXER2, 0, 1, 0),
+ };
+
+ static const struct snd_kcontrol_new line2n_mix[] = {
+-SOC_DAPM_SINGLE("Left Output Switch", WM8993_LINE_MIXER2, 6, 1, 0),
+-SOC_DAPM_SINGLE("Right Output Switch", WM8993_LINE_MIXER2, 5, 1, 0),
++SOC_DAPM_SINGLE("Left Output Switch", WM8993_LINE_MIXER2, 5, 1, 0),
++SOC_DAPM_SINGLE("Right Output Switch", WM8993_LINE_MIXER2, 6, 1, 0),
+ };
+
+ static const struct snd_kcontrol_new line2p_mix[] = {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0011-ARM-7306-1-vfp-flush-thread-hwstate-before-restoring.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0011-ARM-7306-1-vfp-flush-thread-hwstate-before-restoring.patch
new file mode 100644
index 0000000..116be5f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0011-ARM-7306-1-vfp-flush-thread-hwstate-before-restoring.patch
@@ -0,0 +1,60 @@
+From 04c6e8a2521ffa7049aa6df835d48d4bfce37a8e Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Mon, 30 Jan 2012 20:21:42 +0100
+Subject: [PATCH 11/87] ARM: 7306/1: vfp: flush thread hwstate before
+ restoring context from sigframe
+
+commit 2af276dfb1722e97b190bd2e646b079a2aa674db upstream.
+
+Following execution of a signal handler, we currently restore the VFP
+context from the ucontext in the signal frame. This involves copying
+from the user stack into the current thread's vfp_hard_struct and then
+flushing the new data out to the hardware registers.
+
+This is problematic when using a preemptible kernel because we could be
+context switched whilst updating the vfp_hard_struct. If the current
+thread has made use of VFP since the last context switch, the VFP
+notifier will copy from the hardware registers into the vfp_hard_struct,
+overwriting any data that had been partially copied by the signal code.
+
+Disabling preemption across copy_from_user calls is a terrible idea, so
+instead we move the VFP thread flush *before* we update the
+vfp_hard_struct. Since the flushing is performed lazily, this has the
+effect of disabling VFP and clearing the CPU's VFP state pointer,
+therefore preventing the thread from being updated with stale data on
+the next context switch.
+
+Tested-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/kernel/signal.c | 5 ++---
+ 1 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index 0340224..9e617bd 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -227,6 +227,8 @@ static int restore_vfp_context(struct vfp_sigframe __user *frame)
+ if (magic != VFP_MAGIC || size != VFP_STORAGE_SIZE)
+ return -EINVAL;
+
++ vfp_flush_hwstate(thread);
++
+ /*
+ * Copy the floating point registers. There can be unused
+ * registers see asm/hwcap.h for details.
+@@ -251,9 +253,6 @@ static int restore_vfp_context(struct vfp_sigframe __user *frame)
+ __get_user_error(h->fpinst, &frame->ufp_exc.fpinst, err);
+ __get_user_error(h->fpinst2, &frame->ufp_exc.fpinst2, err);
+
+- if (!err)
+- vfp_flush_hwstate(thread);
+-
+ return err ? -EFAULT : 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0012-ARM-7307-1-vfp-fix-ptrace-regset-modification-race.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0012-ARM-7307-1-vfp-fix-ptrace-regset-modification-race.patch
new file mode 100644
index 0000000..139c766
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0012-ARM-7307-1-vfp-fix-ptrace-regset-modification-race.patch
@@ -0,0 +1,68 @@
+From c85ca4cdfafaee9fd428b934fea18e5c2d850fb6 Mon Sep 17 00:00:00 2001
+From: Dave Martin <dave.martin@linaro.org>
+Date: Mon, 30 Jan 2012 20:22:28 +0100
+Subject: [PATCH 12/87] ARM: 7307/1: vfp: fix ptrace regset modification race
+
+commit 247f4993a5974e6759606c4d380748eecfd273ff upstream.
+
+In a preemptible kernel, vfp_set() can be preempted, causing the
+hardware VFP context to be switched while the thread vfp state is
+being read and modified. This leads to a race condition which can
+cause the thread vfp state to become corrupted if lazy VFP context
+save occurs due to preemption in between the time thread->vfpstate
+is read and the time the modified state is written back.
+
+This may occur if preemption occurs during the execution of a
+ptrace() call which modifies the VFP register state of a thread.
+Such instances should be very rare in most realistic scenarios --
+none has been reported, so far as I am aware. Only uniprocessor
+systems should be affected, since VFP context save is not currently
+lazy in SMP kernels.
+
+The problem was introduced by my earlier patch migrating to use
+regsets to implement ptrace.
+
+This patch does a vfp_sync_hwstate() before reading
+thread->vfpstate, to make sure that the thread's VFP state is not
+live in the hardware registers while the registers are modified.
+
+Thanks to Will Deacon for spotting this.
+
+Signed-off-by: Dave Martin <dave.martin@linaro.org>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/kernel/ptrace.c | 6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
+index 483727a..8b17fb4 100644
+--- a/arch/arm/kernel/ptrace.c
++++ b/arch/arm/kernel/ptrace.c
+@@ -699,10 +699,13 @@ static int vfp_set(struct task_struct *target,
+ {
+ int ret;
+ struct thread_info *thread = task_thread_info(target);
+- struct vfp_hard_struct new_vfp = thread->vfpstate.hard;
++ struct vfp_hard_struct new_vfp;
+ const size_t user_fpregs_offset = offsetof(struct user_vfp, fpregs);
+ const size_t user_fpscr_offset = offsetof(struct user_vfp, fpscr);
+
++ vfp_sync_hwstate(thread);
++ new_vfp = thread->vfpstate.hard;
++
+ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
+ &new_vfp.fpregs,
+ user_fpregs_offset,
+@@ -723,7 +726,6 @@ static int vfp_set(struct task_struct *target,
+ if (ret)
+ return ret;
+
+- vfp_sync_hwstate(thread);
+ thread->vfpstate.hard = new_vfp;
+ vfp_flush_hwstate(thread);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0013-ARM-7308-1-vfp-flush-thread-hwstate-before-copying-p.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0013-ARM-7308-1-vfp-flush-thread-hwstate-before-copying-p.patch
new file mode 100644
index 0000000..df943e4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0013-ARM-7308-1-vfp-flush-thread-hwstate-before-copying-p.patch
@@ -0,0 +1,41 @@
+From a4e4a6ee0cc6e069926d006b7a6efd73d33edfcc Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Mon, 30 Jan 2012 20:23:29 +0100
+Subject: [PATCH 13/87] ARM: 7308/1: vfp: flush thread hwstate before copying
+ ptrace registers
+
+commit 8130b9d7b9d858aa04ce67805e8951e3cb6e9b2f upstream.
+
+If we are context switched whilst copying into a thread's
+vfp_hard_struct then the partial copy may be corrupted by the VFP
+context switching code (see "ARM: vfp: flush thread hwstate before
+restoring context from sigframe").
+
+This patch updates the ptrace VFP set code so that the thread state is
+flushed before the copy, therefore disabling VFP and preventing
+corruption from occurring.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/kernel/ptrace.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
+index 8b17fb4..90fa8b3 100644
+--- a/arch/arm/kernel/ptrace.c
++++ b/arch/arm/kernel/ptrace.c
+@@ -726,8 +726,8 @@ static int vfp_set(struct task_struct *target,
+ if (ret)
+ return ret;
+
+- thread->vfpstate.hard = new_vfp;
+ vfp_flush_hwstate(thread);
++ thread->vfpstate.hard = new_vfp;
+
+ return 0;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0014-ARM-OMAP2-GPMC-fix-device-size-setup.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0014-ARM-OMAP2-GPMC-fix-device-size-setup.patch
new file mode 100644
index 0000000..a2f52fe
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0014-ARM-OMAP2-GPMC-fix-device-size-setup.patch
@@ -0,0 +1,43 @@
+From 04712489fde65768a46fa4a4b240fff446c17aa6 Mon Sep 17 00:00:00 2001
+From: Yegor Yefremov <yegor_sub1@visionsystems.de>
+Date: Mon, 23 Jan 2012 08:32:23 +0100
+Subject: [PATCH 14/87] ARM: OMAP2+: GPMC: fix device size setup
+
+commit 8ef5d844cc3a644ea6f7665932a4307e9fad01fa upstream.
+
+following statement can only change device size from 8-bit(0) to 16-bit(1),
+but not vice versa:
+
+regval |= GPMC_CONFIG1_DEVICESIZE(wval);
+
+so as this field has 1 reserved bit, that could be used in future,
+just clear both bits and then OR with the desired value
+
+Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-omap2/gpmc.c | 6 ++++++
+ 1 files changed, 6 insertions(+), 0 deletions(-)
+
+diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c
+index 130034b..dfffbbf 100644
+--- a/arch/arm/mach-omap2/gpmc.c
++++ b/arch/arm/mach-omap2/gpmc.c
+@@ -528,7 +528,13 @@ int gpmc_cs_configure(int cs, int cmd, int wval)
+
+ case GPMC_CONFIG_DEV_SIZE:
+ regval = gpmc_cs_read_reg(cs, GPMC_CS_CONFIG1);
++
++ /* clear 2 target bits */
++ regval &= ~GPMC_CONFIG1_DEVICESIZE(3);
++
++ /* set the proper value */
+ regval |= GPMC_CONFIG1_DEVICESIZE(wval);
++
+ gpmc_cs_write_reg(cs, GPMC_CS_CONFIG1, regval);
+ break;
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0015-drivers-tty-vt-vt_ioctl.c-fix-KDFONTOP-32bit-compati.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0015-drivers-tty-vt-vt_ioctl.c-fix-KDFONTOP-32bit-compati.patch
new file mode 100644
index 0000000..9b0e85e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0015-drivers-tty-vt-vt_ioctl.c-fix-KDFONTOP-32bit-compati.patch
@@ -0,0 +1,44 @@
+From 58f75a56e37352b7dea174ee75f2ca52218370a7 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Fri, 3 Feb 2012 15:37:15 -0800
+Subject: [PATCH 15/87] drivers/tty/vt/vt_ioctl.c: fix KDFONTOP 32bit
+ compatibility layer
+
+commit cbcb8346054073d000ecac324763372d6abd44ac upstream.
+
+KDFONTOP(GET) currently fails with EIO when being run in a 32bit userland
+with a 64bit kernel if the font width is not 8.
+
+This is because of the setting of the KD_FONT_FLAG_OLD flag, which makes
+con_font_get return EIO in such case.
+
+This flag should *not* be set for KDFONTOP, since it's actually the whole
+point of this flag (see comment in con_font_set for instance).
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arthur Taylor <art@ified.ca>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/vt_ioctl.c | 1 -
+ 1 files changed, 0 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index 5e096f4..65447c5 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -1463,7 +1463,6 @@ compat_kdfontop_ioctl(struct compat_console_font_op __user *fontop,
+ if (!perm && op->op != KD_FONT_OP_GET)
+ return -EPERM;
+ op->data = compat_ptr(((struct compat_console_font_op *)op)->data);
+- op->flags |= KD_FONT_FLAG_OLD;
+ i = con_font_op(vc, op);
+ if (i)
+ return i;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0016-proc-mem_release-should-check-mm-NULL.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0016-proc-mem_release-should-check-mm-NULL.patch
new file mode 100644
index 0000000..200bc68
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0016-proc-mem_release-should-check-mm-NULL.patch
@@ -0,0 +1,34 @@
+From 3a196fbe2650a4465d49f6e84d9360eab60e3bcb Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Tue, 31 Jan 2012 17:14:38 +0100
+Subject: [PATCH 16/87] proc: mem_release() should check mm != NULL
+
+commit 71879d3cb3dd8f2dfdefb252775c1b3ea04a3dd4 upstream.
+
+mem_release() can hit mm == NULL, add the necessary check.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/proc/base.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 1fc1dca..a43c70a 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -886,8 +886,8 @@ loff_t mem_lseek(struct file *file, loff_t offset, int orig)
+ static int mem_release(struct inode *inode, struct file *file)
+ {
+ struct mm_struct *mm = file->private_data;
+-
+- mmput(mm);
++ if (mm)
++ mmput(mm);
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0017-proc-unify-mem_read-and-mem_write.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0017-proc-unify-mem_read-and-mem_write.patch
new file mode 100644
index 0000000..1c26c7f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0017-proc-unify-mem_read-and-mem_write.patch
@@ -0,0 +1,148 @@
+From 034089b6f4e2ae0d0df38f3409cd73c386ad069a Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Tue, 31 Jan 2012 17:14:54 +0100
+Subject: [PATCH 17/87] proc: unify mem_read() and mem_write()
+
+commit 572d34b946bae070debd42db1143034d9687e13f upstream.
+
+No functional changes, cleanup and preparation.
+
+mem_read() and mem_write() are very similar. Move this code into the
+new common helper, mem_rw(), which takes the additional "int write"
+argument.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/proc/base.c | 90 ++++++++++++++++++++------------------------------------
+ 1 files changed, 32 insertions(+), 58 deletions(-)
+
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index a43c70a..0d3a4d1 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -782,57 +782,13 @@ static int mem_open(struct inode* inode, struct file* file)
+ return 0;
+ }
+
+-static ssize_t mem_read(struct file * file, char __user * buf,
+- size_t count, loff_t *ppos)
++static ssize_t mem_rw(struct file *file, char __user *buf,
++ size_t count, loff_t *ppos, int write)
+ {
+- int ret;
+- char *page;
+- unsigned long src = *ppos;
+ struct mm_struct *mm = file->private_data;
+-
+- if (!mm)
+- return 0;
+-
+- page = (char *)__get_free_page(GFP_TEMPORARY);
+- if (!page)
+- return -ENOMEM;
+-
+- ret = 0;
+-
+- while (count > 0) {
+- int this_len, retval;
+-
+- this_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
+- retval = access_remote_vm(mm, src, page, this_len, 0);
+- if (!retval) {
+- if (!ret)
+- ret = -EIO;
+- break;
+- }
+-
+- if (copy_to_user(buf, page, retval)) {
+- ret = -EFAULT;
+- break;
+- }
+-
+- ret += retval;
+- src += retval;
+- buf += retval;
+- count -= retval;
+- }
+- *ppos = src;
+-
+- free_page((unsigned long) page);
+- return ret;
+-}
+-
+-static ssize_t mem_write(struct file * file, const char __user *buf,
+- size_t count, loff_t *ppos)
+-{
+- int copied;
++ unsigned long addr = *ppos;
++ ssize_t copied;
+ char *page;
+- unsigned long dst = *ppos;
+- struct mm_struct *mm = file->private_data;
+
+ if (!mm)
+ return 0;
+@@ -843,30 +799,48 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
+
+ copied = 0;
+ while (count > 0) {
+- int this_len, retval;
++ int this_len = min_t(int, count, PAGE_SIZE);
+
+- this_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
+- if (copy_from_user(page, buf, this_len)) {
++ if (write && copy_from_user(page, buf, this_len)) {
+ copied = -EFAULT;
+ break;
+ }
+- retval = access_remote_vm(mm, dst, page, this_len, 1);
+- if (!retval) {
++
++ this_len = access_remote_vm(mm, addr, page, this_len, write);
++ if (!this_len) {
+ if (!copied)
+ copied = -EIO;
+ break;
+ }
+- copied += retval;
+- buf += retval;
+- dst += retval;
+- count -= retval;
++
++ if (!write && copy_to_user(buf, page, this_len)) {
++ copied = -EFAULT;
++ break;
++ }
++
++ buf += this_len;
++ addr += this_len;
++ copied += this_len;
++ count -= this_len;
+ }
+- *ppos = dst;
++ *ppos = addr;
+
+ free_page((unsigned long) page);
+ return copied;
+ }
+
++static ssize_t mem_read(struct file *file, char __user *buf,
++ size_t count, loff_t *ppos)
++{
++ return mem_rw(file, buf, count, ppos, 0);
++}
++
++static ssize_t mem_write(struct file *file, const char __user *buf,
++ size_t count, loff_t *ppos)
++{
++ return mem_rw(file, (char __user*)buf, count, ppos, 1);
++}
++
+ loff_t mem_lseek(struct file *file, loff_t offset, int orig)
+ {
+ switch (orig) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0018-proc-make-sure-mem_open-doesn-t-pin-the-target-s-mem.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0018-proc-make-sure-mem_open-doesn-t-pin-the-target-s-mem.patch
new file mode 100644
index 0000000..836e302
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0018-proc-make-sure-mem_open-doesn-t-pin-the-target-s-mem.patch
@@ -0,0 +1,79 @@
+From 43904e95ba660b59db5899a4d58a00e4ac4d3663 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Tue, 31 Jan 2012 17:15:11 +0100
+Subject: [PATCH 18/87] proc: make sure mem_open() doesn't pin the target's
+ memory
+
+commit 6d08f2c7139790c268820a2e590795cb8333181a upstream.
+
+Once /proc/pid/mem is opened, the memory can't be released until
+mem_release() even if its owner exits.
+
+Change mem_open() to do atomic_inc(mm_count) + mmput(), this only
+pins mm_struct. Change mem_rw() to do atomic_inc_not_zero(mm_count)
+before access_remote_vm(), this verifies that this mm is still alive.
+
+I am not sure what should mem_rw() return if atomic_inc_not_zero()
+fails. With this patch it returns zero to match the "mm == NULL" case,
+may be it should return -EINVAL like it did before e268337d.
+
+Perhaps it makes sense to add the additional fatal_signal_pending()
+check into the main loop, to ensure we do not hold this memory if
+the target task was oom-killed.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/proc/base.c | 14 +++++++++++++-
+ 1 files changed, 13 insertions(+), 1 deletions(-)
+
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 0d3a4d1..1ace83d 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -775,6 +775,13 @@ static int mem_open(struct inode* inode, struct file* file)
+ if (IS_ERR(mm))
+ return PTR_ERR(mm);
+
++ if (mm) {
++ /* ensure this mm_struct can't be freed */
++ atomic_inc(&mm->mm_count);
++ /* but do not pin its memory */
++ mmput(mm);
++ }
++
+ /* OK to pass negative loff_t, we can catch out-of-range */
+ file->f_mode |= FMODE_UNSIGNED_OFFSET;
+ file->private_data = mm;
+@@ -798,6 +805,9 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
+ return -ENOMEM;
+
+ copied = 0;
++ if (!atomic_inc_not_zero(&mm->mm_users))
++ goto free;
++
+ while (count > 0) {
+ int this_len = min_t(int, count, PAGE_SIZE);
+
+@@ -825,6 +835,8 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
+ }
+ *ppos = addr;
+
++ mmput(mm);
++free:
+ free_page((unsigned long) page);
+ return copied;
+ }
+@@ -861,7 +873,7 @@ static int mem_release(struct inode *inode, struct file *file)
+ {
+ struct mm_struct *mm = file->private_data;
+ if (mm)
+- mmput(mm);
++ mmdrop(mm);
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0019-firewire-ohci-add-reset-packet-quirk-for-SB-Audigy.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0019-firewire-ohci-add-reset-packet-quirk-for-SB-Audigy.patch
new file mode 100644
index 0000000..d8f6fa0
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0019-firewire-ohci-add-reset-packet-quirk-for-SB-Audigy.patch
@@ -0,0 +1,43 @@
+From 49b7e22b82d73e58a5335820b3f0441b2606515b Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Thu, 26 Jan 2012 22:05:58 +0100
+Subject: [PATCH 19/87] firewire: ohci: add reset packet quirk for SB Audigy
+
+commit d1bb399ad03c11e792f6dea198d3b1e23061f094 upstream.
+
+The Audigy's SB1394 controller is actually from Texas Instruments
+and has the same bus reset packet generation bug, so it needs the
+same quirk entry.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firewire/ohci.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
+index 6628fea..21250ec 100644
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -263,6 +263,7 @@ static inline struct fw_ohci *fw_ohci(struct fw_card *card)
+ static char ohci_driver_name[] = KBUILD_MODNAME;
+
+ #define PCI_DEVICE_ID_AGERE_FW643 0x5901
++#define PCI_DEVICE_ID_CREATIVE_SB1394 0x4001
+ #define PCI_DEVICE_ID_JMICRON_JMB38X_FW 0x2380
+ #define PCI_DEVICE_ID_TI_TSB12LV22 0x8009
+ #define PCI_DEVICE_ID_TI_TSB12LV26 0x8020
+@@ -289,6 +290,9 @@ static const struct {
+ {PCI_VENDOR_ID_ATT, PCI_DEVICE_ID_AGERE_FW643, 6,
+ QUIRK_NO_MSI},
+
++ {PCI_VENDOR_ID_CREATIVE, PCI_DEVICE_ID_CREATIVE_SB1394, PCI_ANY_ID,
++ QUIRK_RESET_PACKET},
++
+ {PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB38X_FW, PCI_ANY_ID,
+ QUIRK_NO_MSI},
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0020-firewire-ohci-disable-MSI-on-Ricoh-controllers.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0020-firewire-ohci-disable-MSI-on-Ricoh-controllers.patch
new file mode 100644
index 0000000..e758deb
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0020-firewire-ohci-disable-MSI-on-Ricoh-controllers.patch
@@ -0,0 +1,43 @@
+From c1a1e15fd6fe7ed496d115ac9b87649e4d827d65 Mon Sep 17 00:00:00 2001
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Date: Sun, 29 Jan 2012 12:41:15 +0100
+Subject: [PATCH 20/87] firewire: ohci: disable MSI on Ricoh controllers
+
+commit 320cfa6ce0b3dc794fedfa4bae54c0f65077234d upstream.
+
+The PCIe device
+
+ FireWire (IEEE 1394) [0c00]: Ricoh Co Ltd FireWire Host Controller
+ [1180:e832] (prog-if 10 [OHCI])
+
+is unable to access attached FireWire devices when MSI is enabled but
+works if MSI is disabled.
+http://www.mail-archive.com/alsa-user@lists.sourceforge.net/msg28251.html
+
+Hence add the "disable MSI" quirks flag for this device, or in fact for
+safety and simplicity for all current (R5U230, R5U231, R5U240) and
+future Ricoh PCIe 1394 controllers.
+
+Reported-by: Stefan Thomas <kontrapunktstefan@googlemail.com>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firewire/ohci.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
+index 21250ec..7f5f0da 100644
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -303,7 +303,7 @@ static const struct {
+ QUIRK_NO_MSI},
+
+ {PCI_VENDOR_ID_RICOH, PCI_ANY_ID, PCI_ANY_ID,
+- QUIRK_CYCLE_TIMER},
++ QUIRK_CYCLE_TIMER | QUIRK_NO_MSI},
+
+ {PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_TSB12LV22, PCI_ANY_ID,
+ QUIRK_CYCLE_TIMER | QUIRK_RESET_PACKET | QUIRK_NO_1394A},
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0021-IB-mlx4-pass-SMP-vendor-specific-attribute-MADs-to-f.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0021-IB-mlx4-pass-SMP-vendor-specific-attribute-MADs-to-f.patch
new file mode 100644
index 0000000..0307b83
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0021-IB-mlx4-pass-SMP-vendor-specific-attribute-MADs-to-f.patch
@@ -0,0 +1,90 @@
+From a48d135810111baaedd01dfb833c06b094aa3a68 Mon Sep 17 00:00:00 2001
+From: Jack Morgenstein <jackm@mellanox.com>
+Date: Thu, 26 Jan 2012 16:41:33 +0200
+Subject: [PATCH 21/87] IB/mlx4: pass SMP vendor-specific attribute MADs to
+ firmware
+
+commit a6f7feae6d19e84253918d88b04153af09d3a243 upstream.
+
+In the current code, vendor-specific MADs (e.g with the FDR-10
+attribute) are silently dropped by the driver, resulting in timeouts
+at the sending side and inability to query/configure the relevant
+feature. However, the ConnectX firmware is able to handle such MADs.
+For unsupported attributes, the firmware returns a GET_RESPONSE MAD
+containing an error status.
+
+For example, for a FDR-10 node with LID 11:
+
+ # ibstat mlx4_0 1
+
+ CA: 'mlx4_0'
+ Port 1:
+ State: Active
+ Physical state: LinkUp
+ Rate: 40 (FDR10)
+ Base lid: 11
+ LMC: 0
+ SM lid: 24
+ Capability mask: 0x02514868
+ Port GUID: 0x0002c903002e65d1
+ Link layer: InfiniBand
+
+Extended Port Query (EPI) vendor mad timeouts before the patch:
+
+ # smpquery MEPI 11 -d
+
+ ibwarn: [4196] smp_query_via: attr 0xff90 mod 0x0 route Lid 11
+ ibwarn: [4196] _do_madrpc: retry 1 (timeout 1000 ms)
+ ibwarn: [4196] _do_madrpc: retry 2 (timeout 1000 ms)
+ ibwarn: [4196] _do_madrpc: timeout after 3 retries, 3000 ms
+ ibwarn: [4196] mad_rpc: _do_madrpc failed; dport (Lid 11)
+ smpquery: iberror: [pid 4196] main: failed: operation EPI: ext port info query failed
+
+EPI query works OK with the patch:
+
+ # smpquery MEPI 11 -d
+
+ ibwarn: [6548] smp_query_via: attr 0xff90 mod 0x0 route Lid 11
+ ibwarn: [6548] mad_rpc: data offs 64 sz 64
+ mad data
+ 0000 0000 0000 0001 0000 0001 0000 0001
+ 0000 0000 0000 0000 0000 0000 0000 0000
+ 0000 0000 0000 0000 0000 0000 0000 0000
+ 0000 0000 0000 0000 0000 0000 0000 0000
+ # Ext Port info: Lid 11 port 0
+ StateChangeEnable:...............0x00
+ LinkSpeedSupported:..............0x01
+ LinkSpeedEnabled:................0x01
+ LinkSpeedActive:.................0x01
+
+Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+Acked-by: Ira Weiny <weiny2@llnl.gov>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx4/mad.c | 7 ++-----
+ 1 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
+index f36da99..77702c0 100644
+--- a/drivers/infiniband/hw/mlx4/mad.c
++++ b/drivers/infiniband/hw/mlx4/mad.c
+@@ -256,12 +256,9 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
+ return IB_MAD_RESULT_SUCCESS;
+
+ /*
+- * Don't process SMInfo queries or vendor-specific
+- * MADs -- the SMA can't handle them.
++ * Don't process SMInfo queries -- the SMA can't handle them.
+ */
+- if (in_mad->mad_hdr.attr_id == IB_SMP_ATTR_SM_INFO ||
+- ((in_mad->mad_hdr.attr_id & IB_SMP_ATTR_VENDOR_MASK) ==
+- IB_SMP_ATTR_VENDOR_MASK))
++ if (in_mad->mad_hdr.attr_id == IB_SMP_ATTR_SM_INFO)
+ return IB_MAD_RESULT_SUCCESS;
+ } else if (in_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_PERF_MGMT ||
+ in_mad->mad_hdr.mgmt_class == MLX4_IB_VENDOR_CLASS1 ||
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0022-RDMA-core-Fix-kernel-panic-by-always-initializing-qp.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0022-RDMA-core-Fix-kernel-panic-by-always-initializing-qp.patch
new file mode 100644
index 0000000..853d5b9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0022-RDMA-core-Fix-kernel-panic-by-always-initializing-qp.patch
@@ -0,0 +1,68 @@
+From 3ef7302303a7886fd1e6dea9dd33fe2c41784199 Mon Sep 17 00:00:00 2001
+From: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+Date: Fri, 20 Jan 2012 18:43:54 +0000
+Subject: [PATCH 22/87] RDMA/core: Fix kernel panic by always initializing
+ qp->usecnt
+
+commit e47e321a35c741ee41b67976f8c6a3a7a42bc5c0 upstream.
+
+We have just been investigating kernel panics related to
+cq->ibcq.event_handler() completion calls. The problem is that
+ib_destroy_qp() fails with -EBUSY.
+
+Further investigation revealed qp->usecnt is not initialized. This
+counter was introduced in linux-3.2 by commit 0e0ec7e0638e
+("RDMA/core: Export ib_open_qp() to share XRC TGT QPs") but it only
+gets initialized for IB_QPT_XRC_TGT, but it is checked in
+ib_destroy_qp() for any QP type.
+
+Fix this by initializing qp->usecnt for every QP we create.
+
+Signed-off-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+Signed-off-by: Sven Breuner <sven.breuner@itwm.fraunhofer.de>
+
+[ Initialize qp->usecnt in uverbs too. - Sean ]
+
+Signed-off-by: Sean Hefty <sean.hefty@intel.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/uverbs_cmd.c | 1 +
+ drivers/infiniband/core/verbs.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index e3db8ef..a8445b8 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -1485,6 +1485,7 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
+ qp->event_handler = attr.event_handler;
+ qp->qp_context = attr.qp_context;
+ qp->qp_type = attr.qp_type;
++ atomic_set(&qp->usecnt, 0);
+ atomic_inc(&pd->usecnt);
+ atomic_inc(&attr.send_cq->usecnt);
+ if (attr.recv_cq)
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index 602b1bd..575b780 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -421,6 +421,7 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
+ qp->uobject = NULL;
+ qp->qp_type = qp_init_attr->qp_type;
+
++ atomic_set(&qp->usecnt, 0);
+ if (qp_init_attr->qp_type == IB_QPT_XRC_TGT) {
+ qp->event_handler = __ib_shared_qp_event_handler;
+ qp->qp_context = qp;
+@@ -430,7 +431,6 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
+ qp->xrcd = qp_init_attr->xrcd;
+ atomic_inc(&qp_init_attr->xrcd->usecnt);
+ INIT_LIST_HEAD(&qp->open_list);
+- atomic_set(&qp->usecnt, 0);
+
+ real_qp = qp;
+ qp = __ib_open_qp(real_qp, qp_init_attr->event_handler,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0023-kprobes-fix-a-memory-leak-in-function-pre_handler_kr.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0023-kprobes-fix-a-memory-leak-in-function-pre_handler_kr.patch
new file mode 100644
index 0000000..29e9a91
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0023-kprobes-fix-a-memory-leak-in-function-pre_handler_kr.patch
@@ -0,0 +1,52 @@
+From ff016619c98fa2edcb44b6cffe5a60435328348a Mon Sep 17 00:00:00 2001
+From: Jiang Liu <liuj97@gmail.com>
+Date: Fri, 3 Feb 2012 15:37:16 -0800
+Subject: [PATCH 23/87] kprobes: fix a memory leak in function
+ pre_handler_kretprobe()
+
+commit 55ca6140e9bb307efc97a9301a4f501de02a6fd6 upstream.
+
+In function pre_handler_kretprobe(), the allocated kretprobe_instance
+object will get leaked if the entry_handler callback returns non-zero.
+This may cause all the preallocated kretprobe_instance objects exhausted.
+
+This issue can be reproduced by changing
+samples/kprobes/kretprobe_example.c to probe "mutex_unlock". And the fix
+is straightforward: just put the allocated kretprobe_instance object back
+onto the free_instances list.
+
+[akpm@linux-foundation.org: use raw_spin_lock/unlock]
+Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
+Acked-by: Jim Keniston <jkenisto@us.ibm.com>
+Acked-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
+Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/kprobes.c | 6 +++++-
+ 1 files changed, 5 insertions(+), 1 deletions(-)
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 52fd049..faa39d1 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1673,8 +1673,12 @@ static int __kprobes pre_handler_kretprobe(struct kprobe *p,
+ ri->rp = rp;
+ ri->task = current;
+
+- if (rp->entry_handler && rp->entry_handler(ri, regs))
++ if (rp->entry_handler && rp->entry_handler(ri, regs)) {
++ raw_spin_lock_irqsave(&rp->lock, flags);
++ hlist_add_head(&ri->hlist, &rp->free_instances);
++ raw_spin_unlock_irqrestore(&rp->lock, flags);
+ return 0;
++ }
+
+ arch_prepare_kretprobe(ri, regs);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0024-mtd-gpmi-nand-bugfix-reset-the-BCH-module-when-it-is.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0024-mtd-gpmi-nand-bugfix-reset-the-BCH-module-when-it-is.patch
new file mode 100644
index 0000000..92647a5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0024-mtd-gpmi-nand-bugfix-reset-the-BCH-module-when-it-is.patch
@@ -0,0 +1,72 @@
+From 5e71844e1d3a9ae8681fc18781a3579eed4b2406 Mon Sep 17 00:00:00 2001
+From: Huang Shijie <b32955@freescale.com>
+Date: Wed, 4 Jan 2012 11:18:46 +0800
+Subject: [PATCH 24/87] mtd: gpmi-nand bugfix: reset the BCH module when it is
+ not MX23
+
+commit 9398d1ce09b9009996f7d2468e1d3c785fa6feda upstream.
+
+In MX28, if we do not reset the BCH module. The BCH module may
+becomes unstable when the board reboots for several thousands times.
+This bug has been catched in customer's production.
+
+The patch adds some comments (some from Wolfram Sang), and fixes it now.
+
+Also change gpmi_reset_block() to static.
+
+Signed-off-by: Huang Shijie <b32955@freescale.com>
+Acked-by: Marek Vasut <marek.vasut@gmail.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/gpmi-nand/gpmi-lib.c | 18 ++++++++++++++----
+ 1 files changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
+index de4db76..bb2fe60 100644
+--- a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
++++ b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
+@@ -69,17 +69,19 @@ static int clear_poll_bit(void __iomem *addr, u32 mask)
+ * [1] enable the module.
+ * [2] reset the module.
+ *
+- * In most of the cases, it's ok. But there is a hardware bug in the BCH block.
++ * In most of the cases, it's ok.
++ * But in MX23, there is a hardware bug in the BCH block (see erratum #2847).
+ * If you try to soft reset the BCH block, it becomes unusable until
+ * the next hard reset. This case occurs in the NAND boot mode. When the board
+ * boots by NAND, the ROM of the chip will initialize the BCH blocks itself.
+ * So If the driver tries to reset the BCH again, the BCH will not work anymore.
+- * You will see a DMA timeout in this case.
++ * You will see a DMA timeout in this case. The bug has been fixed
++ * in the following chips, such as MX28.
+ *
+ * To avoid this bug, just add a new parameter `just_enable` for
+ * the mxs_reset_block(), and rewrite it here.
+ */
+-int gpmi_reset_block(void __iomem *reset_addr, bool just_enable)
++static int gpmi_reset_block(void __iomem *reset_addr, bool just_enable)
+ {
+ int ret;
+ int timeout = 0x400;
+@@ -206,7 +208,15 @@ int bch_set_geometry(struct gpmi_nand_data *this)
+ if (ret)
+ goto err_out;
+
+- ret = gpmi_reset_block(r->bch_regs, true);
++ /*
++ * Due to erratum #2847 of the MX23, the BCH cannot be soft reset on this
++ * chip, otherwise it will lock up. So we skip resetting BCH on the MX23.
++ * On the other hand, the MX28 needs the reset, because one case has been
++ * seen where the BCH produced ECC errors constantly after 10000
++ * consecutive reboots. The latter case has not been seen on the MX23 yet,
++ * still we don't know if it could happen there as well.
++ */
++ ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
+ if (ret)
+ goto err_out;
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0025-Revert-mtd-atmel_nand-optimize-read-write-buffer-fun.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0025-Revert-mtd-atmel_nand-optimize-read-write-buffer-fun.patch
new file mode 100644
index 0000000..53c40b7
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0025-Revert-mtd-atmel_nand-optimize-read-write-buffer-fun.patch
@@ -0,0 +1,113 @@
+From 061d6b14b3b59f140371baa0f98963f761a7080f Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Thu, 2 Feb 2012 13:54:25 +0200
+Subject: [PATCH 25/87] Revert "mtd: atmel_nand: optimize read/write buffer
+ functions"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 500823195d0c9eec2a4637484f30cc93ec633d4a upstream.
+
+This reverts commit fb5427508abbd635e877fabdf55795488119c2d6.
+
+The reason is that it breaks 16 bits NAND flash as it was reported by
+Nikolaus Voss and confirmed by Eric Bénard.
+
+Nicolas Ferre <nicolas.ferre@atmel.com> alco confirmed:
+"After double checking with designers, I must admit that I misunderstood
+the way of optimizing accesses to SMC. 16 bit nand is not so common
+those days..."
+
+Reported-by: Nikolaus Voss <n.voss@weinmann.de>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/atmel_nand.c | 45 +++++++++++++++++++++++++++++++++++++---
+ 1 files changed, 41 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
+index 23e5d77..ee6e26e 100644
+--- a/drivers/mtd/nand/atmel_nand.c
++++ b/drivers/mtd/nand/atmel_nand.c
+@@ -161,6 +161,37 @@ static int atmel_nand_device_ready(struct mtd_info *mtd)
+ !!host->board->rdy_pin_active_low;
+ }
+
++/*
++ * Minimal-overhead PIO for data access.
++ */
++static void atmel_read_buf8(struct mtd_info *mtd, u8 *buf, int len)
++{
++ struct nand_chip *nand_chip = mtd->priv;
++
++ __raw_readsb(nand_chip->IO_ADDR_R, buf, len);
++}
++
++static void atmel_read_buf16(struct mtd_info *mtd, u8 *buf, int len)
++{
++ struct nand_chip *nand_chip = mtd->priv;
++
++ __raw_readsw(nand_chip->IO_ADDR_R, buf, len / 2);
++}
++
++static void atmel_write_buf8(struct mtd_info *mtd, const u8 *buf, int len)
++{
++ struct nand_chip *nand_chip = mtd->priv;
++
++ __raw_writesb(nand_chip->IO_ADDR_W, buf, len);
++}
++
++static void atmel_write_buf16(struct mtd_info *mtd, const u8 *buf, int len)
++{
++ struct nand_chip *nand_chip = mtd->priv;
++
++ __raw_writesw(nand_chip->IO_ADDR_W, buf, len / 2);
++}
++
+ static void dma_complete_func(void *completion)
+ {
+ complete(completion);
+@@ -235,27 +266,33 @@ err_buf:
+ static void atmel_read_buf(struct mtd_info *mtd, u8 *buf, int len)
+ {
+ struct nand_chip *chip = mtd->priv;
++ struct atmel_nand_host *host = chip->priv;
+
+ if (use_dma && len > mtd->oobsize)
+ /* only use DMA for bigger than oob size: better performances */
+ if (atmel_nand_dma_op(mtd, buf, len, 1) == 0)
+ return;
+
+- /* if no DMA operation possible, use PIO */
+- memcpy_fromio(buf, chip->IO_ADDR_R, len);
++ if (host->board->bus_width_16)
++ atmel_read_buf16(mtd, buf, len);
++ else
++ atmel_read_buf8(mtd, buf, len);
+ }
+
+ static void atmel_write_buf(struct mtd_info *mtd, const u8 *buf, int len)
+ {
+ struct nand_chip *chip = mtd->priv;
++ struct atmel_nand_host *host = chip->priv;
+
+ if (use_dma && len > mtd->oobsize)
+ /* only use DMA for bigger than oob size: better performances */
+ if (atmel_nand_dma_op(mtd, (void *)buf, len, 0) == 0)
+ return;
+
+- /* if no DMA operation possible, use PIO */
+- memcpy_toio(chip->IO_ADDR_W, buf, len);
++ if (host->board->bus_width_16)
++ atmel_write_buf16(mtd, buf, len);
++ else
++ atmel_write_buf8(mtd, buf, len);
+ }
+
+ /*
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0026-at_hdmac-bugfix-for-enabling-channel-irq.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0026-at_hdmac-bugfix-for-enabling-channel-irq.patch
new file mode 100644
index 0000000..e96a322
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0026-at_hdmac-bugfix-for-enabling-channel-irq.patch
@@ -0,0 +1,92 @@
+From 2139363dee1243badcac4da0af194ed764339c05 Mon Sep 17 00:00:00 2001
+From: Nikolaus Voss <n.voss@weinmann.de>
+Date: Tue, 17 Jan 2012 10:28:33 +0100
+Subject: [PATCH 26/87] at_hdmac: bugfix for enabling channel irq
+
+commit bda3a47c886664e86ee14eb79e9072b9e341f575 upstream.
+
+commit 463894705e4089d0ff69e7d877312d496ac70e5b deleted redundant
+chan_id and chancnt initialization in dma drivers as this is done
+in dma_async_device_register().
+
+However, atc_enable_irq() relied on chan_id set before registering
+the device, what left only channel 0 functional for this driver.
+
+This patch introduces atc_enable/disable_chan_irq() as a variant
+of atc_enable/disable_irq() with the channel as explicit argument.
+
+Signed-off-by: Nikolaus Voss <n.voss@weinmann.de>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_hdmac.c | 4 ++--
+ drivers/dma/at_hdmac_regs.h | 17 ++++++++---------
+ 2 files changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index fcfa0a8..a60adbf 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1286,7 +1286,7 @@ static int __init at_dma_probe(struct platform_device *pdev)
+
+ tasklet_init(&atchan->tasklet, atc_tasklet,
+ (unsigned long)atchan);
+- atc_enable_irq(atchan);
++ atc_enable_chan_irq(atdma, i);
+ }
+
+ /* set base routines */
+@@ -1353,7 +1353,7 @@ static int __exit at_dma_remove(struct platform_device *pdev)
+ struct at_dma_chan *atchan = to_at_dma_chan(chan);
+
+ /* Disable interrupts */
+- atc_disable_irq(atchan);
++ atc_disable_chan_irq(atdma, chan->chan_id);
+ tasklet_disable(&atchan->tasklet);
+
+ tasklet_kill(&atchan->tasklet);
+diff --git a/drivers/dma/at_hdmac_regs.h b/drivers/dma/at_hdmac_regs.h
+index aa4c9ae..5aa82b4 100644
+--- a/drivers/dma/at_hdmac_regs.h
++++ b/drivers/dma/at_hdmac_regs.h
+@@ -326,28 +326,27 @@ static void atc_dump_lli(struct at_dma_chan *atchan, struct at_lli *lli)
+ }
+
+
+-static void atc_setup_irq(struct at_dma_chan *atchan, int on)
++static void atc_setup_irq(struct at_dma *atdma, int chan_id, int on)
+ {
+- struct at_dma *atdma = to_at_dma(atchan->chan_common.device);
+- u32 ebci;
++ u32 ebci;
+
+ /* enable interrupts on buffer transfer completion & error */
+- ebci = AT_DMA_BTC(atchan->chan_common.chan_id)
+- | AT_DMA_ERR(atchan->chan_common.chan_id);
++ ebci = AT_DMA_BTC(chan_id)
++ | AT_DMA_ERR(chan_id);
+ if (on)
+ dma_writel(atdma, EBCIER, ebci);
+ else
+ dma_writel(atdma, EBCIDR, ebci);
+ }
+
+-static inline void atc_enable_irq(struct at_dma_chan *atchan)
++static void atc_enable_chan_irq(struct at_dma *atdma, int chan_id)
+ {
+- atc_setup_irq(atchan, 1);
++ atc_setup_irq(atdma, chan_id, 1);
+ }
+
+-static inline void atc_disable_irq(struct at_dma_chan *atchan)
++static void atc_disable_chan_irq(struct at_dma *atdma, int chan_id)
+ {
+- atc_setup_irq(atchan, 0);
++ atc_setup_irq(atdma, chan_id, 0);
+ }
+
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0027-mm-filemap_xip.c-fix-race-condition-in-xip_file_faul.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0027-mm-filemap_xip.c-fix-race-condition-in-xip_file_faul.patch
new file mode 100644
index 0000000..7c3c8a6
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0027-mm-filemap_xip.c-fix-race-condition-in-xip_file_faul.patch
@@ -0,0 +1,58 @@
+From e7908f7b777ac850ef6a11cb53aa8e27fcf40a1e Mon Sep 17 00:00:00 2001
+From: Carsten Otte <carsteno@de.ibm.com>
+Date: Fri, 3 Feb 2012 15:37:14 -0800
+Subject: [PATCH 27/87] mm/filemap_xip.c: fix race condition in
+ xip_file_fault()
+
+commit 99f02ef1f18631eb0a4e0ea0a3d56878dbcb4b90 upstream.
+
+Fix a race condition that shows in conjunction with xip_file_fault() when
+two threads of the same user process fault on the same memory page.
+
+In this case, the race winner will install the page table entry and the
+unlucky loser will cause an oops: xip_file_fault calls vm_insert_pfn (via
+vm_insert_mixed) which drops out at this check:
+
+ retval = -EBUSY;
+ if (!pte_none(*pte))
+ goto out_unlock;
+
+The resulting -EBUSY return value will trigger a BUG_ON() in
+xip_file_fault.
+
+This fix simply considers the fault as fixed in this case, because the
+race winner has successfully installed the pte.
+
+[akpm@linux-foundation.org: use conventional (and consistent) comment layout]
+Reported-by: David Sadler <dsadler@us.ibm.com>
+Signed-off-by: Carsten Otte <cotte@de.ibm.com>
+Reported-by: Louis Alex Eisner <leisner@cs.ucsd.edu>
+Cc: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/filemap_xip.c | 7 ++++++-
+ 1 files changed, 6 insertions(+), 1 deletions(-)
+
+diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
+index f91b2f6..a4eb311 100644
+--- a/mm/filemap_xip.c
++++ b/mm/filemap_xip.c
+@@ -263,7 +263,12 @@ found:
+ xip_pfn);
+ if (err == -ENOMEM)
+ return VM_FAULT_OOM;
+- BUG_ON(err);
++ /*
++ * err == -EBUSY is fine, we've raced against another thread
++ * that faulted-in the same page
++ */
++ if (err != -EBUSY)
++ BUG_ON(err);
+ return VM_FAULT_NOPAGE;
+ } else {
+ int err, ret = VM_FAULT_OOM;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0028-mm-compaction-check-pfn_valid-when-entering-a-new-MA.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0028-mm-compaction-check-pfn_valid-when-entering-a-new-MA.patch
new file mode 100644
index 0000000..8862a78
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0028-mm-compaction-check-pfn_valid-when-entering-a-new-MA.patch
@@ -0,0 +1,112 @@
+From 9da11afefb6f8ccc0f7731831f7ad73106fc87f3 Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@suse.de>
+Date: Fri, 3 Feb 2012 15:37:18 -0800
+Subject: [PATCH 28/87] mm: compaction: check pfn_valid when entering a new
+ MAX_ORDER_NR_PAGES block during isolation for
+ migration
+
+commit 0bf380bc70ecba68cb4d74dc656cc2fa8c4d801a upstream.
+
+When isolating for migration, migration starts at the start of a zone
+which is not necessarily pageblock aligned. Further, it stops isolating
+when COMPACT_CLUSTER_MAX pages are isolated so migrate_pfn is generally
+not aligned. This allows isolate_migratepages() to call pfn_to_page() on
+an invalid PFN which can result in a crash. This was originally reported
+against a 3.0-based kernel with the following trace in a crash dump.
+
+PID: 9902 TASK: d47aecd0 CPU: 0 COMMAND: "memcg_process_s"
+ #0 [d72d3ad0] crash_kexec at c028cfdb
+ #1 [d72d3b24] oops_end at c05c5322
+ #2 [d72d3b38] __bad_area_nosemaphore at c0227e60
+ #3 [d72d3bec] bad_area at c0227fb6
+ #4 [d72d3c00] do_page_fault at c05c72ec
+ #5 [d72d3c80] error_code (via page_fault) at c05c47a4
+ EAX: 00000000 EBX: 000c0000 ECX: 00000001 EDX: 00000807 EBP: 000c0000
+ DS: 007b ESI: 00000001 ES: 007b EDI: f3000a80 GS: 6f50
+ CS: 0060 EIP: c030b15a ERR: ffffffff EFLAGS: 00010002
+ #6 [d72d3cb4] isolate_migratepages at c030b15a
+ #7 [d72d3d14] zone_watermark_ok at c02d26cb
+ #8 [d72d3d2c] compact_zone at c030b8de
+ #9 [d72d3d68] compact_zone_order at c030bba1
+#10 [d72d3db4] try_to_compact_pages at c030bc84
+#11 [d72d3ddc] __alloc_pages_direct_compact at c02d61e7
+#12 [d72d3e08] __alloc_pages_slowpath at c02d66c7
+#13 [d72d3e78] __alloc_pages_nodemask at c02d6a97
+#14 [d72d3eb8] alloc_pages_vma at c030a845
+#15 [d72d3ed4] do_huge_pmd_anonymous_page at c03178eb
+#16 [d72d3f00] handle_mm_fault at c02f36c6
+#17 [d72d3f30] do_page_fault at c05c70ed
+#18 [d72d3fb0] error_code (via page_fault) at c05c47a4
+ EAX: b71ff000 EBX: 00000001 ECX: 00001600 EDX: 00000431
+ DS: 007b ESI: 08048950 ES: 007b EDI: bfaa3788
+ SS: 007b ESP: bfaa36e0 EBP: bfaa3828 GS: 6f50
+ CS: 0073 EIP: 080487c8 ERR: ffffffff EFLAGS: 00010202
+
+It was also reported by Herbert van den Bergh against 3.1-based kernel
+with the following snippet from the console log.
+
+BUG: unable to handle kernel paging request at 01c00008
+IP: [<c0522399>] isolate_migratepages+0x119/0x390
+*pdpt = 000000002f7ce001 *pde = 0000000000000000
+
+It is expected that it also affects 3.2.x and current mainline.
+
+The problem is that pfn_valid is only called on the first PFN being
+checked and that PFN is not necessarily aligned. Lets say we have a case
+like this
+
+H = MAX_ORDER_NR_PAGES boundary
+| = pageblock boundary
+m = cc->migrate_pfn
+f = cc->free_pfn
+o = memory hole
+
+H------|------H------|----m-Hoooooo|ooooooH-f----|------H
+
+The migrate_pfn is just below a memory hole and the free scanner is beyond
+the hole. When isolate_migratepages started, it scans from migrate_pfn to
+migrate_pfn+pageblock_nr_pages which is now in a memory hole. It checks
+pfn_valid() on the first PFN but then scans into the hole where there are
+not necessarily valid struct pages.
+
+This patch ensures that isolate_migratepages calls pfn_valid when
+necessary.
+
+Reported-by: Herbert van den Bergh <herbert.van.den.bergh@oracle.com>
+Tested-by: Herbert van den Bergh <herbert.van.den.bergh@oracle.com>
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Acked-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/compaction.c | 13 +++++++++++++
+ 1 files changed, 13 insertions(+), 0 deletions(-)
+
+diff --git a/mm/compaction.c b/mm/compaction.c
+index 899d956..edc1e26 100644
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -313,6 +313,19 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone,
+ } else if (!locked)
+ spin_lock_irq(&zone->lru_lock);
+
++ /*
++ * migrate_pfn does not necessarily start aligned to a
++ * pageblock. Ensure that pfn_valid is called when moving
++ * into a new MAX_ORDER_NR_PAGES range in case of large
++ * memory holes within the zone
++ */
++ if ((low_pfn & (MAX_ORDER_NR_PAGES - 1)) == 0) {
++ if (!pfn_valid(low_pfn)) {
++ low_pfn += MAX_ORDER_NR_PAGES - 1;
++ continue;
++ }
++ }
++
+ if (!pfn_valid_within(low_pfn))
+ continue;
+ nr_scanned++;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0029-PM-Hibernate-Fix-s2disk-regression-related-to-freezi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0029-PM-Hibernate-Fix-s2disk-regression-related-to-freezi.patch
new file mode 100644
index 0000000..524e6d1
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0029-PM-Hibernate-Fix-s2disk-regression-related-to-freezi.patch
@@ -0,0 +1,100 @@
+From d483054fe4c66eeb7a03fdc97519b07edb1dc803 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+Date: Sun, 29 Jan 2012 20:35:52 +0100
+Subject: [PATCH 29/87] PM / Hibernate: Fix s2disk regression related to
+ freezing workqueues
+
+commit 181e9bdef37bfcaa41f3ab6c948a2a0d60a268b5 upstream.
+
+Commit 2aede851ddf08666f68ffc17be446420e9d2a056
+
+ PM / Hibernate: Freeze kernel threads after preallocating memory
+
+introduced a mechanism by which kernel threads were frozen after
+the preallocation of hibernate image memory to avoid problems with
+frozen kernel threads not responding to memory freeing requests.
+However, it overlooked the s2disk code path in which the
+SNAPSHOT_CREATE_IMAGE ioctl was run directly after SNAPSHOT_FREE,
+which caused freeze_workqueues_begin() to BUG(), because it saw
+that worqueues had been already frozen.
+
+Although in principle this issue might be addressed by removing
+the relevant BUG_ON() from freeze_workqueues_begin(), that would
+reintroduce the very problem that commit 2aede851ddf08666f68ffc17be4
+attempted to avoid into that particular code path. For this reason,
+to fix the issue at hand, introduce thaw_kernel_threads() and make
+the SNAPSHOT_FREE ioctl execute it.
+
+Special thanks to Srivatsa S. Bhat for detailed analysis of the
+problem.
+
+Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Acked-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/freezer.h | 2 ++
+ kernel/power/process.c | 9 +++++++++
+ kernel/power/user.c | 9 +++++++++
+ 3 files changed, 20 insertions(+), 0 deletions(-)
+
+diff --git a/include/linux/freezer.h b/include/linux/freezer.h
+index a5386e3..b5d6b6a 100644
+--- a/include/linux/freezer.h
++++ b/include/linux/freezer.h
+@@ -51,6 +51,7 @@ extern void refrigerator(void);
+ extern int freeze_processes(void);
+ extern int freeze_kernel_threads(void);
+ extern void thaw_processes(void);
++extern void thaw_kernel_threads(void);
+
+ static inline int try_to_freeze(void)
+ {
+@@ -185,6 +186,7 @@ static inline void refrigerator(void) {}
+ static inline int freeze_processes(void) { return -ENOSYS; }
+ static inline int freeze_kernel_threads(void) { return -ENOSYS; }
+ static inline void thaw_processes(void) {}
++static inline void thaw_kernel_threads(void) {}
+
+ static inline int try_to_freeze(void) { return 0; }
+
+diff --git a/kernel/power/process.c b/kernel/power/process.c
+index addbbe5..3d4b954 100644
+--- a/kernel/power/process.c
++++ b/kernel/power/process.c
+@@ -203,3 +203,12 @@ void thaw_processes(void)
+ printk("done.\n");
+ }
+
++void thaw_kernel_threads(void)
++{
++ printk("Restarting kernel threads ... ");
++ thaw_workqueues();
++ thaw_tasks(true);
++ schedule();
++ printk("done.\n");
++}
++
+diff --git a/kernel/power/user.c b/kernel/power/user.c
+index 6d8f535..3565b15 100644
+--- a/kernel/power/user.c
++++ b/kernel/power/user.c
+@@ -303,6 +303,15 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
+ swsusp_free();
+ memset(&data->handle, 0, sizeof(struct snapshot_handle));
+ data->ready = 0;
++ /*
++ * It is necessary to thaw kernel threads here, because
++ * SNAPSHOT_CREATE_IMAGE may be invoked directly after
++ * SNAPSHOT_FREE. In that case, if kernel threads were not
++ * thawed, the preallocation of memory carried out by
++ * hibernation_snapshot() might run into problems (i.e. it
++ * might fail or even deadlock).
++ */
++ thaw_kernel_threads();
+ break;
+
+ case SNAPSHOT_SET_IMAGE_SIZE:
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0030-PM-QoS-CPU-C-state-breakage-with-PM-Qos-change.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0030-PM-QoS-CPU-C-state-breakage-with-PM-Qos-change.patch
new file mode 100644
index 0000000..5e697d5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0030-PM-QoS-CPU-C-state-breakage-with-PM-Qos-change.patch
@@ -0,0 +1,57 @@
+From f51d67a64f32cd81ea8b67ca964fb7cf7e783b2e Mon Sep 17 00:00:00 2001
+From: Venkatesh Pallipadi <venki@google.com>
+Date: Fri, 3 Feb 2012 22:22:25 +0100
+Subject: [PATCH 30/87] PM / QoS: CPU C-state breakage with PM Qos change
+
+commit d020283dc694c9ec31b410f522252f7a8397e67d upstream.
+
+Looks like change "PM QoS: Move and rename the implementation files"
+merged during the 3.2 development cycle made PM QoS depend on
+CONFIG_PM which depends on (PM_SLEEP || PM_RUNTIME).
+
+That breaks CPU C-states with kernels not having these CONFIGs, causing CPUs
+to spend time in Polling loop idle instead of going into deep C-states,
+consuming way way more power. This is with either acpi idle or intel idle
+enabled.
+
+Either CONFIG_PM should be enabled with any pm_qos users or
+the !CONFIG_PM pm_qos_request() should return sane defaults not to break
+the existing users. Here's is the patch for the latter option.
+
+[rjw: Modified the changelog slightly.]
+
+Signed-off-by: Venkatesh Pallipadi <venki@google.com>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/pm_qos.h | 14 +++++++++++++-
+ 1 files changed, 13 insertions(+), 1 deletions(-)
+
+diff --git a/include/linux/pm_qos.h b/include/linux/pm_qos.h
+index 83b0ea3..8a0ede4 100644
+--- a/include/linux/pm_qos.h
++++ b/include/linux/pm_qos.h
+@@ -107,7 +107,19 @@ static inline void pm_qos_remove_request(struct pm_qos_request *req)
+ { return; }
+
+ static inline int pm_qos_request(int pm_qos_class)
+- { return 0; }
++{
++ switch (pm_qos_class) {
++ case PM_QOS_CPU_DMA_LATENCY:
++ return PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE;
++ case PM_QOS_NETWORK_LATENCY:
++ return PM_QOS_NETWORK_LAT_DEFAULT_VALUE;
++ case PM_QOS_NETWORK_THROUGHPUT:
++ return PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE;
++ default:
++ return PM_QOS_DEFAULT_VALUE;
++ }
++}
++
+ static inline int pm_qos_add_notifier(int pm_qos_class,
+ struct notifier_block *notifier)
+ { return 0; }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0031-drm-radeon-Set-DESKTOP_HEIGHT-register-to-the-frameb.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0031-drm-radeon-Set-DESKTOP_HEIGHT-register-to-the-frameb.patch
new file mode 100644
index 0000000..610b959
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0031-drm-radeon-Set-DESKTOP_HEIGHT-register-to-the-frameb.patch
@@ -0,0 +1,55 @@
+From 97f2f58ea0382e2e2df0dacc5bba99190cd10846 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+Date: Wed, 1 Feb 2012 12:09:55 +0100
+Subject: [PATCH 31/87] drm/radeon: Set DESKTOP_HEIGHT register to the
+ framebuffer (not mode) height.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 1b61925061660009f5b8047f93c5297e04541273 upstream.
+
+The value of this register is transferred to the V_COUNTER register at the
+beginning of vertical blank. V_COUNTER is the reference for VLINE waits and
+goes from VIEWPORT_Y_START to VIEWPORT_Y_START+VIEWPORT_HEIGHT during scanout,
+so if VIEWPORT_Y_START is not 0, V_COUNTER actually went backwards at the
+beginning of vertical blank, and VLINE waits excluding the whole scanout area
+could never finish (possibly only if VIEWPORT_Y_START is larger than the length
+of vertical blank in scanlines). Setting DESKTOP_HEIGHT to the framebuffer
+height should prevent this for any kind of VLINE wait.
+
+Fixes https://bugs.freedesktop.org/show_bug.cgi?id=45329 .
+
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 2b97262..b30081f 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1189,7 +1189,7 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
+ WREG32(EVERGREEN_GRPH_ENABLE + radeon_crtc->crtc_offset, 1);
+
+ WREG32(EVERGREEN_DESKTOP_HEIGHT + radeon_crtc->crtc_offset,
+- crtc->mode.vdisplay);
++ target_fb->height);
+ x &= ~3;
+ y &= ~1;
+ WREG32(EVERGREEN_VIEWPORT_START + radeon_crtc->crtc_offset,
+@@ -1358,7 +1358,7 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
+ WREG32(AVIVO_D1GRPH_ENABLE + radeon_crtc->crtc_offset, 1);
+
+ WREG32(AVIVO_D1MODE_DESKTOP_HEIGHT + radeon_crtc->crtc_offset,
+- crtc->mode.vdisplay);
++ target_fb->height);
+ x &= ~3;
+ y &= ~1;
+ WREG32(AVIVO_D1MODE_VIEWPORT_START + radeon_crtc->crtc_offset,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0032-drm-nouveau-gem-fix-fence_sync-race-oops.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0032-drm-nouveau-gem-fix-fence_sync-race-oops.patch
new file mode 100644
index 0000000..05ad972
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0032-drm-nouveau-gem-fix-fence_sync-race-oops.patch
@@ -0,0 +1,108 @@
+From 3d15bd1a90e3d768136562ad63e0d25c953d0c85 Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Tue, 10 Jan 2012 10:18:28 +1000
+Subject: [PATCH 32/87] drm/nouveau/gem: fix fence_sync race / oops
+
+commit 525895ba388c949aa906f26e3ec5cb1ab041f56b upstream.
+
+Due to a race it was possible for a fence to be destroyed while another
+thread was trying to synchronise with it. If this happened in the fallback
+non-semaphore path, it lead to the following oops due to fence->channel
+being NULL.
+
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<fa9632ce>] nouveau_fence_update+0xe/0xe0 [nouveau]
+*pde = a649c067
+SMP
+Modules linked in: fuse nouveau(O) ttm(O) drm_kms_helper(O) drm(O) mxm_wmi video wmi netconsole configfs lockd bnep bluetooth rfkill ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ip6table_filter ip6_tables snd_hda_codec_realtek snd_hda_intel snd_hda_cobinfmt_misc uinput ata_generic pata_acpi pata_aet2c_algo_bit i2c_core [last unloaded: wmi]
+
+Pid: 2255, comm: gnome-shell Tainted: G O 3.2.0-0.rc5.git0.1.fc17.i686 #1 System manufacturer System Product Name/M2A-VM
+EIP: 0060:[<fa9632ce>] EFLAGS: 00010296 CPU: 1
+EIP is at nouveau_fence_update+0xe/0xe0 [nouveau]
+EAX: 00000000 EBX: ddfc6dd0 ECX: dd111580 EDX: 00000000
+ESI: 00003e80 EDI: dd111580 EBP: dd121d00 ESP: dd121ce8
+ DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
+Process gnome-shell (pid: 2255, ti=dd120000 task=dd111580 task.ti=dd120000)
+Stack:
+ 7dc86c76 00000000 00003e80 ddfc6dd0 00003e80 dd111580 dd121d0c fa96371f
+ 00000000 dd121d3c fa963773 dd111580 01000246 000ec53d 00000000 ddfc6dd0
+ 00001f40 00000000 ddfc6dd0 00000010 dc7df840 dd121d6c fa9639a0 00000000
+Call Trace:
+ [<fa96371f>] __nouveau_fence_signalled+0x1f/0x30 [nouveau]
+ [<fa963773>] __nouveau_fence_wait+0x43/0xd0 [nouveau]
+ [<fa9639a0>] nouveau_fence_sync+0x1a0/0x1c0 [nouveau]
+ [<fa964046>] validate_list+0x176/0x300 [nouveau]
+ [<f7d9c9c0>] ? ttm_bo_mem_put+0x30/0x30 [ttm]
+ [<fa964b8a>] nouveau_gem_ioctl_pushbuf+0x48a/0xfd0 [nouveau]
+ [<c0406481>] ? die+0x31/0x80
+ [<f7c93d98>] drm_ioctl+0x388/0x490 [drm]
+ [<c0406481>] ? die+0x31/0x80
+ [<fa964700>] ? nouveau_gem_ioctl_new+0x150/0x150 [nouveau]
+ [<c0635c7b>] ? file_has_perm+0xcb/0xe0
+ [<f7c93a10>] ? drm_copy_field+0x80/0x80 [drm]
+ [<c0564f56>] do_vfs_ioctl+0x86/0x5b0
+ [<c0406481>] ? die+0x31/0x80
+ [<c0635f22>] ? selinux_file_ioctl+0x62/0x130
+ [<c0554f30>] ? fget_light+0x30/0x340
+ [<c05654ef>] sys_ioctl+0x6f/0x80
+ [<c099e3a4>] syscall_call+0x7/0xb
+ [<c0406481>] ? die+0x31/0x80
+ [<c0406481>] ? die+0x31/0x80
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_gem.c | 23 +++++++++++++++++++++--
+ 1 files changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
+index 5f0bc57..7ce3fde 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -380,6 +380,25 @@ retry:
+ }
+
+ static int
++validate_sync(struct nouveau_channel *chan, struct nouveau_bo *nvbo)
++{
++ struct nouveau_fence *fence = NULL;
++ int ret = 0;
++
++ spin_lock(&nvbo->bo.bdev->fence_lock);
++ if (nvbo->bo.sync_obj)
++ fence = nouveau_fence_ref(nvbo->bo.sync_obj);
++ spin_unlock(&nvbo->bo.bdev->fence_lock);
++
++ if (fence) {
++ ret = nouveau_fence_sync(fence, chan);
++ nouveau_fence_unref(&fence);
++ }
++
++ return ret;
++}
++
++static int
+ validate_list(struct nouveau_channel *chan, struct list_head *list,
+ struct drm_nouveau_gem_pushbuf_bo *pbbo, uint64_t user_pbbo_ptr)
+ {
+@@ -393,7 +412,7 @@ validate_list(struct nouveau_channel *chan, struct list_head *list,
+ list_for_each_entry(nvbo, list, entry) {
+ struct drm_nouveau_gem_pushbuf_bo *b = &pbbo[nvbo->pbbo_index];
+
+- ret = nouveau_fence_sync(nvbo->bo.sync_obj, chan);
++ ret = validate_sync(chan, nvbo);
+ if (unlikely(ret)) {
+ NV_ERROR(dev, "fail pre-validate sync\n");
+ return ret;
+@@ -416,7 +435,7 @@ validate_list(struct nouveau_channel *chan, struct list_head *list,
+ return ret;
+ }
+
+- ret = nouveau_fence_sync(nvbo->bo.sync_obj, chan);
++ ret = validate_sync(chan, nvbo);
+ if (unlikely(ret)) {
+ NV_ERROR(dev, "fail post-validate sync\n");
+ return ret;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0033-drm-radeon-kms-disable-output-polling-when-suspended.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0033-drm-radeon-kms-disable-output-polling-when-suspended.patch
new file mode 100644
index 0000000..a90ce35
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0033-drm-radeon-kms-disable-output-polling-when-suspended.patch
@@ -0,0 +1,44 @@
+From d11fa680b5daad1ffb72807cfd0ad30237505fff Mon Sep 17 00:00:00 2001
+From: Seth Forshee <seth.forshee@canonical.com>
+Date: Tue, 31 Jan 2012 19:06:25 -0600
+Subject: [PATCH 33/87] drm/radeon/kms: disable output polling when suspended
+
+commit 86698c20f71d488b32c49ed4687fb3cf8a88a5ca upstream.
+
+Polling the outputs when the device is suspended can result in erroneous
+status updates. Disable output polling during suspend to prevent this
+from happening.
+
+Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index 9b39145..9231564 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -864,6 +864,8 @@ int radeon_suspend_kms(struct drm_device *dev, pm_message_t state)
+ if (dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+ return 0;
+
++ drm_kms_helper_poll_disable(dev);
++
+ /* turn off display hw */
+ list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+@@ -950,6 +952,8 @@ int radeon_resume_kms(struct drm_device *dev)
+ list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
+ }
++
++ drm_kms_helper_poll_enable(dev);
+ return 0;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0034-drm-radeon-kms-fix-TRAVIS-panel-setup.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0034-drm-radeon-kms-fix-TRAVIS-panel-setup.patch
new file mode 100644
index 0000000..a7915d4
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0034-drm-radeon-kms-fix-TRAVIS-panel-setup.patch
@@ -0,0 +1,53 @@
+From 307a5a187c97d1c280e66db8d957249439141850 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 2 Feb 2012 10:18:00 -0500
+Subject: [PATCH 34/87] drm/radeon/kms: fix TRAVIS panel setup
+
+commit 304a48400d9718f74ec35ae46f30868a5f4c4516 upstream.
+
+Different versions of the DP to LVDS bridge chip
+need different panel mode settings depending on
+the chip version used.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=41569
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/atombios_dp.c | 18 +++++++++++++++---
+ 1 files changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index a71557c..552b436 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -564,9 +564,21 @@ int radeon_dp_get_panel_mode(struct drm_encoder *encoder,
+ ENCODER_OBJECT_ID_NUTMEG)
+ panel_mode = DP_PANEL_MODE_INTERNAL_DP1_MODE;
+ else if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) ==
+- ENCODER_OBJECT_ID_TRAVIS)
+- panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
+- else if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
++ ENCODER_OBJECT_ID_TRAVIS) {
++ u8 id[6];
++ int i;
++ for (i = 0; i < 6; i++)
++ id[i] = radeon_read_dpcd_reg(radeon_connector, 0x503 + i);
++ if (id[0] == 0x73 &&
++ id[1] == 0x69 &&
++ id[2] == 0x76 &&
++ id[3] == 0x61 &&
++ id[4] == 0x72 &&
++ id[5] == 0x54)
++ panel_mode = DP_PANEL_MODE_INTERNAL_DP1_MODE;
++ else
++ panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
++ } else if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+ u8 tmp = radeon_read_dpcd_reg(radeon_connector, DP_EDP_CONFIGURATION_CAP);
+ if (tmp & 1)
+ panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0035-sched-rt-Fix-task-stack-corruption-under-__ARCH_WANT.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0035-sched-rt-Fix-task-stack-corruption-under-__ARCH_WANT.patch
new file mode 100644
index 0000000..4fcf64b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0035-sched-rt-Fix-task-stack-corruption-under-__ARCH_WANT.patch
@@ -0,0 +1,94 @@
+From 6341f8928cf458016bab6aab444536843083ef0a Mon Sep 17 00:00:00 2001
+From: Chanho Min <chanho0207@gmail.com>
+Date: Thu, 5 Jan 2012 20:00:19 +0900
+Subject: [PATCH 35/87] sched/rt: Fix task stack corruption under
+ __ARCH_WANT_INTERRUPTS_ON_CTXSW
+
+commit cb297a3e433dbdcf7ad81e0564e7b804c941ff0d upstream.
+
+This issue happens under the following conditions:
+
+ 1. preemption is off
+ 2. __ARCH_WANT_INTERRUPTS_ON_CTXSW is defined
+ 3. RT scheduling class
+ 4. SMP system
+
+Sequence is as follows:
+
+ 1.suppose current task is A. start schedule()
+ 2.task A is enqueued pushable task at the entry of schedule()
+ __schedule
+ prev = rq->curr;
+ ...
+ put_prev_task
+ put_prev_task_rt
+ enqueue_pushable_task
+ 4.pick the task B as next task.
+ next = pick_next_task(rq);
+ 3.rq->curr set to task B and context_switch is started.
+ rq->curr = next;
+ 4.At the entry of context_swtich, release this cpu's rq->lock.
+ context_switch
+ prepare_task_switch
+ prepare_lock_switch
+ raw_spin_unlock_irq(&rq->lock);
+ 5.Shortly after rq->lock is released, interrupt is occurred and start IRQ context
+ 6.try_to_wake_up() which called by ISR acquires rq->lock
+ try_to_wake_up
+ ttwu_remote
+ rq = __task_rq_lock(p)
+ ttwu_do_wakeup(rq, p, wake_flags);
+ task_woken_rt
+ 7.push_rt_task picks the task A which is enqueued before.
+ task_woken_rt
+ push_rt_tasks(rq)
+ next_task = pick_next_pushable_task(rq)
+ 8.At find_lock_lowest_rq(), If double_lock_balance() returns 0,
+ lowest_rq can be the remote rq.
+ (But,If preemption is on, double_lock_balance always return 1 and it
+ does't happen.)
+ push_rt_task
+ find_lock_lowest_rq
+ if (double_lock_balance(rq, lowest_rq))..
+ 9.find_lock_lowest_rq return the available rq. task A is migrated to
+ the remote cpu/rq.
+ push_rt_task
+ ...
+ deactivate_task(rq, next_task, 0);
+ set_task_cpu(next_task, lowest_rq->cpu);
+ activate_task(lowest_rq, next_task, 0);
+ 10. But, task A is on irq context at this cpu.
+ So, task A is scheduled by two cpus at the same time until restore from IRQ.
+ Task A's stack is corrupted.
+
+To fix it, don't migrate an RT task if it's still running.
+
+Signed-off-by: Chanho Min <chanho.min@lge.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Acked-by: Steven Rostedt <rostedt@goodmis.org>
+Link: http://lkml.kernel.org/r/CAOAMb1BHA=5fm7KTewYyke6u-8DP0iUuJMpgQw54vNeXFsGpoQ@mail.gmail.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched_rt.c | 5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
+index 583a136..78fcacf 100644
+--- a/kernel/sched_rt.c
++++ b/kernel/sched_rt.c
+@@ -1388,6 +1388,11 @@ static int push_rt_task(struct rq *rq)
+ if (!next_task)
+ return 0;
+
++#ifdef __ARCH_WANT_INTERRUPTS_ON_CTXSW
++ if (unlikely(task_running(rq, next_task)))
++ return 0;
++#endif
++
+ retry:
+ if (unlikely(next_task == rq->curr)) {
+ WARN_ON(1);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0036-PM-Hibernate-Thaw-processes-in-SNAPSHOT_CREATE_IMAGE.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0036-PM-Hibernate-Thaw-processes-in-SNAPSHOT_CREATE_IMAGE.patch
new file mode 100644
index 0000000..fb7696d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0036-PM-Hibernate-Thaw-processes-in-SNAPSHOT_CREATE_IMAGE.patch
@@ -0,0 +1,83 @@
+From 26b67a54a31d8e18f66f52d6bae4907963648d3c Mon Sep 17 00:00:00 2001
+From: "Srivatsa S. Bhat" <srivatsa.bhat@linux.vnet.ibm.com>
+Date: Thu, 1 Dec 2011 22:33:10 +0100
+Subject: [PATCH 36/87] PM / Hibernate: Thaw processes in
+ SNAPSHOT_CREATE_IMAGE ioctl test path
+
+commit 97819a26224f019e73d88bb2fd4eb5a614860461 upstream.
+
+Commit 2aede851ddf08666f68ffc17be446420e9d2a056 (PM / Hibernate: Freeze
+kernel threads after preallocating memory) moved the freezing of kernel
+threads to hibernation_snapshot() function.
+
+So now, if the call to hibernation_snapshot() returns early due to a
+successful hibernation test, the caller has to thaw processes to ensure
+that the system gets back to its original state.
+
+But in SNAPSHOT_CREATE_IMAGE hibernation ioctl, the caller does not thaw
+processes in case hibernation_snapshot() returned due to a successful
+freezer test. Fix this issue. But note we still send the value of 'in_suspend'
+(which is now 0) to userspace, because we are not in an error path per-se,
+and moreover, the value of in_suspend correctly depicts the situation here.
+
+Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/power/hibernate.c | 2 +-
+ kernel/power/power.h | 2 ++
+ kernel/power/user.c | 11 ++++++++---
+ 3 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index a6b0503..624538a 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -55,7 +55,7 @@ enum {
+
+ static int hibernation_mode = HIBERNATION_SHUTDOWN;
+
+-static bool freezer_test_done;
++bool freezer_test_done;
+
+ static const struct platform_hibernation_ops *hibernation_ops;
+
+diff --git a/kernel/power/power.h b/kernel/power/power.h
+index 23a2db1..0c4defe 100644
+--- a/kernel/power/power.h
++++ b/kernel/power/power.h
+@@ -50,6 +50,8 @@ static inline char *check_image_kernel(struct swsusp_info *info)
+ #define SPARE_PAGES ((1024 * 1024) >> PAGE_SHIFT)
+
+ /* kernel/power/hibernate.c */
++extern bool freezer_test_done;
++
+ extern int hibernation_snapshot(int platform_mode);
+ extern int hibernation_restore(int platform_mode);
+ extern int hibernation_platform_enter(void);
+diff --git a/kernel/power/user.c b/kernel/power/user.c
+index 3565b15..f08bbfb 100644
+--- a/kernel/power/user.c
++++ b/kernel/power/user.c
+@@ -283,10 +283,15 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
+ }
+ pm_restore_gfp_mask();
+ error = hibernation_snapshot(data->platform_support);
+- if (!error)
++ if (!error) {
+ error = put_user(in_suspend, (int __user *)arg);
+- if (!error)
+- data->ready = 1;
++ if (!error && !freezer_test_done)
++ data->ready = 1;
++ if (freezer_test_done) {
++ freezer_test_done = false;
++ thaw_processes();
++ }
++ }
+ break;
+
+ case SNAPSHOT_ATOMIC_RESTORE:
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0037-PM-Hibernate-Thaw-kernel-threads-in-SNAPSHOT_CREATE_.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0037-PM-Hibernate-Thaw-kernel-threads-in-SNAPSHOT_CREATE_.patch
new file mode 100644
index 0000000..6741b06
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0037-PM-Hibernate-Thaw-kernel-threads-in-SNAPSHOT_CREATE_.patch
@@ -0,0 +1,48 @@
+From 695cb013a3332b6c773c8a75be97aa6f91bc227f Mon Sep 17 00:00:00 2001
+From: "Srivatsa S. Bhat" <srivatsa.bhat@linux.vnet.ibm.com>
+Date: Wed, 1 Feb 2012 22:16:36 +0100
+Subject: [PATCH 37/87] PM / Hibernate: Thaw kernel threads in
+ SNAPSHOT_CREATE_IMAGE ioctl path
+
+commit fe9161db2e6053da21e4649d77bbefaf3030b11d upstream.
+
+In the SNAPSHOT_CREATE_IMAGE ioctl, if the call to hibernation_snapshot()
+fails, the frozen tasks are not thawed.
+
+And in the case of success, if we happen to exit due to a successful freezer
+test, all tasks (including those of userspace) are thawed, whereas actually
+we should have thawed only the kernel threads at that point. Fix both these
+issues.
+
+Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/power/user.c | 6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/power/user.c b/kernel/power/user.c
+index f08bbfb..f08d227 100644
+--- a/kernel/power/user.c
++++ b/kernel/power/user.c
+@@ -283,13 +283,15 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
+ }
+ pm_restore_gfp_mask();
+ error = hibernation_snapshot(data->platform_support);
+- if (!error) {
++ if (error) {
++ thaw_kernel_threads();
++ } else {
+ error = put_user(in_suspend, (int __user *)arg);
+ if (!error && !freezer_test_done)
+ data->ready = 1;
+ if (freezer_test_done) {
+ freezer_test_done = false;
+- thaw_processes();
++ thaw_kernel_threads();
+ }
+ }
+ break;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0038-8139cp-fix-missing-napi_gro_flush.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0038-8139cp-fix-missing-napi_gro_flush.patch
new file mode 100644
index 0000000..bb26a30
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0038-8139cp-fix-missing-napi_gro_flush.patch
@@ -0,0 +1,33 @@
+From ff91ca433acbb464e82dbc655c1339498c20d45a Mon Sep 17 00:00:00 2001
+From: Francois Romieu <romieu@fr.zoreil.com>
+Date: Sun, 8 Jan 2012 13:41:33 +0000
+Subject: [PATCH 38/87] 8139cp: fix missing napi_gro_flush.
+
+commit b189e810619a676e6b931a942a3e8387f3d39c21 upstream.
+
+The driver uses __napi_complete and napi_gro_receive. Without it, the
+driver hits the BUG_ON(n->gro_list) assertion hard in __napi_complete.
+
+Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
+Tested-by: Marin Glibic <zhilla2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/realtek/8139cp.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
+index ee5da92..aba4f67 100644
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -563,6 +563,7 @@ rx_next:
+ if (cpr16(IntrStatus) & cp_rx_intr_mask)
+ goto rx_status_loop;
+
++ napi_gro_flush(napi);
+ spin_lock_irqsave(&cp->lock, flags);
+ __napi_complete(napi);
+ cpw16_f(IntrMask, cp_intr_mask);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0039-udf-Mark-LVID-buffer-as-uptodate-before-marking-it-d.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0039-udf-Mark-LVID-buffer-as-uptodate-before-marking-it-d.patch
new file mode 100644
index 0000000..d0d7c9a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0039-udf-Mark-LVID-buffer-as-uptodate-before-marking-it-d.patch
@@ -0,0 +1,40 @@
+From 43f4a516b2f5492bc597f3753b693ad8adc62748 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Fri, 23 Dec 2011 11:53:07 +0100
+Subject: [PATCH 39/87] udf: Mark LVID buffer as uptodate before marking it
+ dirty
+
+commit 853a0c25baf96b028de1654bea1e0c8857eadf3d upstream.
+
+When we hit EIO while writing LVID, the buffer uptodate bit is cleared.
+This then results in an anoying warning from mark_buffer_dirty() when we
+write the buffer again. So just set uptodate flag unconditionally.
+
+Reviewed-by: Namjae Jeon <linkinjeon@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: Dave Jones <davej@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/udf/super.c | 6 ++++++
+ 1 files changed, 6 insertions(+), 0 deletions(-)
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index e185253..87cb24a 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -1799,6 +1799,12 @@ static void udf_close_lvid(struct super_block *sb)
+ le16_to_cpu(lvid->descTag.descCRCLength)));
+
+ lvid->descTag.tagChecksum = udf_tag_checksum(&lvid->descTag);
++ /*
++ * We set buffer uptodate unconditionally here to avoid spurious
++ * warnings from mark_buffer_dirty() when previous EIO has marked
++ * the buffer as !uptodate
++ */
++ set_buffer_uptodate(bh);
+ mark_buffer_dirty(bh);
+ sbi->s_lvid_dirty = 0;
+ mutex_unlock(&sbi->s_alloc_mutex);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0040-drm-i915-HDMI-hot-remove-notification-to-audio-drive.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0040-drm-i915-HDMI-hot-remove-notification-to-audio-drive.patch
new file mode 100644
index 0000000..02c199e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0040-drm-i915-HDMI-hot-remove-notification-to-audio-drive.patch
@@ -0,0 +1,53 @@
+From febaacc3a6165f0cf54ff512f1e7e51563fd27b1 Mon Sep 17 00:00:00 2001
+From: Wu Fengguang <fengguang.wu@intel.com>
+Date: Fri, 9 Dec 2011 20:42:20 +0800
+Subject: [PATCH 40/87] drm/i915: HDMI hot remove notification to audio driver
+
+commit 2deed761188d7480eb5f7efbfe7aa77f09322ed8 upstream.
+
+On HDMI monitor hot remove, clear SDVO_AUDIO_ENABLE accordingly, so that
+the audio driver will receive hot plug events and take action to refresh
+its device state and ELD contents.
+
+The cleared SDVO_AUDIO_ENABLE bit needs to be restored to prevent losing
+HDMI audio after DPMS on.
+
+CC: Wang Zhenyu <zhenyu.z.wang@intel.com>
+Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/intel_hdmi.c | 8 ++++++--
+ 1 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
+index d4f5a0b..64541f7 100644
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -269,6 +269,10 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder);
+ u32 temp;
++ u32 enable_bits = SDVO_ENABLE;
++
++ if (intel_hdmi->has_audio)
++ enable_bits |= SDVO_AUDIO_ENABLE;
+
+ temp = I915_READ(intel_hdmi->sdvox_reg);
+
+@@ -281,9 +285,9 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)
+ }
+
+ if (mode != DRM_MODE_DPMS_ON) {
+- temp &= ~SDVO_ENABLE;
++ temp &= ~enable_bits;
+ } else {
+- temp |= SDVO_ENABLE;
++ temp |= enable_bits;
+ }
+
+ I915_WRITE(intel_hdmi->sdvox_reg, temp);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0041-drm-i915-DisplayPort-hot-remove-notification-to-audi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0041-drm-i915-DisplayPort-hot-remove-notification-to-audi.patch
new file mode 100644
index 0000000..1278a4e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0041-drm-i915-DisplayPort-hot-remove-notification-to-audi.patch
@@ -0,0 +1,40 @@
+From e306967621bd97280eb17c9abab473070a2e5b45 Mon Sep 17 00:00:00 2001
+From: Wu Fengguang <fengguang.wu@intel.com>
+Date: Fri, 9 Dec 2011 20:42:21 +0800
+Subject: [PATCH 41/87] drm/i915: DisplayPort hot remove notification to audio
+ driver
+
+commit 832afda6a7d7235ef0e09f4ec46736861540da6d upstream.
+
+On DP monitor hot remove, clear DP_AUDIO_OUTPUT_ENABLE accordingly,
+so that the audio driver will receive hot plug events and take action
+to refresh its device state and ELD contents.
+
+Note that the DP_AUDIO_OUTPUT_ENABLE bit may be enabled or disabled
+only when the link training is complete and set to "Normal".
+
+Tested OK for both hot plug/remove and DPMS on/off.
+
+Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/intel_dp.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 92b041b..db3b461 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1926,6 +1926,7 @@ intel_dp_link_down(struct intel_dp *intel_dp)
+ intel_wait_for_vblank(dev, to_intel_crtc(crtc)->pipe);
+ }
+
++ DP &= ~DP_AUDIO_OUTPUT_ENABLE;
+ I915_WRITE(intel_dp->output_reg, DP & ~DP_PORT_EN);
+ POSTING_READ(intel_dp->output_reg);
+ msleep(intel_dp->panel_power_down_delay);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0042-drm-i915-check-ACTHD-of-all-rings.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0042-drm-i915-check-ACTHD-of-all-rings.patch
new file mode 100644
index 0000000..9a3ddca
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0042-drm-i915-check-ACTHD-of-all-rings.patch
@@ -0,0 +1,92 @@
+From 2d0e8c788387c3aea69c498d0cc24a73645b71cb Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Sun, 27 Nov 2011 18:58:17 +0100
+Subject: [PATCH 42/87] drm/i915: check ACTHD of all rings
+
+commit 097354eb14fa94d31a09c64d640643f58e4a5a9a upstream.
+
+Otherwise hangcheck spuriously fires when running blitter/bsd-only
+workloads.
+
+Contrary to a similar patch by Ben Widawsky this does not check
+INSTDONE of the other rings. Chris Wilson implied that in a failure to
+detect a hang, most likely because INSTDONE was fluctuating. Thus only
+check ACTHD, which as far as I know is rather reliable. Also, blitter
+and bsd rings can't launch complex tasks from a single instruction
+(like 3D_PRIM on the render with complex or even infinite shaders).
+
+This fixes spurious gpu hang detection when running
+tests/gem_hangcheck_forcewake on snb/ivb.
+
+Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_drv.h | 2 ++
+ drivers/gpu/drm/i915/i915_irq.c | 13 ++++++++++---
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 554bef7..505af3f 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -337,6 +337,8 @@ typedef struct drm_i915_private {
+ struct timer_list hangcheck_timer;
+ int hangcheck_count;
+ uint32_t last_acthd;
++ uint32_t last_acthd_bsd;
++ uint32_t last_acthd_blt;
+ uint32_t last_instdone;
+ uint32_t last_instdone1;
+
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index b40004b..d47a53b 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -1669,7 +1669,7 @@ void i915_hangcheck_elapsed(unsigned long data)
+ {
+ struct drm_device *dev = (struct drm_device *)data;
+ drm_i915_private_t *dev_priv = dev->dev_private;
+- uint32_t acthd, instdone, instdone1;
++ uint32_t acthd, instdone, instdone1, acthd_bsd, acthd_blt;
+ bool err = false;
+
+ if (!i915_enable_hangcheck)
+@@ -1686,16 +1686,21 @@ void i915_hangcheck_elapsed(unsigned long data)
+ }
+
+ if (INTEL_INFO(dev)->gen < 4) {
+- acthd = I915_READ(ACTHD);
+ instdone = I915_READ(INSTDONE);
+ instdone1 = 0;
+ } else {
+- acthd = I915_READ(ACTHD_I965);
+ instdone = I915_READ(INSTDONE_I965);
+ instdone1 = I915_READ(INSTDONE1);
+ }
++ acthd = intel_ring_get_active_head(&dev_priv->ring[RCS]);
++ acthd_bsd = HAS_BSD(dev) ?
++ intel_ring_get_active_head(&dev_priv->ring[VCS]) : 0;
++ acthd_blt = HAS_BLT(dev) ?
++ intel_ring_get_active_head(&dev_priv->ring[BCS]) : 0;
+
+ if (dev_priv->last_acthd == acthd &&
++ dev_priv->last_acthd_bsd == acthd_bsd &&
++ dev_priv->last_acthd_blt == acthd_blt &&
+ dev_priv->last_instdone == instdone &&
+ dev_priv->last_instdone1 == instdone1) {
+ if (dev_priv->hangcheck_count++ > 1) {
+@@ -1727,6 +1732,8 @@ void i915_hangcheck_elapsed(unsigned long data)
+ dev_priv->hangcheck_count = 0;
+
+ dev_priv->last_acthd = acthd;
++ dev_priv->last_acthd_bsd = acthd_bsd;
++ dev_priv->last_acthd_blt = acthd_blt;
+ dev_priv->last_instdone = instdone;
+ dev_priv->last_instdone1 = instdone1;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0043-drm-i915-Fix-TV-Out-refresh-rate.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0043-drm-i915-Fix-TV-Out-refresh-rate.patch
new file mode 100644
index 0000000..a01b012
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0043-drm-i915-Fix-TV-Out-refresh-rate.patch
@@ -0,0 +1,98 @@
+From eb10e9cd3a43bcaea5f7d4727b27b8f7e40d9fc7 Mon Sep 17 00:00:00 2001
+From: Rodrigo Vivi <rodrigo.vivi@gmail.com>
+Date: Wed, 14 Dec 2011 21:10:06 -0200
+Subject: [PATCH 43/87] drm/i915: Fix TV Out refresh rate.
+
+commit 23bd15ec662344dc10e9918fdd0dbc58bc71526d upstream.
+
+TV Out refresh rate was half of the specification for almost all modes.
+Due to this reason pixel clock was so low for some modes causing flickering screen.
+
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@gmail.com>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/intel_tv.c | 16 ++++++++--------
+ 1 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
+index f3c6a9a..2b1fcad 100644
+--- a/drivers/gpu/drm/i915/intel_tv.c
++++ b/drivers/gpu/drm/i915/intel_tv.c
+@@ -417,7 +417,7 @@ static const struct tv_mode tv_modes[] = {
+ {
+ .name = "NTSC-M",
+ .clock = 108000,
+- .refresh = 29970,
++ .refresh = 59940,
+ .oversample = TV_OVERSAMPLE_8X,
+ .component_only = 0,
+ /* 525 Lines, 60 Fields, 15.734KHz line, Sub-Carrier 3.580MHz */
+@@ -460,7 +460,7 @@ static const struct tv_mode tv_modes[] = {
+ {
+ .name = "NTSC-443",
+ .clock = 108000,
+- .refresh = 29970,
++ .refresh = 59940,
+ .oversample = TV_OVERSAMPLE_8X,
+ .component_only = 0,
+ /* 525 Lines, 60 Fields, 15.734KHz line, Sub-Carrier 4.43MHz */
+@@ -502,7 +502,7 @@ static const struct tv_mode tv_modes[] = {
+ {
+ .name = "NTSC-J",
+ .clock = 108000,
+- .refresh = 29970,
++ .refresh = 59940,
+ .oversample = TV_OVERSAMPLE_8X,
+ .component_only = 0,
+
+@@ -545,7 +545,7 @@ static const struct tv_mode tv_modes[] = {
+ {
+ .name = "PAL-M",
+ .clock = 108000,
+- .refresh = 29970,
++ .refresh = 59940,
+ .oversample = TV_OVERSAMPLE_8X,
+ .component_only = 0,
+
+@@ -589,7 +589,7 @@ static const struct tv_mode tv_modes[] = {
+ /* 625 Lines, 50 Fields, 15.625KHz line, Sub-Carrier 4.434MHz */
+ .name = "PAL-N",
+ .clock = 108000,
+- .refresh = 25000,
++ .refresh = 50000,
+ .oversample = TV_OVERSAMPLE_8X,
+ .component_only = 0,
+
+@@ -634,7 +634,7 @@ static const struct tv_mode tv_modes[] = {
+ /* 625 Lines, 50 Fields, 15.625KHz line, Sub-Carrier 4.434MHz */
+ .name = "PAL",
+ .clock = 108000,
+- .refresh = 25000,
++ .refresh = 50000,
+ .oversample = TV_OVERSAMPLE_8X,
+ .component_only = 0,
+
+@@ -821,7 +821,7 @@ static const struct tv_mode tv_modes[] = {
+ {
+ .name = "1080i@50Hz",
+ .clock = 148800,
+- .refresh = 25000,
++ .refresh = 50000,
+ .oversample = TV_OVERSAMPLE_2X,
+ .component_only = 1,
+
+@@ -847,7 +847,7 @@ static const struct tv_mode tv_modes[] = {
+ {
+ .name = "1080i@60Hz",
+ .clock = 148800,
+- .refresh = 30000,
++ .refresh = 60000,
+ .oversample = TV_OVERSAMPLE_2X,
+ .component_only = 1,
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0044-drm-i915-handle-3rd-pipe.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0044-drm-i915-handle-3rd-pipe.patch
new file mode 100644
index 0000000..6753317
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0044-drm-i915-handle-3rd-pipe.patch
@@ -0,0 +1,37 @@
+From a390a377bfcf132841798e09e9bb4d0f6c27de91 Mon Sep 17 00:00:00 2001
+From: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Date: Sat, 7 Jan 2012 23:40:35 -0200
+Subject: [PATCH 44/87] drm/i915: handle 3rd pipe
+
+commit 07c1e8c1462fa7324de4c36ae9e55da2abd79cee upstream.
+
+We don't need to check 3rd pipe specifically, as it shares PLL with some
+other one.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=41977
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_suspend.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
+index 43cbafe..a1eb83d 100644
+--- a/drivers/gpu/drm/i915/i915_suspend.c
++++ b/drivers/gpu/drm/i915/i915_suspend.c
+@@ -34,6 +34,10 @@ static bool i915_pipe_enabled(struct drm_device *dev, enum pipe pipe)
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ u32 dpll_reg;
+
++ /* On IVB, 3rd pipe shares PLL with another one */
++ if (pipe > 1)
++ return false;
++
+ if (HAS_PCH_SPLIT(dev))
+ dpll_reg = (pipe == PIPE_A) ? _PCH_DPLL_A : _PCH_DPLL_B;
+ else
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0045-drm-i915-convert-force_wake_get-to-func-pointer-in-t.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0045-drm-i915-convert-force_wake_get-to-func-pointer-in-t.patch
new file mode 100644
index 0000000..7e24608
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0045-drm-i915-convert-force_wake_get-to-func-pointer-in-t.patch
@@ -0,0 +1,42 @@
+From 97b068a6657ded880cf3b6617e92da865067a0db Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel@ffwll.ch>
+Date: Fri, 13 Jan 2012 16:20:06 -0800
+Subject: [PATCH 45/87] drm/i915: convert force_wake_get to func pointer in
+ the gpu reset code
+
+commit 8109021313c7a3d8947677391ce6ab9cd0bb1d28 upstream.
+
+This was forgotten in the original multi-threaded forcewake
+conversion:
+
+commit 8d715f0024f64ad1b1be85d8c081cf577944c847
+Author: Keith Packard <keithp at keithp.com>
+Date: Fri Nov 18 20:39:01 2011 -0800
+
+ drm/i915: add multi-threaded forcewake support
+
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_drv.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index a1103fc..d7c9d99 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -645,7 +645,7 @@ int i915_reset(struct drm_device *dev, u8 flags)
+ ret = gen6_do_reset(dev, flags);
+ /* If reset with a user forcewake, try to restore */
+ if (atomic_read(&dev_priv->forcewake_count))
+- __gen6_gt_force_wake_get(dev_priv);
++ dev_priv->display.force_wake_get(dev_priv);
+ break;
+ case 5:
+ ret = ironlake_do_reset(dev, flags);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0046-drm-i915-protect-force_wake_-get-put-with-the-gt_loc.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0046-drm-i915-protect-force_wake_-get-put-with-the-gt_loc.patch
new file mode 100644
index 0000000..060d345
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0046-drm-i915-protect-force_wake_-get-put-with-the-gt_loc.patch
@@ -0,0 +1,163 @@
+From 69ac25cd32a4032a94c100b52cf52abf6fde90a5 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Wed, 14 Dec 2011 13:57:03 +0100
+Subject: [PATCH 46/87] drm/i915: protect force_wake_(get|put) with the
+ gt_lock
+
+commit 9f1f46a45a681d357d1ceedecec3671a5ae957f4 upstream.
+
+The problem this patch solves is that the forcewake accounting
+necessary for register reads is protected by dev->struct_mutex. But the
+hangcheck and error_capture code need to access registers without
+grabbing this mutex because we hold it while waiting for the gpu.
+So a new lock is required. Because currently the error_state capture
+is called from the error irq handler and the hangcheck code runs from
+a timer, it needs to be an irqsafe spinlock (note that the registers
+used by the irq handler (neglecting the error handling part) only uses
+registers that don't need the forcewake dance).
+
+We could tune this down to a normal spinlock when we rework the
+error_state capture and hangcheck code to run from a workqueue. But
+we don't have any read in a fastpath that needs forcewake, so I've
+decided to not care much about overhead.
+
+This prevents tests/gem_hangcheck_forcewake from i-g-t from killing my
+snb on recent kernels - something must have slightly changed the
+timings. On previous kernels it only trigger a WARN about the broken
+locking.
+
+v2: Drop the previous patch for the register writes.
+
+v3: Improve the commit message per Chris Wilson's suggestions.
+
+Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_debugfs.c | 8 ++++++--
+ drivers/gpu/drm/i915/i915_dma.c | 1 +
+ drivers/gpu/drm/i915/i915_drv.c | 18 ++++++++++++------
+ drivers/gpu/drm/i915/i915_drv.h | 10 +++++++---
+ 4 files changed, 26 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
+index 004b048..b2e3c97 100644
+--- a/drivers/gpu/drm/i915/i915_debugfs.c
++++ b/drivers/gpu/drm/i915/i915_debugfs.c
+@@ -1314,9 +1314,13 @@ static int i915_gen6_forcewake_count_info(struct seq_file *m, void *data)
+ struct drm_info_node *node = (struct drm_info_node *) m->private;
+ struct drm_device *dev = node->minor->dev;
+ struct drm_i915_private *dev_priv = dev->dev_private;
++ unsigned forcewake_count;
+
+- seq_printf(m, "forcewake count = %d\n",
+- atomic_read(&dev_priv->forcewake_count));
++ spin_lock_irq(&dev_priv->gt_lock);
++ forcewake_count = dev_priv->forcewake_count;
++ spin_unlock_irq(&dev_priv->gt_lock);
++
++ seq_printf(m, "forcewake count = %u\n", forcewake_count);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
+index a9ae374..c4da951 100644
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -2042,6 +2042,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
+ if (!IS_I945G(dev) && !IS_I945GM(dev))
+ pci_enable_msi(dev->pdev);
+
++ spin_lock_init(&dev_priv->gt_lock);
+ spin_lock_init(&dev_priv->irq_lock);
+ spin_lock_init(&dev_priv->error_lock);
+ spin_lock_init(&dev_priv->rps_lock);
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index d7c9d99..e2d85a9 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -368,11 +368,12 @@ void __gen6_gt_force_wake_mt_get(struct drm_i915_private *dev_priv)
+ */
+ void gen6_gt_force_wake_get(struct drm_i915_private *dev_priv)
+ {
+- WARN_ON(!mutex_is_locked(&dev_priv->dev->struct_mutex));
++ unsigned long irqflags;
+
+- /* Forcewake is atomic in case we get in here without the lock */
+- if (atomic_add_return(1, &dev_priv->forcewake_count) == 1)
++ spin_lock_irqsave(&dev_priv->gt_lock, irqflags);
++ if (dev_priv->forcewake_count++ == 0)
+ dev_priv->display.force_wake_get(dev_priv);
++ spin_unlock_irqrestore(&dev_priv->gt_lock, irqflags);
+ }
+
+ void __gen6_gt_force_wake_put(struct drm_i915_private *dev_priv)
+@@ -392,10 +393,12 @@ void __gen6_gt_force_wake_mt_put(struct drm_i915_private *dev_priv)
+ */
+ void gen6_gt_force_wake_put(struct drm_i915_private *dev_priv)
+ {
+- WARN_ON(!mutex_is_locked(&dev_priv->dev->struct_mutex));
++ unsigned long irqflags;
+
+- if (atomic_dec_and_test(&dev_priv->forcewake_count))
++ spin_lock_irqsave(&dev_priv->gt_lock, irqflags);
++ if (--dev_priv->forcewake_count == 0)
+ dev_priv->display.force_wake_put(dev_priv);
++ spin_unlock_irqrestore(&dev_priv->gt_lock, irqflags);
+ }
+
+ void __gen6_gt_wait_for_fifo(struct drm_i915_private *dev_priv)
+@@ -626,6 +629,7 @@ int i915_reset(struct drm_device *dev, u8 flags)
+ * need to
+ */
+ bool need_display = true;
++ unsigned long irqflags;
+ int ret;
+
+ if (!i915_try_reset)
+@@ -644,8 +648,10 @@ int i915_reset(struct drm_device *dev, u8 flags)
+ case 6:
+ ret = gen6_do_reset(dev, flags);
+ /* If reset with a user forcewake, try to restore */
+- if (atomic_read(&dev_priv->forcewake_count))
++ spin_lock_irqsave(&dev_priv->gt_lock, irqflags);
++ if (dev_priv->forcewake_count)
+ dev_priv->display.force_wake_get(dev_priv);
++ spin_unlock_irqrestore(&dev_priv->gt_lock, irqflags);
+ break;
+ case 5:
+ ret = ironlake_do_reset(dev, flags);
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 505af3f..ae294a0 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -286,7 +286,13 @@ typedef struct drm_i915_private {
+ int relative_constants_mode;
+
+ void __iomem *regs;
+- u32 gt_fifo_count;
++ /** gt_fifo_count and the subsequent register write are synchronized
++ * with dev->struct_mutex. */
++ unsigned gt_fifo_count;
++ /** forcewake_count is protected by gt_lock */
++ unsigned forcewake_count;
++ /** gt_lock is also taken in irq contexts. */
++ struct spinlock gt_lock;
+
+ struct intel_gmbus {
+ struct i2c_adapter adapter;
+@@ -738,8 +744,6 @@ typedef struct drm_i915_private {
+
+ struct drm_property *broadcast_rgb_property;
+ struct drm_property *force_audio_property;
+-
+- atomic_t forcewake_count;
+ } drm_i915_private_t;
+
+ enum i915_cache_level {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0047-eCryptfs-Infinite-loop-due-to-overflow-in-ecryptfs_w.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0047-eCryptfs-Infinite-loop-due-to-overflow-in-ecryptfs_w.patch
new file mode 100644
index 0000000..dabc4e5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0047-eCryptfs-Infinite-loop-due-to-overflow-in-ecryptfs_w.patch
@@ -0,0 +1,51 @@
+From 3d1b7976d3697421e04c86c7a782833c83244694 Mon Sep 17 00:00:00 2001
+From: Li Wang <liwang@nudt.edu.cn>
+Date: Thu, 19 Jan 2012 09:44:36 +0800
+Subject: [PATCH 47/87] eCryptfs: Infinite loop due to overflow in
+ ecryptfs_write()
+
+commit 684a3ff7e69acc7c678d1a1394fe9e757993fd34 upstream.
+
+ecryptfs_write() can enter an infinite loop when truncating a file to a
+size larger than 4G. This only happens on architectures where size_t is
+represented by 32 bits.
+
+This was caused by a size_t overflow due to it incorrectly being used to
+store the result of a calculation which uses potentially large values of
+type loff_t.
+
+[tyhicks@canonical.com: rewrite subject and commit message]
+Signed-off-by: Li Wang <liwang@nudt.edu.cn>
+Signed-off-by: Yunchuan Wen <wenyunchuan@kylinos.com.cn>
+Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ecryptfs/read_write.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
+index 54eb14c..608c1c3 100644
+--- a/fs/ecryptfs/read_write.c
++++ b/fs/ecryptfs/read_write.c
+@@ -130,7 +130,7 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
+ pgoff_t ecryptfs_page_idx = (pos >> PAGE_CACHE_SHIFT);
+ size_t start_offset_in_page = (pos & ~PAGE_CACHE_MASK);
+ size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
+- size_t total_remaining_bytes = ((offset + size) - pos);
++ loff_t total_remaining_bytes = ((offset + size) - pos);
+
+ if (fatal_signal_pending(current)) {
+ rc = -EINTR;
+@@ -141,7 +141,7 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
+ num_bytes = total_remaining_bytes;
+ if (pos < offset) {
+ /* remaining zeros to write, up to destination offset */
+- size_t total_remaining_zeros = (offset - pos);
++ loff_t total_remaining_zeros = (offset - pos);
+
+ if (num_bytes > total_remaining_zeros)
+ num_bytes = total_remaining_zeros;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0048-hwmon-w83627ehf-Fix-number-of-fans-for-NCT6776F.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0048-hwmon-w83627ehf-Fix-number-of-fans-for-NCT6776F.patch
new file mode 100644
index 0000000..b3da87e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0048-hwmon-w83627ehf-Fix-number-of-fans-for-NCT6776F.patch
@@ -0,0 +1,55 @@
+From 38c8c07ac7383692d0a4f932f6ac611437ed24ed Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Fri, 27 Jan 2012 05:43:59 -0800
+Subject: [PATCH 48/87] hwmon: (w83627ehf) Fix number of fans for NCT6776F
+
+commit 585c0fd8216e0c9f98e2434092af7ec0f999522d upstream.
+
+NCT6776F can select fan input pins for fans 3 to 5 with a secondary set of
+chip register bits. Check that second set of bits in addition to the first set
+to detect if fans 3..5 are monitored.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83627ehf.c | 23 ++++++++++++++++++++---
+ 1 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
+index 4b57ab6..c25387d 100644
+--- a/drivers/hwmon/w83627ehf.c
++++ b/drivers/hwmon/w83627ehf.c
+@@ -1920,9 +1920,26 @@ w83627ehf_check_fan_inputs(const struct w83627ehf_sio_data *sio_data,
+ fan4min = 0;
+ fan5pin = 0;
+ } else if (sio_data->kind == nct6776) {
+- fan3pin = !(superio_inb(sio_data->sioreg, 0x24) & 0x40);
+- fan4pin = !!(superio_inb(sio_data->sioreg, 0x1C) & 0x01);
+- fan5pin = !!(superio_inb(sio_data->sioreg, 0x1C) & 0x02);
++ bool gpok = superio_inb(sio_data->sioreg, 0x27) & 0x80;
++
++ superio_select(sio_data->sioreg, W83627EHF_LD_HWM);
++ regval = superio_inb(sio_data->sioreg, SIO_REG_ENABLE);
++
++ if (regval & 0x80)
++ fan3pin = gpok;
++ else
++ fan3pin = !(superio_inb(sio_data->sioreg, 0x24) & 0x40);
++
++ if (regval & 0x40)
++ fan4pin = gpok;
++ else
++ fan4pin = !!(superio_inb(sio_data->sioreg, 0x1C) & 0x01);
++
++ if (regval & 0x20)
++ fan5pin = gpok;
++ else
++ fan5pin = !!(superio_inb(sio_data->sioreg, 0x1C) & 0x02);
++
+ fan4min = fan4pin;
+ } else if (sio_data->kind == w83667hg || sio_data->kind == w83667hg_b) {
+ fan3pin = 1;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0049-cifs-Fix-oops-in-session-setup-code-for-null-user-mo.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0049-cifs-Fix-oops-in-session-setup-code-for-null-user-mo.patch
new file mode 100644
index 0000000..fab9d8a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0049-cifs-Fix-oops-in-session-setup-code-for-null-user-mo.patch
@@ -0,0 +1,47 @@
+From 85f2f3e05e8e0deec4fc8b751324f91acb276d21 Mon Sep 17 00:00:00 2001
+From: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
+Date: Thu, 2 Feb 2012 15:28:28 -0600
+Subject: [PATCH 49/87] cifs: Fix oops in session setup code for null user
+ mounts
+
+commit de47a4176c532ef5961b8a46a2d541a3517412d3 upstream.
+
+For null user mounts, do not invoke string length function
+during session setup.
+
+Reported-and-Tested-by: Chris Clayton <chris2553@googlemail.com>
+Acked-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
+Signed-off-by: Steve French <smfrench@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/sess.c | 7 +++----
+ 1 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
+index 4ec3ee9..2504809 100644
+--- a/fs/cifs/sess.c
++++ b/fs/cifs/sess.c
+@@ -246,16 +246,15 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
+ /* copy user */
+ /* BB what about null user mounts - check that we do this BB */
+ /* copy user */
+- if (ses->user_name != NULL)
++ if (ses->user_name != NULL) {
+ strncpy(bcc_ptr, ses->user_name, MAX_USERNAME_SIZE);
++ bcc_ptr += strnlen(ses->user_name, MAX_USERNAME_SIZE);
++ }
+ /* else null user mount */
+-
+- bcc_ptr += strnlen(ses->user_name, MAX_USERNAME_SIZE);
+ *bcc_ptr = 0;
+ bcc_ptr++; /* account for null termination */
+
+ /* copy domain */
+-
+ if (ses->domainName != NULL) {
+ strncpy(bcc_ptr, ses->domainName, 256);
+ bcc_ptr += strnlen(ses->domainName, 256);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0050-atmel_lcdfb-fix-usage-of-CONTRAST_CTR-in-suspend-res.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0050-atmel_lcdfb-fix-usage-of-CONTRAST_CTR-in-suspend-res.patch
new file mode 100644
index 0000000..506fcd3
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0050-atmel_lcdfb-fix-usage-of-CONTRAST_CTR-in-suspend-res.patch
@@ -0,0 +1,36 @@
+From c1a4af09cec0d39604a99ab58e59276c69c4179a Mon Sep 17 00:00:00 2001
+From: Hubert Feurstein <h.feurstein@gmail.com>
+Date: Mon, 9 Jan 2012 17:23:57 +0100
+Subject: [PATCH 50/87] atmel_lcdfb: fix usage of CONTRAST_CTR in
+ suspend/resume
+
+commit 9f1065032ceb7e86c7c9f16bb86518857e88a172 upstream.
+
+An error was existing in the saving of CONTRAST_CTR register
+across suspend/resume.
+
+Signed-off-by: Hubert Feurstein <h.feurstein@gmail.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/atmel_lcdfb.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
+index 63409c1..e919c70 100644
+--- a/drivers/video/atmel_lcdfb.c
++++ b/drivers/video/atmel_lcdfb.c
+@@ -1089,7 +1089,7 @@ static int atmel_lcdfb_suspend(struct platform_device *pdev, pm_message_t mesg)
+ */
+ lcdc_writel(sinfo, ATMEL_LCDC_IDR, ~0UL);
+
+- sinfo->saved_lcdcon = lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
++ sinfo->saved_lcdcon = lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_CTR);
+ lcdc_writel(sinfo, ATMEL_LCDC_CONTRAST_CTR, 0);
+ if (sinfo->atmel_lcdfb_power_control)
+ sinfo->atmel_lcdfb_power_control(0);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0051-lockdep-bug-Exclude-TAINT_FIRMWARE_WORKAROUND-from-d.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0051-lockdep-bug-Exclude-TAINT_FIRMWARE_WORKAROUND-from-d.patch
new file mode 100644
index 0000000..d96ecde
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0051-lockdep-bug-Exclude-TAINT_FIRMWARE_WORKAROUND-from-d.patch
@@ -0,0 +1,56 @@
+From 1a90d01be282f295186d58b42d8cbac1d5d7edc4 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Mon, 14 Nov 2011 13:13:49 +0100
+Subject: [PATCH 51/87] lockdep, bug: Exclude TAINT_FIRMWARE_WORKAROUND from
+ disabling lockdep
+
+commit df754e6af2f237a6c020c0daff55a1a609338e31 upstream.
+
+It's unlikely that TAINT_FIRMWARE_WORKAROUND causes false
+lockdep messages, so do not disable lockdep in that case.
+We still want to keep lockdep disabled in the
+TAINT_OOT_MODULE case:
+
+ - bin-only modules can cause various instabilities in
+ their and in unrelated kernel code
+
+ - they are impossible to debug for kernel developers
+
+ - they also typically do not have the copyright license
+ permission to link to the GPL-ed lockdep code.
+
+Suggested-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Link: http://lkml.kernel.org/n/tip-xopopjjens57r0i13qnyh2yo@git.kernel.org
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/panic.c | 12 ++++++++++--
+ 1 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/panic.c b/kernel/panic.c
+index b2659360..1b83fd8 100644
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -240,8 +240,16 @@ void add_taint(unsigned flag)
+ * Also we want to keep up lockdep for staging development and
+ * post-warning case.
+ */
+- if (flag != TAINT_CRAP && flag != TAINT_WARN && __debug_locks_off())
+- printk(KERN_WARNING "Disabling lock debugging due to kernel taint\n");
++ switch (flag) {
++ case TAINT_CRAP:
++ case TAINT_WARN:
++ case TAINT_FIRMWARE_WORKAROUND:
++ break;
++
++ default:
++ if (__debug_locks_off())
++ printk(KERN_WARNING "Disabling lock debugging due to kernel taint\n");
++ }
+
+ set_bit(flag, &tainted_mask);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0052-lockdep-bug-Exclude-TAINT_OOT_MODULE-from-disabling-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0052-lockdep-bug-Exclude-TAINT_OOT_MODULE-from-disabling-.patch
new file mode 100644
index 0000000..57df74c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0052-lockdep-bug-Exclude-TAINT_OOT_MODULE-from-disabling-.patch
@@ -0,0 +1,56 @@
+From 6492a0fb92a35630103cc62a1902018dfef8b46c Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Wed, 7 Dec 2011 14:30:58 +0000
+Subject: [PATCH 52/87] lockdep, bug: Exclude TAINT_OOT_MODULE from disabling
+ lock debugging
+
+commit 9ec84acee1e221d99dc33237bff5e82839d10cc0 upstream.
+
+We do want to allow lock debugging for GPL-compatible modules
+that are not (yet) built in-tree. This was disabled as a
+side-effect of commit 2449b8ba0745327c5fa49a8d9acffe03b2eded69
+('module,bug: Add TAINT_OOT_MODULE flag for modules not built
+in-tree'). Lock debug warnings now include taint flags, so
+kernel developers should still be able to deflect warnings
+caused by out-of-tree modules.
+
+The TAINT_PROPRIETARY_MODULE flag for non-GPL-compatible modules
+will still disable lock debugging.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Nick Bowler <nbowler@elliptictech.com>
+Cc: Dave Jones <davej@redhat.com>
+Cc: Rusty Russell <rusty@rustcorp.com.au>
+Cc: Randy Dunlap <rdunlap@xenotime.net>
+Cc: Debian kernel maintainers <debian-kernel@lists.debian.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Alan Cox <alan@linux.intel.com>
+Link: http://lkml.kernel.org/r/1323268258.18450.11.camel@deadeye
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/panic.c | 5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/panic.c b/kernel/panic.c
+index 1b83fd8..3458469 100644
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -237,11 +237,12 @@ void add_taint(unsigned flag)
+ * Can't trust the integrity of the kernel anymore.
+ * We don't call directly debug_locks_off() because the issue
+ * is not necessarily serious enough to set oops_in_progress to 1
+- * Also we want to keep up lockdep for staging development and
+- * post-warning case.
++ * Also we want to keep up lockdep for staging/out-of-tree
++ * development and post-warning case.
+ */
+ switch (flag) {
+ case TAINT_CRAP:
++ case TAINT_OOT_MODULE:
+ case TAINT_WARN:
+ case TAINT_FIRMWARE_WORKAROUND:
+ break;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0053-iscsi-target-Fix-reject-release-handling-in-iscsit_f.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0053-iscsi-target-Fix-reject-release-handling-in-iscsit_f.patch
new file mode 100644
index 0000000..1b1175d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0053-iscsi-target-Fix-reject-release-handling-in-iscsit_f.patch
@@ -0,0 +1,79 @@
+From fa577fc1c4b43933b74efe8d44075ef93f289516 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Mon, 16 Jan 2012 16:04:15 -0800
+Subject: [PATCH 53/87] iscsi-target: Fix reject release handling in
+ iscsit_free_cmd()
+
+commit c1ce4bd56f2846de55043374598fd929ad3b711b upstream.
+
+This patch addresses a bug where iscsit_free_cmd() was incorrectly calling
+iscsit_release_cmd() for ISCSI_OP_REJECT because iscsi_add_reject*() will
+overwrite the original iscsi_cmd->iscsi_opcode assignment. This bug was
+introduced with the following commit:
+
+commit 0be67f2ed8f577d2c72d917928394c5885fa9134
+Author: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Sun Oct 9 01:48:14 2011 -0700
+
+ iscsi-target: Remove SCF_SE_LUN_CMD flag abuses
+
+and was manifesting itself as list corruption with the following:
+
+[ 131.191092] ------------[ cut here ]------------
+[ 131.191092] WARNING: at lib/list_debug.c:53 __list_del_entry+0x8d/0x98()
+[ 131.191092] Hardware name: VMware Virtual Platform
+[ 131.191092] list_del corruption. prev->next should be ffff880022d3c100, but was 6b6b6b6b6b6b6b6b
+[ 131.191092] Modules linked in: tcm_vhost ib_srpt ib_cm ib_sa ib_mad ib_core tcm_qla2xxx qla2xxx tcm_loop tcm_fc libfc scsi_transport_fc crc32c iscsi_target_mod target_core_stgt scsi_tgt target_core_pscsi target_core_file target_core_iblock target_core_mod configfs ipv6 iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi sr_mod cdrom sd_mod e1000 ata_piix libata mptspi mptscsih mptbase [last unloaded: scsi_wait_scan]
+[ 131.191092] Pid: 2250, comm: iscsi_ttx Tainted: G W 3.2.0-rc4+ #42
+[ 131.191092] Call Trace:
+[ 131.191092] [<ffffffff8103b553>] warn_slowpath_common+0x80/0x98
+[ 131.191092] [<ffffffff8103b5ff>] warn_slowpath_fmt+0x41/0x43
+[ 131.191092] [<ffffffff811d0279>] __list_del_entry+0x8d/0x98
+[ 131.191092] [<ffffffffa01395c9>] transport_lun_remove_cmd+0x9b/0xb7 [target_core_mod]
+[ 131.191092] [<ffffffffa013a55c>] transport_generic_free_cmd+0x5d/0x71 [target_core_mod]
+[ 131.191092] [<ffffffffa01a012b>] iscsit_free_cmd+0x1e/0x27 [iscsi_target_mod]
+[ 131.191092] [<ffffffffa01a13be>] iscsit_close_connection+0x14d/0x5b2 [iscsi_target_mod]
+[ 131.191092] [<ffffffffa0196a0c>] iscsit_take_action_for_connection_exit+0xdb/0xe0 [iscsi_target_mod]
+[ 131.191092] [<ffffffffa01a55d4>] iscsi_target_tx_thread+0x15cb/0x1608 [iscsi_target_mod]
+[ 131.191092] [<ffffffff8103609a>] ? check_preempt_wakeup+0x121/0x185
+[ 131.191092] [<ffffffff81030801>] ? __dequeue_entity+0x2e/0x33
+[ 131.191092] [<ffffffffa01a4009>] ? iscsit_send_text_rsp+0x25f/0x25f [iscsi_target_mod]
+[ 131.191092] [<ffffffffa01a4009>] ? iscsit_send_text_rsp+0x25f/0x25f [iscsi_target_mod]
+[ 131.191092] [<ffffffff8138f706>] ? schedule+0x55/0x57
+[ 131.191092] [<ffffffff81056c7d>] kthread+0x7d/0x85
+[ 131.191092] [<ffffffff81399534>] kernel_thread_helper+0x4/0x10
+[ 131.191092] [<ffffffff81056c00>] ? kthread_worker_fn+0x16d/0x16d
+[ 131.191092] [<ffffffff81399530>] ? gs_change+0x13/0x13
+
+Reported-by: <jrepac@yahoo.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/iscsi/iscsi_target_util.c | 11 +++++++++++
+ 1 files changed, 11 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
+index 02348f7..99f2af3 100644
+--- a/drivers/target/iscsi/iscsi_target_util.c
++++ b/drivers/target/iscsi/iscsi_target_util.c
+@@ -851,6 +851,17 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd)
+ case ISCSI_OP_SCSI_TMFUNC:
+ transport_generic_free_cmd(&cmd->se_cmd, 1);
+ break;
++ case ISCSI_OP_REJECT:
++ /*
++ * Handle special case for REJECT when iscsi_add_reject*() has
++ * overwritten the original iscsi_opcode assignment, and the
++ * associated cmd->se_cmd needs to be released.
++ */
++ if (cmd->se_cmd.se_tfo != NULL) {
++ transport_generic_free_cmd(&cmd->se_cmd, 1);
++ break;
++ }
++ /* Fall-through */
+ default:
+ iscsit_release_cmd(cmd);
+ break;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0054-iscsi-target-Fix-double-list_add-with-iscsit_alloc_b.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0054-iscsi-target-Fix-double-list_add-with-iscsit_alloc_b.patch
new file mode 100644
index 0000000..159d901
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0054-iscsi-target-Fix-double-list_add-with-iscsit_alloc_b.patch
@@ -0,0 +1,35 @@
+From 49f4afd3b15866b16b72691a6060fad041e8f2dc Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Mon, 16 Jan 2012 17:11:54 -0800
+Subject: [PATCH 54/87] iscsi-target: Fix double list_add with
+ iscsit_alloc_buffs reject
+
+commit cd931ee62fd0258fc85c76a7c5499fe85e0f3436 upstream.
+
+This patch fixes a bug where the iscsit_add_reject_from_cmd() call
+from a failure to iscsit_alloc_buffs() was incorrectly passing
+add_to_conn=1 and causing a double list_add after iscsi_cmd->i_list
+had already been added in iscsit_handle_scsi_cmd().
+
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/iscsi/iscsi_target.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 8599545..3b46e3a 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1062,7 +1062,7 @@ attach_cmd:
+ if (ret < 0)
+ return iscsit_add_reject_from_cmd(
+ ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+- 1, 1, buf, cmd);
++ 1, 0, buf, cmd);
+ /*
+ * Check the CmdSN against ExpCmdSN/MaxCmdSN here if
+ * the Immediate Bit is not set, and no Immediate
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0055-iscsi-target-Fix-discovery-with-INADDR_ANY-and-IN6AD.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0055-iscsi-target-Fix-discovery-with-INADDR_ANY-and-IN6AD.patch
new file mode 100644
index 0000000..feb7c2e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0055-iscsi-target-Fix-discovery-with-INADDR_ANY-and-IN6AD.patch
@@ -0,0 +1,176 @@
+From 7b88c23d62bcaf794ebd97400869d00f00befcd6 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Mon, 16 Jan 2012 23:33:48 -0800
+Subject: [PATCH 55/87] iscsi-target: Fix discovery with INADDR_ANY and
+ IN6ADDR_ANY_INIT
+
+commit 2f9bc894c67dbacae5a6a9875818d2a18a918d18 upstream.
+
+This patch addresses a bug with sendtargets discovery where INADDR_ANY (0.0.0.0)
++ IN6ADDR_ANY_INIT ([0:0:0:0:0:0:0:0]) network portals where incorrectly being
+reported back to initiators instead of the address of the connecting interface.
+To address this, save local socket ->getname() output during iscsi login setup,
+and makes iscsit_build_sendtargets_response() return these TargetAddress keys
+when INADDR_ANY or IN6ADDR_ANY_INIT portals are in use.
+
+Reported-by: Dax Kelson <dkelson@gurulabs.com>
+Reported-by: Andy Grover <agrover@redhat.com>
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/iscsi/iscsi_target.c | 37 +++++++++++++++++++++++++---
+ drivers/target/iscsi/iscsi_target_core.h | 2 +
+ drivers/target/iscsi/iscsi_target_login.c | 31 +++++++++++++++++++++---
+ 3 files changed, 62 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 3b46e3a..0c1d5c73 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -3165,6 +3165,30 @@ static int iscsit_send_task_mgt_rsp(
+ return 0;
+ }
+
++static bool iscsit_check_inaddr_any(struct iscsi_np *np)
++{
++ bool ret = false;
++
++ if (np->np_sockaddr.ss_family == AF_INET6) {
++ const struct sockaddr_in6 sin6 = {
++ .sin6_addr = IN6ADDR_ANY_INIT };
++ struct sockaddr_in6 *sock_in6 =
++ (struct sockaddr_in6 *)&np->np_sockaddr;
++
++ if (!memcmp(sock_in6->sin6_addr.s6_addr,
++ sin6.sin6_addr.s6_addr, 16))
++ ret = true;
++ } else {
++ struct sockaddr_in * sock_in =
++ (struct sockaddr_in *)&np->np_sockaddr;
++
++ if (sock_in->sin_addr.s_addr == INADDR_ANY)
++ ret = true;
++ }
++
++ return ret;
++}
++
+ static int iscsit_build_sendtargets_response(struct iscsi_cmd *cmd)
+ {
+ char *payload = NULL;
+@@ -3214,12 +3238,17 @@ static int iscsit_build_sendtargets_response(struct iscsi_cmd *cmd)
+ spin_lock(&tpg->tpg_np_lock);
+ list_for_each_entry(tpg_np, &tpg->tpg_gnp_list,
+ tpg_np_list) {
++ struct iscsi_np *np = tpg_np->tpg_np;
++ bool inaddr_any = iscsit_check_inaddr_any(np);
++
+ len = sprintf(buf, "TargetAddress="
+ "%s%s%s:%hu,%hu",
+- (tpg_np->tpg_np->np_sockaddr.ss_family == AF_INET6) ?
+- "[" : "", tpg_np->tpg_np->np_ip,
+- (tpg_np->tpg_np->np_sockaddr.ss_family == AF_INET6) ?
+- "]" : "", tpg_np->tpg_np->np_port,
++ (np->np_sockaddr.ss_family == AF_INET6) ?
++ "[" : "", (inaddr_any == false) ?
++ np->np_ip : conn->local_ip,
++ (np->np_sockaddr.ss_family == AF_INET6) ?
++ "]" : "", (inaddr_any == false) ?
++ np->np_port : conn->local_port,
+ tpg->tpgt);
+ len += 1;
+
+diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
+index f1a02da..7da2d6a 100644
+--- a/drivers/target/iscsi/iscsi_target_core.h
++++ b/drivers/target/iscsi/iscsi_target_core.h
+@@ -508,6 +508,7 @@ struct iscsi_conn {
+ u16 cid;
+ /* Remote TCP Port */
+ u16 login_port;
++ u16 local_port;
+ int net_size;
+ u32 auth_id;
+ #define CONNFLAG_SCTP_STRUCT_FILE 0x01
+@@ -527,6 +528,7 @@ struct iscsi_conn {
+ unsigned char bad_hdr[ISCSI_HDR_LEN];
+ #define IPV6_ADDRESS_SPACE 48
+ unsigned char login_ip[IPV6_ADDRESS_SPACE];
++ unsigned char local_ip[IPV6_ADDRESS_SPACE];
+ int conn_usage_count;
+ int conn_waiting_on_uc;
+ atomic_t check_immediate_queue;
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index d734bde..bd2adec 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -616,8 +616,8 @@ static int iscsi_post_login_handler(
+ }
+
+ pr_debug("iSCSI Login successful on CID: %hu from %s to"
+- " %s:%hu,%hu\n", conn->cid, conn->login_ip, np->np_ip,
+- np->np_port, tpg->tpgt);
++ " %s:%hu,%hu\n", conn->cid, conn->login_ip,
++ conn->local_ip, conn->local_port, tpg->tpgt);
+
+ list_add_tail(&conn->conn_list, &sess->sess_conn_list);
+ atomic_inc(&sess->nconn);
+@@ -659,7 +659,8 @@ static int iscsi_post_login_handler(
+ sess->session_state = TARG_SESS_STATE_LOGGED_IN;
+
+ pr_debug("iSCSI Login successful on CID: %hu from %s to %s:%hu,%hu\n",
+- conn->cid, conn->login_ip, np->np_ip, np->np_port, tpg->tpgt);
++ conn->cid, conn->login_ip, conn->local_ip, conn->local_port,
++ tpg->tpgt);
+
+ spin_lock_bh(&sess->conn_lock);
+ list_add_tail(&conn->conn_list, &sess->sess_conn_list);
+@@ -1019,6 +1020,18 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ snprintf(conn->login_ip, sizeof(conn->login_ip), "%pI6c",
+ &sock_in6.sin6_addr.in6_u);
+ conn->login_port = ntohs(sock_in6.sin6_port);
++
++ if (conn->sock->ops->getname(conn->sock,
++ (struct sockaddr *)&sock_in6, &err, 0) < 0) {
++ pr_err("sock_ops->getname() failed.\n");
++ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
++ ISCSI_LOGIN_STATUS_TARGET_ERROR);
++ goto new_sess_out;
++ }
++ snprintf(conn->local_ip, sizeof(conn->local_ip), "%pI6c",
++ &sock_in6.sin6_addr.in6_u);
++ conn->local_port = ntohs(sock_in6.sin6_port);
++
+ } else {
+ memset(&sock_in, 0, sizeof(struct sockaddr_in));
+
+@@ -1031,6 +1044,16 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ }
+ sprintf(conn->login_ip, "%pI4", &sock_in.sin_addr.s_addr);
+ conn->login_port = ntohs(sock_in.sin_port);
++
++ if (conn->sock->ops->getname(conn->sock,
++ (struct sockaddr *)&sock_in, &err, 0) < 0) {
++ pr_err("sock_ops->getname() failed.\n");
++ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
++ ISCSI_LOGIN_STATUS_TARGET_ERROR);
++ goto new_sess_out;
++ }
++ sprintf(conn->local_ip, "%pI4", &sock_in.sin_addr.s_addr);
++ conn->local_port = ntohs(sock_in.sin_port);
+ }
+
+ conn->network_transport = np->np_network_transport;
+@@ -1038,7 +1061,7 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ pr_debug("Received iSCSI login request from %s on %s Network"
+ " Portal %s:%hu\n", conn->login_ip,
+ (conn->network_transport == ISCSI_TCP) ? "TCP" : "SCTP",
+- np->np_ip, np->np_port);
++ conn->local_ip, conn->local_port);
+
+ pr_debug("Moving to TARG_CONN_STATE_IN_LOGIN.\n");
+ conn->conn_state = TARG_CONN_STATE_IN_LOGIN;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0056-ASoC-wm_hubs-Fix-routing-of-input-PGAs-to-line-outpu.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0056-ASoC-wm_hubs-Fix-routing-of-input-PGAs-to-line-outpu.patch
new file mode 100644
index 0000000..98c8833
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0056-ASoC-wm_hubs-Fix-routing-of-input-PGAs-to-line-outpu.patch
@@ -0,0 +1,46 @@
+From f11e42f5205653968c6496e637b1cd524405a9ec Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Tue, 31 Jan 2012 11:55:32 +0000
+Subject: [PATCH 56/87] ASoC: wm_hubs: Fix routing of input PGAs to line
+ output mixer
+
+commit ee76744c51ec342df9822b4a85dbbfc3887b6d60 upstream.
+
+IN1L/R is routed to both line output mixers, we don't route IN1 to LINEOUT1
+and IN2 to LINEOUT2.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm_hubs.c | 8 ++++----
+ 1 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
+index 8547191..6ef2283 100644
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -587,8 +587,8 @@ SOC_DAPM_SINGLE("Left Output Switch", WM8993_LINE_MIXER1, 0, 1, 0),
+ };
+
+ static const struct snd_kcontrol_new line2_mix[] = {
+-SOC_DAPM_SINGLE("IN2R Switch", WM8993_LINE_MIXER2, 2, 1, 0),
+-SOC_DAPM_SINGLE("IN2L Switch", WM8993_LINE_MIXER2, 1, 1, 0),
++SOC_DAPM_SINGLE("IN1R Switch", WM8993_LINE_MIXER2, 2, 1, 0),
++SOC_DAPM_SINGLE("IN1L Switch", WM8993_LINE_MIXER2, 1, 1, 0),
+ SOC_DAPM_SINGLE("Output Switch", WM8993_LINE_MIXER2, 0, 1, 0),
+ };
+
+@@ -846,8 +846,8 @@ static const struct snd_soc_dapm_route lineout1_se_routes[] = {
+ };
+
+ static const struct snd_soc_dapm_route lineout2_diff_routes[] = {
+- { "LINEOUT2 Mixer", "IN2L Switch", "IN2L PGA" },
+- { "LINEOUT2 Mixer", "IN2R Switch", "IN2R PGA" },
++ { "LINEOUT2 Mixer", "IN1L Switch", "IN1L PGA" },
++ { "LINEOUT2 Mixer", "IN1R Switch", "IN1R PGA" },
+ { "LINEOUT2 Mixer", "Output Switch", "Right Output PGA" },
+
+ { "LINEOUT2N Driver", NULL, "LINEOUT2 Mixer" },
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0057-ASoC-wm_hubs-Correct-line-input-to-line-output-2-pat.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0057-ASoC-wm_hubs-Correct-line-input-to-line-output-2-pat.patch
new file mode 100644
index 0000000..7a62535
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0057-ASoC-wm_hubs-Correct-line-input-to-line-output-2-pat.patch
@@ -0,0 +1,35 @@
+From 520a5189a6745dcd3b61e87562e28d6e8aba12f8 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Wed, 1 Feb 2012 23:46:58 +0000
+Subject: [PATCH 57/87] ASoC: wm_hubs: Correct line input to line output 2
+ paths
+
+commit 43b6cec27e1e50a1de3eff47e66e502f3fe7e66e upstream.
+
+The second line output mixer has the controls for the line input bypasses
+in the opposite order.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm_hubs.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
+index 6ef2283..3642e06 100644
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -587,8 +587,8 @@ SOC_DAPM_SINGLE("Left Output Switch", WM8993_LINE_MIXER1, 0, 1, 0),
+ };
+
+ static const struct snd_kcontrol_new line2_mix[] = {
+-SOC_DAPM_SINGLE("IN1R Switch", WM8993_LINE_MIXER2, 2, 1, 0),
+-SOC_DAPM_SINGLE("IN1L Switch", WM8993_LINE_MIXER2, 1, 1, 0),
++SOC_DAPM_SINGLE("IN1L Switch", WM8993_LINE_MIXER2, 2, 1, 0),
++SOC_DAPM_SINGLE("IN1R Switch", WM8993_LINE_MIXER2, 1, 1, 0),
+ SOC_DAPM_SINGLE("Output Switch", WM8993_LINE_MIXER2, 0, 1, 0),
+ };
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0058-ASoC-wm8962-Fix-word-length-configuration.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0058-ASoC-wm8962-Fix-word-length-configuration.patch
new file mode 100644
index 0000000..1109c8b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0058-ASoC-wm8962-Fix-word-length-configuration.patch
@@ -0,0 +1,38 @@
+From ef7dcc8c0fd35d7fb937d7bc4ac7b883945b3586 Mon Sep 17 00:00:00 2001
+From: Susan Gao <sgao@opensource.wolfsonmicro.com>
+Date: Mon, 30 Jan 2012 13:57:04 -0800
+Subject: [PATCH 58/87] ASoC: wm8962: Fix word length configuration
+
+commit 2b6712b19531e22455e7fa18371c5ba9eec76699 upstream.
+
+Signed-off-by: Susan Gao <sgao@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm8962.c | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 53edd9a..d795294 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -3172,13 +3172,13 @@ static int wm8962_hw_params(struct snd_pcm_substream *substream,
+ case SNDRV_PCM_FORMAT_S16_LE:
+ break;
+ case SNDRV_PCM_FORMAT_S20_3LE:
+- aif0 |= 0x40;
++ aif0 |= 0x4;
+ break;
+ case SNDRV_PCM_FORMAT_S24_LE:
+- aif0 |= 0x80;
++ aif0 |= 0x8;
+ break;
+ case SNDRV_PCM_FORMAT_S32_LE:
+- aif0 |= 0xc0;
++ aif0 |= 0xc;
+ break;
+ default:
+ return -EINVAL;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0059-ASoC-wm8994-Enabling-VMID-should-take-a-runtime-PM-r.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0059-ASoC-wm8994-Enabling-VMID-should-take-a-runtime-PM-r.patch
new file mode 100644
index 0000000..0c1b50c
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0059-ASoC-wm8994-Enabling-VMID-should-take-a-runtime-PM-r.patch
@@ -0,0 +1,42 @@
+From e9ee45b83b21448a8e27309456430890b5fa1ff2 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Mon, 6 Feb 2012 12:07:08 +0000
+Subject: [PATCH 59/87] ASoC: wm8994: Enabling VMID should take a runtime PM
+ reference
+
+commit db966f8abb9ba74f7d5a7230f51572f52c31c4e5 upstream.
+
+We can enable VMID independently of the bias in some use cases so we need
+to ensure that the core device is powered up.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm8994.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index d0c545b..a3d6bd8 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -729,6 +729,8 @@ static void vmid_reference(struct snd_soc_codec *codec)
+ {
+ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+
++ pm_runtime_get_sync(codec->dev);
++
+ wm8994->vmid_refcount++;
+
+ dev_dbg(codec->dev, "Referencing VMID, refcount is now %d\n",
+@@ -796,6 +798,8 @@ static void vmid_dereference(struct snd_soc_codec *codec)
+ WM8994_VMID_BUF_ENA |
+ WM8994_VMID_RAMP_MASK, 0);
+ }
++
++ pm_runtime_put(codec->dev);
+ }
+
+ static int vmid_event(struct snd_soc_dapm_widget *w,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0060-ASoC-wm8994-Fix-typo-in-VMID-ramp-setting.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0060-ASoC-wm8994-Fix-typo-in-VMID-ramp-setting.patch
new file mode 100644
index 0000000..d4b7d71
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0060-ASoC-wm8994-Fix-typo-in-VMID-ramp-setting.patch
@@ -0,0 +1,31 @@
+From a79cee16dfd9206eb087fbd25767c4d8dec0b0c5 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Tue, 7 Feb 2012 17:24:19 +0000
+Subject: [PATCH 60/87] ASoC: wm8994: Fix typo in VMID ramp setting
+
+commit f647e1526fd6c7c8ab720781c40d11e11f930e93 upstream.
+
+The VMID ramp rate is supposed to be 0x3, not 11b. Fix that.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wm8994.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index a3d6bd8..6e502af 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -744,7 +744,7 @@ static void vmid_reference(struct snd_soc_codec *codec)
+ WM8994_VMID_RAMP_MASK,
+ WM8994_STARTUP_BIAS_ENA |
+ WM8994_VMID_BUF_ENA |
+- (0x11 << WM8994_VMID_RAMP_SHIFT));
++ (0x3 << WM8994_VMID_RAMP_SHIFT));
+
+ /* Main bias enable, VMID=2x40k */
+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_1,
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0061-pcmcia-fix-socket-refcount-decrementing-on-each-resu.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0061-pcmcia-fix-socket-refcount-decrementing-on-each-resu.patch
new file mode 100644
index 0000000..375aeeb
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0061-pcmcia-fix-socket-refcount-decrementing-on-each-resu.patch
@@ -0,0 +1,179 @@
+From 93636af6098a627a1ddc02f2f265be4a9d337201 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Wed, 8 Feb 2012 17:13:41 -0800
+Subject: [PATCH 61/87] pcmcia: fix socket refcount decrementing on each
+ resume
+
+commit 025e4ab3db07fcbf62c01e4f30d1012234beb980 upstream.
+
+This fixes a memory-corrupting bug: not only does it cause the warning,
+but as a result of dropping the refcount to zero, it causes the
+pcmcia_socket0 device structure to be freed while it still has
+references, causing slab caches corruption. A fatal oops quickly
+follows this warning - often even just a 'dmesg' following the warning
+causes the kernel to oops.
+
+While testing suspend/resume on an ARM device with PCMCIA support, and a
+CF card inserted, I found that after five suspend and resumes, the
+kernel would complain, and shortly die after with slab corruption.
+
+ WARNING: at include/linux/kref.h:41 kobject_get+0x28/0x50()
+
+As the message doesn't give a clue about which kobject, and the built-in
+debugging in drivers/base/power/main.c happens too late, this was added
+right before each get_device():
+
+ printk("%s: %p [%s] %u\n", __func__, dev, kobject_name(&dev->kobj), atomic_read(&dev->kobj.kref.refcount));
+
+and on the 3rd s2ram cycle, the following behaviour observed:
+
+On the 3rd suspend/resume cycle:
+
+ dpm_prepare: c1a0d998 [pcmcia_socket0] 3
+ dpm_suspend: c1a0d998 [pcmcia_socket0] 3
+ dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 3
+ dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 3
+ dpm_resume: c1a0d998 [pcmcia_socket0] 3
+ dpm_complete: c1a0d998 [pcmcia_socket0] 2
+
+4th:
+
+ dpm_prepare: c1a0d998 [pcmcia_socket0] 2
+ dpm_suspend: c1a0d998 [pcmcia_socket0] 2
+ dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 2
+ dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 2
+ dpm_resume: c1a0d998 [pcmcia_socket0] 2
+ dpm_complete: c1a0d998 [pcmcia_socket0] 1
+
+5th:
+
+ dpm_prepare: c1a0d998 [pcmcia_socket0] 1
+ dpm_suspend: c1a0d998 [pcmcia_socket0] 1
+ dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 1
+ dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 1
+ dpm_resume: c1a0d998 [pcmcia_socket0] 1
+ dpm_complete: c1a0d998 [pcmcia_socket0] 0
+ ------------[ cut here ]------------
+ WARNING: at include/linux/kref.h:41 kobject_get+0x28/0x50()
+ Modules linked in: ucb1x00_core
+ Backtrace:
+ [<c0212090>] (dump_backtrace+0x0/0x110) from [<c04799dc>] (dump_stack+0x18/0x1c)
+ [<c04799c4>] (dump_stack+0x0/0x1c) from [<c021cba0>] (warn_slowpath_common+0x50/0x68)
+ [<c021cb50>] (warn_slowpath_common+0x0/0x68) from [<c021cbdc>] (warn_slowpath_null+0x24/0x28)
+ [<c021cbb8>] (warn_slowpath_null+0x0/0x28) from [<c0335374>] (kobject_get+0x28/0x50)
+ [<c033534c>] (kobject_get+0x0/0x50) from [<c03804f4>] (get_device+0x1c/0x24)
+ [<c0388c90>] (dpm_complete+0x0/0x1a0) from [<c0389cc0>] (dpm_resume_end+0x1c/0x20)
+ ...
+
+Looking at commit 7b24e7988263 ("pcmcia: split up central event handler"),
+the following change was made to cs.c:
+
+ return 0;
+ }
+ #endif
+-
+- send_event(skt, CS_EVENT_PM_RESUME, CS_EVENT_PRI_LOW);
++ if (!(skt->state & SOCKET_CARDBUS) && (skt->callback))
++ skt->callback->early_resume(skt);
+ return 0;
+ }
+
+And the corresponding change in ds.c is from:
+
+-static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
+-{
+- struct pcmcia_socket *s = pcmcia_get_socket(skt);
+...
+- switch (event) {
+...
+- case CS_EVENT_PM_RESUME:
+- if (verify_cis_cache(skt) != 0) {
+- dev_dbg(&skt->dev, "cis mismatch - different card\n");
+- /* first, remove the card */
+- ds_event(skt, CS_EVENT_CARD_REMOVAL, CS_EVENT_PRI_HIGH);
+- mutex_lock(&s->ops_mutex);
+- destroy_cis_cache(skt);
+- kfree(skt->fake_cis);
+- skt->fake_cis = NULL;
+- s->functions = 0;
+- mutex_unlock(&s->ops_mutex);
+- /* now, add the new card */
+- ds_event(skt, CS_EVENT_CARD_INSERTION,
+- CS_EVENT_PRI_LOW);
+- }
+- break;
+...
+- }
+
+- pcmcia_put_socket(s);
+
+- return 0;
+-} /* ds_event */
+
+to:
+
++static int pcmcia_bus_early_resume(struct pcmcia_socket *skt)
++{
++ if (!verify_cis_cache(skt)) {
++ pcmcia_put_socket(skt);
++ return 0;
++ }
+
++ dev_dbg(&skt->dev, "cis mismatch - different card\n");
+
++ /* first, remove the card */
++ pcmcia_bus_remove(skt);
++ mutex_lock(&skt->ops_mutex);
++ destroy_cis_cache(skt);
++ kfree(skt->fake_cis);
++ skt->fake_cis = NULL;
++ skt->functions = 0;
++ mutex_unlock(&skt->ops_mutex);
+
++ /* now, add the new card */
++ pcmcia_bus_add(skt);
++ return 0;
++}
+
+As can be seen, the original function called pcmcia_get_socket() and
+pcmcia_put_socket() around the guts, whereas the replacement code
+calls pcmcia_put_socket() only in one path. This creates an imbalance
+in the refcounting.
+
+Testing with pcmcia_put_socket() put removed shows that the bug is gone:
+
+ dpm_suspend: c1a10998 [pcmcia_socket0] 5
+ dpm_suspend_noirq: c1a10998 [pcmcia_socket0] 5
+ dpm_resume_noirq: c1a10998 [pcmcia_socket0] 5
+ dpm_resume: c1a10998 [pcmcia_socket0] 5
+ dpm_complete: c1a10998 [pcmcia_socket0] 5
+
+Tested-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pcmcia/ds.c | 4 +---
+ 1 files changed, 1 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
+index 749c2a1..1932029 100644
+--- a/drivers/pcmcia/ds.c
++++ b/drivers/pcmcia/ds.c
+@@ -1269,10 +1269,8 @@ static int pcmcia_bus_add(struct pcmcia_socket *skt)
+
+ static int pcmcia_bus_early_resume(struct pcmcia_socket *skt)
+ {
+- if (!verify_cis_cache(skt)) {
+- pcmcia_put_socket(skt);
++ if (!verify_cis_cache(skt))
+ return 0;
+- }
+
+ dev_dbg(&skt->dev, "cis mismatch - different card\n");
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0062-ALSA-oxygen-virtuoso-fix-exchanged-L-R-volumes-of-au.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0062-ALSA-oxygen-virtuoso-fix-exchanged-L-R-volumes-of-au.patch
new file mode 100644
index 0000000..4bd7da2
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0062-ALSA-oxygen-virtuoso-fix-exchanged-L-R-volumes-of-au.patch
@@ -0,0 +1,67 @@
+From bc7e7c8b2462ed098d18bc54b431341cc69584b2 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Sat, 4 Feb 2012 20:56:47 +0100
+Subject: [PATCH 62/87] ALSA: oxygen, virtuoso: fix exchanged L/R volumes of
+ aux and CD inputs
+
+commit 2492250e4412c6411324c14ab289629360640b0a upstream.
+
+The driver accidentally exchanged the left/right fields for stereo AC'97
+mixer registers. This affected only the aux and CD inputs because the
+line input bypasses the AC'97 codec and the mic input is mono; cards
+without AC'97 (Xonar DS/DG/HDAV Slim, HG2PCI, HiFier) were not affected.
+
+Reported-and-tested-by: Abby Cedar <abbycedar@yahoo.com.au>
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/oxygen/oxygen_mixer.c | 25 ++++++++++++++-----------
+ 1 files changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/sound/pci/oxygen/oxygen_mixer.c b/sound/pci/oxygen/oxygen_mixer.c
+index 26c7e8b..c0dbb52 100644
+--- a/sound/pci/oxygen/oxygen_mixer.c
++++ b/sound/pci/oxygen/oxygen_mixer.c
+@@ -618,9 +618,12 @@ static int ac97_volume_get(struct snd_kcontrol *ctl,
+ mutex_lock(&chip->mutex);
+ reg = oxygen_read_ac97(chip, codec, index);
+ mutex_unlock(&chip->mutex);
+- value->value.integer.value[0] = 31 - (reg & 0x1f);
+- if (stereo)
+- value->value.integer.value[1] = 31 - ((reg >> 8) & 0x1f);
++ if (!stereo) {
++ value->value.integer.value[0] = 31 - (reg & 0x1f);
++ } else {
++ value->value.integer.value[0] = 31 - ((reg >> 8) & 0x1f);
++ value->value.integer.value[1] = 31 - (reg & 0x1f);
++ }
+ return 0;
+ }
+
+@@ -636,14 +639,14 @@ static int ac97_volume_put(struct snd_kcontrol *ctl,
+
+ mutex_lock(&chip->mutex);
+ oldreg = oxygen_read_ac97(chip, codec, index);
+- newreg = oldreg;
+- newreg = (newreg & ~0x1f) |
+- (31 - (value->value.integer.value[0] & 0x1f));
+- if (stereo)
+- newreg = (newreg & ~0x1f00) |
+- ((31 - (value->value.integer.value[1] & 0x1f)) << 8);
+- else
+- newreg = (newreg & ~0x1f00) | ((newreg & 0x1f) << 8);
++ if (!stereo) {
++ newreg = oldreg & ~0x1f;
++ newreg |= 31 - (value->value.integer.value[0] & 0x1f);
++ } else {
++ newreg = oldreg & ~0x1f1f;
++ newreg |= (31 - (value->value.integer.value[0] & 0x1f)) << 8;
++ newreg |= 31 - (value->value.integer.value[1] & 0x1f);
++ }
+ change = newreg != oldreg;
+ if (change)
+ oxygen_write_ac97(chip, codec, index, newreg);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0063-iommu-amd-Work-around-broken-IVRS-tables.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0063-iommu-amd-Work-around-broken-IVRS-tables.patch
new file mode 100644
index 0000000..b3b5969
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0063-iommu-amd-Work-around-broken-IVRS-tables.patch
@@ -0,0 +1,37 @@
+From 61c39c6dcc3c7b3278c611a5bdcc135a1e4d825e Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Wed, 18 Jan 2012 14:03:11 +0100
+Subject: [PATCH 63/87] iommu/amd: Work around broken IVRS tables
+
+commit af1be04901e27ce669b4ecde1c953d5c939498f5 upstream.
+
+On some systems the IVRS table does not contain all PCI
+devices present in the system. In case a device not present
+in the IVRS table is translated by the IOMMU no DMA is
+possible from that device by default.
+This patch fixes this by removing the DTE entry for every
+PCI device present in the system and not covered by IVRS.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/amd_iommu.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 4ee277a..e0b3e33 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2479,6 +2479,9 @@ static unsigned device_dma_ops_init(void)
+
+ for_each_pci_dev(pdev) {
+ if (!check_device(&pdev->dev)) {
++
++ iommu_ignore_device(&pdev->dev);
++
+ unhandled += 1;
+ continue;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0064-iommu-msm-Fix-error-handling-in-msm_iommu_unmap.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0064-iommu-msm-Fix-error-handling-in-msm_iommu_unmap.patch
new file mode 100644
index 0000000..b488d7b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0064-iommu-msm-Fix-error-handling-in-msm_iommu_unmap.patch
@@ -0,0 +1,62 @@
+From d7cd8fc525c9322ceb1f1de26d7c6201aef9d842 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Thu, 26 Jan 2012 18:25:37 +0100
+Subject: [PATCH 64/87] iommu/msm: Fix error handling in msm_iommu_unmap()
+
+commit 05df1f3c2afaef5672627f2b7095f0d4c4dbc3a0 upstream.
+
+Error handling in msm_iommu_unmap() is broken. On some error
+conditions retval is set to a non-zero value which causes
+the function to return 'len' at the end. This hides the
+error from the user. Zero should be returned in those error
+cases.
+
+Cc: David Brown <davidb@codeaurora.org>
+Cc: Stepan Moskovchenko <stepanm@codeaurora.org>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Acked-by: David Brown <davidb@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/msm_iommu.c | 7 +------
+ 1 files changed, 1 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c
+index 5865dd2..a4d134d 100644
+--- a/drivers/iommu/msm_iommu.c
++++ b/drivers/iommu/msm_iommu.c
+@@ -481,23 +481,19 @@ static int msm_iommu_unmap(struct iommu_domain *domain, unsigned long va,
+
+ priv = domain->priv;
+
+- if (!priv) {
+- ret = -ENODEV;
++ if (!priv)
+ goto fail;
+- }
+
+ fl_table = priv->pgtable;
+
+ if (len != SZ_16M && len != SZ_1M &&
+ len != SZ_64K && len != SZ_4K) {
+ pr_debug("Bad length: %d\n", len);
+- ret = -EINVAL;
+ goto fail;
+ }
+
+ if (!fl_table) {
+ pr_debug("Null page table\n");
+- ret = -EINVAL;
+ goto fail;
+ }
+
+@@ -506,7 +502,6 @@ static int msm_iommu_unmap(struct iommu_domain *domain, unsigned long va,
+
+ if (*fl_pte == 0) {
+ pr_debug("First level PTE is 0\n");
+- ret = -ENODEV;
+ goto fail;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0065-mm-compaction-check-for-overlapping-nodes-during-iso.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0065-mm-compaction-check-for-overlapping-nodes-during-iso.patch
new file mode 100644
index 0000000..1b7e90d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0065-mm-compaction-check-for-overlapping-nodes-during-iso.patch
@@ -0,0 +1,111 @@
+From a7d2576c858c397282602fe92adf8c8ac9d6a0e0 Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@suse.de>
+Date: Wed, 8 Feb 2012 17:13:38 -0800
+Subject: [PATCH 65/87] mm: compaction: check for overlapping nodes during
+ isolation for migration
+
+commit dc9086004b3d5db75997a645b3fe08d9138b7ad0 upstream.
+
+When isolating pages for migration, migration starts at the start of a
+zone while the free scanner starts at the end of the zone. Migration
+avoids entering a new zone by never going beyond the free scanned.
+
+Unfortunately, in very rare cases nodes can overlap. When this happens,
+migration isolates pages without the LRU lock held, corrupting lists
+which will trigger errors in reclaim or during page free such as in the
+following oops
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
+ IP: [<ffffffff810f795c>] free_pcppages_bulk+0xcc/0x450
+ PGD 1dda554067 PUD 1e1cb58067 PMD 0
+ Oops: 0000 [#1] SMP
+ CPU 37
+ Pid: 17088, comm: memcg_process_s Tainted: G X
+ RIP: free_pcppages_bulk+0xcc/0x450
+ Process memcg_process_s (pid: 17088, threadinfo ffff881c2926e000, task ffff881c2926c0c0)
+ Call Trace:
+ free_hot_cold_page+0x17e/0x1f0
+ __pagevec_free+0x90/0xb0
+ release_pages+0x22a/0x260
+ pagevec_lru_move_fn+0xf3/0x110
+ putback_lru_page+0x66/0xe0
+ unmap_and_move+0x156/0x180
+ migrate_pages+0x9e/0x1b0
+ compact_zone+0x1f3/0x2f0
+ compact_zone_order+0xa2/0xe0
+ try_to_compact_pages+0xdf/0x110
+ __alloc_pages_direct_compact+0xee/0x1c0
+ __alloc_pages_slowpath+0x370/0x830
+ __alloc_pages_nodemask+0x1b1/0x1c0
+ alloc_pages_vma+0x9b/0x160
+ do_huge_pmd_anonymous_page+0x160/0x270
+ do_page_fault+0x207/0x4c0
+ page_fault+0x25/0x30
+
+The "X" in the taint flag means that external modules were loaded but but
+is unrelated to the bug triggering. The real problem was because the PFN
+layout looks like this
+
+ Zone PFN ranges:
+ DMA 0x00000010 -> 0x00001000
+ DMA32 0x00001000 -> 0x00100000
+ Normal 0x00100000 -> 0x01e80000
+ Movable zone start PFN for each node
+ early_node_map[14] active PFN ranges
+ 0: 0x00000010 -> 0x0000009b
+ 0: 0x00000100 -> 0x0007a1ec
+ 0: 0x0007a354 -> 0x0007a379
+ 0: 0x0007f7ff -> 0x0007f800
+ 0: 0x00100000 -> 0x00680000
+ 1: 0x00680000 -> 0x00e80000
+ 0: 0x00e80000 -> 0x01080000
+ 1: 0x01080000 -> 0x01280000
+ 0: 0x01280000 -> 0x01480000
+ 1: 0x01480000 -> 0x01680000
+ 0: 0x01680000 -> 0x01880000
+ 1: 0x01880000 -> 0x01a80000
+ 0: 0x01a80000 -> 0x01c80000
+ 1: 0x01c80000 -> 0x01e80000
+
+The fix is straight-forward. isolate_migratepages() has to make a
+similar check to isolate_freepage to ensure that it never isolates pages
+from a zone it does not hold the LRU lock for.
+
+This was discovered in a 3.0-based kernel but it affects 3.1.x, 3.2.x
+and current mainline.
+
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Acked-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/compaction.c | 11 ++++++++++-
+ 1 files changed, 10 insertions(+), 1 deletions(-)
+
+diff --git a/mm/compaction.c b/mm/compaction.c
+index edc1e26..8fb8a40 100644
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -330,8 +330,17 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone,
+ continue;
+ nr_scanned++;
+
+- /* Get the page and skip if free */
++ /*
++ * Get the page and ensure the page is within the same zone.
++ * See the comment in isolate_freepages about overlapping
++ * nodes. It is deliberate that the new zone lock is not taken
++ * as memory compaction should not move pages between nodes.
++ */
+ page = pfn_to_page(low_pfn);
++ if (page_zone(page) != zone)
++ continue;
++
++ /* Skip if free */
+ if (PageBuddy(page))
+ continue;
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0066-mm-fix-UP-THP-spin_is_locked-BUGs.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0066-mm-fix-UP-THP-spin_is_locked-BUGs.patch
new file mode 100644
index 0000000..42d3525
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0066-mm-fix-UP-THP-spin_is_locked-BUGs.patch
@@ -0,0 +1,63 @@
+From d0a77dc1abbe11f8d14a6cce8632d85ff79f3636 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Wed, 8 Feb 2012 17:13:40 -0800
+Subject: [PATCH 66/87] mm: fix UP THP spin_is_locked BUGs
+
+commit b9980cdcf2524c5fe15d8cbae9c97b3ed6385563 upstream.
+
+Fix CONFIG_TRANSPARENT_HUGEPAGE=y CONFIG_SMP=n CONFIG_DEBUG_VM=y
+CONFIG_DEBUG_SPINLOCK=n kernel: spin_is_locked() is then always false,
+and so triggers some BUGs in Transparent HugePage codepaths.
+
+asm-generic/bug.h mentions this problem, and provides a WARN_ON_SMP(x);
+but being too lazy to add VM_BUG_ON_SMP, BUG_ON_SMP, WARN_ON_SMP_ONCE,
+VM_WARN_ON_SMP_ONCE, just test NR_CPUS != 1 in the existing VM_BUG_ONs.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/huge_memory.c | 4 ++--
+ mm/swap.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 36b3d98..33141f5 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2064,7 +2064,7 @@ static void collect_mm_slot(struct mm_slot *mm_slot)
+ {
+ struct mm_struct *mm = mm_slot->mm;
+
+- VM_BUG_ON(!spin_is_locked(&khugepaged_mm_lock));
++ VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock));
+
+ if (khugepaged_test_exit(mm)) {
+ /* free mm_slot */
+@@ -2094,7 +2094,7 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages,
+ int progress = 0;
+
+ VM_BUG_ON(!pages);
+- VM_BUG_ON(!spin_is_locked(&khugepaged_mm_lock));
++ VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock));
+
+ if (khugepaged_scan.mm_slot)
+ mm_slot = khugepaged_scan.mm_slot;
+diff --git a/mm/swap.c b/mm/swap.c
+index a91caf7..55b266d 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -667,7 +667,7 @@ void lru_add_page_tail(struct zone* zone,
+ VM_BUG_ON(!PageHead(page));
+ VM_BUG_ON(PageCompound(page_tail));
+ VM_BUG_ON(PageLRU(page_tail));
+- VM_BUG_ON(!spin_is_locked(&zone->lru_lock));
++ VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&zone->lru_lock));
+
+ SetPageLRU(page_tail);
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0067-target-Use-correct-preempted-registration-sense-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0067-target-Use-correct-preempted-registration-sense-code.patch
new file mode 100644
index 0000000..73d2839
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0067-target-Use-correct-preempted-registration-sense-code.patch
@@ -0,0 +1,59 @@
+From 1c7a78d3cf820992a6a67ea90423713fb429907f Mon Sep 17 00:00:00 2001
+From: Marco Sanvido <marco@purestorage.com>
+Date: Tue, 3 Jan 2012 17:12:57 -0800
+Subject: [PATCH 67/87] target: Use correct preempted registration sense code
+
+commit 9e08e34e3735ae057eb3834da3570995811b7eb9 upstream.
+
+The comments quote the right parts of the spec:
+
+ * d) Establish a unit attention condition for the
+ * initiator port associated with every I_T nexus
+ * that lost its registration other than the I_T
+ * nexus on which the PERSISTENT RESERVE OUT command
+ * was received, with the additional sense code set
+ * to REGISTRATIONS PREEMPTED.
+
+and
+
+ * e) Establish a unit attention condition for the initiator
+ * port associated with every I_T nexus that lost its
+ * persistent reservation and/or registration, with the
+ * additional sense code set to REGISTRATIONS PREEMPTED;
+
+but the actual code accidentally uses ASCQ_2AH_RESERVATIONS_PREEMPTED
+instead of ASCQ_2AH_REGISTRATIONS_PREEMPTED. Fix this.
+
+Signed-off-by: Marco Sanvido <marco@purestorage.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/target_core_pr.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index 95dee70..4911fe9 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -3138,7 +3138,7 @@ static int core_scsi3_pro_preempt(
+ if (!calling_it_nexus)
+ core_scsi3_ua_allocate(pr_reg_nacl,
+ pr_res_mapped_lun, 0x2A,
+- ASCQ_2AH_RESERVATIONS_PREEMPTED);
++ ASCQ_2AH_REGISTRATIONS_PREEMPTED);
+ }
+ spin_unlock(&pr_tmpl->registration_lock);
+ /*
+@@ -3251,7 +3251,7 @@ static int core_scsi3_pro_preempt(
+ * additional sense code set to REGISTRATIONS PREEMPTED;
+ */
+ core_scsi3_ua_allocate(pr_reg_nacl, pr_res_mapped_lun, 0x2A,
+- ASCQ_2AH_RESERVATIONS_PREEMPTED);
++ ASCQ_2AH_REGISTRATIONS_PREEMPTED);
+ }
+ spin_unlock(&pr_tmpl->registration_lock);
+ /*
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0068-target-Allow-PERSISTENT-RESERVE-IN-for-non-reservati.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0068-target-Allow-PERSISTENT-RESERVE-IN-for-non-reservati.patch
new file mode 100644
index 0000000..83fcdfb
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0068-target-Allow-PERSISTENT-RESERVE-IN-for-non-reservati.patch
@@ -0,0 +1,35 @@
+From 1348bc5266eb73206b11e675656051201f28949b Mon Sep 17 00:00:00 2001
+From: Marco Sanvido <marco@purestorage.com>
+Date: Tue, 3 Jan 2012 17:12:58 -0800
+Subject: [PATCH 68/87] target: Allow PERSISTENT RESERVE IN for
+ non-reservation holder
+
+commit 6816966a8418b980481b4dced7eddd1796b145e8 upstream.
+
+Initiators that aren't the active reservation holder should be able to
+do a PERSISTENT RESERVE IN command in all cases, so add it to the list
+of allowed CDBs in core_scsi3_pr_seq_non_holder().
+
+Signed-off-by: Marco Sanvido <marco@purestorage.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/target_core_pr.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index 4911fe9..9119d92 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -481,6 +481,7 @@ static int core_scsi3_pr_seq_non_holder(
+ case READ_MEDIA_SERIAL_NUMBER:
+ case REPORT_LUNS:
+ case REQUEST_SENSE:
++ case PERSISTENT_RESERVE_IN:
+ ret = 0; /*/ Allowed CDBs */
+ break;
+ default:
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0069-target-Correct-sense-key-for-INVALID-FIELD-IN-PARAME.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0069-target-Correct-sense-key-for-INVALID-FIELD-IN-PARAME.patch
new file mode 100644
index 0000000..dbbc827
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0069-target-Correct-sense-key-for-INVALID-FIELD-IN-PARAME.patch
@@ -0,0 +1,69 @@
+From f4d055fceeb62aca2303fe076d17005a662690a3 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Mon, 9 Jan 2012 17:54:00 -0800
+Subject: [PATCH 69/87] target: Correct sense key for INVALID FIELD IN
+ {PARAMETER LIST,CDB}
+
+commit 9fbc8909876a2160044e71d376848973b9bfdc3f upstream.
+
+According to SPC-4, the sense key for commands that are failed with
+INVALID FIELD IN PARAMETER LIST and INVALID FIELD IN CDB should be
+ILLEGAL REQUEST (5h) rather than ABORTED COMMAND (Bh). Without this
+patch, a tcm_loop LUN incorrectly gives:
+
+ # sg_raw -r 1 -v /dev/sda 3 1 0 0 ff 0
+ Sense Information:
+ Fixed format, current; Sense key: Aborted Command
+ Additional sense: Invalid field in cdb
+ Raw sense data (in hex):
+ 70 00 0b 00 00 00 00 0a 00 00 00 00 24 00 00 00
+ 00 00
+
+While a real SCSI disk gives:
+
+ Sense Information:
+ Fixed format, current; Sense key: Illegal Request
+ Additional sense: Invalid field in cdb
+ Raw sense data (in hex):
+ 70 00 05 00 00 00 00 18 00 00 00 00 24 00 00 00
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+
+with the main point being that the real disk gives a sense key of
+ILLEGAL REQUEST (5h).
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/target_core_transport.c | 8 ++++----
+ 1 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index e87d0eb..4f99d4c 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -4403,8 +4403,8 @@ int transport_send_check_condition_and_sense(
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
+ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+- /* ABORTED COMMAND */
+- buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
++ /* ILLEGAL REQUEST */
++ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* INVALID FIELD IN CDB */
+ buffer[offset+SPC_ASC_KEY_OFFSET] = 0x24;
+ break;
+@@ -4412,8 +4412,8 @@ int transport_send_check_condition_and_sense(
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
+ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+- /* ABORTED COMMAND */
+- buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
++ /* ILLEGAL REQUEST */
++ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* INVALID FIELD IN PARAMETER LIST */
+ buffer[offset+SPC_ASC_KEY_OFFSET] = 0x26;
+ break;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0070-target-Add-workaround-for-zero-length-control-CDB-ha.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0070-target-Add-workaround-for-zero-length-control-CDB-ha.patch
new file mode 100644
index 0000000..5eabdb9
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0070-target-Add-workaround-for-zero-length-control-CDB-ha.patch
@@ -0,0 +1,62 @@
+From f467de45d956d46c692fd6a2331f296e9e872aba Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Fri, 13 Jan 2012 12:01:34 -0800
+Subject: [PATCH 70/87] target: Add workaround for zero-length control CDB
+ handling
+
+commit 91ec1d3535b2acf12c599045cc19ad9be3c6a47b upstream.
+
+This patch adds a work-around for handling zero allocation length
+control CDBs (type SCF_SCSI_CONTROL_SG_IO_CDB) that was causing an
+OOPs with the following raw calls:
+
+ # sg_raw -v /dev/sdd 3 0 0 0 0 0
+ # sg_raw -v /dev/sdd 0x1a 0 1 0 0 0
+
+This patch will follow existing zero-length handling for data I/O
+and silently return with GOOD status. This addresses the zero length
+issue, but the proper long-term resolution for handling arbitary
+allocation lengths will be to refactor out data-phase handling in
+individual CDB emulation logic within target_core_cdb.c
+
+Reported-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/target_core_transport.c | 13 +++++++++++++
+ 1 files changed, 13 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 4f99d4c..861628e 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -3701,6 +3701,11 @@ transport_allocate_control_task(struct se_cmd *cmd)
+ struct se_task *task;
+ unsigned long flags;
+
++ /* Workaround for handling zero-length control CDBs */
++ if ((cmd->se_cmd_flags & SCF_SCSI_CONTROL_SG_IO_CDB) &&
++ !cmd->data_length)
++ return 0;
++
+ task = transport_generic_get_task(cmd, cmd->data_direction);
+ if (!task)
+ return -ENOMEM;
+@@ -3772,6 +3777,14 @@ int transport_generic_new_cmd(struct se_cmd *cmd)
+ else if (!task_cdbs && (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB)) {
+ cmd->t_state = TRANSPORT_COMPLETE;
+ atomic_set(&cmd->t_transport_active, 1);
++
++ if (cmd->t_task_cdb[0] == REQUEST_SENSE) {
++ u8 ua_asc = 0, ua_ascq = 0;
++
++ core_scsi3_ua_clear_for_request_sense(cmd,
++ &ua_asc, &ua_ascq);
++ }
++
+ INIT_WORK(&cmd->work, target_complete_ok_work);
+ queue_work(target_completion_wq, &cmd->work);
+ return 0;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0071-target-Return-correct-ASC-for-unimplemented-VPD-page.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0071-target-Return-correct-ASC-for-unimplemented-VPD-page.patch
new file mode 100644
index 0000000..3f9aff2
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0071-target-Return-correct-ASC-for-unimplemented-VPD-page.patch
@@ -0,0 +1,37 @@
+From 0e14d6b67d73aba29df97b9619e97e249a882cbe Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Tue, 17 Jan 2012 18:00:56 -0800
+Subject: [PATCH 71/87] target: Return correct ASC for unimplemented VPD pages
+
+commit bb1acb2ee038a6c13ee99e0b9fb44dacb4a9de84 upstream.
+
+My draft of SPC-4 says:
+
+ If the device server does not implement the requested vital product
+ data page, then the command shall be terminated with CHECK CONDITION
+ status, with the sense key set to ILLEGAL REQUEST, and the
+ additional sense code set to INVALID FIELD IN CDB.
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/target_core_cdb.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
+index 2e8c1be..24991f3 100644
+--- a/drivers/target/target_core_cdb.c
++++ b/drivers/target/target_core_cdb.c
+@@ -732,7 +732,7 @@ int target_emulate_inquiry(struct se_task *task)
+ }
+
+ pr_err("Unknown VPD Code: 0x%02x\n", cdb[2]);
+- cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
++ cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+ ret = -EINVAL;
+
+ out_unmap:
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0072-target-Fail-INQUIRY-commands-with-EVPD-0-but-PAGE-CO.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0072-target-Fail-INQUIRY-commands-with-EVPD-0-but-PAGE-CO.patch
new file mode 100644
index 0000000..cd102df
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0072-target-Fail-INQUIRY-commands-with-EVPD-0-but-PAGE-CO.patch
@@ -0,0 +1,43 @@
+From 95db7f1f8dee58ba87842ecd5b93e7c2884e0637 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Tue, 17 Jan 2012 18:00:57 -0800
+Subject: [PATCH 72/87] target: Fail INQUIRY commands with EVPD==0 but PAGE
+ CODE!=0
+
+commit bf0053550aebe56f3bb5dd793e9de69238b5b945 upstream.
+
+My draft of SPC-4 says:
+
+ If the PAGE CODE field is not set to zero when the EVPD bit is set
+ to zero, the command shall be terminated with CHECK CONDITION
+ status, with the sense key set to ILLEGAL REQUEST, and the
+ additional sense code set to INVALID FIELD IN CDB.
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/target_core_cdb.c | 7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
+index 24991f3..251e48f 100644
+--- a/drivers/target/target_core_cdb.c
++++ b/drivers/target/target_core_cdb.c
+@@ -701,6 +701,13 @@ int target_emulate_inquiry(struct se_task *task)
+ int p, ret;
+
+ if (!(cdb[1] & 0x1)) {
++ if (cdb[2]) {
++ pr_err("INQUIRY with EVPD==0 but PAGE CODE=%02x\n",
++ cdb[2]);
++ cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
++ return -EINVAL;
++ }
++
+ ret = target_emulate_inquiry_std(cmd);
+ goto out;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0073-Staging-asus_oled-fix-image-processing.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0073-Staging-asus_oled-fix-image-processing.patch
new file mode 100644
index 0000000..d6490da
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0073-Staging-asus_oled-fix-image-processing.patch
@@ -0,0 +1,59 @@
+From d352f16e64cab162bb25e4f6af298f1a9d1d9e12 Mon Sep 17 00:00:00 2001
+From: Pekka Paalanen <pq@iki.fi>
+Date: Sun, 22 Jan 2012 16:33:46 +0200
+Subject: [PATCH 73/87] Staging: asus_oled: fix image processing
+
+commit 635032cb397b396241372fa0ff36ae758e658b23 upstream.
+
+Programming an image was broken, because odev->buf_offs was not advanced
+for val == 0 in append_values(). This regression was introduced in:
+
+ commit 1ff12a4aa354bed093a0240d5e6347b1e27601bc
+ Author: Kevin A. Granade <kevin.granade@gmail.com>
+ Date: Sat Sep 5 01:03:39 2009 -0500
+
+ Staging: asus_oled: Cleaned up checkpatch issues.
+
+Fix the image processing by special-casing val == 0.
+
+I have tested this change on an Asus G50V laptop only.
+
+Cc: Jakub Schmidtke <sjakub@gmail.com>
+Cc: Kevin A. Granade <kevin.granade@gmail.com>
+Signed-off-by: Pekka Paalanen <pq@iki.fi>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/asus_oled/asus_oled.c | 10 ++++++++--
+ 1 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/asus_oled/asus_oled.c b/drivers/staging/asus_oled/asus_oled.c
+index 7bb7da7..8894bd5 100644
+--- a/drivers/staging/asus_oled/asus_oled.c
++++ b/drivers/staging/asus_oled/asus_oled.c
+@@ -355,7 +355,14 @@ static void send_data(struct asus_oled_dev *odev)
+
+ static int append_values(struct asus_oled_dev *odev, uint8_t val, size_t count)
+ {
+- while (count-- > 0 && val) {
++ odev->last_val = val;
++
++ if (val == 0) {
++ odev->buf_offs += count;
++ return 0;
++ }
++
++ while (count-- > 0) {
+ size_t x = odev->buf_offs % odev->width;
+ size_t y = odev->buf_offs / odev->width;
+ size_t i;
+@@ -406,7 +413,6 @@ static int append_values(struct asus_oled_dev *odev, uint8_t val, size_t count)
+ ;
+ }
+
+- odev->last_val = val;
+ odev->buf_offs++;
+ }
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0074-Staging-asus_oled-fix-NULL-ptr-crash-on-unloading.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0074-Staging-asus_oled-fix-NULL-ptr-crash-on-unloading.patch
new file mode 100644
index 0000000..43ee220
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0074-Staging-asus_oled-fix-NULL-ptr-crash-on-unloading.patch
@@ -0,0 +1,59 @@
+From ebb468b38e343782b3271343766d92978f8436a7 Mon Sep 17 00:00:00 2001
+From: Pekka Paalanen <pq@iki.fi>
+Date: Sun, 22 Jan 2012 16:33:47 +0200
+Subject: [PATCH 74/87] Staging: asus_oled: fix NULL-ptr crash on unloading
+
+commit 3589e74595a4332ebf77b5ed006f3c6686071ecd upstream.
+
+Asus_oled triggers the following bug on module unloading:
+
+ usbcore: deregistering interface driver asus-oled
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
+ IP: [<ffffffff8111292b>] sysfs_delete_link+0x30/0x66
+
+ Call Trace:
+ [<ffffffff81225373>] device_remove_class_symlinks+0x6b/0x70
+ [<ffffffff812256a8>] device_del+0x9f/0x1ab
+ [<ffffffff812257c5>] device_unregister+0x11/0x1e
+ [<ffffffffa000cb82>] asus_oled_disconnect+0x4f/0x9e [asus_oled]
+ [<ffffffff81277430>] usb_unbind_interface+0x54/0x103
+ [<ffffffff812276c4>] __device_release_driver+0xa2/0xeb
+ [<ffffffff81227794>] driver_detach+0x87/0xad
+ [<ffffffff812269e9>] bus_remove_driver+0x91/0xc1
+ [<ffffffff81227fb4>] driver_unregister+0x66/0x6e
+ [<ffffffff812771ed>] usb_deregister+0xbb/0xc4
+ [<ffffffffa000ce87>] asus_oled_exit+0x2f/0x31 [asus_oled]
+ [<ffffffff81068365>] sys_delete_module+0x1b8/0x21b
+ [<ffffffff810ae3de>] ? do_munmap+0x2ef/0x313
+ [<ffffffff813699bb>] system_call_fastpath+0x16/0x1b
+
+This is due to an incorrect destruction sequence in asus_oled_exit().
+
+Fix the order, fixes the bug. Tested on an Asus G50V laptop only.
+
+Cc: Jakub Schmidtke <sjakub@gmail.com>
+Signed-off-by: Pekka Paalanen <pq@iki.fi>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/asus_oled/asus_oled.c | 3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/asus_oled/asus_oled.c b/drivers/staging/asus_oled/asus_oled.c
+index 8894bd5..63bafbb 100644
+--- a/drivers/staging/asus_oled/asus_oled.c
++++ b/drivers/staging/asus_oled/asus_oled.c
+@@ -811,10 +811,9 @@ error:
+
+ static void __exit asus_oled_exit(void)
+ {
++ usb_deregister(&oled_driver);
+ class_remove_file(oled_class, &class_attr_version.attr);
+ class_destroy(oled_class);
+-
+- usb_deregister(&oled_driver);
+ }
+
+ module_init(asus_oled_init);
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0075-staging-r8712u-Add-new-Sitecom-UsB-ID.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0075-staging-r8712u-Add-new-Sitecom-UsB-ID.patch
new file mode 100644
index 0000000..67a862d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0075-staging-r8712u-Add-new-Sitecom-UsB-ID.patch
@@ -0,0 +1,32 @@
+From 1cbce5d4added4defb84dc19acab3efc86b1e979 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 7 Jan 2012 10:07:03 -0600
+Subject: [PATCH 75/87] staging: r8712u: Add new Sitecom UsB ID
+
+commit 1793bf1deddc8ce25dc41925d5dbe64536c841b6 upstream.
+
+Add USB ID for SITECOM WLA-1000 V1 001 WLAN
+
+Reported-and-tested-by: Roland Gruber <post@rolandgruber.de>
+Reported-and-tested-by: Dario Lucia <dario.lucia@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/rtl8712/usb_intf.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
+index 5385da2..8de0c80 100644
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -89,6 +89,7 @@ static struct usb_device_id rtl871x_usb_id_tbl[] = {
+ {USB_DEVICE(0x0DF6, 0x0045)},
+ {USB_DEVICE(0x0DF6, 0x0059)}, /* 11n mode disable */
+ {USB_DEVICE(0x0DF6, 0x004B)},
++ {USB_DEVICE(0x0DF6, 0x005B)},
+ {USB_DEVICE(0x0DF6, 0x005D)},
+ {USB_DEVICE(0x0DF6, 0x0063)},
+ /* Sweex */
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0076-staging-r8712u-Use-asynchronous-firmware-loading.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0076-staging-r8712u-Use-asynchronous-firmware-loading.patch
new file mode 100644
index 0000000..7cfd04b
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0076-staging-r8712u-Use-asynchronous-firmware-loading.patch
@@ -0,0 +1,285 @@
+From bc5d453eab4506cb52397db8830d1070904265a4 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 5 Feb 2012 21:12:26 -0600
+Subject: [PATCH 76/87] staging: r8712u: Use asynchronous firmware loading
+
+commit 8c213fa59199f9673d66970d6940fa093186642f upstream.
+
+In https://bugs.archlinux.org/task/27996, failure of driver r8712u is
+reported, with a timeout during module loading due to synchronous loading
+of the firmware. The code now uses request_firmware_nowait().
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/rtl8712/drv_types.h | 7 ++++
+ drivers/staging/rtl8712/hal_init.c | 62 +++++++++++++++++++++++----------
+ drivers/staging/rtl8712/os_intfs.c | 14 ++++++--
+ drivers/staging/rtl8712/rtl8712_hal.h | 1 +
+ drivers/staging/rtl8712/usb_intf.c | 9 +++--
+ 5 files changed, 68 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/staging/rtl8712/drv_types.h b/drivers/staging/rtl8712/drv_types.h
+index 9b5d771..ed85b44 100644
+--- a/drivers/staging/rtl8712/drv_types.h
++++ b/drivers/staging/rtl8712/drv_types.h
+@@ -37,6 +37,8 @@ struct _adapter;
+ #include "wlan_bssdef.h"
+ #include "rtl8712_spec.h"
+ #include "rtl8712_hal.h"
++#include <linux/mutex.h>
++#include <linux/completion.h>
+
+ enum _NIC_VERSION {
+ RTL8711_NIC,
+@@ -168,6 +170,7 @@ struct _adapter {
+ s32 bSurpriseRemoved;
+ u32 IsrContent;
+ u32 ImrContent;
++ bool fw_found;
+ u8 EepromAddressSize;
+ u8 hw_init_completed;
+ struct task_struct *cmdThread;
+@@ -184,6 +187,10 @@ struct _adapter {
+ _workitem wkFilterRxFF0;
+ u8 blnEnableRxFF0Filter;
+ spinlock_t lockRxFF0Filter;
++ const struct firmware *fw;
++ struct usb_interface *pusb_intf;
++ struct mutex mutex_start;
++ struct completion rtl8712_fw_ready;
+ };
+
+ static inline u8 *myid(struct eeprom_priv *peepriv)
+diff --git a/drivers/staging/rtl8712/hal_init.c b/drivers/staging/rtl8712/hal_init.c
+index d0029aa..cc893c0 100644
+--- a/drivers/staging/rtl8712/hal_init.c
++++ b/drivers/staging/rtl8712/hal_init.c
+@@ -42,29 +42,56 @@
+ #define FWBUFF_ALIGN_SZ 512
+ #define MAX_DUMP_FWSZ 49152 /*default = 49152 (48k)*/
+
+-static u32 rtl871x_open_fw(struct _adapter *padapter, void **pphfwfile_hdl,
+- const u8 **ppmappedfw)
++static void rtl871x_load_fw_cb(const struct firmware *firmware, void *context)
+ {
++ struct _adapter *padapter = context;
++
++ complete(&padapter->rtl8712_fw_ready);
++ if (!firmware) {
++ struct usb_device *udev = padapter->dvobjpriv.pusbdev;
++ struct usb_interface *pusb_intf = padapter->pusb_intf;
++ printk(KERN_ERR "r8712u: Firmware request failed\n");
++ padapter->fw_found = false;
++ usb_put_dev(udev);
++ usb_set_intfdata(pusb_intf, NULL);
++ return;
++ }
++ padapter->fw = firmware;
++ padapter->fw_found = true;
++ /* firmware available - start netdev */
++ register_netdev(padapter->pnetdev);
++}
++
++static const char firmware_file[] = "rtlwifi/rtl8712u.bin";
++
++int rtl871x_load_fw(struct _adapter *padapter)
++{
++ struct device *dev = &padapter->dvobjpriv.pusbdev->dev;
+ int rc;
+- const char firmware_file[] = "rtlwifi/rtl8712u.bin";
+- const struct firmware **praw = (const struct firmware **)
+- (pphfwfile_hdl);
+- struct dvobj_priv *pdvobjpriv = (struct dvobj_priv *)
+- (&padapter->dvobjpriv);
+- struct usb_device *pusbdev = pdvobjpriv->pusbdev;
+
++ init_completion(&padapter->rtl8712_fw_ready);
+ printk(KERN_INFO "r8712u: Loading firmware from \"%s\"\n",
+ firmware_file);
+- rc = request_firmware(praw, firmware_file, &pusbdev->dev);
+- if (rc < 0) {
+- printk(KERN_ERR "r8712u: Unable to load firmware\n");
+- printk(KERN_ERR "r8712u: Install latest linux-firmware\n");
++ rc = request_firmware_nowait(THIS_MODULE, 1, firmware_file, dev,
++ GFP_KERNEL, padapter, rtl871x_load_fw_cb);
++ if (rc)
++ printk(KERN_ERR "r8712u: Firmware request error %d\n", rc);
++ return rc;
++}
++MODULE_FIRMWARE("rtlwifi/rtl8712u.bin");
++
++static u32 rtl871x_open_fw(struct _adapter *padapter, const u8 **ppmappedfw)
++{
++ const struct firmware **praw = &padapter->fw;
++
++ if (padapter->fw->size > 200000) {
++ printk(KERN_ERR "r8172u: Badfw->size of %d\n",
++ (int)padapter->fw->size);
+ return 0;
+ }
+ *ppmappedfw = (u8 *)((*praw)->data);
+ return (*praw)->size;
+ }
+-MODULE_FIRMWARE("rtlwifi/rtl8712u.bin");
+
+ static void fill_fwpriv(struct _adapter *padapter, struct fw_priv *pfwpriv)
+ {
+@@ -142,18 +169,17 @@ static u8 rtl8712_dl_fw(struct _adapter *padapter)
+ uint dump_imem_sz, imem_sz, dump_emem_sz, emem_sz; /* max = 49152; */
+ struct fw_hdr fwhdr;
+ u32 ulfilelength; /* FW file size */
+- void *phfwfile_hdl = NULL;
+ const u8 *pmappedfw = NULL;
+ u8 *ptmpchar = NULL, *ppayload, *ptr;
+ struct tx_desc *ptx_desc;
+ u32 txdscp_sz = sizeof(struct tx_desc);
+ u8 ret = _FAIL;
+
+- ulfilelength = rtl871x_open_fw(padapter, &phfwfile_hdl, &pmappedfw);
++ ulfilelength = rtl871x_open_fw(padapter, &pmappedfw);
+ if (pmappedfw && (ulfilelength > 0)) {
+ update_fwhdr(&fwhdr, pmappedfw);
+ if (chk_fwhdr(&fwhdr, ulfilelength) == _FAIL)
+- goto firmware_rel;
++ return ret;
+ fill_fwpriv(padapter, &fwhdr.fwpriv);
+ /* firmware check ok */
+ maxlen = (fwhdr.img_IMEM_size > fwhdr.img_SRAM_size) ?
+@@ -161,7 +187,7 @@ static u8 rtl8712_dl_fw(struct _adapter *padapter)
+ maxlen += txdscp_sz;
+ ptmpchar = _malloc(maxlen + FWBUFF_ALIGN_SZ);
+ if (ptmpchar == NULL)
+- goto firmware_rel;
++ return ret;
+
+ ptx_desc = (struct tx_desc *)(ptmpchar + FWBUFF_ALIGN_SZ -
+ ((addr_t)(ptmpchar) & (FWBUFF_ALIGN_SZ - 1)));
+@@ -297,8 +323,6 @@ static u8 rtl8712_dl_fw(struct _adapter *padapter)
+
+ exit_fail:
+ kfree(ptmpchar);
+-firmware_rel:
+- release_firmware((struct firmware *)phfwfile_hdl);
+ return ret;
+ }
+
+diff --git a/drivers/staging/rtl8712/os_intfs.c b/drivers/staging/rtl8712/os_intfs.c
+index 9a75c6d..98a3d68 100644
+--- a/drivers/staging/rtl8712/os_intfs.c
++++ b/drivers/staging/rtl8712/os_intfs.c
+@@ -31,6 +31,7 @@
+ #include <linux/module.h>
+ #include <linux/init.h>
+ #include <linux/kthread.h>
++#include <linux/firmware.h>
+ #include "osdep_service.h"
+ #include "drv_types.h"
+ #include "xmit_osdep.h"
+@@ -264,12 +265,12 @@ static void start_drv_timers(struct _adapter *padapter)
+ void r8712_stop_drv_timers(struct _adapter *padapter)
+ {
+ _cancel_timer_ex(&padapter->mlmepriv.assoc_timer);
+- _cancel_timer_ex(&padapter->mlmepriv.sitesurveyctrl.
+- sitesurvey_ctrl_timer);
+ _cancel_timer_ex(&padapter->securitypriv.tkip_timer);
+ _cancel_timer_ex(&padapter->mlmepriv.scan_to_timer);
+ _cancel_timer_ex(&padapter->mlmepriv.dhcp_timer);
+ _cancel_timer_ex(&padapter->mlmepriv.wdg_timer);
++ _cancel_timer_ex(&padapter->mlmepriv.sitesurveyctrl.
++ sitesurvey_ctrl_timer);
+ }
+
+ static u8 init_default_value(struct _adapter *padapter)
+@@ -347,7 +348,8 @@ u8 r8712_free_drv_sw(struct _adapter *padapter)
+ r8712_free_mlme_priv(&padapter->mlmepriv);
+ r8712_free_io_queue(padapter);
+ _free_xmit_priv(&padapter->xmitpriv);
+- _r8712_free_sta_priv(&padapter->stapriv);
++ if (padapter->fw_found)
++ _r8712_free_sta_priv(&padapter->stapriv);
+ _r8712_free_recv_priv(&padapter->recvpriv);
+ mp871xdeinit(padapter);
+ if (pnetdev)
+@@ -388,6 +390,7 @@ static int netdev_open(struct net_device *pnetdev)
+ {
+ struct _adapter *padapter = (struct _adapter *)netdev_priv(pnetdev);
+
++ mutex_lock(&padapter->mutex_start);
+ if (padapter->bup == false) {
+ padapter->bDriverStopped = false;
+ padapter->bSurpriseRemoved = false;
+@@ -435,11 +438,13 @@ static int netdev_open(struct net_device *pnetdev)
+ /* start driver mlme relation timer */
+ start_drv_timers(padapter);
+ padapter->ledpriv.LedControlHandler(padapter, LED_CTL_NO_LINK);
++ mutex_unlock(&padapter->mutex_start);
+ return 0;
+ netdev_open_error:
+ padapter->bup = false;
+ netif_carrier_off(pnetdev);
+ netif_stop_queue(pnetdev);
++ mutex_unlock(&padapter->mutex_start);
+ return -1;
+ }
+
+@@ -473,6 +478,9 @@ static int netdev_close(struct net_device *pnetdev)
+ r8712_free_network_queue(padapter);
+ /* The interface is no longer Up: */
+ padapter->bup = false;
++ release_firmware(padapter->fw);
++ /* never exit with a firmware callback pending */
++ wait_for_completion(&padapter->rtl8712_fw_ready);
+ return 0;
+ }
+
+diff --git a/drivers/staging/rtl8712/rtl8712_hal.h b/drivers/staging/rtl8712/rtl8712_hal.h
+index 665e718..d19865a 100644
+--- a/drivers/staging/rtl8712/rtl8712_hal.h
++++ b/drivers/staging/rtl8712/rtl8712_hal.h
+@@ -145,5 +145,6 @@ struct hal_priv {
+ };
+
+ uint rtl8712_hal_init(struct _adapter *padapter);
++int rtl871x_load_fw(struct _adapter *padapter);
+
+ #endif
+diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
+index 8de0c80..9bade18 100644
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -390,6 +390,7 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
+ pdvobjpriv = &padapter->dvobjpriv;
+ pdvobjpriv->padapter = padapter;
+ padapter->dvobjpriv.pusbdev = udev;
++ padapter->pusb_intf = pusb_intf;
+ usb_set_intfdata(pusb_intf, pnetdev);
+ SET_NETDEV_DEV(pnetdev, &pusb_intf->dev);
+ /* step 2. */
+@@ -596,10 +597,11 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
+ "%pM\n", mac);
+ memcpy(pnetdev->dev_addr, mac, ETH_ALEN);
+ }
+- /* step 6. Tell the network stack we exist */
+- if (register_netdev(pnetdev) != 0)
++ /* step 6. Load the firmware asynchronously */
++ if (rtl871x_load_fw(padapter))
+ goto error;
+ spin_lock_init(&padapter->lockRxFF0Filter);
++ mutex_init(&padapter->mutex_start);
+ return 0;
+ error:
+ usb_put_dev(udev);
+@@ -630,7 +632,8 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
+ flush_scheduled_work();
+ udelay(1);
+ /*Stop driver mlme relation timer */
+- r8712_stop_drv_timers(padapter);
++ if (padapter->fw_found)
++ r8712_stop_drv_timers(padapter);
+ r871x_dev_unload(padapter);
+ r8712_free_drv_sw(padapter);
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0077-usb-ch9.h-usb_endpoint_maxp-uses-__le16_to_cpu.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0077-usb-ch9.h-usb_endpoint_maxp-uses-__le16_to_cpu.patch
new file mode 100644
index 0000000..98855bb
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0077-usb-ch9.h-usb_endpoint_maxp-uses-__le16_to_cpu.patch
@@ -0,0 +1,37 @@
+From 915cf0ec84e35d10f00166d3c9b64b12e605c792 Mon Sep 17 00:00:00 2001
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Tue, 31 Jan 2012 16:43:50 -0800
+Subject: [PATCH 77/87] usb: ch9.h: usb_endpoint_maxp() uses __le16_to_cpu()
+
+commit 9c0a835a9d9aed41bcf9c287f5069133a6e2a87b upstream.
+
+The usb/ch9.h will be installed to /usr/include/linux,
+and be used from user space.
+But le16_to_cpu() is only defined for kernel code.
+Without this patch, user space compile will be broken.
+Special thanks to Stefan Becker
+
+Reported-by: Stefan Becker <chemobejk@gmail.com>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/usb/ch9.h | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/include/linux/usb/ch9.h b/include/linux/usb/ch9.h
+index 61b2905..3b6f628 100644
+--- a/include/linux/usb/ch9.h
++++ b/include/linux/usb/ch9.h
+@@ -589,7 +589,7 @@ static inline int usb_endpoint_is_isoc_out(
+ */
+ static inline int usb_endpoint_maxp(const struct usb_endpoint_descriptor *epd)
+ {
+- return le16_to_cpu(epd->wMaxPacketSize);
++ return __le16_to_cpu(epd->wMaxPacketSize);
+ }
+
+ /*-------------------------------------------------------------------------*/
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0078-usb-gadget-zero-fix-bug-in-loopback-autoresume-handl.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0078-usb-gadget-zero-fix-bug-in-loopback-autoresume-handl.patch
new file mode 100644
index 0000000..e43e5dc
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0078-usb-gadget-zero-fix-bug-in-loopback-autoresume-handl.patch
@@ -0,0 +1,36 @@
+From d99aad98ef32d6615cef9f91aa213b8484cb4083 Mon Sep 17 00:00:00 2001
+From: Timo Juhani Lindfors <timo.lindfors@iki.fi>
+Date: Sun, 29 Jan 2012 16:12:13 +0200
+Subject: [PATCH 78/87] usb: gadget: zero: fix bug in loopback autoresume
+ handling
+
+commit 683da59d7b8ae04891636d4b59893cd4e9b0b7e5 upstream.
+
+ab943a2e125b (USB: gadget: gadget zero uses new suspend/resume hooks)
+introduced a copy-paste error where f_loopback.c writes to a variable
+declared in f_sourcesink.c. This prevents one from creating gadgets
+that only have a loopback function.
+
+Signed-off-by: Timo Juhani Lindfors <timo.lindfors@iki.fi>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/f_loopback.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/gadget/f_loopback.c b/drivers/usb/gadget/f_loopback.c
+index 6d87f28..2c0cd82 100644
+--- a/drivers/usb/gadget/f_loopback.c
++++ b/drivers/usb/gadget/f_loopback.c
+@@ -418,7 +418,7 @@ int __init loopback_add(struct usb_composite_dev *cdev, bool autoresume)
+
+ /* support autoresume for remote wakeup testing */
+ if (autoresume)
+- sourcesink_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
++ loopback_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
+
+ /* support OTG systems */
+ if (gadget_is_otg(cdev->gadget)) {
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0079-usb-Skip-PCI-USB-quirk-handling-for-Netlogic-XLP.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0079-usb-Skip-PCI-USB-quirk-handling-for-Netlogic-XLP.patch
new file mode 100644
index 0000000..d9b862f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0079-usb-Skip-PCI-USB-quirk-handling-for-Netlogic-XLP.patch
@@ -0,0 +1,45 @@
+From 0bbd5d1b0a768b0b5761643b601422dfe78fd9c5 Mon Sep 17 00:00:00 2001
+From: Jayachandran C <jayachandranc@netlogicmicro.com>
+Date: Fri, 27 Jan 2012 20:27:32 +0530
+Subject: [PATCH 79/87] usb: Skip PCI USB quirk handling for Netlogic XLP
+
+commit e4436a7c17ac2b5e138f93f83a541cba9b311685 upstream.
+
+The Netlogic XLP SoC's on-chip USB controller appears as a PCI
+USB device, but does not need the EHCI/OHCI handoff done in
+usb/host/pci-quirks.c.
+
+The pci-quirks.c is enabled for all vendors and devices, and is
+enabled if USB and PCI are configured.
+
+If we do not skip the qurik handling on XLP, the readb() call in
+ehci_bios_handoff() will cause a crash since byte access is not
+supported for EHCI registers in XLP.
+
+Signed-off-by: Jayachandran C <jayachandranc@netlogicmicro.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/pci-quirks.c | 6 ++++++
+ 1 files changed, 6 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index caf8742..ac53a66 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -867,6 +867,12 @@ hc_init:
+
+ static void __devinit quirk_usb_early_handoff(struct pci_dev *pdev)
+ {
++ /* Skip Netlogic mips SoC's internal PCI USB controller.
++ * This device does not need/support EHCI/OHCI handoff
++ */
++ if (pdev->vendor == 0x184e) /* vendor Netlogic */
++ return;
++
+ if (pdev->class == PCI_CLASS_SERIAL_USB_UHCI)
+ quirk_usb_handoff_uhci(pdev);
+ else if (pdev->class == PCI_CLASS_SERIAL_USB_OHCI)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0080-USB-usbserial-add-new-PID-number-0xa951-to-the-ftdi-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0080-USB-usbserial-add-new-PID-number-0xa951-to-the-ftdi-.patch
new file mode 100644
index 0000000..48d275f
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0080-USB-usbserial-add-new-PID-number-0xa951-to-the-ftdi-.patch
@@ -0,0 +1,45 @@
+From 294913e9df10298b440f3c8ee1df4b2d02c06f49 Mon Sep 17 00:00:00 2001
+From: Milan Kocian <milon@wq.cz>
+Date: Fri, 3 Feb 2012 14:28:00 +0100
+Subject: [PATCH 80/87] USB: usbserial: add new PID number (0xa951) to the
+ ftdi driver
+
+commit 90451e6973a5da155c6f315a409ca0a8d3ce6b76 upstream.
+
+Signed-off-by: Milan Kocian <milon@wq.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 7 +++++++
+ 2 files changed, 8 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 058b92c..f030471 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -839,6 +839,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LOGBOOKML_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LS_LOGBOOK_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_HS_LOGBOOK_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
+ { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 76d4f31..4eb7715 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1187,3 +1187,10 @@
+ */
+ /* ZigBee controller */
+ #define FTDI_RF_R106 0x8A28
++
++/*
++ * Product: HCP HIT GPRS modem
++ * Manufacturer: HCP d.o.o.
++ * ATI command output: Cinterion MC55i
++ */
++#define FTDI_CINTERION_MC55I_PID 0xA951
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0081-USB-add-new-zte-3g-dongle-s-pid-to-option.c.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0081-USB-add-new-zte-3g-dongle-s-pid-to-option.c.patch
new file mode 100644
index 0000000..82b8672
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0081-USB-add-new-zte-3g-dongle-s-pid-to-option.c.patch
@@ -0,0 +1,181 @@
+From 57c313f71800dd93f10f6641650dcb4167fa8739 Mon Sep 17 00:00:00 2001
+From: Rui li <li.rui27@zte.com.cn>
+Date: Tue, 31 Jan 2012 15:27:33 +0800
+Subject: [PATCH 81/87] USB: add new zte 3g-dongle's pid to option.c
+
+commit 1608ea5f4b5d6262cd6e808839491cfb2a67405a upstream.
+
+As ZTE have and will use more pid for new products this year,
+so we need to add some new zte 3g-dongle's pid on option.c ,
+and delete one pid 0x0154 because it use for mass-storage port.
+
+Signed-off-by: Rui li <li.rui27@zte.com.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 129 ++++++++++++++++++++++++++++++++++++++++++-
+ 1 files changed, 128 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 2a9ed6e..338d082 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -855,6 +855,18 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0083, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0087, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0088, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0089, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0090, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0091, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0092, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0093, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0095, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0096, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0097, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0098, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0099, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0105, 0xff, 0xff, 0xff) },
+@@ -883,7 +895,6 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0151, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0154, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) },
+@@ -892,6 +903,12 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0164, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
+@@ -1066,6 +1083,116 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1401, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1403, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1404, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1405, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1406, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1407, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1408, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1409, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1410, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1411, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1412, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1413, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1414, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1415, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1416, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1417, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1418, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1419, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1420, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1421, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1422, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1423, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1424, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1425, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1427, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1429, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1430, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1431, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1432, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1433, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1434, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1435, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1436, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1437, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1438, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1439, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1440, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1441, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1442, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1443, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1444, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1445, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1446, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1447, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1448, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1449, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1450, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1451, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1452, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1453, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1454, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1455, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1456, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1457, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1458, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1459, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1460, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1461, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1462, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1463, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1464, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1465, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1466, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1467, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1468, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1469, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1470, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1471, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1472, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1473, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1474, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1475, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1476, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1477, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1478, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1479, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1480, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1482, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1483, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1484, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1485, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1486, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1487, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1488, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1489, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1490, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1491, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1492, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1493, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1494, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1495, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1496, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1497, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1498, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1499, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1500, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1501, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1502, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1503, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1504, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1505, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1506, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1507, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1508, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1509, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1510, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0082-zcache-Set-SWIZ_BITS-to-8-to-reduce-tmem-bucket-lock.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0082-zcache-Set-SWIZ_BITS-to-8-to-reduce-tmem-bucket-lock.patch
new file mode 100644
index 0000000..fddd690
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0082-zcache-Set-SWIZ_BITS-to-8-to-reduce-tmem-bucket-lock.patch
@@ -0,0 +1,46 @@
+From c1efec8273372700693661f094324081d8f3ad3d Mon Sep 17 00:00:00 2001
+From: Dan Magenheimer <dan.magenheimer@oracle.com>
+Date: Mon, 23 Jan 2012 16:52:20 -0500
+Subject: [PATCH 82/87] zcache: Set SWIZ_BITS to 8 to reduce tmem bucket lock
+ contention.
+
+commit e8b4553457e78bcff90f70a31212a40a8fd4f0db upstream.
+
+SWIZ_BITS > 8 results in a much larger number of "tmem_obj"
+allocations, likely one per page-placed-in-frontswap. The
+tmem_obj is not huge (roughly 100 bytes), but it is large
+enough to add a not-insignificant memory overhead to zcache.
+
+The SWIZ_BITS=8 will get roughly the same lock contention
+without the space wastage.
+
+The effect of SWIZ_BITS can be thought of as "2^SWIZ_BITS is
+the number of unique oids that be generated" (This concept is
+limited to frontswap's use of tmem).
+
+Acked-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/zcache/zcache-main.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
+index 56c1f9c..d3a8e67 100644
+--- a/drivers/staging/zcache/zcache-main.c
++++ b/drivers/staging/zcache/zcache-main.c
+@@ -1782,9 +1782,9 @@ static int zcache_frontswap_poolid = -1;
+ * Swizzling increases objects per swaptype, increasing tmem concurrency
+ * for heavy swaploads. Later, larger nr_cpus -> larger SWIZ_BITS
+ * Setting SWIZ_BITS to 27 basically reconstructs the swap entry from
+- * frontswap_get_page()
++ * frontswap_get_page(), but has side-effects. Hence using 8.
+ */
+-#define SWIZ_BITS 27
++#define SWIZ_BITS 8
+ #define SWIZ_MASK ((1 << SWIZ_BITS) - 1)
+ #define _oswiz(_type, _ind) ((_type << SWIZ_BITS) | (_ind & SWIZ_MASK))
+ #define iswiz(_ind) (_ind >> SWIZ_BITS)
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0083-zcache-fix-deadlock-condition.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0083-zcache-fix-deadlock-condition.patch
new file mode 100644
index 0000000..c73b80a
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0083-zcache-fix-deadlock-condition.patch
@@ -0,0 +1,55 @@
+From 5c97f5b2d4924961479e862e8fe516ba217551b3 Mon Sep 17 00:00:00 2001
+From: Dan Magenheimer <dan.magenheimer@oracle.com>
+Date: Wed, 25 Jan 2012 14:32:51 -0800
+Subject: [PATCH 83/87] zcache: fix deadlock condition
+
+commit 9256a4789be3dae37d00924c03546ba7958ea5a3 upstream.
+
+I discovered this deadlock condition awhile ago working on RAMster
+but it affects zcache as well. The list spinlock must be
+locked prior to the page spinlock and released after. As
+a result, the page copy must also be done while the locks are held.
+
+Applies to 3.2. Konrad, please push (via GregKH?)...
+this is definitely a bug fix so need not be pushed during
+a -rc0 window.
+
+Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com>
+Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/zcache/zcache-main.c | 7 +++----
+ 1 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
+index d3a8e67..f5e469d 100644
+--- a/drivers/staging/zcache/zcache-main.c
++++ b/drivers/staging/zcache/zcache-main.c
+@@ -358,8 +358,8 @@ static struct zbud_hdr *zbud_create(uint16_t client_id, uint16_t pool_id,
+ if (unlikely(zbpg == NULL))
+ goto out;
+ /* ok, have a page, now compress the data before taking locks */
+- spin_lock(&zbpg->lock);
+ spin_lock(&zbud_budlists_spinlock);
++ spin_lock(&zbpg->lock);
+ list_add_tail(&zbpg->bud_list, &zbud_unbuddied[nchunks].list);
+ zbud_unbuddied[nchunks].count++;
+ zh = &zbpg->buddy[0];
+@@ -389,12 +389,11 @@ init_zh:
+ zh->oid = *oid;
+ zh->pool_id = pool_id;
+ zh->client_id = client_id;
+- /* can wait to copy the data until the list locks are dropped */
+- spin_unlock(&zbud_budlists_spinlock);
+-
+ to = zbud_data(zh, size);
+ memcpy(to, cdata, size);
+ spin_unlock(&zbpg->lock);
++ spin_unlock(&zbud_budlists_spinlock);
++
+ zbud_cumul_chunk_counts[nchunks]++;
+ atomic_inc(&zcache_zbud_curr_zpages);
+ zcache_zbud_cumul_zpages++;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0084-mmc-cb710-core-Add-missing-spin_lock_init-for-irq_lo.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0084-mmc-cb710-core-Add-missing-spin_lock_init-for-irq_lo.patch
new file mode 100644
index 0000000..7ff88b2
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0084-mmc-cb710-core-Add-missing-spin_lock_init-for-irq_lo.patch
@@ -0,0 +1,33 @@
+From 6bffce08e4d8f5daf00e3d45dad594764c3fc8f0 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@gmail.com>
+Date: Wed, 1 Feb 2012 12:31:47 +0800
+Subject: [PATCH 84/87] mmc: cb710 core: Add missing spin_lock_init for
+ irq_lock of struct cb710_chip
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit b5266ea675c5a041e2852c7ccec4cf2d4f5e0cf4 upstream.
+
+Signed-off-by: Axel Lin <axel.lin@gmail.com>
+Acked-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/cb710/core.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/misc/cb710/core.c b/drivers/misc/cb710/core.c
+index 68cd05b..85cc771 100644
+--- a/drivers/misc/cb710/core.c
++++ b/drivers/misc/cb710/core.c
+@@ -245,6 +245,7 @@ static int __devinit cb710_probe(struct pci_dev *pdev,
+ if (err)
+ return err;
+
++ spin_lock_init(&chip->irq_lock);
+ chip->pdev = pdev;
+ chip->iobase = pcim_iomap_table(pdev)[0];
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0085-powernow-k8-Avoid-Pstate-MSR-accesses-on-systems-sup.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0085-powernow-k8-Avoid-Pstate-MSR-accesses-on-systems-sup.patch
new file mode 100644
index 0000000..b00bc7d
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0085-powernow-k8-Avoid-Pstate-MSR-accesses-on-systems-sup.patch
@@ -0,0 +1,60 @@
+From af2ff521425c83a3043af8a600b62d32443031dd Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Fri, 6 Jan 2012 15:56:31 +0100
+Subject: [PATCH 85/87] powernow-k8: Avoid Pstate MSR accesses on systems
+ supporting CPB
+
+commit 201bf0f129e1715a33568d1563d9a75b840ab4d3 upstream.
+
+Due to CPB we can't directly map SW Pstates to Pstate MSRs. Get rid of
+the paranoia check. (assuming that the ACPI Pstate information is
+correct.)
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Signed-off-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/powernow-k8.c | 19 ++++++++++---------
+ 1 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
+index bce576d..e0329f9 100644
+--- a/drivers/cpufreq/powernow-k8.c
++++ b/drivers/cpufreq/powernow-k8.c
+@@ -926,23 +926,24 @@ static int fill_powernow_table_pstate(struct powernow_k8_data *data,
+ invalidate_entry(powernow_table, i);
+ continue;
+ }
+- rdmsr(MSR_PSTATE_DEF_BASE + index, lo, hi);
+- if (!(hi & HW_PSTATE_VALID_MASK)) {
+- pr_debug("invalid pstate %d, ignoring\n", index);
+- invalidate_entry(powernow_table, i);
+- continue;
+- }
+-
+- powernow_table[i].index = index;
+-
+ /* Frequency may be rounded for these */
+ if ((boot_cpu_data.x86 == 0x10 && boot_cpu_data.x86_model < 10)
+ || boot_cpu_data.x86 == 0x11) {
++
++ rdmsr(MSR_PSTATE_DEF_BASE + index, lo, hi);
++ if (!(hi & HW_PSTATE_VALID_MASK)) {
++ pr_debug("invalid pstate %d, ignoring\n", index);
++ invalidate_entry(powernow_table, i);
++ continue;
++ }
++
+ powernow_table[i].frequency =
+ freq_from_fid_did(lo & 0x3f, (lo >> 6) & 7);
+ } else
+ powernow_table[i].frequency =
+ data->acpi_data.states[i].core_frequency * 1000;
++
++ powernow_table[i].index = index;
+ }
+ return 0;
+ }
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0086-powernow-k8-Fix-indexing-issue.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0086-powernow-k8-Fix-indexing-issue.patch
new file mode 100644
index 0000000..998d0c5
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0086-powernow-k8-Fix-indexing-issue.patch
@@ -0,0 +1,86 @@
+From 8f44619e1e633884c5f0bfcf6ae05d7b0304cca3 Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Fri, 6 Jan 2012 15:57:55 +0100
+Subject: [PATCH 86/87] powernow-k8: Fix indexing issue
+
+commit a8eb28480e9b637cc78b9aa5e08612ba97e1317a upstream.
+
+The driver uses the pstate number from the status register as index in
+its table of ACPI pstates (powernow_table). This is wrong as this is
+not a 1-to-1 mapping.
+
+For example we can have _PSS information to just utilize Pstate 0 and
+Pstate 4, ie.
+
+ powernow-k8: Core Performance Boosting: on.
+ powernow-k8: 0 : pstate 0 (2200 MHz)
+ powernow-k8: 1 : pstate 4 (1400 MHz)
+
+In this example the driver's powernow_table has just 2 entries. Using
+the pstate number (4) as index into this table is just plain wrong.
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Signed-off-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/powernow-k8.c | 15 +++++++++++----
+ 1 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
+index e0329f9..ad683ec 100644
+--- a/drivers/cpufreq/powernow-k8.c
++++ b/drivers/cpufreq/powernow-k8.c
+@@ -54,6 +54,9 @@ static DEFINE_PER_CPU(struct powernow_k8_data *, powernow_data);
+
+ static int cpu_family = CPU_OPTERON;
+
++/* array to map SW pstate number to acpi state */
++static u32 ps_to_as[8];
++
+ /* core performance boost */
+ static bool cpb_capable, cpb_enabled;
+ static struct msr __percpu *msrs;
+@@ -80,9 +83,9 @@ static u32 find_khz_freq_from_fid(u32 fid)
+ }
+
+ static u32 find_khz_freq_from_pstate(struct cpufreq_frequency_table *data,
+- u32 pstate)
++ u32 pstate)
+ {
+- return data[pstate].frequency;
++ return data[ps_to_as[pstate]].frequency;
+ }
+
+ /* Return the vco fid for an input fid
+@@ -926,6 +929,9 @@ static int fill_powernow_table_pstate(struct powernow_k8_data *data,
+ invalidate_entry(powernow_table, i);
+ continue;
+ }
++
++ ps_to_as[index] = i;
++
+ /* Frequency may be rounded for these */
+ if ((boot_cpu_data.x86 == 0x10 && boot_cpu_data.x86_model < 10)
+ || boot_cpu_data.x86 == 0x11) {
+@@ -1190,7 +1196,8 @@ static int powernowk8_target(struct cpufreq_policy *pol,
+ powernow_k8_acpi_pst_values(data, newstate);
+
+ if (cpu_family == CPU_HW_PSTATE)
+- ret = transition_frequency_pstate(data, newstate);
++ ret = transition_frequency_pstate(data,
++ data->powernow_table[newstate].index);
+ else
+ ret = transition_frequency_fidvid(data, newstate);
+ if (ret) {
+@@ -1203,7 +1210,7 @@ static int powernowk8_target(struct cpufreq_policy *pol,
+
+ if (cpu_family == CPU_HW_PSTATE)
+ pol->cur = find_khz_freq_from_pstate(data->powernow_table,
+- newstate);
++ data->powernow_table[newstate].index);
+ else
+ pol->cur = find_khz_freq_from_fid(data->currfid);
+ ret = 0;
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0087-Linux-3.2.6.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0087-Linux-3.2.6.patch
new file mode 100644
index 0000000..e5754bc
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.6/0087-Linux-3.2.6.patch
@@ -0,0 +1,24 @@
+From c2db2e264bce3b5c82b8786ec3080cbe41b7114c Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 13 Feb 2012 11:17:29 -0800
+Subject: [PATCH 87/87] Linux 3.2.6
+
+---
+ Makefile | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index e9dd0ff..47fe496 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+--
+1.7.7.4
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt b/recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt
deleted file mode 100644
index 916c5c5..0000000
--- a/recipes-kernel/linux/linux-ti33x-psp-3.2/src.txt
+++ /dev/null
@@ -1,295 +0,0 @@
- file://3.2.1/0001-MAINTAINERS-stable-Update-address.patch \
- file://3.2.1/0002-Documentation-Update-stable-address.patch \
- file://3.2.1/0003-firmware-Fix-an-oops-on-reading-fw_priv-fw-in-sysfs-.patch \
- file://3.2.1/0004-rt2800usb-Move-ID-out-of-unknown.patch \
- file://3.2.1/0005-offb-Fix-setting-of-the-pseudo-palette-for-8bpp.patch \
- file://3.2.1/0006-offb-Fix-bug-in-calculating-requested-vram-size.patch \
- file://3.2.1/0007-libertas-clean-up-scan-thread-handling.patch \
- file://3.2.1/0008-bcma-support-for-suspend-and-resume.patch \
- file://3.2.1/0009-wl12xx-Validate-FEM-index-from-ini-file-and-FW.patch \
- file://3.2.1/0010-wl12xx-Check-buffer-bound-when-processing-nvs-data.patch \
- file://3.2.1/0011-wl12xx-Restore-testmode-ABI.patch \
- file://3.2.1/0012-powerpc-time-Handle-wrapping-of-decrementer.patch \
- file://3.2.1/0013-powerpc-Fix-unpaired-probe_hcall_entry-and-probe_hca.patch \
- file://3.2.1/0014-IB-qib-Fix-a-possible-data-corruption-when-receiving.patch \
- file://3.2.1/0015-IB-uverbs-Protect-QP-multicast-list.patch \
- file://3.2.1/0016-iwlagn-fix-TID-use-bug.patch \
- file://3.2.1/0017-iwlagn-fix-remove-use-of-PAGE_SIZE.patch \
- file://3.2.1/0018-perf-Fix-parsing-of-__print_flags-in-TP_printk.patch \
- file://3.2.1/0019-ore-Fix-crash-in-case-of-an-IO-error.patch \
- file://3.2.1/0020-ore-fix-BUG_ON-too-few-sgs-when-reading.patch \
- file://3.2.1/0021-ore-Must-support-none-PAGE-aligned-IO.patch \
- file://3.2.1/0022-ore-FIX-breakage-when-MISC_FILESYSTEMS-is-not-set.patch \
- file://3.2.1/0023-reiserfs-Fix-quota-mount-option-parsing.patch \
- file://3.2.1/0024-reiserfs-Force-inode-evictions-before-umount-to-avoi.patch \
- file://3.2.1/0025-ext3-Don-t-warn-from-writepage-when-readonly-inode-i.patch \
- file://3.2.1/0026-drivers-hv-Don-t-OOPS-when-you-cannot-init-vmbus.patch \
- file://3.2.1/0027-Drivers-hv-Fix-a-bug-in-vmbus_driver_unregister.patch \
- file://3.2.1/0028-USB-update-documentation-for-usbmon.patch \
- file://3.2.1/0029-usbfs-Fix-oops-related-to-user-namespace-conversion.patch \
- file://3.2.1/0030-atmel_serial-fix-spinlock-lockup-in-RS485-code.patch \
- file://3.2.1/0031-cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch \
- file://3.2.1/0032-udf-Fix-deadlock-when-converting-file-from-in-ICB-on.patch \
- file://3.2.1/0033-drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch \
- file://3.2.1/0034-USB-isight-fix-kernel-bug-when-loading-firmware.patch \
- file://3.2.1/0035-usb-usb-storage-doesn-t-support-dynamic-id-currently.patch \
- file://3.2.1/0036-USB-pxa168-Fix-compilation-error.patch \
- file://3.2.1/0037-USB-add-quirk-for-another-camera.patch \
- file://3.2.1/0038-usb-musb-fix-pm_runtime-mismatch.patch \
- file://3.2.1/0039-USB-omninet-fix-write_room.patch \
- file://3.2.1/0040-usb-option-add-ZD-Incorporated-HSPA-modem.patch \
- file://3.2.1/0041-USB-Add-USB-ID-for-Multiplex-RC-serial-adapter-to-cp.patch \
- file://3.2.1/0042-usb-fix-number-of-mapped-SG-DMA-entries.patch \
- file://3.2.1/0043-xhci-Properly-handle-COMP_2ND_BW_ERR.patch \
- file://3.2.1/0044-usb-ch9-fix-up-MaxStreams-helper.patch \
- file://3.2.1/0045-igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch \
- file://3.2.1/0046-asix-fix-infinite-loop-in-rx_fixup.patch \
- file://3.2.1/0047-bonding-fix-error-handling-if-slave-is-busy-v2.patch \
- file://3.2.1/0048-usb-cdc-acm-Fix-acm_tty_hangup-vs.-acm_tty_close-rac.patch \
- file://3.2.1/0049-xfs-fix-acl-count-validation-in-xfs_acl_from_disk.patch \
- file://3.2.1/0050-Linux-3.2.1.patch \
- file://3.2.2/0001-mtdoops-fix-the-oops_page_used-array-size.patch \
- file://3.2.2/0002-mtd-mtdoops-skip-reading-initially-bad-blocks.patch \
- file://3.2.2/0003-mtd-mtd_blkdevs-don-t-increase-open-count-on-error-p.patch \
- file://3.2.2/0004-mtd-tests-stresstest-bail-out-if-device-has-not-enou.patch \
- file://3.2.2/0005-drivers-rtc-interface.c-fix-alarm-rollover-when-day-.patch \
- file://3.2.2/0006-ext4-add-missing-ext4_resize_end-on-error-paths.patch \
- file://3.2.2/0007-ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch \
- file://3.2.2/0008-ALSA-snd-usb-us122l-Delete-calls-to-preempt_disable.patch \
- file://3.2.2/0009-ALSA-HDA-Fix-master-control-for-Cirrus-Logic-421X.patch \
- file://3.2.2/0010-ALSA-HDA-Fix-automute-for-Cirrus-Logic-421x.patch \
- file://3.2.2/0011-ALSA-ice1724-Check-for-ac97-to-avoid-kernel-oops.patch \
- file://3.2.2/0012-ALSA-usb-audio-Avoid-flood-of-frame-active-debug-mes.patch \
- file://3.2.2/0013-ALSA-hda-Use-auto-parser-for-HP-laptops-with-cx20459.patch \
- file://3.2.2/0014-ALSA-hda-Return-the-error-from-get_wcaps_type-for-in.patch \
- file://3.2.2/0015-ALSA-hda-Fix-the-detection-of-Loopback-Mixing-contro.patch \
- file://3.2.2/0016-ALSA-hda-Fix-the-lost-power-setup-of-seconary-pins-a.patch \
- file://3.2.2/0017-drm-radeon-kms-workaround-invalid-AVI-infoframe-chec.patch \
- file://3.2.2/0018-drm-radeon-kms-disable-writeback-on-pre-R300-asics.patch \
- file://3.2.2/0019-radeon-Fix-disabling-PCI-bus-mastering-on-big-endian.patch \
- file://3.2.2/0020-pnfs-obj-pNFS-errors-are-communicated-on-iodata-pnfs.patch \
- file://3.2.2/0021-pnfs-obj-Must-return-layout-on-IO-error.patch \
- file://3.2.2/0022-NFS-Retry-mounting-NFSROOT.patch \
- file://3.2.2/0023-NFSv4.1-fix-backchannel-slotid-off-by-one-bug.patch \
- file://3.2.2/0024-NFS-fix-recent-breakage-to-NFS-error-handling.patch \
- file://3.2.2/0025-NFSv4-include-bitmap-in-nfsv4-get-acl-data.patch \
- file://3.2.2/0026-nfs-fix-regression-in-handling-of-context-option-in-.patch \
- file://3.2.2/0027-HID-bump-maximum-global-item-tag-report-size-to-96-b.patch \
- file://3.2.2/0028-HID-wiimote-Select-INPUT_FF_MEMLESS.patch \
- file://3.2.2/0029-UBI-fix-missing-scrub-when-there-is-a-bit-flip.patch \
- file://3.2.2/0030-UBI-fix-use-after-free-on-error-path.patch \
- file://3.2.2/0031-PCI-Fix-PCI_EXP_TYPE_RC_EC-value.patch \
- file://3.2.2/0032-PCI-msi-Disable-msi-interrupts-when-we-initialize-a-.patch \
- file://3.2.2/0033-x86-PCI-Ignore-CPU-non-addressable-_CRS-reserved-mem.patch \
- file://3.2.2/0034-x86-PCI-amd-factor-out-MMCONFIG-discovery.patch \
- file://3.2.2/0035-x86-PCI-build-amd_bus.o-only-when-CONFIG_AMD_NB-y.patch \
- file://3.2.2/0036-SCSI-mpt2sas-Release-spinlock-for-the-raid-device-li.patch \
- file://3.2.2/0037-SCSI-mpt2sas-Fix-for-memory-allocation-error-for-lar.patch \
- file://3.2.2/0038-xen-xenbus-Reject-replies-with-payload-XENSTORE_PAYL.patch \
- file://3.2.2/0039-md-raid1-perform-bad-block-tests-for-WriteMostly-dev.patch \
- file://3.2.2/0040-ima-free-duplicate-measurement-memory.patch \
- file://3.2.2/0041-ima-fix-invalid-memory-reference.patch \
- file://3.2.2/0042-slub-fix-a-possible-memleak-in-__slab_alloc.patch \
- file://3.2.2/0043-PNP-work-around-Dell-1536-1546-BIOS-MMCONFIG-bug-tha.patch \
- file://3.2.2/0044-asix-fix-setting-custom-MAC-address-on-Asix-88178-de.patch \
- file://3.2.2/0045-asix-fix-setting-custom-MAC-address-on-Asix-88772-de.patch \
- file://3.2.2/0046-include-linux-crash_dump.h-needs-elf.h.patch \
- file://3.2.2/0047-rtl8192se-Fix-BUG-caused-by-failure-to-check-skb-all.patch \
- file://3.2.2/0048-mac80211-fix-rx-key-NULL-pointer-dereference-in-prom.patch \
- file://3.2.2/0049-ath9k-Fix-regression-in-channelwidth-switch-at-the-s.patch \
- file://3.2.2/0050-memcg-add-mem_cgroup_replace_page_cache-to-fix-LRU-i.patch \
- file://3.2.2/0051-x86-Fix-mmap-random-address-range.patch \
- file://3.2.2/0052-UBI-fix-nameless-volumes-handling.patch \
- file://3.2.2/0053-UBI-fix-debugging-messages.patch \
- file://3.2.2/0054-UBI-make-vid_hdr-non-static.patch \
- file://3.2.2/0055-UBIFS-fix-debugging-messages.patch \
- file://3.2.2/0056-UBIFS-make-debugging-messages-light-again.patch \
- file://3.2.2/0057-i2c-Fix-error-value-returned-by-several-bus-drivers.patch \
- file://3.2.2/0058-mmc-core-Fix-voltage-select-in-DDR-mode.patch \
- file://3.2.2/0059-mmc-sdhci-Fix-tuning-timer-incorrect-setting-when-su.patch \
- file://3.2.2/0060-mmc-sd-Fix-SDR12-timing-regression.patch \
- file://3.2.2/0061-V4L-DVB-v4l2-ioctl-integer-overflow-in-video_usercop.patch \
- file://3.2.2/0062-Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch \
- file://3.2.2/0063-ftrace-Fix-unregister-ftrace_ops-accounting.patch \
- file://3.2.2/0064-kconfig-streamline-config.pl-Simplify-backslash-line.patch \
- file://3.2.2/0065-kconfig-streamline-config.pl-Fix-parsing-Makefile-wi.patch \
- file://3.2.2/0066-svcrpc-fix-double-free-on-shutdown-of-nfsd-after-cha.patch \
- file://3.2.2/0067-svcrpc-destroy-server-sockets-all-at-once.patch \
- file://3.2.2/0068-svcrpc-avoid-memory-corruption-on-pool-shutdown.patch \
- file://3.2.2/0069-nfsd4-fix-lockowner-matching.patch \
- file://3.2.2/0070-nfsd-Fix-oops-when-parsing-a-0-length-export.patch \
- file://3.2.2/0071-fsnotify-don-t-BUG-in-fsnotify_destroy_mark.patch \
- file://3.2.2/0072-x86-UV-Update-Boot-messages-for-SGI-UV2-platform.patch \
- file://3.2.2/0073-recordmcount-Fix-handling-of-elf64-big-endian-object.patch \
- file://3.2.2/0074-uvcvideo-Fix-integer-overflow-in-uvc_ioctl_ctrl_map.patch \
- file://3.2.2/0075-dcache-use-a-dispose-list-in-select_parent.patch \
- file://3.2.2/0076-fix-shrink_dcache_parent-livelock.patch \
- file://3.2.2/0077-pnfsblock-acquire-im_lock-in-_preload_range.patch \
- file://3.2.2/0078-pnfsblock-don-t-spinlock-when-freeing-block_dev.patch \
- file://3.2.2/0079-pnfsblock-limit-bio-page-count.patch \
- file://3.2.2/0080-mac80211-revert-on-channel-work-optimisations.patch \
- file://3.2.2/0081-HID-hid-multitouch-add-another-eGalax-id.patch \
- file://3.2.2/0082-HID-multitouch-cleanup-with-eGalax-PID-definitions.patch \
- file://3.2.2/0083-HID-multitouch-Add-egalax-ID-for-Acer-Iconia-W500.patch \
- file://3.2.2/0084-HID-multitouch-add-support-for-the-MSI-Windpad-110W.patch \
- file://3.2.2/0085-HID-hid-multitouch-add-support-for-new-Hanvon-panels.patch \
- file://3.2.2/0086-HID-multitouch-add-support-of-Atmel-multitouch-panel.patch \
- file://3.2.2/0087-HID-multitouch-add-support-for-3M-32.patch \
- file://3.2.2/0088-HID-hid-multitouch-add-support-9-new-Xiroku-devices.patch \
- file://3.2.2/0089-fix-cputime-overflow-in-uptime_proc_show.patch \
- file://3.2.2/0090-block-add-and-use-scsi_blk_cmd_ioctl.patch \
- file://3.2.2/0091-block-fail-SCSI-passthrough-ioctls-on-partition-devi.patch \
- file://3.2.2/0092-dm-do-not-forward-ioctls-from-logical-volumes-to-the.patch \
- file://3.2.2/0093-proc-clean-up-and-fix-proc-pid-mem-handling.patch \
- file://3.2.2/0094-ALSA-HDA-Use-LPIB-position-fix-for-Macbook-Pro-7-1.patch \
- file://3.2.2/0095-ALSA-virtuoso-Xonar-DS-fix-polarity-of-front-output.patch \
- file://3.2.2/0096-ALSA-HDA-Fix-internal-microphone-on-Dell-Studio-16-X.patch \
- file://3.2.2/0097-TOMOYO-Accept-000-as-a-valid-character.patch \
- file://3.2.2/0098-intel-idle-Make-idle-driver-more-robust.patch \
- file://3.2.2/0099-intel_idle-fix-API-misuse.patch \
- file://3.2.2/0100-ACPI-Store-SRAT-table-revision.patch \
- file://3.2.2/0101-ACPI-x86-Use-SRAT-table-rev-to-use-8bit-or-32bit-PXM.patch \
- file://3.2.2/0102-ACPI-ia64-Use-SRAT-table-rev-to-use-8bit-or-16-32bit.patch \
- file://3.2.2/0103-ACPICA-Put-back-the-call-to-acpi_os_validate_address.patch \
- file://3.2.2/0104-ACPI-processor-fix-acpi_get_cpuid-for-UP-processor.patch \
- file://3.2.2/0105-sym53c8xx-Fix-NULL-pointer-dereference-in-slave_dest.patch \
- file://3.2.2/0106-target-Set-response-format-in-INQUIRY-response.patch \
- file://3.2.2/0107-target-Set-additional-sense-length-field-in-sense-da.patch \
- file://3.2.2/0108-bcma-invalidate-the-mapped-core-over-suspend-resume.patch \
- file://3.2.2/0109-cx23885-dvb-check-if-dvb_attach-succeded.patch \
- file://3.2.2/0110-cx88-fix-don-t-duplicate-xc4000-entry-for-radio.patch \
- file://3.2.2/0111-tuner-Fix-numberspace-conflict-between-xc4000-and-pt.patch \
- file://3.2.2/0112-tracepoints-module-Fix-disabling-tracepoints-with-ta.patch \
- file://3.2.2/0113-I2C-OMAP-correct-SYSC-register-offset-for-OMAP4.patch \
- file://3.2.2/0114-x86-UV2-Fix-new-UV2-hardware-by-using-native-UV2-bro.patch \
- file://3.2.2/0115-x86-UV2-Fix-BAU-destination-timeout-initialization.patch \
- file://3.2.2/0116-x86-UV2-Work-around-BAU-bug.patch \
- file://3.2.2/0117-ath9k_hw-fix-interpretation-of-the-rx-KeyMiss-flag.patch \
- file://3.2.2/0118-rt2800pci-fix-spurious-interrupts-generation.patch \
- file://3.2.2/0119-xfs-fix-endian-conversion-issue-in-discard-code.patch \
- file://3.2.2/0120-i2c-eg20t-modified-the-setting-of-transfer-rate.patch \
- file://3.2.2/0121-score-fix-off-by-one-index-into-syscall-table.patch \
- file://3.2.2/0122-cifs-lower-default-wsize-when-unix-extensions-are-no.patch \
- file://3.2.2/0123-kprobes-initialize-before-using-a-hlist.patch \
- file://3.2.2/0124-proc-clear_refs-do-not-clear-reserved-pages.patch \
- file://3.2.2/0125-mm-fix-NULL-ptr-dereference-in-__count_immobile_page.patch \
- file://3.2.2/0126-iwlagn-check-for-SMPS-mode.patch \
- file://3.2.2/0127-iwlegacy-3945-fix-hw-passive-scan-on-radar-channels.patch \
- file://3.2.2/0128-SHM_UNLOCK-fix-long-unpreemptible-section.patch \
- file://3.2.2/0129-SHM_UNLOCK-fix-Unevictable-pages-stranded-after-swap.patch \
- file://3.2.2/0130-Linux-3.2.2.patch \
- file://3.2.3/0001-ALSA-hda-Fix-buffer-alignment-regression-with-Nvidia.patch \
- file://3.2.3/0002-ALSA-hda-Fix-silent-outputs-from-docking-station-jac.patch \
- file://3.2.3/0003-eCryptfs-Sanitize-write-counts-of-dev-ecryptfs.patch \
- file://3.2.3/0004-ecryptfs-Improve-metadata-read-failure-logging.patch \
- file://3.2.3/0005-eCryptfs-Make-truncate-path-killable.patch \
- file://3.2.3/0006-eCryptfs-Check-inode-changes-in-setattr.patch \
- file://3.2.3/0007-eCryptfs-Fix-oops-when-printing-debug-info-in-extent.patch \
- file://3.2.3/0008-drm-radeon-kms-Add-an-MSI-quirk-for-Dell-RS690.patch \
- file://3.2.3/0009-drm-radeon-kms-move-panel-mode-setup-into-encoder-mo.patch \
- file://3.2.3/0010-drm-radeon-kms-rework-modeset-sequence-for-DCE41-and.patch \
- file://3.2.3/0011-drm-Fix-authentication-kernel-crash.patch \
- file://3.2.3/0012-xfs-Fix-missing-xfs_iunlock-on-error-recovery-path-i.patch \
- file://3.2.3/0013-ASoC-Mark-WM5100-register-map-cache-only-when-going-.patch \
- file://3.2.3/0014-ASoC-Disable-register-synchronisation-for-low-freque.patch \
- file://3.2.3/0015-ASoC-Don-t-go-through-cache-when-applying-WM5100-rev.patch \
- file://3.2.3/0016-ASoC-wm8996-Call-_POST_PMU-callback-for-CPVDD.patch \
- file://3.2.3/0017-brcmsmac-fix-tx-queue-flush-infinite-loop.patch \
- file://3.2.3/0018-mac80211-fix-work-removal-on-deauth-request.patch \
- file://3.2.3/0019-jbd-Issue-cache-flush-after-checkpointing.patch \
- file://3.2.3/0020-crypto-sha512-make-it-work-undo-percpu-message-sched.patch \
- file://3.2.3/0021-crypto-sha512-reduce-stack-usage-to-safe-number.patch \
- file://3.2.3/0022-tpm_tis-add-delay-after-aborting-command.patch \
- file://3.2.3/0023-x86-uv-Fix-uninitialized-spinlocks.patch \
- file://3.2.3/0024-x86-uv-Fix-uv_gpa_to_soc_phys_ram-shift.patch \
- file://3.2.3/0025-x86-microcode_amd-Add-support-for-CPU-family-specifi.patch \
- file://3.2.3/0026-m68k-Fix-assembler-constraint-to-prevent-overeager-g.patch \
- file://3.2.3/0027-ALSA-hda-set-mute-led-polarity-for-laptops-with-bugg.patch \
- file://3.2.3/0028-ALSA-hda-Fix-silent-output-on-ASUS-A6Rp.patch \
- file://3.2.3/0029-ALSA-hda-Fix-silent-output-on-Haier-W18-laptop.patch \
- file://3.2.3/0030-drm-i915-paper-over-missed-irq-issues-with-force-wak.patch \
- file://3.2.3/0031-drm-i915-sdvo-always-set-positive-sync-polarity.patch \
- file://3.2.3/0032-drm-i915-Re-enable-gen7-RC6-and-GPU-turbo-after-resu.patch \
- file://3.2.3/0033-ARM-at91-fix-at91rm9200-soc-subtype-handling.patch \
- file://3.2.3/0034-mach-ux500-enable-ARM-errata-764369.patch \
- file://3.2.3/0035-ARM-7296-1-proc-v7.S-remove-HARVARD_CACHE-preprocess.patch \
- file://3.2.3/0036-sysfs-Complain-bitterly-about-attempts-to-remove-fil.patch \
- file://3.2.3/0037-x86-xen-size-struct-xen_spinlock-to-always-fit-in-ar.patch \
- file://3.2.3/0038-mpt2sas-Removed-redundant-calling-of-_scsih_probe_de.patch \
- file://3.2.3/0039-USB-option-Add-LG-docomo-L-02C.patch \
- file://3.2.3/0040-USB-ftdi_sio-fix-TIOCSSERIAL-baud_base-handling.patch \
- file://3.2.3/0041-USB-ftdi_sio-fix-initial-baud-rate.patch \
- file://3.2.3/0042-USB-ftdi_sio-add-PID-for-TI-XDS100v2-BeagleBone-A3.patch \
- file://3.2.3/0043-USB-serial-ftdi-additional-IDs.patch \
- file://3.2.3/0044-USB-ftdi_sio-Add-more-identifiers.patch \
- file://3.2.3/0045-USB-cdc-wdm-updating-desc-length-must-be-protected-b.patch \
- file://3.2.3/0046-USB-cdc-wdm-use-two-mutexes-to-allow-simultaneous-re.patch \
- file://3.2.3/0047-qcaux-add-more-Pantech-UML190-and-UML290-ports.patch \
- file://3.2.3/0048-usb-dwc3-ep0-tidy-up-Pending-Request-handling.patch \
- file://3.2.3/0049-usb-io_ti-Make-edge_remove_sysfs_attrs-the-port_remo.patch \
- file://3.2.3/0050-TTY-fix-UV-serial-console-regression.patch \
- file://3.2.3/0051-serial-amba-pl011-lock-console-writes-against-interr.patch \
- file://3.2.3/0052-jsm-Fixed-EEH-recovery-error.patch \
- file://3.2.3/0053-iwlwifi-fix-PCI-E-transport-inta-race.patch \
- file://3.2.3/0054-vmwgfx-Fix-assignment-in-vmw_framebuffer_create_hand.patch \
- file://3.2.3/0055-USB-Realtek-cr-fix-autopm-scheduling-while-atomic.patch \
- file://3.2.3/0056-USB-usbsevseg-fix-max-length.patch \
- file://3.2.3/0057-usb-gadget-langwell-don-t-call-gadget-s-disconnect.patch \
- file://3.2.3/0058-usb-gadget-storage-endian-fix.patch \
- file://3.2.3/0059-drivers-usb-host-ehci-fsl.c-add-missing-iounmap.patch \
- file://3.2.3/0060-xhci-Fix-USB-3.0-device-restart-on-resume.patch \
- file://3.2.3/0061-xHCI-Cleanup-isoc-transfer-ring-when-TD-length-misma.patch \
- file://3.2.3/0062-usb-musb-davinci-fix-build-breakage.patch \
- file://3.2.3/0063-hwmon-f71805f-Fix-clamping-of-temperature-limits.patch \
- file://3.2.3/0064-hwmon-w83627ehf-Disable-setting-DC-mode-for-pwm2-pwm.patch \
- file://3.2.3/0065-hwmon-sht15-fix-bad-error-code.patch \
- file://3.2.3/0066-USB-cdc-wdm-call-wake_up_all-to-allow-driver-to-shut.patch \
- file://3.2.3/0067-USB-cdc-wdm-better-allocate-a-buffer-that-is-at-leas.patch \
- file://3.2.3/0068-USB-cdc-wdm-Avoid-hanging-on-interface-with-no-USB_C.patch \
- file://3.2.3/0069-netns-fix-net_alloc_generic.patch \
- file://3.2.3/0070-netns-Fail-conspicously-if-someone-uses-net_generic-.patch \
- file://3.2.3/0071-net-caif-Register-properly-as-a-pernet-subsystem.patch \
- file://3.2.3/0072-af_unix-fix-EPOLLET-regression-for-stream-sockets.patch \
- file://3.2.3/0073-bonding-fix-enslaving-in-alb-mode-when-link-down.patch \
- file://3.2.3/0074-l2tp-l2tp_ip-fix-possible-oops-on-packet-receive.patch \
- file://3.2.3/0075-macvlan-fix-a-possible-use-after-free.patch \
- file://3.2.3/0076-net-bpf_jit-fix-divide-by-0-generation.patch \
- file://3.2.3/0077-net-reintroduce-missing-rcu_assign_pointer-calls.patch \
- file://3.2.3/0078-rds-Make-rds_sock_lock-BH-rather-than-IRQ-safe.patch \
- file://3.2.3/0079-tcp-fix-tcp_trim_head-to-adjust-segment-count-with-s.patch \
- file://3.2.3/0080-tcp-md5-using-remote-adress-for-md5-lookup-in-rst-pa.patch \
- file://3.2.3/0081-USB-serial-CP210x-Added-USB-ID-for-the-Link-Instrume.patch \
- file://3.2.3/0082-USB-cp210x-call-generic-open-last-in-open.patch \
- file://3.2.3/0083-USB-cp210x-fix-CP2104-baudrate-usage.patch \
- file://3.2.3/0084-USB-cp210x-do-not-map-baud-rates-to-B0.patch \
- file://3.2.3/0085-USB-cp210x-fix-up-set_termios-variables.patch \
- file://3.2.3/0086-USB-cp210x-clean-up-refactor-and-document-speed-hand.patch \
- file://3.2.3/0087-USB-cp210x-initialise-baud-rate-at-open.patch \
- file://3.2.3/0088-USB-cp210x-allow-more-baud-rates-above-1Mbaud.patch \
- file://3.2.3/0089-mach-ux500-no-MMC_CAP_SD_HIGHSPEED-on-Snowball.patch \
- file://3.2.3/0090-Linux-3.2.3.patch \
- file://3.2.4/0001-Revert-ASoC-Mark-WM5100-register-map-cache-only-when.patch \
- file://3.2.4/0002-Revert-ASoC-Don-t-go-through-cache-when-applying-WM5.patch \
- file://3.2.4/0003-Linux-3.2.4.patch \
- file://3.2.5/0001-PCI-Rework-ASPM-disable-code.patch \
- file://3.2.5/0002-Linux-3.2.5.patch \
- file://0002-f_rndis-HACK-around-undefined-variables.patch \
- file://0003-da8xx-fb-add-DVI-support-for-beaglebone.patch \
- file://0004-beaglebone-rebase-everything-onto-3.2-WARNING-MEGAPA.patch \
- file://0005-more-beaglebone-merges.patch \
- file://0006-beaglebone-disable-tsadc.patch \
- file://0007-tscadc-Add-general-purpose-mode-untested-with-touchs.patch \
- file://0008-tscadc-Add-board-file-mfd-support-fix-warning.patch \
- file://0009-AM335X-init-tsc-bone-style-for-new-boards.patch \
- file://0010-tscadc-make-stepconfig-channel-configurable.patch \
- file://0011-tscadc-Trigger-through-sysfs.patch \
- file://0012-meta-ti-Remove-debug-messages-for-meta-ti.patch \
- file://0013-tscadc-switch-to-polling-instead-of-interrupts.patch \
- file://0014-beaglebone-fix-ADC-init.patch \
- file://0015-AM335x-MUX-add-ehrpwm1A.patch \
- file://0016-beaglebone-enable-PWM-for-lcd-backlight-backlight-is.patch \
- file://0017-omap_hsmmc-Set-dto-to-max-value-of-14-to-avoid-SD-Ca.patch \
- file://0018-beaglebone-set-default-brightness-to-50-for-pwm-back.patch \
- file://0019-st7735fb-WIP-framebuffer-driver-supporting-Adafruit-.patch \
- file://0020-beaglebone-use-P8_6-gpio1_3-as-w1-bus.patch \
- file://0021-beaglebone-add-support-for-Towertech-TT3201-CAN-cape.patch \
diff --git a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
index 33ae9bd..42a606d 100644
--- a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
+++ b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
@@ -299,6 +299,93 @@ PATCHES_OVER_PSP = " \
file://3.2.4/0003-Linux-3.2.4.patch \
file://3.2.5/0001-PCI-Rework-ASPM-disable-code.patch \
file://3.2.5/0002-Linux-3.2.5.patch \
+ file://3.2.6/0001-readahead-fix-pipeline-break-caused-by-block-plug.patch \
+ file://3.2.6/0002-ALSA-hda-Fix-the-logic-to-detect-VIA-analog-low-curr.patch \
+ file://3.2.6/0003-ALSA-HDA-Remove-quirk-for-Asus-N53Jq.patch \
+ file://3.2.6/0004-ALSA-hda-Apply-0x0f-VREF-fix-to-all-ASUS-laptops-wit.patch \
+ file://3.2.6/0005-ALSA-hda-Fix-calling-cs_automic-twice-for-Cirrus-cod.patch \
+ file://3.2.6/0006-ALSA-hda-Allow-analog-low-current-mode-when-dynamic-.patch \
+ file://3.2.6/0007-ALSA-HDA-Fix-duplicated-output-to-more-than-one-code.patch \
+ file://3.2.6/0008-ALSA-hda-Disable-dynamic-power-control-for-VIA-as-de.patch \
+ file://3.2.6/0009-ASoC-wm_hubs-Enable-line-out-VMID-buffer-for-single-.patch \
+ file://3.2.6/0010-ASoC-wm_hubs-fix-wrong-bits-for-LINEOUT2-N-P-mixer.patch \
+ file://3.2.6/0011-ARM-7306-1-vfp-flush-thread-hwstate-before-restoring.patch \
+ file://3.2.6/0012-ARM-7307-1-vfp-fix-ptrace-regset-modification-race.patch \
+ file://3.2.6/0013-ARM-7308-1-vfp-flush-thread-hwstate-before-copying-p.patch \
+ file://3.2.6/0014-ARM-OMAP2-GPMC-fix-device-size-setup.patch \
+ file://3.2.6/0015-drivers-tty-vt-vt_ioctl.c-fix-KDFONTOP-32bit-compati.patch \
+ file://3.2.6/0016-proc-mem_release-should-check-mm-NULL.patch \
+ file://3.2.6/0017-proc-unify-mem_read-and-mem_write.patch \
+ file://3.2.6/0018-proc-make-sure-mem_open-doesn-t-pin-the-target-s-mem.patch \
+ file://3.2.6/0019-firewire-ohci-add-reset-packet-quirk-for-SB-Audigy.patch \
+ file://3.2.6/0020-firewire-ohci-disable-MSI-on-Ricoh-controllers.patch \
+ file://3.2.6/0021-IB-mlx4-pass-SMP-vendor-specific-attribute-MADs-to-f.patch \
+ file://3.2.6/0022-RDMA-core-Fix-kernel-panic-by-always-initializing-qp.patch \
+ file://3.2.6/0023-kprobes-fix-a-memory-leak-in-function-pre_handler_kr.patch \
+ file://3.2.6/0024-mtd-gpmi-nand-bugfix-reset-the-BCH-module-when-it-is.patch \
+ file://3.2.6/0025-Revert-mtd-atmel_nand-optimize-read-write-buffer-fun.patch \
+ file://3.2.6/0026-at_hdmac-bugfix-for-enabling-channel-irq.patch \
+ file://3.2.6/0027-mm-filemap_xip.c-fix-race-condition-in-xip_file_faul.patch \
+ file://3.2.6/0028-mm-compaction-check-pfn_valid-when-entering-a-new-MA.patch \
+ file://3.2.6/0029-PM-Hibernate-Fix-s2disk-regression-related-to-freezi.patch \
+ file://3.2.6/0030-PM-QoS-CPU-C-state-breakage-with-PM-Qos-change.patch \
+ file://3.2.6/0031-drm-radeon-Set-DESKTOP_HEIGHT-register-to-the-frameb.patch \
+ file://3.2.6/0032-drm-nouveau-gem-fix-fence_sync-race-oops.patch \
+ file://3.2.6/0033-drm-radeon-kms-disable-output-polling-when-suspended.patch \
+ file://3.2.6/0034-drm-radeon-kms-fix-TRAVIS-panel-setup.patch \
+ file://3.2.6/0035-sched-rt-Fix-task-stack-corruption-under-__ARCH_WANT.patch \
+ file://3.2.6/0036-PM-Hibernate-Thaw-processes-in-SNAPSHOT_CREATE_IMAGE.patch \
+ file://3.2.6/0037-PM-Hibernate-Thaw-kernel-threads-in-SNAPSHOT_CREATE_.patch \
+ file://3.2.6/0038-8139cp-fix-missing-napi_gro_flush.patch \
+ file://3.2.6/0039-udf-Mark-LVID-buffer-as-uptodate-before-marking-it-d.patch \
+ file://3.2.6/0040-drm-i915-HDMI-hot-remove-notification-to-audio-drive.patch \
+ file://3.2.6/0041-drm-i915-DisplayPort-hot-remove-notification-to-audi.patch \
+ file://3.2.6/0042-drm-i915-check-ACTHD-of-all-rings.patch \
+ file://3.2.6/0043-drm-i915-Fix-TV-Out-refresh-rate.patch \
+ file://3.2.6/0044-drm-i915-handle-3rd-pipe.patch \
+ file://3.2.6/0045-drm-i915-convert-force_wake_get-to-func-pointer-in-t.patch \
+ file://3.2.6/0046-drm-i915-protect-force_wake_-get-put-with-the-gt_loc.patch \
+ file://3.2.6/0047-eCryptfs-Infinite-loop-due-to-overflow-in-ecryptfs_w.patch \
+ file://3.2.6/0048-hwmon-w83627ehf-Fix-number-of-fans-for-NCT6776F.patch \
+ file://3.2.6/0049-cifs-Fix-oops-in-session-setup-code-for-null-user-mo.patch \
+ file://3.2.6/0050-atmel_lcdfb-fix-usage-of-CONTRAST_CTR-in-suspend-res.patch \
+ file://3.2.6/0051-lockdep-bug-Exclude-TAINT_FIRMWARE_WORKAROUND-from-d.patch \
+ file://3.2.6/0052-lockdep-bug-Exclude-TAINT_OOT_MODULE-from-disabling-.patch \
+ file://3.2.6/0053-iscsi-target-Fix-reject-release-handling-in-iscsit_f.patch \
+ file://3.2.6/0054-iscsi-target-Fix-double-list_add-with-iscsit_alloc_b.patch \
+ file://3.2.6/0055-iscsi-target-Fix-discovery-with-INADDR_ANY-and-IN6AD.patch \
+ file://3.2.6/0056-ASoC-wm_hubs-Fix-routing-of-input-PGAs-to-line-outpu.patch \
+ file://3.2.6/0057-ASoC-wm_hubs-Correct-line-input-to-line-output-2-pat.patch \
+ file://3.2.6/0058-ASoC-wm8962-Fix-word-length-configuration.patch \
+ file://3.2.6/0059-ASoC-wm8994-Enabling-VMID-should-take-a-runtime-PM-r.patch \
+ file://3.2.6/0060-ASoC-wm8994-Fix-typo-in-VMID-ramp-setting.patch \
+ file://3.2.6/0061-pcmcia-fix-socket-refcount-decrementing-on-each-resu.patch \
+ file://3.2.6/0062-ALSA-oxygen-virtuoso-fix-exchanged-L-R-volumes-of-au.patch \
+ file://3.2.6/0063-iommu-amd-Work-around-broken-IVRS-tables.patch \
+ file://3.2.6/0064-iommu-msm-Fix-error-handling-in-msm_iommu_unmap.patch \
+ file://3.2.6/0065-mm-compaction-check-for-overlapping-nodes-during-iso.patch \
+ file://3.2.6/0066-mm-fix-UP-THP-spin_is_locked-BUGs.patch \
+ file://3.2.6/0067-target-Use-correct-preempted-registration-sense-code.patch \
+ file://3.2.6/0068-target-Allow-PERSISTENT-RESERVE-IN-for-non-reservati.patch \
+ file://3.2.6/0069-target-Correct-sense-key-for-INVALID-FIELD-IN-PARAME.patch \
+ file://3.2.6/0070-target-Add-workaround-for-zero-length-control-CDB-ha.patch \
+ file://3.2.6/0071-target-Return-correct-ASC-for-unimplemented-VPD-page.patch \
+ file://3.2.6/0072-target-Fail-INQUIRY-commands-with-EVPD-0-but-PAGE-CO.patch \
+ file://3.2.6/0073-Staging-asus_oled-fix-image-processing.patch \
+ file://3.2.6/0074-Staging-asus_oled-fix-NULL-ptr-crash-on-unloading.patch \
+ file://3.2.6/0075-staging-r8712u-Add-new-Sitecom-UsB-ID.patch \
+ file://3.2.6/0076-staging-r8712u-Use-asynchronous-firmware-loading.patch \
+ file://3.2.6/0077-usb-ch9.h-usb_endpoint_maxp-uses-__le16_to_cpu.patch \
+ file://3.2.6/0078-usb-gadget-zero-fix-bug-in-loopback-autoresume-handl.patch \
+ file://3.2.6/0079-usb-Skip-PCI-USB-quirk-handling-for-Netlogic-XLP.patch \
+ file://3.2.6/0080-USB-usbserial-add-new-PID-number-0xa951-to-the-ftdi-.patch \
+ file://3.2.6/0081-USB-add-new-zte-3g-dongle-s-pid-to-option.c.patch \
+ file://3.2.6/0082-zcache-Set-SWIZ_BITS-to-8-to-reduce-tmem-bucket-lock.patch \
+ file://3.2.6/0083-zcache-fix-deadlock-condition.patch \
+ file://3.2.6/0084-mmc-cb710-core-Add-missing-spin_lock_init-for-irq_lo.patch \
+ file://3.2.6/0085-powernow-k8-Avoid-Pstate-MSR-accesses-on-systems-sup.patch \
+ file://3.2.6/0086-powernow-k8-Fix-indexing-issue.patch \
+ file://3.2.6/0087-Linux-3.2.6.patch \
file://0002-f_rndis-HACK-around-undefined-variables.patch \
file://0003-da8xx-fb-add-DVI-support-for-beaglebone.patch \
file://0004-beaglebone-rebase-everything-onto-3.2-WARNING-MEGAPA.patch \
--
1.7.2.5
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [BeagleBone][PATCH v3 04/11] linux 3.0: update from 3.0.17 to 3.0.22
2012-02-27 13:40 [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 02/11] linux-ti33x-psp 3.2: update to 3.2.5 Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 03/11] linux-ti335x-psp 3.2: update to 3.2.6 Koen Kooi
@ 2012-02-27 13:40 ` Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 05/11] u-boot 2011.09: add patch to support 'cold' AM335x silicon Koen Kooi
` (7 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Koen Kooi @ 2012-02-27 13:40 UTC (permalink / raw)
To: meta-ti
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
conf/machine/include/omap3.inc | 2 +-
recipes-kernel/linux/linux_3.0.bb | 8 ++++----
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/conf/machine/include/omap3.inc b/conf/machine/include/omap3.inc
index f415864..b7d23af 100644
--- a/conf/machine/include/omap3.inc
+++ b/conf/machine/include/omap3.inc
@@ -3,7 +3,7 @@ SOC_FAMILY = "omap3"
require conf/machine/include/tune-cortexa8.inc
PREFERRED_PROVIDER_virtual/kernel = "linux-omap"
# Increase this everytime you change something in the kernel
-MACHINE_KERNEL_PR = "r115"
+MACHINE_KERNEL_PR = "r116"
KERNEL_IMAGETYPE = "uImage"
diff --git a/recipes-kernel/linux/linux_3.0.bb b/recipes-kernel/linux/linux_3.0.bb
index d62c1ea..65084fb 100644
--- a/recipes-kernel/linux/linux_3.0.bb
+++ b/recipes-kernel/linux/linux_3.0.bb
@@ -5,12 +5,12 @@ KERNEL_IMAGETYPE = "uImage"
COMPATIBLE_MACHINE = "(beagleboard)"
-PV = "3.0.17"
-# v3.0.17 tag
-SRCREV_pn-${PN} = "e9d23be2708477feeaec78e707c80441520c1ef6"
+PV = "3.0.22"
+# v3.0.22 tag
+SRCREV_pn-${PN} = "a4a663513af05a98d6085d92f85c16bb64ac4050"
# The main PR is now using MACHINE_KERNEL_PR, for omap3 see conf/machine/include/omap3.inc
-MACHINE_KERNEL_PR_append = "c"
+MACHINE_KERNEL_PR_append = "a"
FILESPATH =. "${FILE_DIRNAME}/linux-3.0:${FILE_DIRNAME}/linux-3.0/${MACHINE}:"
--
1.7.2.5
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [BeagleBone][PATCH v3 05/11] u-boot 2011.09: add patch to support 'cold' AM335x silicon
2012-02-27 13:40 [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Koen Kooi
` (2 preceding siblings ...)
2012-02-27 13:40 ` [BeagleBone][PATCH v3 04/11] linux 3.0: update from 3.0.17 to 3.0.22 Koen Kooi
@ 2012-02-27 13:40 ` Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 06/11] beaglebone-tester: include Jasons debug tweaks Koen Kooi
` (6 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Koen Kooi @ 2012-02-27 13:40 UTC (permalink / raw)
To: meta-ti
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
...ddr_defs-change-DDR-timings-for-15x15-EVM.patch | 30 ++++++++++++++++++++
recipes-bsp/u-boot/u-boot_2011.10rc.bb | 3 +-
2 files changed, 32 insertions(+), 1 deletions(-)
create mode 100644 recipes-bsp/u-boot/u-boot/2011.09git/0001-ddr_defs-change-DDR-timings-for-15x15-EVM.patch
diff --git a/recipes-bsp/u-boot/u-boot/2011.09git/0001-ddr_defs-change-DDR-timings-for-15x15-EVM.patch b/recipes-bsp/u-boot/u-boot/2011.09git/0001-ddr_defs-change-DDR-timings-for-15x15-EVM.patch
new file mode 100644
index 0000000..4563a2c
--- /dev/null
+++ b/recipes-bsp/u-boot/u-boot/2011.09git/0001-ddr_defs-change-DDR-timings-for-15x15-EVM.patch
@@ -0,0 +1,30 @@
+From 7a3b3b04b1aed6a649d99396f914ec042968f924 Mon Sep 17 00:00:00 2001
+From: Chase Maupin <Chase.Maupin@ti.com>
+Date: Thu, 9 Feb 2012 13:09:27 -0600
+Subject: [PATCH] ddr_defs: change DDR timings for 15x15 EVM
+
+* For cold silicon the DDR timings need to be relaxed in order for
+ the device to boot with DDR at 266MHz
+* Fix proposed by James Doublesin
+
+Signed-off-by: Chase Maupin <Chase.Maupin@ti.com>
+---
+ arch/arm/include/asm/arch-ti81xx/ddr_defs.h | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/arch/arm/include/asm/arch-ti81xx/ddr_defs.h b/arch/arm/include/asm/arch-ti81xx/ddr_defs.h
+index 6c4b422..0b7ffe7 100644
+--- a/arch/arm/include/asm/arch-ti81xx/ddr_defs.h
++++ b/arch/arm/include/asm/arch-ti81xx/ddr_defs.h
+@@ -338,7 +338,7 @@
+ #define DDR2_RD_DQS 0x40
+ #define DDR2_PHY_FIFO_WE 0x56
+ #else
+-#define EMIF_READ_LATENCY 0x04
++#define EMIF_READ_LATENCY 0x05
+ #define EMIF_TIM1 0x0666B3D6
+ #define EMIF_TIM2 0x143731DA
+ #define EMIF_TIM3 0x00000347
+--
+1.7.0.4
+
diff --git a/recipes-bsp/u-boot/u-boot_2011.10rc.bb b/recipes-bsp/u-boot/u-boot_2011.10rc.bb
index 74597f6..0102d15 100644
--- a/recipes-bsp/u-boot/u-boot_2011.10rc.bb
+++ b/recipes-bsp/u-boot/u-boot_2011.10rc.bb
@@ -6,7 +6,7 @@ COMPATIBLE_MACHINE = "(ti33x)"
DEFAULT_PREFERENCE_ti33x = "99"
PV = "2011.09+git"
-PR = "r25"
+PR = "r26"
# SPL build
UBOOT_BINARY = "u-boot.img"
@@ -23,6 +23,7 @@ SRC_URI = "git://arago-project.org/git/projects/u-boot-am33x.git;protocol=git;br
file://2011.09git/0007-am335x_evm-switch-to-ext4.patch \
file://2011.09git/0008-HACK-am335x-evm-turn-d-cache-on-globally-turn-it-off.patch \
file://2011.09git/0009-am335x-evm-enable-i2c2-pinmux-for-beaglebone.patch \
+ file://2011.09git/0001-ddr_defs-change-DDR-timings-for-15x15-EVM.patch \
"
SRCREV = "f63b270e47f62f4d1a05b2001357e215966c6f5a"
--
1.7.2.5
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [BeagleBone][PATCH v3 06/11] beaglebone-tester: include Jasons debug tweaks
2012-02-27 13:40 [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Koen Kooi
` (3 preceding siblings ...)
2012-02-27 13:40 ` [BeagleBone][PATCH v3 05/11] u-boot 2011.09: add patch to support 'cold' AM335x silicon Koen Kooi
@ 2012-02-27 13:40 ` Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 07/11] beaglebone-getting-started: update to latest git Koen Kooi
` (5 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Koen Kooi @ 2012-02-27 13:40 UTC (permalink / raw)
To: meta-ti
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
recipes-ti/beagleboard/beaglebone-tester.bb | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/recipes-ti/beagleboard/beaglebone-tester.bb b/recipes-ti/beagleboard/beaglebone-tester.bb
index dae9628..7a72547 100644
--- a/recipes-ti/beagleboard/beaglebone-tester.bb
+++ b/recipes-ti/beagleboard/beaglebone-tester.bb
@@ -7,11 +7,11 @@ LIC_FILES_CHKSUM="file://gpl.txt;md5=5b122a36d0f6dc55279a0ebc69f3c60b"
# only scripts and data
inherit allarch
-PR = "r12"
+PR = "r13"
SRC_URI = "git://github.com/koenkooi/validation-scripts.git;protocol=git \
"
-SRCREV = "0a3415705afb206694d4e873fe8228b7440213db"
+SRCREV = "dc89e2d6b2ac0238a7aa5a334d7c86d7b8613837"
S = "${WORKDIR}/git"
--
1.7.2.5
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [BeagleBone][PATCH v3 07/11] beaglebone-getting-started: update to latest git
2012-02-27 13:40 [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Koen Kooi
` (4 preceding siblings ...)
2012-02-27 13:40 ` [BeagleBone][PATCH v3 06/11] beaglebone-tester: include Jasons debug tweaks Koen Kooi
@ 2012-02-27 13:40 ` Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 08/11] gadget-init: remove ehrPWM polarity workaround Koen Kooi
` (4 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Koen Kooi @ 2012-02-27 13:40 UTC (permalink / raw)
To: meta-ti
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
recipes-misc/payload/beaglebone-getting-started.bb | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/recipes-misc/payload/beaglebone-getting-started.bb b/recipes-misc/payload/beaglebone-getting-started.bb
index b135176..d02c749 100644
--- a/recipes-misc/payload/beaglebone-getting-started.bb
+++ b/recipes-misc/payload/beaglebone-getting-started.bb
@@ -1,13 +1,13 @@
DESCRIPTION = "BeagleBone Getting Started Guide"
-PR = "r17"
+PR = "r18"
inherit allarch
LICENSE = "GPLv2+ & MIT & PD & others"
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=603591dea023c3c75b48e07cb47ce639"
-SRCREV = "5b93037d0504ab194709cf8b6dc3890fefe19fd9"
+SRCREV = "9b46d33531f0c740be25bbff5d485bec522f5934"
SRC_URI = "git://github.com/jadonk/beaglebone-getting-started.git"
S = "${WORKDIR}/git"
--
1.7.2.5
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [BeagleBone][PATCH v3 08/11] gadget-init: remove ehrPWM polarity workaround
2012-02-27 13:40 [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Koen Kooi
` (5 preceding siblings ...)
2012-02-27 13:40 ` [BeagleBone][PATCH v3 07/11] beaglebone-getting-started: update to latest git Koen Kooi
@ 2012-02-27 13:40 ` Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 09/11] cloud9-image: ship connman-test as well to manipulate interfaces using the CLI Koen Kooi
` (3 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Koen Kooi @ 2012-02-27 13:40 UTC (permalink / raw)
To: meta-ti
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
recipes-ti/beagleboard/gadget-init.bb | 7 ++-----
1 files changed, 2 insertions(+), 5 deletions(-)
diff --git a/recipes-ti/beagleboard/gadget-init.bb b/recipes-ti/beagleboard/gadget-init.bb
index 150ff8e..016877d 100644
--- a/recipes-ti/beagleboard/gadget-init.bb
+++ b/recipes-ti/beagleboard/gadget-init.bb
@@ -1,6 +1,6 @@
DESCRIPTION = "Units to initialize usb gadgets"
-PR = "r16"
+PR = "r18"
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://${COREBASE}/LICENSE;md5=3f40d7994397109285ec7b81fdeb3b58"
@@ -35,14 +35,11 @@ do_install() {
install -d ${D}${bindir}
install -m 0755 ${WORKDIR}/*.sh ${D}${bindir}
-
- install -d ${D}${sysconfdir}/tmpfiles.d
- echo "w /sys/class/pwm/ehrpwm.1:0/polarity - - - - 1" > ${D}${sysconfdir}/tmpfiles.d/lcd7.conf
}
PACKAGES =+ "${PN}-storage ${PN}-network ${PN}-udhcpd"
-FILES_${PN} = "${sysconfdir}/tmpfiles.d"
+ALLOW_EMPTY_${PN} = "1"
FILES_${PN}-storage = "${base_libdir}/systemd/system/storage-gadget-init.service \
${base_libdir}/systemd/system/basic.target.wants/storage-gadget-init.service \
--
1.7.2.5
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [BeagleBone][PATCH v3 09/11] cloud9-image: ship connman-test as well to manipulate interfaces using the CLI
2012-02-27 13:40 [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Koen Kooi
` (6 preceding siblings ...)
2012-02-27 13:40 ` [BeagleBone][PATCH v3 08/11] gadget-init: remove ehrPWM polarity workaround Koen Kooi
@ 2012-02-27 13:40 ` Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 10/11] beaglebone-getting-started: update SRM to rev A5 Koen Kooi
` (2 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: Koen Kooi @ 2012-02-27 13:40 UTC (permalink / raw)
To: meta-ti
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
recipes-misc/images/cloud9-image.bb | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/recipes-misc/images/cloud9-image.bb b/recipes-misc/images/cloud9-image.bb
index 1a7e269..b8ef3d8 100644
--- a/recipes-misc/images/cloud9-image.bb
+++ b/recipes-misc/images/cloud9-image.bb
@@ -29,6 +29,7 @@ IMAGE_INSTALL += " \
mplayer2 \
tslib-tests tslib-calibrate \
iproute2 canutils \
+ connman-tests \
"
export IMAGE_BASENAME = "Cloud9-IDE"
--
1.7.2.5
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [BeagleBone][PATCH v3 10/11] beaglebone-getting-started: update SRM to rev A5
2012-02-27 13:40 [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Koen Kooi
` (7 preceding siblings ...)
2012-02-27 13:40 ` [BeagleBone][PATCH v3 09/11] cloud9-image: ship connman-test as well to manipulate interfaces using the CLI Koen Kooi
@ 2012-02-27 13:40 ` Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 11/11] linux-ti33x-psp 3.2: enable PRU support for beaglebone Koen Kooi
2012-02-27 14:12 ` [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Denys Dmytriyenko
10 siblings, 0 replies; 12+ messages in thread
From: Koen Kooi @ 2012-02-27 13:40 UTC (permalink / raw)
To: meta-ti
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
recipes-misc/payload/beaglebone-getting-started.bb | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/recipes-misc/payload/beaglebone-getting-started.bb b/recipes-misc/payload/beaglebone-getting-started.bb
index d02c749..548a9c0 100644
--- a/recipes-misc/payload/beaglebone-getting-started.bb
+++ b/recipes-misc/payload/beaglebone-getting-started.bb
@@ -1,13 +1,13 @@
DESCRIPTION = "BeagleBone Getting Started Guide"
-PR = "r18"
+PR = "r19"
inherit allarch
LICENSE = "GPLv2+ & MIT & PD & others"
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=603591dea023c3c75b48e07cb47ce639"
-SRCREV = "9b46d33531f0c740be25bbff5d485bec522f5934"
+SRCREV = "4750e2bdd29ce037a045149b50ad73906d26999f"
SRC_URI = "git://github.com/jadonk/beaglebone-getting-started.git"
S = "${WORKDIR}/git"
--
1.7.2.5
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [BeagleBone][PATCH v3 11/11] linux-ti33x-psp 3.2: enable PRU support for beaglebone
2012-02-27 13:40 [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Koen Kooi
` (8 preceding siblings ...)
2012-02-27 13:40 ` [BeagleBone][PATCH v3 10/11] beaglebone-getting-started: update SRM to rev A5 Koen Kooi
@ 2012-02-27 13:40 ` Koen Kooi
2012-02-27 14:12 ` [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Denys Dmytriyenko
10 siblings, 0 replies; 12+ messages in thread
From: Koen Kooi @ 2012-02-27 13:40 UTC (permalink / raw)
To: meta-ti
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
---
.../linux/linux-ti33x-psp-3.2/beaglebone/defconfig | 7 +++++--
recipes-kernel/linux/linux-ti33x-psp_3.2.bb | 2 +-
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/beaglebone/defconfig b/recipes-kernel/linux/linux-ti33x-psp-3.2/beaglebone/defconfig
index 07b9987..c5b80d1 100644
--- a/recipes-kernel/linux/linux-ti33x-psp-3.2/beaglebone/defconfig
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/beaglebone/defconfig
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
-# Linux/arm 3.2.0 Kernel Configuration
+# Linux/arm 3.2.6 Kernel Configuration
#
CONFIG_ARM=y
CONFIG_HAVE_PWM=y
@@ -2894,7 +2894,10 @@ CONFIG_RTC_DRV_TWL4030=y
CONFIG_RTC_DRV_OMAP=y
# CONFIG_DMADEVICES is not set
# CONFIG_AUXDISPLAY is not set
-# CONFIG_UIO is not set
+CONFIG_UIO=m
+CONFIG_UIO_PDRV=m
+CONFIG_UIO_PDRV_GENIRQ=m
+CONFIG_UIO_PRUSS=m
CONFIG_VIRTIO=m
CONFIG_VIRTIO_RING=m
diff --git a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
index 42a606d..36df3e6 100644
--- a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
+++ b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
@@ -11,7 +11,7 @@ MULTI_CONFIG_BASE_SUFFIX = ""
BRANCH = "v3.2-staging"
SRCREV = "09e9651bcf2ee8d86685f2a8075bc6557b1d3b91"
-MACHINE_KERNEL_PR_append = "a+gitr${SRCREV}"
+MACHINE_KERNEL_PR_append = "c+gitr${SRCREV}"
COMPATIBLE_MACHINE = "(ti33x)"
--
1.7.2.5
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion
2012-02-27 13:40 [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Koen Kooi
` (9 preceding siblings ...)
2012-02-27 13:40 ` [BeagleBone][PATCH v3 11/11] linux-ti33x-psp 3.2: enable PRU support for beaglebone Koen Kooi
@ 2012-02-27 14:12 ` Denys Dmytriyenko
10 siblings, 0 replies; 12+ messages in thread
From: Denys Dmytriyenko @ 2012-02-27 14:12 UTC (permalink / raw)
To: Koen Kooi; +Cc: meta-ti
On Mon, Feb 27, 2012 at 02:40:19PM +0100, Koen Kooi wrote:
> Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
Thanks, applied.
> ---
> recipes-kernel/linux/linux-ti33x-psp_3.2.bb | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
> index a25d503..f2ba8e0 100644
> --- a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
> +++ b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb
> @@ -10,8 +10,8 @@ S = "${WORKDIR}/git"
> MULTI_CONFIG_BASE_SUFFIX = ""
>
> BRANCH = "v3.2-staging"
> -SRCREV = "21ef5e1fa530eb8f23bfe18650e3915d7c291ca9"
> -MACHINE_KERNEL_PR_append = "e+gitr${SRCREV}"
> +SRCREV = "09e9651bcf2ee8d86685f2a8075bc6557b1d3b91"
> +MACHINE_KERNEL_PR_append = "f+gitr${SRCREV}"
>
> COMPATIBLE_MACHINE = "(ti33x)"
>
> --
> 1.7.2.5
>
> _______________________________________________
> meta-ti mailing list
> meta-ti@yoctoproject.org
> https://lists.yoctoproject.org/listinfo/meta-ti
>
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2012-02-27 14:12 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-02-27 13:40 [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 02/11] linux-ti33x-psp 3.2: update to 3.2.5 Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 03/11] linux-ti335x-psp 3.2: update to 3.2.6 Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 04/11] linux 3.0: update from 3.0.17 to 3.0.22 Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 05/11] u-boot 2011.09: add patch to support 'cold' AM335x silicon Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 06/11] beaglebone-tester: include Jasons debug tweaks Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 07/11] beaglebone-getting-started: update to latest git Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 08/11] gadget-init: remove ehrPWM polarity workaround Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 09/11] cloud9-image: ship connman-test as well to manipulate interfaces using the CLI Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 10/11] beaglebone-getting-started: update SRM to rev A5 Koen Kooi
2012-02-27 13:40 ` [BeagleBone][PATCH v3 11/11] linux-ti33x-psp 3.2: enable PRU support for beaglebone Koen Kooi
2012-02-27 14:12 ` [BeagleBone][PATCH v3 01/11] linux-ti33x-psp 3.2: fix ehrPWM polarity inversion Denys Dmytriyenko
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.