summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 2257c7b)
raw | patch | inline | side by side (parent: 2257c7b)
| author | Koen Kooi <koen@dominion.thruhere.net> | |
| Wed, 20 Jun 2012 10:42:22 +0000 (12:42 +0200) | ||
| committer | Denys Dmytriyenko <denys@ti.com> | |
| Thu, 26 Jul 2012 00:23:44 +0000 (20:23 -0400) |
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
419 files changed:
index 61ee65ebfaecaad164e27263e0fcc177f1b63ae8..441a7bbbfc2f764b36a9cf2d6a550f7aade3c502 100644 (file)
require conf/machine/include/tune-cortexa8.inc
PREFERRED_PROVIDER_virtual/kernel = "linux-ti33x-psp"
# Increase this everytime you change something in the kernel
-MACHINE_KERNEL_PR = "r12"
+MACHINE_KERNEL_PR = "r13"
KERNEL_IMAGETYPE = "uImage"
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0001-KVM-mmu_notifier-Flush-TLBs-before-releasing-mmu_loc.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0001-KVM-mmu_notifier-Flush-TLBs-before-releasing-mmu_loc.patch
--- /dev/null
@@ -0,0 +1,79 @@
+From e29e69cb6dff635429cbda9a9548c3d0390689f9 Mon Sep 17 00:00:00 2001
+From: Takuya Yoshikawa <yoshikawa.takuya@oss.ntt.co.jp>
+Date: Fri, 10 Feb 2012 15:28:31 +0900
+Subject: [PATCH 001/117] KVM: mmu_notifier: Flush TLBs before releasing
+ mmu_lock
+
+(cherry picked from commit 565f3be2174611f364405bbea2d86e153c2e7e78
+
+Other threads may process the same page in that small window and skip
+TLB flush and then return before these functions do flush.
+
+Signed-off-by: Takuya Yoshikawa <yoshikawa.takuya@oss.ntt.co.jp>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ virt/kvm/kvm_main.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index e401c1b..9ffac2e 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -289,15 +289,15 @@ static void kvm_mmu_notifier_invalidate_page(struct mmu_notifier *mn,
+ */
+ idx = srcu_read_lock(&kvm->srcu);
+ spin_lock(&kvm->mmu_lock);
++
+ kvm->mmu_notifier_seq++;
+ need_tlb_flush = kvm_unmap_hva(kvm, address) | kvm->tlbs_dirty;
+- spin_unlock(&kvm->mmu_lock);
+- srcu_read_unlock(&kvm->srcu, idx);
+-
+ /* we've to flush the tlb before the pages can be freed */
+ if (need_tlb_flush)
+ kvm_flush_remote_tlbs(kvm);
+
++ spin_unlock(&kvm->mmu_lock);
++ srcu_read_unlock(&kvm->srcu, idx);
+ }
+
+ static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn,
+@@ -335,12 +335,12 @@ static void kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
+ for (; start < end; start += PAGE_SIZE)
+ need_tlb_flush |= kvm_unmap_hva(kvm, start);
+ need_tlb_flush |= kvm->tlbs_dirty;
+- spin_unlock(&kvm->mmu_lock);
+- srcu_read_unlock(&kvm->srcu, idx);
+-
+ /* we've to flush the tlb before the pages can be freed */
+ if (need_tlb_flush)
+ kvm_flush_remote_tlbs(kvm);
++
++ spin_unlock(&kvm->mmu_lock);
++ srcu_read_unlock(&kvm->srcu, idx);
+ }
+
+ static void kvm_mmu_notifier_invalidate_range_end(struct mmu_notifier *mn,
+@@ -378,13 +378,14 @@ static int kvm_mmu_notifier_clear_flush_young(struct mmu_notifier *mn,
+
+ idx = srcu_read_lock(&kvm->srcu);
+ spin_lock(&kvm->mmu_lock);
+- young = kvm_age_hva(kvm, address);
+- spin_unlock(&kvm->mmu_lock);
+- srcu_read_unlock(&kvm->srcu, idx);
+
++ young = kvm_age_hva(kvm, address);
+ if (young)
+ kvm_flush_remote_tlbs(kvm);
+
++ spin_unlock(&kvm->mmu_lock);
++ srcu_read_unlock(&kvm->srcu, idx);
++
+ return young;
+ }
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0002-KVM-Ensure-all-vcpus-are-consistent-with-in-kernel-i.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0002-KVM-Ensure-all-vcpus-are-consistent-with-in-kernel-i.patch
--- /dev/null
@@ -0,0 +1,110 @@
+From 54719e9d5196e2af1e358795de9face038502343 Mon Sep 17 00:00:00 2001
+From: Avi Kivity <avi@redhat.com>
+Date: Mon, 5 Mar 2012 14:23:29 +0200
+Subject: [PATCH 002/117] KVM: Ensure all vcpus are consistent with in-kernel
+ irqchip settings
+
+(cherry picked from commit 3e515705a1f46beb1c942bb8043c16f8ac7b1e9e)
+
+If some vcpus are created before KVM_CREATE_IRQCHIP, then
+irqchip_in_kernel() and vcpu->arch.apic will be inconsistent, leading
+to potential NULL pointer dereferences.
+
+Fix by:
+- ensuring that no vcpus are installed when KVM_CREATE_IRQCHIP is called
+- ensuring that a vcpu has an apic if it is installed after KVM_CREATE_IRQCHIP
+
+This is somewhat long winded because vcpu->arch.apic is created without
+kvm->lock held.
+
+Based on earlier patch by Michael Ellerman.
+
+Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/ia64/kvm/kvm-ia64.c | 5 +++++
+ arch/x86/kvm/x86.c | 8 ++++++++
+ include/linux/kvm_host.h | 7 +++++++
+ virt/kvm/kvm_main.c | 4 ++++
+ 4 files changed, 24 insertions(+)
+
+diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
+index 43f4c92..7073185 100644
+--- a/arch/ia64/kvm/kvm-ia64.c
++++ b/arch/ia64/kvm/kvm-ia64.c
+@@ -1169,6 +1169,11 @@ out:
+
+ #define PALE_RESET_ENTRY 0x80000000ffffffb0UL
+
++bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
++{
++ return irqchip_in_kernel(vcpu->kcm) == (vcpu->arch.apic != NULL);
++}
++
+ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ {
+ struct kvm_vcpu *v;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index e04cae1..4fc5323 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3579,6 +3579,9 @@ long kvm_arch_vm_ioctl(struct file *filp,
+ r = -EEXIST;
+ if (kvm->arch.vpic)
+ goto create_irqchip_unlock;
++ r = -EINVAL;
++ if (atomic_read(&kvm->online_vcpus))
++ goto create_irqchip_unlock;
+ r = -ENOMEM;
+ vpic = kvm_create_pic(kvm);
+ if (vpic) {
+@@ -6486,6 +6489,11 @@ void kvm_arch_check_processor_compat(void *rtn)
+ kvm_x86_ops->check_processor_compatibility(rtn);
+ }
+
++bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
++{
++ return irqchip_in_kernel(vcpu->kvm) == (vcpu->arch.apic != NULL);
++}
++
+ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ {
+ struct page *page;
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 35410ef..6136821 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -744,6 +744,13 @@ static inline bool kvm_vcpu_is_bsp(struct kvm_vcpu *vcpu)
+ {
+ return vcpu->kvm->bsp_vcpu_id == vcpu->vcpu_id;
+ }
++
++bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu);
++
++#else
++
++static inline bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu) { return true; }
++
+ #endif
+
+ #ifdef __KVM_HAVE_DEVICE_ASSIGNMENT
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 9ffac2e..ec747dc 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -1667,6 +1667,10 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
+ goto vcpu_destroy;
+
+ mutex_lock(&kvm->lock);
++ if (!kvm_vcpu_compatible(vcpu)) {
++ r = -EINVAL;
++ goto unlock_vcpu_destroy;
++ }
+ if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {
+ r = -EINVAL;
+ goto unlock_vcpu_destroy;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0003-KVM-lock-slots_lock-around-device-assignment.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0003-KVM-lock-slots_lock-around-device-assignment.patch
--- /dev/null
@@ -0,0 +1,83 @@
+From 2464830dde6595631a26a5178946f8d8d0ac974f Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Tue, 17 Apr 2012 21:46:44 -0600
+Subject: [PATCH 003/117] KVM: lock slots_lock around device assignment
+
+(cherry picked from commit 21a1416a1c945c5aeaeaf791b63c64926018eb77)
+
+As pointed out by Jason Baron, when assigning a device to a guest
+we first set the iommu domain pointer, which enables mapping
+and unmapping of memory slots to the iommu. This leaves a window
+where this path is enabled, but we haven't synchronized the iommu
+mappings to the existing memory slots. Thus a slot being removed
+at that point could send us down unexpected code paths removing
+non-existent pinnings and iommu mappings. Take the slots_lock
+around creating the iommu domain and initial mappings as well as
+around iommu teardown to avoid this race.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ virt/kvm/iommu.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
+index fd817a2..533db33 100644
+--- a/virt/kvm/iommu.c
++++ b/virt/kvm/iommu.c
+@@ -239,9 +239,13 @@ int kvm_iommu_map_guest(struct kvm *kvm)
+ return -ENODEV;
+ }
+
++ mutex_lock(&kvm->slots_lock);
++
+ kvm->arch.iommu_domain = iommu_domain_alloc(&pci_bus_type);
+- if (!kvm->arch.iommu_domain)
+- return -ENOMEM;
++ if (!kvm->arch.iommu_domain) {
++ r = -ENOMEM;
++ goto out_unlock;
++ }
+
+ if (!allow_unsafe_assigned_interrupts &&
+ !iommu_domain_has_cap(kvm->arch.iommu_domain,
+@@ -252,17 +256,16 @@ int kvm_iommu_map_guest(struct kvm *kvm)
+ " module option.\n", __func__);
+ iommu_domain_free(kvm->arch.iommu_domain);
+ kvm->arch.iommu_domain = NULL;
+- return -EPERM;
++ r = -EPERM;
++ goto out_unlock;
+ }
+
+ r = kvm_iommu_map_memslots(kvm);
+ if (r)
+- goto out_unmap;
+-
+- return 0;
++ kvm_iommu_unmap_memslots(kvm);
+
+-out_unmap:
+- kvm_iommu_unmap_memslots(kvm);
++out_unlock:
++ mutex_unlock(&kvm->slots_lock);
+ return r;
+ }
+
+@@ -338,7 +341,11 @@ int kvm_iommu_unmap_guest(struct kvm *kvm)
+ if (!domain)
+ return 0;
+
++ mutex_lock(&kvm->slots_lock);
+ kvm_iommu_unmap_memslots(kvm);
++ kvm->arch.iommu_domain = NULL;
++ mutex_unlock(&kvm->slots_lock);
++
+ iommu_domain_free(domain);
+ return 0;
+ }
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0004-KVM-nVMX-Fix-erroneous-exception-bitmap-check.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0004-KVM-nVMX-Fix-erroneous-exception-bitmap-check.patch
--- /dev/null
@@ -0,0 +1,36 @@
+From c997d0a009e5eb7b372287c13fc9eaba901533e8 Mon Sep 17 00:00:00 2001
+From: Nadav Har'El <nyh@math.technion.ac.il>
+Date: Tue, 6 Mar 2012 16:39:22 +0200
+Subject: [PATCH 004/117] KVM: nVMX: Fix erroneous exception bitmap check
+
+(cherry picked from commit 9587190107d0c0cbaccbf7bf6b0245d29095a9ae)
+
+The code which checks whether to inject a pagefault to L1 or L2 (in
+nested VMX) was wrong, incorrect in how it checked the PF_VECTOR bit.
+Thanks to Dan Carpenter for spotting this.
+
+Signed-off-by: Nadav Har'El <nyh@il.ibm.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/kvm/vmx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 4ea7678..7ac5993 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1677,7 +1677,7 @@ static int nested_pf_handled(struct kvm_vcpu *vcpu)
+ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+
+ /* TODO: also check PFEC_MATCH/MASK, not just EB.PF. */
+- if (!(vmcs12->exception_bitmap & PF_VECTOR))
++ if (!(vmcs12->exception_bitmap & (1u << PF_VECTOR)))
+ return 0;
+
+ nested_vmx_vmexit(vcpu);
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0005-KVM-VMX-vmx_set_cr0-expects-kvm-srcu-locked.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0005-KVM-VMX-vmx_set_cr0-expects-kvm-srcu-locked.patch
--- /dev/null
@@ -0,0 +1,35 @@
+From 6d02e81e40e77ff4e0d65ae89cf91a7402d3255f Mon Sep 17 00:00:00 2001
+From: Marcelo Tosatti <mtosatti@redhat.com>
+Date: Tue, 27 Mar 2012 19:47:26 -0300
+Subject: [PATCH 005/117] KVM: VMX: vmx_set_cr0 expects kvm->srcu locked
+
+(cherry picked from commit 7a4f5ad051e02139a9f1c0f7f4b1acb88915852b)
+
+vmx_set_cr0 is called from vcpu run context, therefore it expects
+kvm->srcu to be held (for setting up the real-mode TSS).
+
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/kvm/vmx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 7ac5993..7315488 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3915,7 +3915,9 @@ static int vmx_vcpu_reset(struct kvm_vcpu *vcpu)
+ vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid);
+
+ vmx->vcpu.arch.cr0 = X86_CR0_NW | X86_CR0_CD | X86_CR0_ET;
++ vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
+ vmx_set_cr0(&vmx->vcpu, kvm_read_cr0(vcpu)); /* enter rmode */
++ srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
+ vmx_set_cr4(&vmx->vcpu, 0);
+ vmx_set_efer(&vmx->vcpu, 0);
+ vmx_fpu_activate(&vmx->vcpu);
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0006-KVM-s390-do-store-status-after-handling-STOP_ON_STOP.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0006-KVM-s390-do-store-status-after-handling-STOP_ON_STOP.patch
--- /dev/null
@@ -0,0 +1,65 @@
+From 4ec77e205d0abcfd9d48332ac0a8d60322966562 Mon Sep 17 00:00:00 2001
+From: Jens Freimann <jfrei@linux.vnet.ibm.com>
+Date: Mon, 6 Feb 2012 10:59:03 +0100
+Subject: [PATCH 006/117] KVM: s390: do store status after handling
+ STOP_ON_STOP bit
+
+(cherry picked from commit 9e0d5473e2f0ba2d2fe9dab9408edef3060b710e)
+
+In handle_stop() handle the stop bit before doing the store status as
+described for "Stop and Store Status" in the Principles of Operation.
+We have to give up the local_int.lock before calling kvm store status
+since it calls gmap_fault() which might sleep. Since local_int.lock
+only protects local_int.* and not guest memory we can give up the lock.
+
+Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/s390/kvm/intercept.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
+index 0243454..a5f6eff 100644
+--- a/arch/s390/kvm/intercept.c
++++ b/arch/s390/kvm/intercept.c
+@@ -133,13 +133,6 @@ static int handle_stop(struct kvm_vcpu *vcpu)
+
+ vcpu->stat.exit_stop_request++;
+ spin_lock_bh(&vcpu->arch.local_int.lock);
+- if (vcpu->arch.local_int.action_bits & ACTION_STORE_ON_STOP) {
+- vcpu->arch.local_int.action_bits &= ~ACTION_STORE_ON_STOP;
+- rc = kvm_s390_vcpu_store_status(vcpu,
+- KVM_S390_STORE_STATUS_NOADDR);
+- if (rc >= 0)
+- rc = -EOPNOTSUPP;
+- }
+
+ if (vcpu->arch.local_int.action_bits & ACTION_RELOADVCPU_ON_STOP) {
+ vcpu->arch.local_int.action_bits &= ~ACTION_RELOADVCPU_ON_STOP;
+@@ -155,7 +148,18 @@ static int handle_stop(struct kvm_vcpu *vcpu)
+ rc = -EOPNOTSUPP;
+ }
+
+- spin_unlock_bh(&vcpu->arch.local_int.lock);
++ if (vcpu->arch.local_int.action_bits & ACTION_STORE_ON_STOP) {
++ vcpu->arch.local_int.action_bits &= ~ACTION_STORE_ON_STOP;
++ /* store status must be called unlocked. Since local_int.lock
++ * only protects local_int.* and not guest memory we can give
++ * up the lock here */
++ spin_unlock_bh(&vcpu->arch.local_int.lock);
++ rc = kvm_s390_vcpu_store_status(vcpu,
++ KVM_S390_STORE_STATUS_NOADDR);
++ if (rc >= 0)
++ rc = -EOPNOTSUPP;
++ } else
++ spin_unlock_bh(&vcpu->arch.local_int.lock);
+ return rc;
+ }
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0007-KVM-s390-Sanitize-fpc-registers-for-KVM_SET_FPU.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0007-KVM-s390-Sanitize-fpc-registers-for-KVM_SET_FPU.patch
--- /dev/null
@@ -0,0 +1,36 @@
+From 12632a351defb18140a84df1720a363d94991973 Mon Sep 17 00:00:00 2001
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+Date: Mon, 6 Feb 2012 10:59:02 +0100
+Subject: [PATCH 007/117] KVM: s390: Sanitize fpc registers for KVM_SET_FPU
+
+(cherry picked from commit 851755871c1f3184f4124c466e85881f17fa3226)
+
+commit 7eef87dc99e419b1cc051e4417c37e4744d7b661 (KVM: s390: fix
+register setting) added a load of the floating point control register
+to the KVM_SET_FPU path. Lets make sure that the fpc is valid.
+
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/s390/kvm/kvm-s390.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index d1c44573..d3cb86c 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -418,7 +418,7 @@ int kvm_arch_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
+ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
+ {
+ memcpy(&vcpu->arch.guest_fpregs.fprs, &fpu->fprs, sizeof(fpu->fprs));
+- vcpu->arch.guest_fpregs.fpc = fpu->fpc;
++ vcpu->arch.guest_fpregs.fpc = fpu->fpc & FPC_VALID_MASK;
+ restore_fp_regs(&vcpu->arch.guest_fpregs);
+ return 0;
+ }
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0008-bio-don-t-overflow-in-bio_get_nr_vecs.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0008-bio-don-t-overflow-in-bio_get_nr_vecs.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0008-bio-don-t-overflow-in-bio_get_nr_vecs.patch
@@ -0,0 +1,61 @@
+From ac72e8c98ddb0c511b506472d9bc5afcf720babc Mon Sep 17 00:00:00 2001
+From: Kent Overstreet <kent.overstreet@gmail.com>
+Date: Wed, 8 Feb 2012 22:07:18 +0100
+Subject: [PATCH 008/117] bio: don't overflow in bio_get_nr_vecs()
+
+commit 5abebfdd02450fa1349daacf242e70b3736581e3 upstream.
+
+There were two places bio_get_nr_vecs() could overflow:
+
+First, it did a left shift to convert from sectors to bytes immediately
+before dividing by PAGE_SIZE. If PAGE_SIZE ever was less than 512 a great
+many things would break, so dividing by PAGE_SIZE >> 9 is safe and will
+generate smaller code too.
+
+The nastier overflow was in the DIV_ROUND_UP() (that's what the code was
+effectively doing, anyways). If n + d overflowed, the whole thing would
+return 0 which breaks things rather effectively.
+
+bio_get_nr_vecs() doesn't claim to give an exact value anyways, so the
+DIV_ROUND_UP() is silly; we could do a straight divide except if a
+device's queue_max_sectors was less than PAGE_SIZE we'd return 0. So we
+just add 1; this should always be safe - things will break badly if
+bio_get_nr_vecs() returns > BIO_MAX_PAGES (bio_alloc() will suddenly start
+failing) but it's queue_max_segments that must guard against this, if
+queue_max_sectors is preventing this from happen things are going to
+explode on architectures with different PAGE_SIZE.
+
+Signed-off-by: Kent Overstreet <koverstreet@google.com>
+Cc: Tejun Heo <tj@kernel.org>
+Acked-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/bio.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/fs/bio.c b/fs/bio.c
+index b1fe82c..b980ecd 100644
+--- a/fs/bio.c
++++ b/fs/bio.c
+@@ -505,13 +505,9 @@ EXPORT_SYMBOL(bio_clone);
+ int bio_get_nr_vecs(struct block_device *bdev)
+ {
+ struct request_queue *q = bdev_get_queue(bdev);
+- int nr_pages;
+-
+- nr_pages = ((queue_max_sectors(q) << 9) + PAGE_SIZE - 1) >> PAGE_SHIFT;
+- if (nr_pages > queue_max_segments(q))
+- nr_pages = queue_max_segments(q);
+-
+- return nr_pages;
++ return min_t(unsigned,
++ queue_max_segments(q),
++ queue_max_sectors(q) / (PAGE_SIZE >> 9) + 1);
+ }
+ EXPORT_SYMBOL(bio_get_nr_vecs);
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0009-bio-allocation-failure-due-to-bio_get_nr_vecs.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0009-bio-allocation-failure-due-to-bio_get_nr_vecs.patch
--- /dev/null
@@ -0,0 +1,49 @@
+From a98c14f6d0a745c09fa0ebf22c2ce8913c211d9b Mon Sep 17 00:00:00 2001
+From: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+Date: Fri, 11 May 2012 16:36:44 +0200
+Subject: [PATCH 009/117] bio allocation failure due to bio_get_nr_vecs()
+
+commit f908ee9463b09ddd05e1c1a0111132212dc05fac upstream.
+
+The number of bio_get_nr_vecs() is passed down via bio_alloc() to
+bvec_alloc_bs(), which fails the bio allocation if
+nr_iovecs > BIO_MAX_PAGES. For the underlying caller this causes an
+unexpected bio allocation failure.
+Limiting to queue_max_segments() is not sufficient, as max_segments
+also might be very large.
+
+bvec_alloc_bs(gfp_mask, nr_iovecs, ) => NULL when nr_iovecs > BIO_MAX_PAGES
+bio_alloc_bioset(gfp_mask, nr_iovecs, ...)
+bio_alloc(GFP_NOIO, nvecs)
+xfs_alloc_ioend_bio()
+
+Signed-off-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/bio.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/bio.c b/fs/bio.c
+index b980ecd..4fc4dbb 100644
+--- a/fs/bio.c
++++ b/fs/bio.c
+@@ -505,9 +505,14 @@ EXPORT_SYMBOL(bio_clone);
+ int bio_get_nr_vecs(struct block_device *bdev)
+ {
+ struct request_queue *q = bdev_get_queue(bdev);
+- return min_t(unsigned,
++ int nr_pages;
++
++ nr_pages = min_t(unsigned,
+ queue_max_segments(q),
+ queue_max_sectors(q) / (PAGE_SIZE >> 9) + 1);
++
++ return min_t(unsigned, nr_pages, BIO_MAX_PAGES);
++
+ }
+ EXPORT_SYMBOL(bio_get_nr_vecs);
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0010-block-fix-buffer-overflow-when-printing-partition-UU.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0010-block-fix-buffer-overflow-when-printing-partition-UU.patch
--- /dev/null
@@ -0,0 +1,98 @@
+From 6a6f5fba154e1400185844d74b953fba440fda63 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 15 May 2012 08:22:04 +0200
+Subject: [PATCH 010/117] block: fix buffer overflow when printing partition
+ UUIDs
+
+commit 05c69d298c96703741cac9a5cbbf6c53bd55a6e2 upstream.
+
+6d1d8050b4bc8 "block, partition: add partition_meta_info to hd_struct"
+added part_unpack_uuid() which assumes that the passed in buffer has
+enough space for sprintfing "%pU" - 37 characters including '\0'.
+
+Unfortunately, b5af921ec0233 "init: add support for root devices
+specified by partition UUID" supplied 33 bytes buffer to the function
+leading to the following panic with stackprotector enabled.
+
+ Kernel panic - not syncing: stack-protector: Kernel stack corrupted in: ffffffff81b14c7e
+
+ [<ffffffff815e226b>] panic+0xba/0x1c6
+ [<ffffffff81b14c7e>] ? printk_all_partitions+0x259/0x26xb
+ [<ffffffff810566bb>] __stack_chk_fail+0x1b/0x20
+ [<ffffffff81b15c7e>] printk_all_paritions+0x259/0x26xb
+ [<ffffffff81aedfe0>] mount_block_root+0x1bc/0x27f
+ [<ffffffff81aee0fa>] mount_root+0x57/0x5b
+ [<ffffffff81aee23b>] prepare_namespace+0x13d/0x176
+ [<ffffffff8107eec0>] ? release_tgcred.isra.4+0x330/0x30
+ [<ffffffff81aedd60>] kernel_init+0x155/0x15a
+ [<ffffffff81087b97>] ? schedule_tail+0x27/0xb0
+ [<ffffffff815f4d24>] kernel_thread_helper+0x5/0x10
+ [<ffffffff81aedc0b>] ? start_kernel+0x3c5/0x3c5
+ [<ffffffff815f4d20>] ? gs_change+0x13/0x13
+
+Increase the buffer size, remove the dangerous part_unpack_uuid() and
+use snprintf() directly from printk_all_partitions().
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Szymon Gruszczynski <sz.gruszczynski@googlemail.com>
+Cc: Will Drewry <wad@chromium.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ block/genhd.c | 10 ++++++----
+ include/linux/genhd.h | 6 ------
+ 2 files changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/block/genhd.c b/block/genhd.c
+index 997afd6..4927476 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -744,7 +744,7 @@ void __init printk_all_partitions(void)
+ struct hd_struct *part;
+ char name_buf[BDEVNAME_SIZE];
+ char devt_buf[BDEVT_SIZE];
+- u8 uuid[PARTITION_META_INFO_UUIDLTH * 2 + 1];
++ char uuid_buf[PARTITION_META_INFO_UUIDLTH * 2 + 5];
+
+ /*
+ * Don't show empty devices or things that have been
+@@ -763,14 +763,16 @@ void __init printk_all_partitions(void)
+ while ((part = disk_part_iter_next(&piter))) {
+ bool is_part0 = part == &disk->part0;
+
+- uuid[0] = 0;
++ uuid_buf[0] = '\0';
+ if (part->info)
+- part_unpack_uuid(part->info->uuid, uuid);
++ snprintf(uuid_buf, sizeof(uuid_buf), "%pU",
++ part->info->uuid);
+
+ printk("%s%s %10llu %s %s", is_part0 ? "" : " ",
+ bdevt_str(part_devt(part), devt_buf),
+ (unsigned long long)part->nr_sects >> 1,
+- disk_name(disk, part->partno, name_buf), uuid);
++ disk_name(disk, part->partno, name_buf),
++ uuid_buf);
+ if (is_part0) {
+ if (disk->driverfs_dev != NULL &&
+ disk->driverfs_dev->driver != NULL)
+diff --git a/include/linux/genhd.h b/include/linux/genhd.h
+index c6f7f6a..4eec461 100644
+--- a/include/linux/genhd.h
++++ b/include/linux/genhd.h
+@@ -222,12 +222,6 @@ static inline void part_pack_uuid(const u8 *uuid_str, u8 *to)
+ }
+ }
+
+-static inline char *part_unpack_uuid(const u8 *uuid, char *out)
+-{
+- sprintf(out, "%pU", uuid);
+- return out;
+-}
+-
+ static inline int disk_max_parts(struct gendisk *disk)
+ {
+ if (disk->flags & GENHD_FL_EXT_DEVT)
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0011-fix-PA1.1-oops-on-boot.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0011-fix-PA1.1-oops-on-boot.patch
--- /dev/null
@@ -0,0 +1,43 @@
+From 882770bdde14aed9bf896980f51fe2fc8a55623f Mon Sep 17 00:00:00 2001
+From: James Bottomley <JBottomley@Parallels.com>
+Date: Tue, 15 May 2012 11:04:19 +0100
+Subject: [PATCH 011/117] fix PA1.1 oops on boot
+
+commit 5e185581d7c46ddd33cd9c01106d1fc86efb9376 upstream.
+
+All PA1.1 systems have been oopsing on boot since
+
+commit f311847c2fcebd81912e2f0caf8a461dec28db41
+Author: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date: Wed Dec 22 10:22:11 2010 -0600
+
+ parisc: flush pages through tmpalias space
+
+because a PA2.0 instruction was accidentally introduced into the PA1.1 TLB
+insertion interruption path when it was consolidated with the do_alias macro.
+Fix the do_alias macro only to use PA2.0 instructions if compiled for 64 bit.
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/parisc/kernel/entry.S | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index 6f05944..5350342 100644
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -581,7 +581,11 @@
+ */
+ cmpiclr,= 0x01,\tmp,%r0
+ ldi (_PAGE_DIRTY|_PAGE_READ|_PAGE_WRITE),\prot
++#ifdef CONFIG_64BIT
+ depd,z \prot,8,7,\prot
++#else
++ depw,z \prot,8,7,\prot
++#endif
+ /*
+ * OK, it is in the temp alias region, check whether "from" or "to".
+ * Check "subtle" note in pacache.S re: r23/r26.
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0012-fix-crash-in-flush_icache_page_asm-on-PA1.1.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0012-fix-crash-in-flush_icache_page_asm-on-PA1.1.patch
--- /dev/null
@@ -0,0 +1,91 @@
+From 95093fb411e522ec7a6c33d12863107ba841fe72 Mon Sep 17 00:00:00 2001
+From: John David Anglin <dave.anglin@bell.net>
+Date: Wed, 16 May 2012 10:14:52 +0100
+Subject: [PATCH 012/117] fix crash in flush_icache_page_asm on PA1.1
+
+commit 207f583d7179f707f402c36a7bda5ca1fd03ad5b upstream.
+
+As pointed out by serveral people, PA1.1 only has a type 26 instruction
+meaning that the space register must be explicitly encoded. Not giving an
+explicit space means that the compiler uses the type 24 version which is PA2.0
+only resulting in an illegal instruction crash.
+
+This regression was caused by
+
+ commit f311847c2fcebd81912e2f0caf8a461dec28db41
+ Author: James Bottomley <James.Bottomley@HansenPartnership.com>
+ Date: Wed Dec 22 10:22:11 2010 -0600
+
+ parisc: flush pages through tmpalias space
+
+Reported-by: Helge Deller <deller@gmx.de>
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/parisc/kernel/pacache.S | 38 ++++++++++++++++++++------------------
+ 1 file changed, 20 insertions(+), 18 deletions(-)
+
+diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
+index 93ff3d9..5d7218a 100644
+--- a/arch/parisc/kernel/pacache.S
++++ b/arch/parisc/kernel/pacache.S
+@@ -692,7 +692,7 @@ ENTRY(flush_icache_page_asm)
+
+ /* Purge any old translation */
+
+- pitlb (%sr0,%r28)
++ pitlb (%sr4,%r28)
+
+ ldil L%icache_stride, %r1
+ ldw R%icache_stride(%r1), %r1
+@@ -706,27 +706,29 @@ ENTRY(flush_icache_page_asm)
+ sub %r25, %r1, %r25
+
+
+-1: fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
+- fic,m %r1(%r28)
++ /* fic only has the type 26 form on PA1.1, requiring an
++ * explicit space specification, so use %sr4 */
++1: fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
++ fic,m %r1(%sr4,%r28)
+ cmpb,COND(<<) %r28, %r25,1b
+- fic,m %r1(%r28)
++ fic,m %r1(%sr4,%r28)
+
+ sync
+ bv %r0(%r2)
+- pitlb (%sr0,%r25)
++ pitlb (%sr4,%r25)
+ .exit
+
+ .procend
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0013-fix-panic-on-prefetch-NULL-on-PA7300LC.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0013-fix-panic-on-prefetch-NULL-on-PA7300LC.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0013-fix-panic-on-prefetch-NULL-on-PA7300LC.patch
@@ -0,0 +1,39 @@
+From ae4fc9e89e9e7fb510ddbff1c3ca6d41477f45e1 Mon Sep 17 00:00:00 2001
+From: James Bottomley <JBottomley@Parallels.com>
+Date: Wed, 16 May 2012 11:10:27 +0100
+Subject: [PATCH 013/117] fix panic on prefetch(NULL) on PA7300LC
+
+commit b3cb8674811d1851bbf1486a73d62b90c119b994 upstream.
+
+Due to an errata, the PA7300LC generates a TLB miss interruption even on the
+prefetch instruction. This means that prefetch(NULL), which is supposed to be
+a nop on linux actually generates a NULL deref fault. Fix this by testing the
+address of prefetch against NULL before doing the prefetch.
+
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/parisc/include/asm/prefetch.h | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/parisc/include/asm/prefetch.h b/arch/parisc/include/asm/prefetch.h
+index c5edc60..1ee7c82 100644
+--- a/arch/parisc/include/asm/prefetch.h
++++ b/arch/parisc/include/asm/prefetch.h
+@@ -21,7 +21,12 @@
+ #define ARCH_HAS_PREFETCH
+ static inline void prefetch(const void *addr)
+ {
+- __asm__("ldw 0(%0), %%r0" : : "r" (addr));
++ __asm__(
++#ifndef CONFIG_PA20
++ /* Need to avoid prefetch of NULL on PA7300LC */
++ " extrw,u,= %0,31,32,%%r0\n"
++#endif
++ " ldw 0(%0), %%r0" : : "r" (addr));
+ }
+
+ /* LDD is a PA2.0 addition. */
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0014-arch-tile-Kconfig-remove-pointless-M386-test.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0014-arch-tile-Kconfig-remove-pointless-M386-test.patch
--- /dev/null
@@ -0,0 +1,31 @@
+From 083a3c3d326ad085b05c8606f4ea8594ca6467b8 Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Tue, 27 Mar 2012 13:47:57 -0400
+Subject: [PATCH 014/117] arch/tile/Kconfig: remove pointless "!M386" test.
+
+commit 8d6951439ef524683057251f1231df232046b6b6 upstream.
+
+Looks like a cut and paste bug from the x86 version.
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/tile/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
+index 70a0de4..7c9d2d4 100644
+--- a/arch/tile/Kconfig
++++ b/arch/tile/Kconfig
+@@ -12,7 +12,7 @@ config TILE
+ select GENERIC_PENDING_IRQ if SMP
+ select GENERIC_IRQ_SHOW
+ select SYS_HYPERVISOR
+- select ARCH_HAVE_NMI_SAFE_CMPXCHG if !M386
++ select ARCH_HAVE_NMI_SAFE_CMPXCHG
+
+ # FIXME: investigate whether we need/want these options.
+ # select HAVE_IOREMAP_PROT
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0015-tilegx-enable-SYSCALL_WRAPPERS-support.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0015-tilegx-enable-SYSCALL_WRAPPERS-support.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0015-tilegx-enable-SYSCALL_WRAPPERS-support.patch
@@ -0,0 +1,39 @@
+From 7f297eaca9b90a9be05ebe02c90efca3692136db Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Fri, 18 May 2012 13:33:24 -0400
+Subject: [PATCH 015/117] tilegx: enable SYSCALL_WRAPPERS support
+
+commit e6d9668e119af44ae5bcd5f1197174531458afe3 upstream.
+
+Some discussion with the glibc mailing lists revealed that this was
+necessary for 64-bit platforms with MIPS-like sign-extension rules
+for 32-bit values. The original symptom was that passing (uid_t)-1 to
+setreuid() was failing in programs linked -pthread because of the "setxid"
+mechanism for passing setxid-type function arguments to the syscall code.
+SYSCALL_WRAPPERS handles ensuring that all syscall arguments end up with
+proper sign-extension and is thus the appropriate fix for this problem.
+
+On other platforms (s390, powerpc, sparc64, and mips) this was fixed
+in 2.6.28.6. The general issue is tracked as CVE-2009-0029.
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/tile/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
+index 7c9d2d4..6cb8319 100644
+--- a/arch/tile/Kconfig
++++ b/arch/tile/Kconfig
+@@ -11,6 +11,7 @@ config TILE
+ select GENERIC_IRQ_PROBE
+ select GENERIC_PENDING_IRQ if SMP
+ select GENERIC_IRQ_SHOW
++ select HAVE_SYSCALL_WRAPPERS if TILEGX
+ select SYS_HYPERVISOR
+ select ARCH_HAVE_NMI_SAFE_CMPXCHG
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0016-mtd-sm_ftl-fix-typo-in-major-number.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0016-mtd-sm_ftl-fix-typo-in-major-number.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0016-mtd-sm_ftl-fix-typo-in-major-number.patch
@@ -0,0 +1,33 @@
+From 183929ad3fad7588523ae70fa91912196d4697db Mon Sep 17 00:00:00 2001
+From: Maxim Levitsky <maximlevitsky@gmail.com>
+Date: Sat, 17 Mar 2012 20:16:53 +0200
+Subject: [PATCH 016/117] mtd: sm_ftl: fix typo in major number.
+
+commit 452380efbd72d8d41f53ea64c8a6ea1fedc4394d upstream.
+
+major == 0 allocates dynamic major, not major == -1
+
+Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/mtd/sm_ftl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
+index fddb714..a9ff89ff 100644
+--- a/drivers/mtd/sm_ftl.c
++++ b/drivers/mtd/sm_ftl.c
+@@ -1256,7 +1256,7 @@ static void sm_remove_dev(struct mtd_blktrans_dev *dev)
+
+ static struct mtd_blktrans_ops sm_ftl_ops = {
+ .name = "smblk",
+- .major = -1,
++ .major = 0,
+ .part_bits = SM_FTL_PARTN_BITS,
+ .blksize = SM_SECTOR_SIZE,
+ .getgeo = sm_getgeo,
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0017-hpsa-Fix-problem-with-MSA2xxx-devices.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0017-hpsa-Fix-problem-with-MSA2xxx-devices.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0017-hpsa-Fix-problem-with-MSA2xxx-devices.patch
@@ -0,0 +1,77 @@
+From 3b1c9abc52f8145721d64abf54bf65139554f2be Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+Date: Thu, 19 Jan 2012 14:01:04 -0600
+Subject: [PATCH 017/117] hpsa: Fix problem with MSA2xxx devices
+
+commit 9bc3711cbb67ac620bf09b4a147cbab45b2c36c0 upstream.
+
+Upgraded firmware on Smart Array P7xx (and some others) made them show up as
+SCSI revision 5 devices and this caused the driver to fail to map MSA2xxx
+logical drives to the correct bus/target/lun. A symptom of this would be that
+the target ID of the logical drives as presented by the external storage array
+is ignored, and all such logical drives are assigned to target zero,
+differentiated only by LUN. Some multipath software reportedly does not deal
+well with this behavior, failing to recognize different paths to the same
+device as such.
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
+Signed-off-by: Scott Teel <scott.teel@hp.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/scsi/hpsa.c | 34 +++++++++++++++-------------------
+ 1 file changed, 15 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 865d452..dc9dea3 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -1674,30 +1674,26 @@ static void figure_bus_target_lun(struct ctlr_info *h,
+
+ if (is_logical_dev_addr_mode(lunaddrbytes)) {
+ /* logical device */
+- if (unlikely(is_scsi_rev_5(h))) {
+- /* p1210m, logical drives lun assignments
+- * match SCSI REPORT LUNS data.
++ lunid = le32_to_cpu(*((__le32 *) lunaddrbytes));
++ if (is_msa2xxx(h, device)) {
++ /* msa2xxx way, put logicals on bus 1
++ * and match target/lun numbers box
++ * reports.
+ */
+- lunid = le32_to_cpu(*((__le32 *) lunaddrbytes));
+- *bus = 0;
+- *target = 0;
+- *lun = (lunid & 0x3fff) + 1;
++ *bus = 1;
++ *target = (lunid >> 16) & 0x3fff;
++ *lun = lunid & 0x00ff;
+ } else {
+- /* not p1210m... */
+- lunid = le32_to_cpu(*((__le32 *) lunaddrbytes));
+- if (is_msa2xxx(h, device)) {
+- /* msa2xxx way, put logicals on bus 1
+- * and match target/lun numbers box
+- * reports.
+- */
+- *bus = 1;
+- *target = (lunid >> 16) & 0x3fff;
+- *lun = lunid & 0x00ff;
++ if (likely(is_scsi_rev_5(h))) {
++ /* All current smart arrays (circa 2011) */
++ *bus = 0;
++ *target = 0;
++ *lun = (lunid & 0x3fff) + 1;
+ } else {
+- /* Traditional smart array way. */
++ /* Traditional old smart array way. */
+ *bus = 0;
+- *lun = 0;
+ *target = lunid & 0x3fff;
++ *lun = 0;
+ }
+ }
+ } else {
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0018-SELinux-if-sel_make_bools-errors-don-t-leave-inconsi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0018-SELinux-if-sel_make_bools-errors-don-t-leave-inconsi.patch
--- /dev/null
@@ -0,0 +1,34 @@
+From d5263c321d2e9dcacc4eed438d3dad60c13f95ba Mon Sep 17 00:00:00 2001
+From: Eric Paris <eparis@redhat.com>
+Date: Wed, 4 Apr 2012 13:47:11 -0400
+Subject: [PATCH 018/117] SELinux: if sel_make_bools errors don't leave
+ inconsistent state
+
+commit 154c50ca4eb9ae472f50b6a481213e21ead4457d upstream.
+
+We reset the bool names and values array to NULL, but do not reset the
+number of entries in these arrays to 0. If we error out and then get back
+into this function we will walk these NULL pointers based on the belief
+that they are non-zero length.
+
+Signed-off-by: Eric Paris <eparis@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ security/selinux/selinuxfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index f466587..b4f802d 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -1238,6 +1238,7 @@ static int sel_make_bools(void)
+ kfree(bool_pending_names[i]);
+ kfree(bool_pending_names);
+ kfree(bool_pending_values);
++ bool_num = 0;
+ bool_pending_names = NULL;
+ bool_pending_values = NULL;
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0019-cfg80211-warn-if-db.txt-is-empty-with-CONFIG_CFG8021.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0019-cfg80211-warn-if-db.txt-is-empty-with-CONFIG_CFG8021.patch
--- /dev/null
@@ -0,0 +1,86 @@
+From d9029a9d61ea9f9f8b153d7967365d66229b3874 Mon Sep 17 00:00:00 2001
+From: "Luis R. Rodriguez" <mcgrof@frijolero.org>
+Date: Fri, 23 Mar 2012 07:23:31 -0700
+Subject: [PATCH 019/117] cfg80211: warn if db.txt is empty with
+ CONFIG_CFG80211_INTERNAL_REGDB
+
+commit 80007efeff0568375b08faf93c7aad65602cb97e upstream.
+
+It has happened twice now where elaborate troubleshooting has
+undergone on systems where CONFIG_CFG80211_INTERNAL_REGDB [0]
+has been set but yet net/wireless/db.txt was not updated.
+
+Despite the documentation on this it seems system integrators could
+use some more help with this, so throw out a kernel warning at boot time
+when their database is empty.
+
+This does mean that the error-prone system integrator won't likely
+realize the issue until they boot the machine but -- it does not seem
+to make sense to enable a build bug breaking random build testing.
+
+[0] http://wireless.kernel.org/en/developers/Regulatory/CRDA#CONFIG_CFG80211_INTERNAL_REGDB
+
+Cc: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Youngsin Lee <youngsin@qualcomm.com>
+Cc: Raja Mani <rmani@qca.qualcomm.com>
+Cc: Senthil Kumar Balasubramanian <senthilb@qca.qualcomm.com>
+Cc: Vipin Mehta <vipimeht@qca.qualcomm.com>
+Cc: yahuan@qca.qualcomm.com
+Cc: jjan@qca.qualcomm.com
+Cc: vthiagar@qca.qualcomm.com
+Cc: henrykim@qualcomm.com
+Cc: jouni@qca.qualcomm.com
+Cc: athiruve@qca.qualcomm.com
+Cc: cjkim@qualcomm.com
+Cc: philipk@qca.qualcomm.com
+Cc: sunnykim@qualcomm.com
+Cc: sskwak@qualcomm.com
+Cc: kkim@qualcomm.com
+Cc: mattbyun@qualcomm.com
+Cc: ryanlee@qualcomm.com
+Cc: simbap@qualcomm.com
+Cc: krislee@qualcomm.com
+Cc: conner@qualcomm.com
+Cc: hojinkim@qualcomm.com
+Cc: honglee@qualcomm.com
+Cc: johnwkim@qualcomm.com
+Cc: jinyong@qca.qualcomm.com
+Signed-off-by: Luis R. Rodriguez <mcgrof@frijolero.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/wireless/reg.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 3302c56..c1c99dd 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -379,7 +379,15 @@ static void reg_regdb_query(const char *alpha2)
+
+ schedule_work(®_regdb_work);
+ }
++
++/* Feel free to add any other sanity checks here */
++static void reg_regdb_size_check(void)
++{
++ /* We should ideally BUILD_BUG_ON() but then random builds would fail */
++ WARN_ONCE(!reg_regdb_size, "db.txt is empty, you should update it...");
++}
+ #else
++static inline void reg_regdb_size_check(void) {}
+ static inline void reg_regdb_query(const char *alpha2) {}
+ #endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
+@@ -2236,6 +2244,8 @@ int __init regulatory_init(void)
+ spin_lock_init(®_requests_lock);
+ spin_lock_init(®_pending_beacons_lock);
+
++ reg_regdb_size_check();
++
+ cfg80211_regdomain = cfg80211_world_regdom;
+
+ user_alpha2[0] = '9';
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0020-mpt2sas-Fix-for-panic-happening-because-of-improper-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0020-mpt2sas-Fix-for-panic-happening-because-of-improper-.patch
--- /dev/null
@@ -0,0 +1,60 @@
+From b12bc1d8337657ea79d90aecba397eaee36d10f6 Mon Sep 17 00:00:00 2001
+From: "nagalakshmi.nandigama@lsi.com" <nagalakshmi.nandigama@lsi.com>
+Date: Tue, 20 Mar 2012 12:10:01 +0530
+Subject: [PATCH 020/117] mpt2sas: Fix for panic happening because of improper
+ memory allocation
+
+commit e42fafc25fa86c61824e8d4c5e7582316415d24f upstream.
+
+The ioc->pfacts member in the IOC structure is getting set to zero
+following a call to _base_get_ioc_facts due to the memset in that routine.
+So if the ioc->pfacts was read after a host reset, there would be a NULL
+pointer dereference. The routine _base_get_ioc_facts is called from context
+of host reset. The problem in _base_get_ioc_facts is the size of
+Mpi2IOCFactsReply is 64, whereas the sizeof "struct mpt2sas_facts" is 60,
+so there is a four byte overflow resulting from the memset.
+
+Also, there is memset in _base_get_port_facts using the incorrect structure,
+it should be "struct mpt2sas_port_facts" instead of Mpi2PortFactsReply.
+
+Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
+index b1ddfef..ac336e1 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -3274,7 +3274,7 @@ _base_get_port_facts(struct MPT2SAS_ADAPTER *ioc, int port, int sleep_flag)
+ }
+
+ pfacts = &ioc->pfacts[port];
+- memset(pfacts, 0, sizeof(Mpi2PortFactsReply_t));
++ memset(pfacts, 0, sizeof(struct mpt2sas_port_facts));
+ pfacts->PortNumber = mpi_reply.PortNumber;
+ pfacts->VP_ID = mpi_reply.VP_ID;
+ pfacts->VF_ID = mpi_reply.VF_ID;
+@@ -3316,7 +3316,7 @@ _base_get_ioc_facts(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ }
+
+ facts = &ioc->facts;
+- memset(facts, 0, sizeof(Mpi2IOCFactsReply_t));
++ memset(facts, 0, sizeof(struct mpt2sas_facts));
+ facts->MsgVersion = le16_to_cpu(mpi_reply.MsgVersion);
+ facts->HeaderVersion = le16_to_cpu(mpi_reply.HeaderVersion);
+ facts->VP_ID = mpi_reply.VP_ID;
+@@ -4193,7 +4193,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
+ goto out_free_resources;
+
+ ioc->pfacts = kcalloc(ioc->facts.NumberOfPorts,
+- sizeof(Mpi2PortFactsReply_t), GFP_KERNEL);
++ sizeof(struct mpt2sas_port_facts), GFP_KERNEL);
+ if (!ioc->pfacts) {
+ r = -ENOMEM;
+ goto out_free_resources;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0021-isdn-gigaset-ratelimit-CAPI-message-dumps.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0021-isdn-gigaset-ratelimit-CAPI-message-dumps.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0021-isdn-gigaset-ratelimit-CAPI-message-dumps.patch
@@ -0,0 +1,87 @@
+From cb510e3381f2dda5ad0cdf3519e6eee50ee2081e Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Wed, 25 Apr 2012 13:02:19 +0000
+Subject: [PATCH 021/117] isdn/gigaset: ratelimit CAPI message dumps
+
+commit 8e618aad5348b6e6c5a90e8d97ea643197963b20 upstream.
+
+Introduce a global ratelimit for CAPI message dumps to protect
+against possible log flood.
+Drop the ratelimit for ignored messages which is now covered by the
+global one.
+
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/isdn/gigaset/capi.c | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
+index 6d5ceee..5b80ef7 100644
+--- a/drivers/isdn/gigaset/capi.c
++++ b/drivers/isdn/gigaset/capi.c
+@@ -14,6 +14,7 @@
+ #include "gigaset.h"
+ #include <linux/proc_fs.h>
+ #include <linux/seq_file.h>
++#include <linux/ratelimit.h>
+ #include <linux/isdn/capilli.h>
+ #include <linux/isdn/capicmd.h>
+ #include <linux/isdn/capiutil.h>
+@@ -223,10 +224,14 @@ get_appl(struct gigaset_capi_ctr *iif, u16 appl)
+ static inline void dump_cmsg(enum debuglevel level, const char *tag, _cmsg *p)
+ {
+ #ifdef CONFIG_GIGASET_DEBUG
++ /* dump at most 20 messages in 20 secs */
++ static DEFINE_RATELIMIT_STATE(msg_dump_ratelimit, 20 * HZ, 20);
+ _cdebbuf *cdb;
+
+ if (!(gigaset_debuglevel & level))
+ return;
++ if (!___ratelimit(&msg_dump_ratelimit, tag))
++ return;
+
+ cdb = capi_cmsg2str(p);
+ if (cdb) {
+@@ -2059,12 +2064,6 @@ static void do_reset_b3_req(struct gigaset_capi_ctr *iif,
+ }
+
+ /*
+- * dump unsupported/ignored messages at most twice per minute,
+- * some apps send those very frequently
+- */
+-static unsigned long ignored_msg_dump_time;
+-
+-/*
+ * unsupported CAPI message handler
+ */
+ static void do_unsupported(struct gigaset_capi_ctr *iif,
+@@ -2073,8 +2072,7 @@ static void do_unsupported(struct gigaset_capi_ctr *iif,
+ {
+ /* decode message */
+ capi_message2cmsg(&iif->acmsg, skb->data);
+- if (printk_timed_ratelimit(&ignored_msg_dump_time, 30 * 1000))
+- dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
++ dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+ send_conf(iif, ap, skb, CapiMessageNotSupportedInCurrentState);
+ }
+
+@@ -2085,11 +2083,9 @@ static void do_nothing(struct gigaset_capi_ctr *iif,
+ struct gigaset_capi_appl *ap,
+ struct sk_buff *skb)
+ {
+- if (printk_timed_ratelimit(&ignored_msg_dump_time, 30 * 1000)) {
+- /* decode message */
+- capi_message2cmsg(&iif->acmsg, skb->data);
+- dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+- }
++ /* decode message */
++ capi_message2cmsg(&iif->acmsg, skb->data);
++ dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+ dev_kfree_skb_any(skb);
+ }
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0022-isdn-gigaset-fix-CAPI-disconnect-B3-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0022-isdn-gigaset-fix-CAPI-disconnect-B3-handling.patch
--- /dev/null
@@ -0,0 +1,46 @@
+From 49aed427d03f5bc84f690900a4a13c52b4c0916c Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Wed, 25 Apr 2012 13:02:20 +0000
+Subject: [PATCH 022/117] isdn/gigaset: fix CAPI disconnect B3 handling
+
+commit 62a1cfe052346b96a552b6a9178d412c709711bb upstream.
+
+If DISCONNECT_B3_IND was synthesized because of a DISCONNECT_REQ
+with existing logical connections, the connection state wasn't
+updated accordingly. Also the emitted DISCONNECT_B3_IND message
+wasn't included in the debug log as requested.
+This patch fixes both of these issues.
+
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/isdn/gigaset/capi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
+index 5b80ef7..fd17bb3 100644
+--- a/drivers/isdn/gigaset/capi.c
++++ b/drivers/isdn/gigaset/capi.c
+@@ -1887,6 +1887,9 @@ static void do_disconnect_req(struct gigaset_capi_ctr *iif,
+
+ /* check for active logical connection */
+ if (bcs->apconnstate >= APCONN_ACTIVE) {
++ /* clear it */
++ bcs->apconnstate = APCONN_SETUP;
++
+ /*
+ * emit DISCONNECT_B3_IND with cause 0x3301
+ * use separate cmsg structure, as the content of iif->acmsg
+@@ -1911,6 +1914,7 @@ static void do_disconnect_req(struct gigaset_capi_ctr *iif,
+ }
+ capi_cmsg2message(b3cmsg,
+ __skb_put(b3skb, CAPI_DISCONNECT_B3_IND_BASELEN));
++ dump_cmsg(DEBUG_CMD, __func__, b3cmsg);
+ kfree(b3cmsg);
+ capi_ctr_handle_message(&iif->ctr, ap->id, b3skb);
+ }
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0023-isdn-gigaset-improve-error-handling-querying-firmwar.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0023-isdn-gigaset-improve-error-handling-querying-firmwar.patch
--- /dev/null
@@ -0,0 +1,47 @@
+From acee45e91a831a741676284dc84513b074705805 Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Wed, 25 Apr 2012 13:02:20 +0000
+Subject: [PATCH 023/117] isdn/gigaset: improve error handling querying
+ firmware version
+
+commit e055d03dc088a990fe5ea24a2d64033a168da23c upstream.
+
+An out-of-place "OK" response to the "AT+GMR" (get firmware version)
+command turns out to be, more often than not, a delayed response to
+a previous command rather than an actual error, so continue waiting
+for the version number in that case.
+
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[bwh: Backported to 3.2: adjust indentation]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/isdn/gigaset/ev-layer.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
+index 6d12623..e95fac0 100644
+--- a/drivers/isdn/gigaset/ev-layer.c
++++ b/drivers/isdn/gigaset/ev-layer.c
+@@ -190,6 +190,7 @@ struct reply_t gigaset_tab_nocid[] =
+ ACT_INIT} },
+ {RSP_OK, 121, 121, -1, 0, 0, {ACT_GOTVER,
+ ACT_INIT} },
++{RSP_NONE, 121, 121, -1, 120, 0, {ACT_GETSTRING} },
+
+ /* leave dle mode */
+ {RSP_INIT, 0, 0, SEQ_DLE0, 201, 5, {0}, "^SDLE=0\r"},
+@@ -1314,8 +1315,9 @@ static void do_action(int action, struct cardstate *cs,
+ s = ev->ptr;
+
+ if (!strcmp(s, "OK")) {
++ /* OK without version string: assume old response */
+ *p_genresp = 1;
+- *p_resp_code = RSP_ERROR;
++ *p_resp_code = RSP_NONE;
+ break;
+ }
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0024-KEYS-Use-the-compat-keyctl-syscall-wrapper-on-Sparc6.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0024-KEYS-Use-the-compat-keyctl-syscall-wrapper-on-Sparc6.patch
--- /dev/null
@@ -0,0 +1,60 @@
+From ab5b15d0550f35ed49bb445fe04092d8b6fac542 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Fri, 11 May 2012 10:56:56 +0100
+Subject: [PATCH 024/117] KEYS: Use the compat keyctl() syscall wrapper on
+ Sparc64 for Sparc32 compat
+
+commit 45de6767dc51358a188f75dc4ad9dfddb7fb9480 upstream.
+
+Use the 32-bit compat keyctl() syscall wrapper on Sparc64 for Sparc32 binary
+compatibility.
+
+Without this, keyctl(KEYCTL_INSTANTIATE_IOV) is liable to malfunction as it
+uses an iovec array read from userspace - though the kernel should survive this
+as it checks pointers and sizes anyway.
+
+I think all the other keyctl() function should just work, provided (a) the top
+32-bits of each 64-bit argument register are cleared prior to invoking the
+syscall routine, and the 32-bit address space is right at the 0-end of the
+64-bit address space. Most of the arguments are 32-bit anyway, and so for
+those clearing is not required.
+
+Signed-off-by: David Howells <dhowells@redhat.com
+cc: "David S. Miller" <davem@davemloft.net>
+cc: sparclinux@vger.kernel.org
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/sparc/Kconfig | 3 +++
+ arch/sparc/kernel/systbls_64.S | 2 +-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index f92602e..f210d51 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -583,6 +583,9 @@ config SYSVIPC_COMPAT
+ depends on COMPAT && SYSVIPC
+ default y
+
++config KEYS_COMPAT
++ def_bool y if COMPAT && KEYS
++
+ endmenu
+
+ source "net/Kconfig"
+diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
+index db86b1a..3a58e0d 100644
+--- a/arch/sparc/kernel/systbls_64.S
++++ b/arch/sparc/kernel/systbls_64.S
+@@ -74,7 +74,7 @@ sys_call_table32:
+ .word sys_timer_delete, compat_sys_timer_create, sys_ni_syscall, compat_sys_io_setup, sys_io_destroy
+ /*270*/ .word sys32_io_submit, sys_io_cancel, compat_sys_io_getevents, sys32_mq_open, sys_mq_unlink
+ .word compat_sys_mq_timedsend, compat_sys_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, compat_sys_waitid
+-/*280*/ .word sys32_tee, sys_add_key, sys_request_key, sys_keyctl, compat_sys_openat
++/*280*/ .word sys32_tee, sys_add_key, sys_request_key, compat_sys_keyctl, compat_sys_openat
+ .word sys_mkdirat, sys_mknodat, sys_fchownat, compat_sys_futimesat, compat_sys_fstatat64
+ /*290*/ .word sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
+ .word sys_fchmodat, sys_faccessat, compat_sys_pselect6, compat_sys_ppoll, sys_unshare
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0025-IB-core-Fix-mismatch-between-locked-and-pinned-pages.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0025-IB-core-Fix-mismatch-between-locked-and-pinned-pages.patch
--- /dev/null
@@ -0,0 +1,38 @@
+From a107ab4ce96a6243eca41ca139acc033a8be253b Mon Sep 17 00:00:00 2001
+From: Yishai Hadas <yishaih@mellanox.com>
+Date: Thu, 10 May 2012 23:28:05 +0300
+Subject: [PATCH 025/117] IB/core: Fix mismatch between locked and pinned
+ pages
+
+commit c4870eb874ac16dccef40e1bc7a002c7e9156adc upstream.
+
+Commit bc3e53f682d9 ("mm: distinguish between mlocked and pinned
+pages") introduced a separate counter for pinned pages and used it in
+the IB stack. However, in ib_umem_get() the pinned counter is
+incremented, but ib_umem_release() wrongly decrements the locked
+counter. Fix this.
+
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Reviewed-by: Christoph Lameter <cl@linux.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/infiniband/core/umem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index 71f0c0f..a841123 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -269,7 +269,7 @@ void ib_umem_release(struct ib_umem *umem)
+ } else
+ down_write(&mm->mmap_sem);
+
+- current->mm->locked_vm -= diff;
++ current->mm->pinned_vm -= diff;
+ up_write(&mm->mmap_sem);
+ mmput(mm);
+ kfree(umem);
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0026-regulator-core-Release-regulator-regulator-supplies-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0026-regulator-core-Release-regulator-regulator-supplies-.patch
--- /dev/null
@@ -0,0 +1,34 @@
+From 675478b722ec5e21b9e1db453e3c59ced85b2008 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Sun, 13 May 2012 18:35:56 +0100
+Subject: [PATCH 026/117] regulator: core: Release regulator-regulator
+ supplies on error
+
+commit e81dba85c6388dfabcb76cbc2b8bd02836a53ae5 upstream.
+
+If we fail while registering a regulator make sure we release the supply
+for the regulator if there is one.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/regulator/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 938398f..6ec610c 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -2765,6 +2765,8 @@ unset_supplies:
+ unset_regulator_supplies(rdev);
+
+ scrub:
++ if (rdev->supply)
++ regulator_put(rdev->supply);
+ kfree(rdev->constraints);
+ device_unregister(&rdev->dev);
+ /* device core frees rdev */
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0027-iommu-Fix-off-by-one-in-dmar_get_fault_reason.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0027-iommu-Fix-off-by-one-in-dmar_get_fault_reason.patch
--- /dev/null
@@ -0,0 +1,41 @@
+From 3dd0f718e41c8a6e580d3c11f8153ffd7ddeacde Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sun, 13 May 2012 20:09:38 +0300
+Subject: [PATCH 027/117] iommu: Fix off by one in dmar_get_fault_reason()
+
+commit fefe1ed1398b81e3fadc92d11d91162d343c8836 upstream.
+
+fault_reason - 0x20 == ARRAY_SIZE(irq_remap_fault_reasons) is
+one past the end of the array.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+Cc: Youquan Song <youquan.song@intel.com>
+Cc: walter harms <wharms@bfs.de>
+Cc: Suresh Siddha <suresh.b.siddha@intel.com>
+Link: http://lkml.kernel.org/r/20120513170938.GA4280@elgon.mountain
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+[bwh: Backported to 3.2: s/irq_remap_fault_reasons/intr_remap_fault_reasons/]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/iommu/dmar.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 35c1e17..97b2e21 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1056,8 +1056,8 @@ static const char *intr_remap_fault_reasons[] =
+
+ const char *dmar_get_fault_reason(u8 fault_reason, int *fault_type)
+ {
+- if (fault_reason >= 0x20 && (fault_reason <= 0x20 +
+- ARRAY_SIZE(intr_remap_fault_reasons))) {
++ if (fault_reason >= 0x20 && (fault_reason - 0x20 <
++ ARRAY_SIZE(intr_remap_fault_reasons))) {
+ *fault_type = INTR_REMAP;
+ return intr_remap_fault_reasons[fault_reason - 0x20];
+ } else if (fault_reason < ARRAY_SIZE(dma_remap_fault_reasons)) {
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0028-RDMA-cxgb4-Always-wake-up-waiters-in-c4iw_peer_abort.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0028-RDMA-cxgb4-Always-wake-up-waiters-in-c4iw_peer_abort.patch
--- /dev/null
@@ -0,0 +1,38 @@
+From e8cefa61ecf62e7ec98658843627df00696699d5 Mon Sep 17 00:00:00 2001
+From: Steve Wise <swise@opengridcomputing.com>
+Date: Fri, 27 Apr 2012 09:59:16 -0500
+Subject: [PATCH 028/117] RDMA/cxgb4: Always wake up waiters in
+ c4iw_peer_abort_intr()
+
+commit 0f1dcfae6bc5563424346ad3a03282b8235a4c33 upstream.
+
+This fixes a race where an ingress abort fails to wake up the thread
+blocked in rdma_init() causing the app to hang.
+
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 0747004..151334c 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2725,11 +2725,8 @@ static int peer_abort_intr(struct c4iw_dev *dev, struct sk_buff *skb)
+
+ /*
+ * Wake up any threads in rdma_init() or rdma_fini().
+- * However, this is not needed if com state is just
+- * MPA_REQ_SENT
+ */
+- if (ep->com.state != MPA_REQ_SENT)
+- c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
++ c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
+ sched(dev, skb);
+ return 0;
+ }
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0029-RDMA-cxgb4-Drop-peer_abort-when-no-endpoint-found.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0029-RDMA-cxgb4-Drop-peer_abort-when-no-endpoint-found.patch
--- /dev/null
@@ -0,0 +1,37 @@
+From 6ccdd0ede34681b1bdda91a5735e700274db9e5c Mon Sep 17 00:00:00 2001
+From: Steve Wise <swise@opengridcomputing.com>
+Date: Mon, 30 Apr 2012 15:31:29 -0500
+Subject: [PATCH 029/117] RDMA/cxgb4: Drop peer_abort when no endpoint found
+
+commit 14b9222808bb8bfefc71f72bc0dbdcf3b2f0140f upstream.
+
+Log a warning and drop the abort message. Otherwise we will do a
+bogus wake_up() and crash.
+
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 151334c..2e6a538 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2714,6 +2714,12 @@ static int peer_abort_intr(struct c4iw_dev *dev, struct sk_buff *skb)
+ unsigned int tid = GET_TID(req);
+
+ ep = lookup_tid(t, tid);
++ if (!ep) {
++ printk(KERN_WARNING MOD
++ "Abort on non-existent endpoint, tid %d\n", tid);
++ kfree_skb(skb);
++ return 0;
++ }
+ if (is_neg_adv_abort(req->status)) {
+ PDBG("%s neg_adv_abort ep %p tid %u\n", __func__, ep,
+ ep->hwtid);
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0030-s390-pfault-fix-task-state-race.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0030-s390-pfault-fix-task-state-race.patch
--- /dev/null
@@ -0,0 +1,82 @@
+From f292f8180fb1ab073d5e88859f3d05608fa1fbe7 Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Wed, 9 May 2012 09:37:30 +0200
+Subject: [PATCH 030/117] s390/pfault: fix task state race
+
+commit d5e50a51ccbda36b379aba9d1131a852eb908dda upstream.
+
+When setting the current task state to TASK_UNINTERRUPTIBLE this can
+race with a different cpu. The other cpu could set the task state after
+it inspected it (while it was still TASK_RUNNING) to TASK_RUNNING which
+would change the state from TASK_UNINTERRUPTIBLE to TASK_RUNNING again.
+
+This race was always present in the pfault interrupt code but didn't
+cause anything harmful before commit f2db2e6c "[S390] pfault: cpu hotplug
+vs missing completion interrupts" which relied on the fact that after
+setting the task state to TASK_UNINTERRUPTIBLE the task would really
+sleep.
+Since this is not necessarily the case the result may be a list corruption
+of the pfault_list or, as observed, a use-after-free bug while trying to
+access the task_struct of a task which terminated itself already.
+
+To fix this, we need to get a reference of the affected task when receiving
+the initial pfault interrupt and add special handling if we receive yet
+another initial pfault interrupt when the task is already enqueued in the
+pfault list.
+
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Reviewed-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/s390/mm/fault.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
+index c7f0fbc..b28aaa4 100644
+--- a/arch/s390/mm/fault.c
++++ b/arch/s390/mm/fault.c
+@@ -583,6 +583,7 @@ static void pfault_interrupt(unsigned int ext_int_code,
+ tsk->thread.pfault_wait = 0;
+ list_del(&tsk->thread.list);
+ wake_up_process(tsk);
++ put_task_struct(tsk);
+ } else {
+ /* Completion interrupt was faster than initial
+ * interrupt. Set pfault_wait to -1 so the initial
+@@ -597,14 +598,22 @@ static void pfault_interrupt(unsigned int ext_int_code,
+ put_task_struct(tsk);
+ } else {
+ /* signal bit not set -> a real page is missing. */
+- if (tsk->thread.pfault_wait == -1) {
++ if (tsk->thread.pfault_wait == 1) {
++ /* Already on the list with a reference: put to sleep */
++ set_task_state(tsk, TASK_UNINTERRUPTIBLE);
++ set_tsk_need_resched(tsk);
++ } else if (tsk->thread.pfault_wait == -1) {
+ /* Completion interrupt was faster than the initial
+ * interrupt (pfault_wait == -1). Set pfault_wait
+ * back to zero and exit. */
+ tsk->thread.pfault_wait = 0;
+ } else {
+ /* Initial interrupt arrived before completion
+- * interrupt. Let the task sleep. */
++ * interrupt. Let the task sleep.
++ * An extra task reference is needed since a different
++ * cpu may set the task state to TASK_RUNNING again
++ * before the scheduler is reached. */
++ get_task_struct(tsk);
+ tsk->thread.pfault_wait = 1;
+ list_add(&tsk->thread.list, &pfault_list);
+ set_task_state(tsk, TASK_UNINTERRUPTIBLE);
+@@ -629,6 +638,7 @@ static int __cpuinit pfault_cpu_notify(struct notifier_block *self,
+ list_del(&thread->list);
+ tsk = container_of(thread, struct task_struct, thread);
+ wake_up_process(tsk);
++ put_task_struct(tsk);
+ }
+ spin_unlock_irq(&pfault_lock);
+ break;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0031-isci-fix-oem-parameter-validation-on-single-controll.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0031-isci-fix-oem-parameter-validation-on-single-controll.patch
--- /dev/null
@@ -0,0 +1,46 @@
+From 51945640120dea3c9b3a0207bc864138c6c1c8a8 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Mon, 30 Apr 2012 11:57:44 -0700
+Subject: [PATCH 031/117] isci: fix oem parameter validation on single
+ controller skus
+
+commit fc25f79af321c01a739150ba2c09435cf977a63d upstream.
+
+OEM parameters [1] are parsed from the platform option-rom / efi
+driver. By default the driver was validating the parameters for the
+dual-controller case, but in single-controller case only the first set
+of parameters may be valid.
+
+Limit the validation to the number of actual controllers detected
+otherwise the driver may fail to parse the valid parameters leading to
+driver-load or runtime failures.
+
+[1] the platform specific set of phy address, configuration,and analog
+ tuning values
+
+[stable v3.0+]
+Reported-by: Dave Jiang <dave.jiang@intel.com>
+Tested-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/scsi/isci/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
+index a97edab..83d08b6 100644
+--- a/drivers/scsi/isci/init.c
++++ b/drivers/scsi/isci/init.c
+@@ -465,7 +465,7 @@ static int __devinit isci_pci_probe(struct pci_dev *pdev, const struct pci_devic
+ if (!orom)
+ orom = isci_request_oprom(pdev);
+
+- for (i = 0; orom && i < ARRAY_SIZE(orom->ctrl); i++) {
++ for (i = 0; orom && i < num_controllers(pdev); i++) {
+ if (sci_oem_parameters_validate(&orom->ctrl[i])) {
+ dev_warn(&pdev->dev,
+ "[%d]: invalid oem parameters detected, falling back to firmware\n", i);
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0032-Fix-blocking-allocations-called-very-early-during-bo.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0032-Fix-blocking-allocations-called-very-early-during-bo.patch
--- /dev/null
@@ -0,0 +1,69 @@
+From 193433aeaf9380a822cd4bf7f5777e70b2e86550 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Mon, 21 May 2012 12:52:42 -0700
+Subject: [PATCH 032/117] Fix blocking allocations called very early during
+ bootup
+
+commit 31a67102f4762df5544bc2dfb34a931233d2a5b2 upstream.
+
+During early boot, when the scheduler hasn't really been fully set up,
+we really can't do blocking allocations because with certain (dubious)
+configurations the "might_resched()" calls can actually result in
+scheduling events.
+
+We could just make such users always use GFP_ATOMIC, but quite often the
+code that does the allocation isn't really aware of the fact that the
+scheduler isn't up yet, and forcing that kind of random knowledge on the
+initialization code is just annoying and not good for anybody.
+
+And we actually have a the 'gfp_allowed_mask' exactly for this reason:
+it's just that the kernel init sequence happens to set it to allow
+blocking allocations much too early.
+
+So move the 'gfp_allowed_mask' initialization from 'start_kernel()'
+(which is some of the earliest init code, and runs with preemption
+disabled for good reasons) into 'kernel_init()'. kernel_init() is run
+in the newly created thread that will become the 'init' process, as
+opposed to the early startup code that runs within the context of what
+will be the first idle thread.
+
+So by the time we reach 'kernel_init()', we know that the scheduler must
+be at least limping along, because we've already scheduled from the idle
+thread into the init thread.
+
+Reported-by: Steven Rostedt <rostedt@goodmis.org>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ init/main.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/init/main.c b/init/main.c
+index 217ed23..cb08fea2 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -563,9 +563,6 @@ asmlinkage void __init start_kernel(void)
+ early_boot_irqs_disabled = false;
+ local_irq_enable();
+
+- /* Interrupts are enabled now so all GFP allocations are safe. */
+- gfp_allowed_mask = __GFP_BITS_MASK;
+-
+ kmem_cache_init_late();
+
+ /*
+@@ -798,6 +795,10 @@ static int __init kernel_init(void * unused)
+ * Wait until kthreadd is all set-up.
+ */
+ wait_for_completion(&kthreadd_done);
++
++ /* Now the scheduler is fully set up and can do blocking allocations */
++ gfp_allowed_mask = __GFP_BITS_MASK;
++
+ /*
+ * init can allocate pages on any node
+ */
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0033-vfs-make-AIO-use-the-proper-rw_verify_area-area-help.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0033-vfs-make-AIO-use-the-proper-rw_verify_area-area-help.patch
--- /dev/null
@@ -0,0 +1,109 @@
+From 078dda1f3c0c180fc5d408f9f087752a0afbed3f Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Mon, 21 May 2012 16:06:20 -0700
+Subject: [PATCH 033/117] vfs: make AIO use the proper rw_verify_area() area
+ helpers
+
+commit a70b52ec1aaeaf60f4739edb1b422827cb6f3893 upstream.
+
+We had for some reason overlooked the AIO interface, and it didn't use
+the proper rw_verify_area() helper function that checks (for example)
+mandatory locking on the file, and that the size of the access doesn't
+cause us to overflow the provided offset limits etc.
+
+Instead, AIO did just the security_file_permission() thing (that
+rw_verify_area() also does) directly.
+
+This fixes it to do all the proper helper functions, which not only
+means that now mandatory file locking works with AIO too, we can
+actually remove lines of code.
+
+Reported-by: Manish Honap <manish_honap_vit@yahoo.co.in>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/aio.c | 30 ++++++++++++++----------------
+ 1 file changed, 14 insertions(+), 16 deletions(-)
+
+diff --git a/fs/aio.c b/fs/aio.c
+index b9d64d8..3b65ee7 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -1477,6 +1477,10 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
+ if (ret < 0)
+ goto out;
+
++ ret = rw_verify_area(type, kiocb->ki_filp, &kiocb->ki_pos, ret);
++ if (ret < 0)
++ goto out;
++
+ kiocb->ki_nr_segs = kiocb->ki_nbytes;
+ kiocb->ki_cur_seg = 0;
+ /* ki_nbytes/left now reflect bytes instead of segs */
+@@ -1488,11 +1492,17 @@ out:
+ return ret;
+ }
+
+-static ssize_t aio_setup_single_vector(struct kiocb *kiocb)
++static ssize_t aio_setup_single_vector(int type, struct file * file, struct kiocb *kiocb)
+ {
++ int bytes;
++
++ bytes = rw_verify_area(type, file, &kiocb->ki_pos, kiocb->ki_left);
++ if (bytes < 0)
++ return bytes;
++
+ kiocb->ki_iovec = &kiocb->ki_inline_vec;
+ kiocb->ki_iovec->iov_base = kiocb->ki_buf;
+- kiocb->ki_iovec->iov_len = kiocb->ki_left;
++ kiocb->ki_iovec->iov_len = bytes;
+ kiocb->ki_nr_segs = 1;
+ kiocb->ki_cur_seg = 0;
+ return 0;
+@@ -1517,10 +1527,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ if (unlikely(!access_ok(VERIFY_WRITE, kiocb->ki_buf,
+ kiocb->ki_left)))
+ break;
+- ret = security_file_permission(file, MAY_READ);
+- if (unlikely(ret))
+- break;
+- ret = aio_setup_single_vector(kiocb);
++ ret = aio_setup_single_vector(READ, file, kiocb);
+ if (ret)
+ break;
+ ret = -EINVAL;
+@@ -1535,10 +1542,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ if (unlikely(!access_ok(VERIFY_READ, kiocb->ki_buf,
+ kiocb->ki_left)))
+ break;
+- ret = security_file_permission(file, MAY_WRITE);
+- if (unlikely(ret))
+- break;
+- ret = aio_setup_single_vector(kiocb);
++ ret = aio_setup_single_vector(WRITE, file, kiocb);
+ if (ret)
+ break;
+ ret = -EINVAL;
+@@ -1549,9 +1553,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ ret = -EBADF;
+ if (unlikely(!(file->f_mode & FMODE_READ)))
+ break;
+- ret = security_file_permission(file, MAY_READ);
+- if (unlikely(ret))
+- break;
+ ret = aio_setup_vectored_rw(READ, kiocb, compat);
+ if (ret)
+ break;
+@@ -1563,9 +1564,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ ret = -EBADF;
+ if (unlikely(!(file->f_mode & FMODE_WRITE)))
+ break;
+- ret = security_file_permission(file, MAY_WRITE);
+- if (unlikely(ret))
+- break;
+ ret = aio_setup_vectored_rw(WRITE, kiocb, compat);
+ if (ret)
+ break;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0034-docs-update-HOWTO-for-2.6.x-3.x-versioning.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0034-docs-update-HOWTO-for-2.6.x-3.x-versioning.patch
--- /dev/null
@@ -0,0 +1,100 @@
+From d2c7de1fefbc917e3731bf69e18b553b3c7a165f Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 18 Apr 2012 23:16:45 -0700
+Subject: [PATCH 034/117] docs: update HOWTO for 2.6.x -> 3.x versioning
+
+commit 591bfc6bf9e5e25e464fd4c87d64afd5135667c4 upstream.
+
+The HOWTO document needed updating for the new kernel versioning. The
+git URI for -next was updated as well.
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ Documentation/HOWTO | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/Documentation/HOWTO b/Documentation/HOWTO
+index f7ade3b..59c080f 100644
+--- a/Documentation/HOWTO
++++ b/Documentation/HOWTO
+@@ -218,16 +218,16 @@ The development process
+ Linux kernel development process currently consists of a few different
+ main kernel "branches" and lots of different subsystem-specific kernel
+ branches. These different branches are:
+- - main 2.6.x kernel tree
+- - 2.6.x.y -stable kernel tree
+- - 2.6.x -git kernel patches
++ - main 3.x kernel tree
++ - 3.x.y -stable kernel tree
++ - 3.x -git kernel patches
+ - subsystem specific kernel trees and patches
+- - the 2.6.x -next kernel tree for integration tests
++ - the 3.x -next kernel tree for integration tests
+
+-2.6.x kernel tree
++3.x kernel tree
+ -----------------
+-2.6.x kernels are maintained by Linus Torvalds, and can be found on
+-kernel.org in the pub/linux/kernel/v2.6/ directory. Its development
++3.x kernels are maintained by Linus Torvalds, and can be found on
++kernel.org in the pub/linux/kernel/v3.x/ directory. Its development
+ process is as follows:
+ - As soon as a new kernel is released a two weeks window is open,
+ during this period of time maintainers can submit big diffs to
+@@ -262,20 +262,20 @@ mailing list about kernel releases:
+ released according to perceived bug status, not according to a
+ preconceived timeline."
+
+-2.6.x.y -stable kernel tree
++3.x.y -stable kernel tree
+ ---------------------------
+-Kernels with 4-part versions are -stable kernels. They contain
++Kernels with 3-part versions are -stable kernels. They contain
+ relatively small and critical fixes for security problems or significant
+-regressions discovered in a given 2.6.x kernel.
++regressions discovered in a given 3.x kernel.
+
+ This is the recommended branch for users who want the most recent stable
+ kernel and are not interested in helping test development/experimental
+ versions.
+
+-If no 2.6.x.y kernel is available, then the highest numbered 2.6.x
++If no 3.x.y kernel is available, then the highest numbered 3.x
+ kernel is the current stable kernel.
+
+-2.6.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
++3.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
+ are released as needs dictate. The normal release period is approximately
+ two weeks, but it can be longer if there are no pressing problems. A
+ security-related problem, instead, can cause a release to happen almost
+@@ -285,7 +285,7 @@ The file Documentation/stable_kernel_rules.txt in the kernel tree
+ documents what kinds of changes are acceptable for the -stable tree, and
+ how the release process works.
+
+-2.6.x -git patches
++3.x -git patches
+ ------------------
+ These are daily snapshots of Linus' kernel tree which are managed in a
+ git repository (hence the name.) These patches are usually released
+@@ -317,13 +317,13 @@ revisions to it, and maintainers can mark patches as under review,
+ accepted, or rejected. Most of these patchwork sites are listed at
+ http://patchwork.kernel.org/.
+
+-2.6.x -next kernel tree for integration tests
++3.x -next kernel tree for integration tests
+ ---------------------------------------------
+-Before updates from subsystem trees are merged into the mainline 2.6.x
++Before updates from subsystem trees are merged into the mainline 3.x
+ tree, they need to be integration-tested. For this purpose, a special
+ testing repository exists into which virtually all subsystem trees are
+ pulled on an almost daily basis:
+- http://git.kernel.org/?p=linux/kernel/git/sfr/linux-next.git
++ http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git
+ http://linux.f-seidel.de/linux-next/pmwiki/
+
+ This way, the -next kernel gives a summary outlook onto what will be
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0035-drivers-staging-comedi-comedi_fops.c-add-missing-vfr.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0035-drivers-staging-comedi-comedi_fops.c-add-missing-vfr.patch
--- /dev/null
@@ -0,0 +1,34 @@
+From bf21ec2ca510b5e8d017ea1177ffa78a2fec5b93 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Sun, 22 Apr 2012 13:37:09 +0200
+Subject: [PATCH 035/117] drivers/staging/comedi/comedi_fops.c: add missing
+ vfree
+
+commit abae41e6438b798e046d721b6ccdd55b4a398170 upstream.
+
+aux_free is freed on all other exits from the function. By removing the
+return, we can benefit from the vfree already at the end of the function.
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/staging/comedi/comedi_fops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index 5e78c77..4ad2c0e 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -280,7 +280,7 @@ static int do_devconfig_ioctl(struct comedi_device *dev,
+ if (ret == 0) {
+ if (!try_module_get(dev->driver->module)) {
+ comedi_device_detach(dev);
+- return -ENOSYS;
++ ret = -ENOSYS;
+ }
+ }
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0036-USB-move-usb_translate_errors-to-linux-usb.h.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0036-USB-move-usb_translate_errors-to-linux-usb.h.patch
--- /dev/null
@@ -0,0 +1,70 @@
+From a62e9c8e391b91bd60c705748ea8ec207ef72eab Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Thu, 10 Nov 2011 14:58:26 +0100
+Subject: [PATCH 036/117] USB: move usb_translate_errors to linux/usb.h
+
+commit 2c4d6bf295ae10ffcd84f0df6cb642598eb66603 upstream.
+
+Move usb_translate_errors from usb core to linux/usb.h as it is meant to
+be accessed from drivers.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/core/usb.h | 14 --------------
+ include/linux/usb.h | 13 +++++++++++++
+ 2 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
+index 3888778..45e8479 100644
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -132,20 +132,6 @@ static inline int is_usb_device_driver(struct device_driver *drv)
+ for_devices;
+ }
+
+-/* translate USB error codes to codes user space understands */
+-static inline int usb_translate_errors(int error_code)
+-{
+- switch (error_code) {
+- case 0:
+- case -ENOMEM:
+- case -ENODEV:
+- return error_code;
+- default:
+- return -EIO;
+- }
+-}
+-
+-
+ /* for labeling diagnostics */
+ extern const char *usbcore_name;
+
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 7626e5a..68cdc84 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -1600,6 +1600,19 @@ usb_maxpacket(struct usb_device *udev, int pipe, int is_out)
+
+ /* ----------------------------------------------------------------------- */
+
++/* translate USB error codes to codes user space understands */
++static inline int usb_translate_errors(int error_code)
++{
++ switch (error_code) {
++ case 0:
++ case -ENOMEM:
++ case -ENODEV:
++ return error_code;
++ default:
++ return -EIO;
++ }
++}
++
+ /* Events from the usb core */
+ #define USB_DEVICE_ADD 0x0001
+ #define USB_DEVICE_REMOVE 0x0002
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0037-USB-cdc-wdm-sanitize-error-returns.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0037-USB-cdc-wdm-sanitize-error-returns.patch
--- /dev/null
@@ -0,0 +1,33 @@
+From 1676590583666a41bf8b26924d0ab9b729455813 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Fri, 27 Apr 2012 14:23:54 +0200
+Subject: [PATCH 037/117] USB: cdc-wdm: sanitize error returns
+
+commit 24a85bae5da2b43fed423859c09c5a81ab359473 upstream.
+
+wdm_flush() returns unsanitized USB error codes.
+They must be cleaned up to before being anded to user space
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 2db0327..ac9099a 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -500,7 +500,7 @@ static int wdm_flush(struct file *file, fl_owner_t id)
+ dev_err(&desc->intf->dev, "Error in flush path: %d\n",
+ desc->werr);
+
+- return desc->werr;
++ return usb_translate_errors(desc->werr);
+ }
+
+ static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0038-USB-cdc-wdm-fix-memory-leak.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0038-USB-cdc-wdm-fix-memory-leak.patch
--- /dev/null
@@ -0,0 +1,35 @@
+From bc51604d6cadd35fa7a9a4d70644471cb6ab81f8 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Fri, 27 Apr 2012 14:36:37 +0200
+Subject: [PATCH 038/117] USB: cdc-wdm: fix memory leak
+
+commit 2f338c8a1904e2e7aa5a8bd12fb0cf2422d17da4 upstream.
+
+cleanup() is not called if the last close() comes after
+disconnect(). That leads to a memory leak. Rectified
+by checking for an earlier disconnect() in release()
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/class/cdc-wdm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index ac9099a..cfe5be4 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -590,6 +590,8 @@ static int wdm_release(struct inode *inode, struct file *file)
+ kill_urbs(desc);
+ if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+ desc->intf->needs_remote_wakeup = 0;
++ else
++ cleanup(desc);
+ }
+ mutex_unlock(&wdm_mutex);
+ return 0;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0039-8250_pci-fix-pch-uart-matching.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0039-8250_pci-fix-pch-uart-matching.patch
--- /dev/null
@@ -0,0 +1,102 @@
+From e90d4ef7a5801bf1e9c956edf51d22f6c8f33611 Mon Sep 17 00:00:00 2001
+From: Arnaud Patard <apatard@hupstream.com>
+Date: Wed, 25 Apr 2012 12:17:24 +0200
+Subject: [PATCH 039/117] 8250_pci: fix pch uart matching
+
+commit aaa10eb1d0034eccc096f583fe308f0921617598 upstream.
+
+The rules used to make 8250_pci "ignore" the PCH uarts are lacking pci subids
+entries, preventing it to match and thus is breaking serial port support for
+theses systems.
+
+This has been tested on a nanoETXexpress-TT, which has a specifici uart clock.
+
+Tested-by: Erwan Velu <Erwan.Velu@zodiacaerospace.com>
+Signed-off-by: Arnaud Patard <apatard@hupstream.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: adjust filename]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/serial/8250_pci.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/tty/serial/8250_pci.c b/drivers/tty/serial/8250_pci.c
+index 825937a..482d51e 100644
+--- a/drivers/tty/serial/8250_pci.c
++++ b/drivers/tty/serial/8250_pci.c
+@@ -1590,54 +1590,72 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
+ {
+ .vendor = PCI_VENDOR_ID_INTEL,
+ .device = 0x8811,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = PCI_VENDOR_ID_INTEL,
+ .device = 0x8812,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = PCI_VENDOR_ID_INTEL,
+ .device = 0x8813,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = PCI_VENDOR_ID_INTEL,
+ .device = 0x8814,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = 0x10DB,
+ .device = 0x8027,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = 0x10DB,
+ .device = 0x8028,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = 0x10DB,
+ .device = 0x8029,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = 0x10DB,
+ .device = 0x800C,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = 0x10DB,
+ .device = 0x800D,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0040-usb-add-USB_QUIRK_RESET_RESUME-for-M-Audio-88es.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0040-usb-add-USB_QUIRK_RESET_RESUME-for-M-Audio-88es.patch
--- /dev/null
@@ -0,0 +1,36 @@
+From aa66cb26f7b032f3ae43ff3cb126b3a3cff9b151 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Steffen=20M=C3=BCller?= <steffen.mueller@radio-frei.de>
+Date: Mon, 30 Apr 2012 13:05:34 +0200
+Subject: [PATCH 040/117] usb: add USB_QUIRK_RESET_RESUME for M-Audio 88es
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 166cb70e97bd83d7ae9bbec6ae59a178fd9bb823 upstream.
+
+Tested-by: Steffen Müller <steffen.mueller@radio-frei.de>
+Signed-off-by: Steffen Müller <steffen.mueller@radio-frei.de>
+Signed-off-by: Stefan Seyfried <seife+kernel@b1-systems.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 4c65eb6..32d3adc 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -123,6 +123,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Guillemot Webcam Hercules Dualpix Exchange*/
+ { USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Midiman M-Audio Keystation 88es */
++ { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* M-Systems Flash Disk Pioneers */
+ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0041-usb-usbtest-two-super-speed-fixes-for-usbtest.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0041-usb-usbtest-two-super-speed-fixes-for-usbtest.patch
--- /dev/null
@@ -0,0 +1,60 @@
+From bb6dfbca863a06884b7af33a6c46fddb690eb7d3 Mon Sep 17 00:00:00 2001
+From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
+Date: Mon, 16 Apr 2012 14:19:07 -0700
+Subject: [PATCH 041/117] usb: usbtest: two super speed fixes for usbtest
+
+commit 6a23ccd216b6a8ba2c67a9f9d8969b4431ad2920 upstream.
+
+bMaxPacketSize0 field for super speed is a power of 2, not a count.
+The size itself is always 512.
+
+Max packet size for a super speed bulk endpoint is 1024, so
+allocate the urb size in halt_simple() accordingly.
+
+Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
+Acked-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/misc/usbtest.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
+index bd6d008..b9ac9a3 100644
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -1025,7 +1025,10 @@ test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
+ case 13: /* short read, resembling case 10 */
+ req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
+ /* last data packet "should" be DATA1, not DATA0 */
+- len = 1024 - udev->descriptor.bMaxPacketSize0;
++ if (udev->speed == USB_SPEED_SUPER)
++ len = 1024 - 512;
++ else
++ len = 1024 - udev->descriptor.bMaxPacketSize0;
+ expected = -EREMOTEIO;
+ break;
+ case 14: /* short read; try to fill the last packet */
+@@ -1384,11 +1387,15 @@ static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
+
+ static int halt_simple(struct usbtest_dev *dev)
+ {
+- int ep;
+- int retval = 0;
+- struct urb *urb;
++ int ep;
++ int retval = 0;
++ struct urb *urb;
++ struct usb_device *udev = testdev_to_usbdev(dev);
+
+- urb = simple_alloc_urb(testdev_to_usbdev(dev), 0, 512);
++ if (udev->speed == USB_SPEED_SUPER)
++ urb = simple_alloc_urb(udev, 0, 1024);
++ else
++ urb = simple_alloc_urb(udev, 0, 512);
+ if (urb == NULL)
+ return -ENOMEM;
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0042-8250.c-less-than-2400-baud-fix.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0042-8250.c-less-than-2400-baud-fix.patch
--- /dev/null
@@ -0,0 +1,51 @@
+From 52c1820cb4b5f10c0664104bb6f570305d0c49cc Mon Sep 17 00:00:00 2001
+From: Christian Melki <christian.melki@ericsson.se>
+Date: Mon, 30 Apr 2012 11:21:26 +0200
+Subject: [PATCH 042/117] 8250.c: less than 2400 baud fix.
+
+commit f9a9111b540fd67db5dab332f4b83d86c90e27b1 upstream.
+
+We noticed that we were loosing data at speed less than 2400 baud.
+It turned out our (TI16750 compatible) uart with 64 byte outgoing fifo
+was truncated to 16 byte (bit 5 sets fifo len) when modifying the fcr
+reg.
+The input code still fills the buffer with 64 bytes if I remember
+correctly and thus data is lost.
+Our fix was to remove whiping of the fcr content and just add the
+TRIGGER_1 which we want for latency.
+I can't see why this would not work on less than 2400 always, for all
+uarts ...
+Otherwise one would have to make sure the filling of the fifo re-checks
+the current state of available fifo size (urrk).
+
+Signed-off-by: Christian Melki <christian.melki@ericsson.se>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: adjust filename; replace *port with up->port]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/serial/8250.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/tty/serial/8250.c b/drivers/tty/serial/8250.c
+index eeadf1b..70585b6 100644
+--- a/drivers/tty/serial/8250.c
++++ b/drivers/tty/serial/8250.c
+@@ -2327,10 +2327,11 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios,
+ quot++;
+
+ if (up->capabilities & UART_CAP_FIFO && up->port.fifosize > 1) {
+- if (baud < 2400)
+- fcr = UART_FCR_ENABLE_FIFO | UART_FCR_TRIGGER_1;
+- else
+- fcr = uart_config[up->port.type].fcr;
++ fcr = uart_config[up->port.type].fcr;
++ if (baud < 2400) {
++ fcr &= ~UART_FCR_TRIGGER_MASK;
++ fcr |= UART_FCR_TRIGGER_1;
++ }
+ }
+
+ /*
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0043-usb-xhci-Handle-COMP_TX_ERR-for-isoc-tds.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0043-usb-xhci-Handle-COMP_TX_ERR-for-isoc-tds.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0043-usb-xhci-Handle-COMP_TX_ERR-for-isoc-tds.patch
@@ -0,0 +1,49 @@
+From 5ccddedea273a8a59eda8f3a7ad026d0751ada3d Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 23 Apr 2012 15:06:09 +0200
+Subject: [PATCH 043/117] usb-xhci: Handle COMP_TX_ERR for isoc tds
+
+commit 9c745995ae5c4ff787f34a359de908facc11ee00 upstream.
+
+While testing unplugging an UVC HD webcam with usb-redirection (so through
+usbdevfs), my userspace usb-redir code was getting a value of -1 in
+iso_frame_desc[n].status, which according to Documentation/usb/error-codes.txt
+is not a valid value.
+
+The source of this -1 is the default case in xhci-ring.c:process_isoc_td()
+adding a kprintf there showed the value of trb_comp_code to be COMP_TX_ERR
+in this case, so this patch adds handling for that completion code to
+process_isoc_td().
+
+This was observed and tested with the following xhci controller:
+1033:0194 NEC Corporation uPD720200 USB 3.0 Host Controller (rev 04)
+
+Note: I also wonder if setting frame->status to -1 (-EPERM) is the best we can
+do, but since I cannot come up with anything better I've left that as is.
+
+This patch should be backported to kernels as old as 2.6.36, which contain the
+commit 04e51901dd44f40a5a385ced897f6bca87d5f40a "USB: xHCI: Isochronous
+transfer implementation".
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/xhci-ring.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 43b3447..2304c45 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1752,6 +1752,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ break;
+ case COMP_DEV_ERR:
+ case COMP_STALL:
++ case COMP_TX_ERR:
+ frame->status = -EPROTO;
+ skip_td = true;
+ break;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0044-xhci-Avoid-dead-ports-when-CONFIG_USB_XHCI_HCD-n.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0044-xhci-Avoid-dead-ports-when-CONFIG_USB_XHCI_HCD-n.patch
--- /dev/null
@@ -0,0 +1,63 @@
+From 48a73f4c8ba6d9e5587a29aa4f9710f405a28cc7 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Mon, 16 Apr 2012 10:56:47 -0700
+Subject: [PATCH 044/117] xhci: Avoid dead ports when CONFIG_USB_XHCI_HCD=n
+
+commit 51c9e6c7732b67769c0a514d31f505e49fa82dd4 upstream.
+
+If the user chooses to say "no" to CONFIG_USB_XHCI_HCD on a system
+with an Intel Panther Point chipset, the PCI quirks code or the EHCI
+driver will switch the ports over to the xHCI host, but the xHCI driver
+will never load. The ports will be powered off and seem "dead" to the
+user.
+
+Fix this by only switching the ports over if CONFIG_USB_XHCI_HCD is
+either compiled in, or compiled as a module.
+
+This patch should be backported to stable kernels as old as 3.0,
+that contain commit 69e848c2090aebba5698a1620604c7dccb448684
+"Intel xhci: Support EHCI/xHCI port switching."
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reported-by: Eric Anholt <eric.anholt@intel.com>
+Reported-by: David Bein <d.bein@f5.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/pci-quirks.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index 2afff88..a33362b 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -9,6 +9,7 @@
+ */
+
+ #include <linux/types.h>
++#include <linux/kconfig.h>
+ #include <linux/kernel.h>
+ #include <linux/pci.h>
+ #include <linux/init.h>
+@@ -742,6 +743,19 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
+ {
+ u32 ports_available;
+
++ /* Don't switchover the ports if the user hasn't compiled the xHCI
++ * driver. Otherwise they will see "dead" USB ports that don't power
++ * the devices.
++ */
++ if (!IS_ENABLED(CONFIG_USB_XHCI_HCD)) {
++ dev_warn(&xhci_pdev->dev,
++ "CONFIG_USB_XHCI_HCD is turned off, "
++ "defaulting to EHCI.\n");
++ dev_warn(&xhci_pdev->dev,
++ "USB 3.0 devices will work at USB 2.0 speeds.\n");
++ return;
++ }
++
+ ports_available = 0xffffffff;
+ /* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable
+ * Register, to turn on SuperSpeed terminations for all
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0045-xhci-Add-Lynx-Point-to-list-of-Intel-switchable-host.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0045-xhci-Add-Lynx-Point-to-list-of-Intel-switchable-host.patch
--- /dev/null
@@ -0,0 +1,81 @@
+From cc4326a34985d9ce41cd590e7cf7275a0fbaa9dd Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Thu, 9 Feb 2012 15:55:13 -0800
+Subject: [PATCH 045/117] xhci: Add Lynx Point to list of Intel switchable
+ hosts.
+
+commit 1c12443ab8eba71a658fae4572147e56d1f84f66 upstream.
+
+The upcoming Intel Lynx Point chipset includes an xHCI host controller
+that can have ports switched from the EHCI host controller, just like
+the Intel Panther Point xHCI host. This time, ports from both EHCI
+hosts can be switched to the xHCI host controller. The PCI config
+registers to do the port switching are in the exact same place in the
+xHCI PCI configuration registers, with the same semantics.
+
+Hooray for shipping patches for next-gen hardware before the current gen
+hardware is even available for purchase!
+
+This patch should be backported to stable kernels as old as 3.0,
+that contain commit 69e848c2090aebba5698a1620604c7dccb448684
+"Intel xhci: Support EHCI/xHCI port switching."
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/ehci-pci.c | 4 +++-
+ drivers/usb/host/pci-quirks.c | 18 +++++++++++++++++-
+ 2 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index 971d312..ee85e81 100644
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -365,7 +365,9 @@ static bool usb_is_intel_switchable_ehci(struct pci_dev *pdev)
+ {
+ return pdev->class == PCI_CLASS_SERIAL_USB_EHCI &&
+ pdev->vendor == PCI_VENDOR_ID_INTEL &&
+- pdev->device == 0x1E26;
++ (pdev->device == 0x1E26 ||
++ pdev->device == 0x8C2D ||
++ pdev->device == 0x8C26);
+ }
+
+ static void ehci_enable_xhci_companion(void)
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index a33362b..833b3c6 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -713,12 +713,28 @@ static int handshake(void __iomem *ptr, u32 mask, u32 done,
+ return -ETIMEDOUT;
+ }
+
+-bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
++#define PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI 0x8C31
++
++bool usb_is_intel_ppt_switchable_xhci(struct pci_dev *pdev)
+ {
+ return pdev->class == PCI_CLASS_SERIAL_USB_XHCI &&
+ pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI;
+ }
++
++/* The Intel Lynx Point chipset also has switchable ports. */
++bool usb_is_intel_lpt_switchable_xhci(struct pci_dev *pdev)
++{
++ return pdev->class == PCI_CLASS_SERIAL_USB_XHCI &&
++ pdev->vendor == PCI_VENDOR_ID_INTEL &&
++ pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI;
++}
++
++bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
++{
++ return usb_is_intel_ppt_switchable_xhci(pdev) ||
++ usb_is_intel_lpt_switchable_xhci(pdev);
++}
+ EXPORT_SYMBOL_GPL(usb_is_intel_switchable_xhci);
+
+ /*
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0046-usb-gadget-fsl_udc_core-dTD-s-next-dtd-pointer-need-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0046-usb-gadget-fsl_udc_core-dTD-s-next-dtd-pointer-need-.patch
--- /dev/null
@@ -0,0 +1,44 @@
+From 45bf78829065725fa73b4cacfaf2a2142056d301 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Sun, 1 Apr 2012 15:17:16 +0800
+Subject: [PATCH 046/117] usb: gadget: fsl_udc_core: dTD's next dtd pointer
+ need to be updated once written
+
+commit 4d0947dec4db1224354e2f6f00ae22ce38e62a43 upstream.
+
+dTD's next dtd pointer need to be updated once CPU writes it, or this
+request may not be handled by controller, then host will get NAK from
+device forever.
+
+This problem occurs when there is a request is handling, we need to add
+a new request to dTD list, if this new request is added before the current
+one is finished, the new request is intended to added as next dtd pointer
+at current dTD, but without wmb(), the dTD's next dtd pointer may not be
+updated when the controller reads it. In that case, the controller will
+still get Terminate Bit is 1 at dTD's next dtd pointer, that means there is
+no next request, then this new request is missed by controller.
+
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Acked-by: Li Yang <leoli@freescale.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/gadget/fsl_udc_core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
+index 9085d14..185db03 100644
+--- a/drivers/usb/gadget/fsl_udc_core.c
++++ b/drivers/usb/gadget/fsl_udc_core.c
+@@ -736,6 +736,8 @@ static void fsl_queue_td(struct fsl_ep *ep, struct fsl_req *req)
+ lastreq = list_entry(ep->queue.prev, struct fsl_req, queue);
+ lastreq->tail->next_td_ptr =
+ cpu_to_hc32(req->head->td_dma & DTD_ADDR_MASK);
++ /* Ensure dTD's next dtd pointer to be updated */
++ wmb();
+ /* Read prime bit, if 1 goto done */
+ if (fsl_readl(&dr_regs->endpointprime) & bitmask)
+ return;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0047-Add-missing-call-to-uart_update_timeout.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0047-Add-missing-call-to-uart_update_timeout.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0047-Add-missing-call-to-uart_update_timeout.patch
@@ -0,0 +1,36 @@
+From 17e2d3e18d2042fb6fb23605752754deb87772c5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Lothar=20Wa=C3=9Fmann?= <LW@KARO-electronics.de>
+Date: Thu, 3 May 2012 11:37:12 +0200
+Subject: [PATCH 047/117] Add missing call to uart_update_timeout()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 8b979f7c6bf13a57e7b6002f1175312a44773960 upstream.
+
+This patch fixes a problem reported here:
+http://article.gmane.org/gmane.linux.ports.arm.kernel/155242/match=auart
+
+Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/serial/mxs-auart.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 7e02c9c..5b3d063 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -368,6 +368,8 @@ static void mxs_auart_settermios(struct uart_port *u,
+
+ writel(ctrl, u->membase + AUART_LINECTRL);
+ writel(ctrl2, u->membase + AUART_CTRL2);
++
++ uart_update_timeout(u, termios->c_cflag, baud);
+ }
+
+ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0048-USB-ftdi-sio-add-support-for-Physik-Instrumente-E-86.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0048-USB-ftdi-sio-add-support-for-Physik-Instrumente-E-86.patch
--- /dev/null
@@ -0,0 +1,58 @@
+From 52bf48eda8302a253e63ac9ec069a1635932b237 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=89ric=20Piel?= <piel@delmic.com>
+Date: Mon, 7 May 2012 12:37:54 +0200
+Subject: [PATCH 048/117] USB: ftdi-sio: add support for Physik Instrumente
+ E-861
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit b69cc672052540e8efb1368420f10d7d4d8b8a3d upstream.
+
+This adds VID/PID for the PI E-861. Without it, I had to do:
+modprobe -q ftdi-sio product=0x1008 vendor=0x1a72
+
+http://www.physikinstrumente.com/en/products/prdetail.php?sortnr=900610
+
+Signed-off-by: Éric Piel <piel@delmic.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index c4cf3f3..450bdfe 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -809,6 +809,7 @@ static struct usb_device_id id_table_combined [] = {
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
+ { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
++ { USB_DEVICE(PI_VID, PI_E861_PID) },
+ { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+ { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index c6dd18e..219b199 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -785,6 +785,14 @@
+ #define RTSYSTEMS_SERIAL_VX7_PID 0x9e52 /* Serial converter for VX-7 Radios using FT232RL */
+ #define RTSYSTEMS_CT29B_PID 0x9e54 /* CT29B Radio Cable */
+
++
++/*
++ * Physik Instrumente
++ * http://www.physikinstrumente.com/en/products/
++ */
++#define PI_VID 0x1a72 /* Vendor ID */
++#define PI_E861_PID 0x1008 /* E-861 piezo controller USB connection */
++
+ /*
+ * Bayer Ascensia Contour blood glucose meter USB-converter cable.
+ * http://winglucofacts.com/cables/
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0049-USB-ffs-test-fix-length-argument-of-out-function-cal.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0049-USB-ffs-test-fix-length-argument-of-out-function-cal.patch
--- /dev/null
@@ -0,0 +1,36 @@
+From 7041c376790f592d9ed3c6b88a44a6cf18b8423c Mon Sep 17 00:00:00 2001
+From: Matthias Fend <Matthias.Fend@wolfvision.net>
+Date: Mon, 7 May 2012 14:37:30 +0200
+Subject: [PATCH 049/117] USB: ffs-test: fix length argument of out function
+ call
+
+commit eb9c5836384cd2a276254df6254ed71117983626 upstream.
+
+The out functions should only handle actual available data instead of the complete buffer.
+Otherwise for example the ep0_consume function will report ghost events since it tries to decode
+the complete buffer - which may contain partly invalid data.
+
+Signed-off-by: Matthias Fend <matthias.fend@wolfvision.net>
+Acked-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ tools/usb/ffs-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
+index b9c7986..f17dfee 100644
+--- a/tools/usb/ffs-test.c
++++ b/tools/usb/ffs-test.c
+@@ -324,7 +324,7 @@ static void *start_thread_helper(void *arg)
+
+ ret = t->in(t, t->buf, t->buf_size);
+ if (ret > 0) {
+- ret = t->out(t, t->buf, t->buf_size);
++ ret = t->out(t, t->buf, ret);
+ name = out_name;
+ op = "write";
+ } else {
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0050-HID-wiimote-Fix-IR-data-parser.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0050-HID-wiimote-Fix-IR-data-parser.patch
--- /dev/null
@@ -0,0 +1,60 @@
+From 0842fcae9a509f08c6d540dfa4d3f097c4f3f92d Mon Sep 17 00:00:00 2001
+From: David Herrmann <dh.herrmann@googlemail.com>
+Date: Tue, 8 May 2012 16:52:31 +0200
+Subject: [PATCH 050/117] HID: wiimote: Fix IR data parser
+
+commit 74b89e8a3625c17c7452532dfb997ac4f1a38751 upstream.
+
+We incorrectly parse incoming IR data. The extra byte contains the upper
+bits and not the lower bits of the x/y coordinates. User-space expects
+absolute position data from us so this patch does not break existing
+applications. On the contrary, it extends the virtual view and fixes
+garbage reports for margin areas of the virtual screen.
+
+Reported-by: Peter Bukovsky <bukovsky.peter@gmail.com>
+Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+[bwh: Backported to 3.2: adjust filename]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/hid/hid-wiimote.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/hid/hid-wiimote.c b/drivers/hid/hid-wiimote.c
+index 76739c0..bfa9a27 100644
+--- a/drivers/hid/hid-wiimote.c
++++ b/drivers/hid/hid-wiimote.c
+@@ -829,7 +829,7 @@ static void __ir_to_input(struct wiimote_data *wdata, const __u8 *ir,
+
+ /*
+ * Basic IR data is encoded into 3 bytes. The first two bytes are the
+- * upper 8 bit of the X/Y data, the 3rd byte contains the lower 2 bits
++ * lower 8 bit of the X/Y data, the 3rd byte contains the upper 2 bits
+ * of both.
+ * If data is packed, then the 3rd byte is put first and slightly
+ * reordered. This allows to interleave packed and non-packed data to
+@@ -838,17 +838,11 @@ static void __ir_to_input(struct wiimote_data *wdata, const __u8 *ir,
+ */
+
+ if (packed) {
+- x = ir[1] << 2;
+- y = ir[2] << 2;
+-
+- x |= ir[0] & 0x3;
+- y |= (ir[0] >> 2) & 0x3;
++ x = ir[1] | ((ir[0] & 0x03) << 8);
++ y = ir[2] | ((ir[0] & 0x0c) << 6);
+ } else {
+- x = ir[0] << 2;
+- y = ir[1] << 2;
+-
+- x |= (ir[2] >> 4) & 0x3;
+- y |= (ir[2] >> 6) & 0x3;
++ x = ir[0] | ((ir[2] & 0x30) << 4);
++ y = ir[1] | ((ir[2] & 0xc0) << 2);
+ }
+
+ input_report_abs(wdata->ir, xid, x);
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0051-usb-storage-unusual_devs-entry-for-Yarvik-PMP400-MP4.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0051-usb-storage-unusual_devs-entry-for-Yarvik-PMP400-MP4.patch
--- /dev/null
@@ -0,0 +1,41 @@
+From a595c200511d66729bc55aadbb93adb96988c590 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 8 May 2012 15:15:25 -0400
+Subject: [PATCH 051/117] usb-storage: unusual_devs entry for Yarvik PMP400
+ MP4 player
+
+commit df767b71e5816692134d59c0c17e0f77cd73333d upstream.
+
+This patch (as1553) adds an unusual_dev entrie for the Yarvik PMP400
+MP4 music player.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Jesse Feddema <jdfeddema@gmail.com>
+Tested-by: Jesse Feddema <jdfeddema@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 24caba7..591f57f 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1885,6 +1885,13 @@ UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_RESIDUE ),
+
++/* Reported by Jesse Feddema <jdfeddema@gmail.com> */
++UNUSUAL_DEV( 0x177f, 0x0400, 0x0000, 0x0000,
++ "Yarvik",
++ "PMP400",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
++
+ /* Reported by Hans de Goede <hdegoede@redhat.com>
+ * These Appotech controllers are found in Picture Frames, they provide a
+ * (buggy) emulation of a cdrom drive which contains the windows software
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0052-USB-ohci-at91-add-a-reset-function-to-fix-race-condi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0052-USB-ohci-at91-add-a-reset-function-to-fix-race-condi.patch
--- /dev/null
@@ -0,0 +1,63 @@
+From ac7728e7d633262cd020d764404abf381f282d12 Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Wed, 9 May 2012 10:48:54 +0200
+Subject: [PATCH 052/117] USB: ohci-at91: add a reset function to fix race
+ condition
+
+commit 07e4e556eff4938eb2edf2591de3aa7d7fb82b52 upstream.
+
+A possible race condition appears because we are not initializing
+the ohci->regs before calling usb_hcd_request_irqs().
+We move the call to ohci_init() in hcd->driver->reset() instead of
+hcd->driver->start() to fix this.
+This was experienced when we share the same IRQ line between OHCI and EHCI
+controllers.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Tested-by: Christian Eggers <christian.eggers@kathrein.de>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/ohci-at91.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
+index 95a9fec..a60c7aa 100644
+--- a/drivers/usb/host/ohci-at91.c
++++ b/drivers/usb/host/ohci-at91.c
+@@ -199,7 +199,7 @@ static void usb_hcd_at91_remove(struct usb_hcd *hcd,
+ /*-------------------------------------------------------------------------*/
+
+ static int __devinit
+-ohci_at91_start (struct usb_hcd *hcd)
++ohci_at91_reset (struct usb_hcd *hcd)
+ {
+ struct at91_usbh_data *board = hcd->self.controller->platform_data;
+ struct ohci_hcd *ohci = hcd_to_ohci (hcd);
+@@ -209,6 +209,14 @@ ohci_at91_start (struct usb_hcd *hcd)
+ return ret;
+
+ ohci->num_ports = board->ports;
++ return 0;
++}
++
++static int __devinit
++ohci_at91_start (struct usb_hcd *hcd)
++{
++ struct ohci_hcd *ohci = hcd_to_ohci (hcd);
++ int ret;
+
+ if ((ret = ohci_run(ohci)) < 0) {
+ err("can't start %s", hcd->self.bus_name);
+@@ -390,6 +398,7 @@ static const struct hc_driver ohci_at91_hc_driver = {
+ /*
+ * basic lifecycle operations
+ */
++ .reset = ohci_at91_reset,
+ .start = ohci_at91_start,
+ .stop = ohci_stop,
+ .shutdown = ohci_shutdown,
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0053-HID-logitech-read-all-32-bits-of-report-type-bitfiel.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0053-HID-logitech-read-all-32-bits-of-report-type-bitfiel.patch
--- /dev/null
@@ -0,0 +1,70 @@
+From 4061b435a02342ee10ee34fb69f2c75d53e8da70 Mon Sep 17 00:00:00 2001
+From: Jonathan Nieder <jrnieder@gmail.com>
+Date: Fri, 11 May 2012 16:17:16 +0200
+Subject: [PATCH 053/117] HID: logitech: read all 32 bits of report type
+ bitfield
+
+commit 44d27f7dfedd9aadc082cda31462f6600f56e4ec upstream.
+
+On big-endian systems (e.g., Apple PowerBook), trying to use a
+logitech wireless mouse with the Logitech Unifying Receiver does not
+work with v3.2 and later kernels. The device doesn't show up in
+/dev/input. Older kernels work fine.
+
+That is because the new hid-logitech-dj driver claims the device. The
+device arrival notification appears:
+
+ 20 00 41 02 00 00 00 00 00 00 00 00 00 00 00
+
+and we read the report_types bitfield (02 00 00 00) to find out what
+kind of device it is. Unfortunately the driver only reads the first 8
+bits and treats that value as a 32-bit little-endian number, so on a
+powerpc the report type seems to be 0x02000000 and is not recognized.
+
+Even on little-endian machines, connecting a media center remote
+control (report type 00 01 00 00) with this driver loaded would
+presumably fail for the same reason.
+
+Fix both problems by using get_unaligned_le32() to read all four
+bytes, which is a little clearer anyway. After this change, the
+wireless mouse works on Hugo's PowerBook again.
+
+Based on a patch by Nestor Lopez Casado.
+Addresses http://bugs.debian.org/671292
+
+Reported-by: Hugo Osvaldo Barrera <hugo@osvaldobarrera.com.ar>
+Inspired-by: Nestor Lopez Casado <nlopezcasad@logitech.com>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Nestor Lopez Casado <nlopezcasad@logitech.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/hid/hid-logitech-dj.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 38b12e4..2eac8c5 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -26,6 +26,7 @@
+ #include <linux/hid.h>
+ #include <linux/module.h>
+ #include <linux/usb.h>
++#include <asm/unaligned.h>
+ #include "usbhid/usbhid.h"
+ #include "hid-ids.h"
+ #include "hid-logitech-dj.h"
+@@ -265,8 +266,8 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
+ goto dj_device_allocate_fail;
+ }
+
+- dj_dev->reports_supported = le32_to_cpu(
+- dj_report->report_params[DEVICE_PAIRED_RF_REPORT_TYPE]);
++ dj_dev->reports_supported = get_unaligned_le32(
++ dj_report->report_params + DEVICE_PAIRED_RF_REPORT_TYPE);
+ dj_dev->hdev = dj_hiddev;
+ dj_dev->dj_receiver_dev = djrcv_dev;
+ dj_dev->device_index = dj_report->device_index;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0054-USB-serial-ti_usb_3410_5052-Add-support-for-the-FRI2.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0054-USB-serial-ti_usb_3410_5052-Add-support-for-the-FRI2.patch
--- /dev/null
@@ -0,0 +1,77 @@
+From 38827d01920cd8adbdbdb89d79b749f6cb50b8f0 Mon Sep 17 00:00:00 2001
+From: Darren Hart <dvhart@linux.intel.com>
+Date: Fri, 11 May 2012 13:56:57 -0700
+Subject: [PATCH 054/117] USB: serial: ti_usb_3410_5052: Add support for the
+ FRI2 serial console
+
+commit 975dc33b82cb887d75a29b1e3835c8eb063a8e99 upstream.
+
+The Kontron M2M development board, also known as the Fish River Island II,
+has an optional daughter card providing access to the PCH_UART (EG20T) via
+a ti_usb_3410_5052 uart to usb chip.
+
+http://us.kontron.com/products/systems+and+platforms/m2m/m2m+smart+services+developer+kit.html
+
+Signed-off-by: Darren Hart <dvhart@linux.intel.com>
+CC: Al Borchers <alborchers@steinerpoint.com>
+CC: Peter Berger <pberger@brimson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/serial/ti_usb_3410_5052.c | 6 ++++--
+ drivers/usb/serial/ti_usb_3410_5052.h | 1 +
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index 21c82b0..2856474 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -165,7 +165,7 @@ static unsigned int product_5052_count;
+ /* the array dimension is the number of default entries plus */
+ /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
+ /* null entry */
+-static struct usb_device_id ti_id_table_3410[14+TI_EXTRA_VID_PID_COUNT+1] = {
++static struct usb_device_id ti_id_table_3410[15+TI_EXTRA_VID_PID_COUNT+1] = {
+ { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
+ { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
+ { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
+@@ -180,6 +180,7 @@ static struct usb_device_id ti_id_table_3410[14+TI_EXTRA_VID_PID_COUNT+1] = {
+ { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
+ { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
+ { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
++ { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
+ };
+
+ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
+@@ -189,7 +190,7 @@ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
+ { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
+ };
+
+-static struct usb_device_id ti_id_table_combined[18+2*TI_EXTRA_VID_PID_COUNT+1] = {
++static struct usb_device_id ti_id_table_combined[19+2*TI_EXTRA_VID_PID_COUNT+1] = {
+ { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
+ { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
+ { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
+@@ -208,6 +209,7 @@ static struct usb_device_id ti_id_table_combined[18+2*TI_EXTRA_VID_PID_COUNT+1]
+ { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
+ { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
+ { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
++ { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
+ { }
+ };
+
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
+index f140f1b..b353e7e 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.h
++++ b/drivers/usb/serial/ti_usb_3410_5052.h
+@@ -37,6 +37,7 @@
+ #define TI_5152_BOOT_PRODUCT_ID 0x5152 /* no EEPROM, no firmware */
+ #define TI_5052_EEPROM_PRODUCT_ID 0x505A /* EEPROM, no firmware */
+ #define TI_5052_FIRMWARE_PRODUCT_ID 0x505F /* firmware is running */
++#define FRI2_PRODUCT_ID 0x5053 /* Fish River Island II */
+
+ /* Multi-Tech vendor and product ids */
+ #define MTS_VENDOR_ID 0x06E0
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0055-USB-cdc-wdm-poll-must-return-POLLHUP-if-device-is-go.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0055-USB-cdc-wdm-poll-must-return-POLLHUP-if-device-is-go.patch
--- /dev/null
@@ -0,0 +1,38 @@
+From 420e76b95a867f5105ee9b3d824c47f62601c19b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Wed, 9 May 2012 13:53:21 +0200
+Subject: [PATCH 055/117] USB: cdc-wdm: poll must return POLLHUP if device is
+ gone
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 616b6937e348ef2b4c6ea5fef2cd3c441145efb0 upstream.
+
+Else the poll will be restarted indefinitely in a tight loop,
+preventing final device cleanup.
+
+Cc: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index cfe5be4..38d8c33 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -511,7 +511,7 @@ static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
+
+ spin_lock_irqsave(&desc->iuspin, flags);
+ if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+- mask = POLLERR;
++ mask = POLLHUP | POLLERR;
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+ goto desc_out;
+ }
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0056-USB-cdc-wdm-add-debug-messages-on-cleanup.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0056-USB-cdc-wdm-add-debug-messages-on-cleanup.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0056-USB-cdc-wdm-add-debug-messages-on-cleanup.patch
@@ -0,0 +1,54 @@
+From ec4941d4623bada1da050a962485961da8c928d6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Mon, 30 Apr 2012 09:26:11 +0200
+Subject: [PATCH 056/117] USB: cdc-wdm: add debug messages on cleanup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 880bca3a2a6f159d7453e0cbcbfe2f1d8204d907 upstream.
+
+Device state cleanup is done in either wdm_disconnect or
+wdm_release depending on the order they are called. Adding
+a couple of debug messages to document the program flow.
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Acked-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/class/cdc-wdm.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 38d8c33..40a3f0b 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -588,10 +588,12 @@ static int wdm_release(struct inode *inode, struct file *file)
+ if (!desc->count) {
+ dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
+ kill_urbs(desc);
+- if (!test_bit(WDM_DISCONNECTING, &desc->flags))
++ if (!test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ desc->intf->needs_remote_wakeup = 0;
+- else
++ } else {
++ dev_dbg(&desc->intf->dev, "%s: device gone - cleaning up\n", __func__);
+ cleanup(desc);
++ }
+ }
+ mutex_unlock(&wdm_mutex);
+ return 0;
+@@ -807,6 +809,8 @@ static void wdm_disconnect(struct usb_interface *intf)
+ mutex_unlock(&desc->rlock);
+ if (!desc->count)
+ cleanup(desc);
++ else
++ dev_dbg(&intf->dev, "%s: %d open files - postponing cleanup\n", __func__, desc->count);
+ mutex_unlock(&wdm_mutex);
+ }
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0057-USB-cdc-wdm-cannot-use-dev_printk-when-device-is-gon.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0057-USB-cdc-wdm-cannot-use-dev_printk-when-device-is-gon.patch
--- /dev/null
@@ -0,0 +1,66 @@
+From beaa75548738c322895c5b3ca7c010397cfb0afb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Wed, 9 May 2012 13:53:22 +0200
+Subject: [PATCH 057/117] USB: cdc-wdm: cannot use dev_printk when device is
+ gone
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 6b0b79d38806481c1c8fffa7c5842f3c83679a42 upstream.
+
+We cannot dereference a removed USB interface for
+dev_printk. Use pr_debug instead where necessary.
+
+Flush errors are expected if device is unplugged and are
+therefore best ingored at this point.
+
+Move the kill_urbs() call in wdm_release with dev_dbg()
+for the non disconnect, as we know it has already been
+called if WDM_DISCONNECTING is set. This does not
+actually fix anything, but keeps the code more consistent.
+
+Cc: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/class/cdc-wdm.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 40a3f0b..554ac90 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -496,7 +496,9 @@ static int wdm_flush(struct file *file, fl_owner_t id)
+ struct wdm_device *desc = file->private_data;
+
+ wait_event(desc->wait, !test_bit(WDM_IN_USE, &desc->flags));
+- if (desc->werr < 0)
++
++ /* cannot dereference desc->intf if WDM_DISCONNECTING */
++ if (desc->werr < 0 && !test_bit(WDM_DISCONNECTING, &desc->flags))
+ dev_err(&desc->intf->dev, "Error in flush path: %d\n",
+ desc->werr);
+
+@@ -586,12 +588,13 @@ static int wdm_release(struct inode *inode, struct file *file)
+ mutex_unlock(&desc->wlock);
+
+ if (!desc->count) {
+- dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
+- kill_urbs(desc);
+ if (!test_bit(WDM_DISCONNECTING, &desc->flags)) {
++ dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
++ kill_urbs(desc);
+ desc->intf->needs_remote_wakeup = 0;
+ } else {
+- dev_dbg(&desc->intf->dev, "%s: device gone - cleaning up\n", __func__);
++ /* must avoid dev_printk here as desc->intf is invalid */
++ pr_debug(KBUILD_MODNAME " %s: device gone - cleaning up\n", __func__);
+ cleanup(desc);
+ }
+ }
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0058-tty-Allow-uart_register-unregister-register.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0058-tty-Allow-uart_register-unregister-register.patch
--- /dev/null
@@ -0,0 +1,33 @@
+From d3f8f68e0ff8065d2769fc80ebab6cd4a99df65d Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Mon, 14 May 2012 14:51:22 +0100
+Subject: [PATCH 058/117] tty: Allow uart_register/unregister/register
+
+commit 1e66cded334e6cea596c72f6f650eec351b1e959 upstream.
+
+This is legitimate but because we don't clear the drv->state pointer in the
+unregister code causes a bogus BUG().
+
+Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=42880
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/serial/serial_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 0406d7f..af5ffb9 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -2305,6 +2305,7 @@ void uart_unregister_driver(struct uart_driver *drv)
+ tty_unregister_driver(p);
+ put_tty_driver(p);
+ kfree(drv->state);
++ drv->state = NULL;
+ drv->tty_driver = NULL;
+ }
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0059-workqueue-skip-nr_running-sanity-check-in-worker_ent.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0059-workqueue-skip-nr_running-sanity-check-in-worker_ent.patch
--- /dev/null
@@ -0,0 +1,51 @@
+From ac2fd7de4ac5b536aace631588cdab6c27a3ef9d Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 14 May 2012 15:04:50 -0700
+Subject: [PATCH 059/117] workqueue: skip nr_running sanity check in
+ worker_enter_idle() if trustee is active
+
+commit 544ecf310f0e7f51fa057ac2a295fc1b3b35a9d3 upstream.
+
+worker_enter_idle() has WARN_ON_ONCE() which triggers if nr_running
+isn't zero when every worker is idle. This can trigger spuriously
+while a cpu is going down due to the way trustee sets %WORKER_ROGUE
+and zaps nr_running.
+
+It first sets %WORKER_ROGUE on all workers without updating
+nr_running, releases gcwq->lock, schedules, regrabs gcwq->lock and
+then zaps nr_running. If the last running worker enters idle
+inbetween, it would see stale nr_running which hasn't been zapped yet
+and trigger the WARN_ON_ONCE().
+
+Fix it by performing the sanity check iff the trustee is idle.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ kernel/workqueue.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index bb425b1..7947e16 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1215,8 +1215,13 @@ static void worker_enter_idle(struct worker *worker)
+ } else
+ wake_up_all(&gcwq->trustee_wait);
+
+- /* sanity check nr_running */
+- WARN_ON_ONCE(gcwq->nr_workers == gcwq->nr_idle &&
++ /*
++ * Sanity check nr_running. Because trustee releases gcwq->lock
++ * between setting %WORKER_ROGUE and zapping nr_running, the
++ * warning may trigger spuriously. Check iff trustee is idle.
++ */
++ WARN_ON_ONCE(gcwq->trustee_state == TRUSTEE_DONE &&
++ gcwq->nr_workers == gcwq->nr_idle &&
+ atomic_read(get_gcwq_nr_running(gcwq->cpu)));
+ }
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0060-xhci-Add-new-short-TX-quirk-for-Fresco-Logic-host.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0060-xhci-Add-new-short-TX-quirk-for-Fresco-Logic-host.patch
--- /dev/null
@@ -0,0 +1,129 @@
+From 24338a0903923d202e90e35100abe050436bf00a Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Tue, 8 May 2012 09:22:49 -0700
+Subject: [PATCH 060/117] xhci: Add new short TX quirk for Fresco Logic host.
+
+commit 1530bbc6272d9da1e39ef8e06190d42c13a02733 upstream.
+
+Sergio reported that when he recorded audio from a USB headset mic
+plugged into the USB 3.0 port on his ASUS N53SV-DH72, the audio sounded
+"robotic". When plugged into the USB 2.0 port under EHCI on the same
+laptop, the audio sounded fine. The device is:
+
+Bus 002 Device 004: ID 046d:0a0c Logitech, Inc. Clear Chat Comfort USB Headset
+
+The problem was tracked down to the Fresco Logic xHCI host controller
+not correctly reporting short transfers on isochronous IN endpoints.
+The driver would submit a 96 byte transfer, the device would only send
+88 or 90 bytes, and the xHCI host would report the transfer had a
+"successful" completion code, with an untransferred buffer length of 8
+or 6 bytes.
+
+The successful completion code and non-zero untransferred length is a
+contradiction. The xHCI host is supposed to only mark a transfer as
+successful if all the bytes are transferred. Otherwise, the transfer
+should be marked with a short packet completion code. Without the EHCI
+bus trace, we wouldn't know whether the xHCI driver should trust the
+completion code or the untransferred length. With it, we know to trust
+the untransferred length.
+
+Add a new xHCI quirk for the Fresco Logic host controller. If a
+transfer is reported as successful, but the untransferred length is
+non-zero, print a warning. For the Fresco Logic host, change the
+completion code to COMP_SHORT_TX and process the transfer like a short
+transfer.
+
+This should be backported to stable kernels that contain the commit
+f5182b4155b9d686c5540a6822486400e34ddd98 "xhci: Disable MSI for some
+Fresco Logic hosts." That commit was marked for stable kernels as old
+as 2.6.36.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reported-by: Sergio Correia <lists@uece.net>
+Tested-by: Sergio Correia <lists@uece.net>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/xhci-pci.c | 1 +
+ drivers/usb/host/xhci-ring.c | 20 +++++++++++++++++---
+ drivers/usb/host/xhci.h | 1 +
+ 3 files changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 211296a..daf5754 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -72,6 +72,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci_dbg(xhci, "QUIRK: Fresco Logic revision %u "
+ "has broken MSI implementation\n",
+ pdev->revision);
++ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+ }
+
+ if (pdev->vendor == PCI_VENDOR_ID_NEC)
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 2304c45..fb0981e 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1735,8 +1735,12 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ /* handle completion code */
+ switch (trb_comp_code) {
+ case COMP_SUCCESS:
+- frame->status = 0;
+- break;
++ if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
++ frame->status = 0;
++ break;
++ }
++ if ((xhci->quirks & XHCI_TRUST_TX_LENGTH))
++ trb_comp_code = COMP_SHORT_TX;
+ case COMP_SHORT_TX:
+ frame->status = td->urb->transfer_flags & URB_SHORT_NOT_OK ?
+ -EREMOTEIO : 0;
+@@ -1833,13 +1837,16 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ switch (trb_comp_code) {
+ case COMP_SUCCESS:
+ /* Double check that the HW transferred everything. */
+- if (event_trb != td->last_trb) {
++ if (event_trb != td->last_trb ||
++ TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+ xhci_warn(xhci, "WARN Successful completion "
+ "on short TX\n");
+ if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+ *status = -EREMOTEIO;
+ else
+ *status = 0;
++ if ((xhci->quirks & XHCI_TRUST_TX_LENGTH))
++ trb_comp_code = COMP_SHORT_TX;
+ } else {
+ *status = 0;
+ }
+@@ -1978,6 +1985,13 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ * transfer type
+ */
+ case COMP_SUCCESS:
++ if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
++ break;
++ if (xhci->quirks & XHCI_TRUST_TX_LENGTH)
++ trb_comp_code = COMP_SHORT_TX;
++ else
++ xhci_warn(xhci, "WARN Successful completion on short TX: "
++ "needs XHCI_TRUST_TX_LENGTH quirk?\n");
+ case COMP_SHORT_TX:
+ break;
+ case COMP_STOP:
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 4850c4d..363b141 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1466,6 +1466,7 @@ struct xhci_hcd {
+ #define XHCI_RESET_ON_RESUME (1 << 7)
+ #define XHCI_SW_BW_CHECKING (1 << 8)
+ #define XHCI_AMD_0x96_HOST (1 << 9)
++#define XHCI_TRUST_TX_LENGTH (1 << 10)
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+ /* There are two roothubs to keep track of bus suspend info for */
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0061-usbcore-enable-USB2-LPM-if-port-suspend-fails.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0061-usbcore-enable-USB2-LPM-if-port-suspend-fails.patch
--- /dev/null
@@ -0,0 +1,43 @@
+From 644753e795bddc5e687932d9e8b6795859553ac3 Mon Sep 17 00:00:00 2001
+From: Andiry Xu <andiry.xu@gmail.com>
+Date: Sat, 5 May 2012 00:50:10 +0800
+Subject: [PATCH 061/117] usbcore: enable USB2 LPM if port suspend fails
+
+commit c3e751e4f4754793bb52bd5ae30e9cc027edbb12 upstream.
+
+USB2 LPM is disabled when device begin to suspend and enabled after device
+is resumed. That's because USB spec does not define the transition from
+U1/U2 state to U3 state.
+
+If usb_port_suspend() fails, usb_port_resume() is never called, and USB2 LPM
+is disabled in this situation. Enable USB2 LPM if port suspend fails.
+
+This patch should be backported to kernels as old as 3.2, that contain
+the commit 65580b4321eb36f16ae8b5987bfa1bb948fc5112 "xHCI: set USB2
+hardware LPM".
+
+Signed-off-by: Andiry Xu <andiry.xu@gmail.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/core/hub.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index ab4e49f..50cf41a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2420,6 +2420,10 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ NULL, 0,
+ USB_CTRL_SET_TIMEOUT);
+
++ /* Try to enable USB2 hardware LPM again */
++ if (udev->usb2_hw_lpm_capable == 1)
++ usb_set_usb2_hardware_lpm(udev, 1);
++
+ /* System sleep transitions should never fail */
+ if (!PMSG_IS_AUTO(msg))
+ status = 0;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0062-perf-x86-Update-event-scheduling-constraints-for-AMD.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0062-perf-x86-Update-event-scheduling-constraints-for-AMD.patch
--- /dev/null
@@ -0,0 +1,62 @@
+From 2ece12a2e8f1df09f28dbed203e3295d99d94c83 Mon Sep 17 00:00:00 2001
+From: Robert Richter <robert.richter@amd.com>
+Date: Fri, 18 May 2012 12:40:42 +0200
+Subject: [PATCH 062/117] perf/x86: Update event scheduling constraints for
+ AMD family 15h models
+
+commit 5bcdf5e4fee3c45e1281c25e4941f2163cb28c65 upstream.
+
+This update is for newer family 15h cpu models from 0x02 to 0x1f.
+
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lkml.kernel.org/r/1337337642-1621-1-git-send-email-robert.richter@amd.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/kernel/cpu/perf_event_amd.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
+index f64a039..3dbfb00 100644
+--- a/arch/x86/kernel/cpu/perf_event_amd.c
++++ b/arch/x86/kernel/cpu/perf_event_amd.c
+@@ -473,6 +473,7 @@ static __initconst const struct x86_pmu amd_pmu = {
+ * 0x023 DE PERF_CTL[2:0]
+ * 0x02D LS PERF_CTL[3]
+ * 0x02E LS PERF_CTL[3,0]
++ * 0x031 LS PERF_CTL[2:0] (**)
+ * 0x043 CU PERF_CTL[2:0]
+ * 0x045 CU PERF_CTL[2:0]
+ * 0x046 CU PERF_CTL[2:0]
+@@ -486,10 +487,12 @@ static __initconst const struct x86_pmu amd_pmu = {
+ * 0x0DD LS PERF_CTL[5:0]
+ * 0x0DE LS PERF_CTL[5:0]
+ * 0x0DF LS PERF_CTL[5:0]
++ * 0x1C0 EX PERF_CTL[5:3]
+ * 0x1D6 EX PERF_CTL[5:0]
+ * 0x1D8 EX PERF_CTL[5:0]
+ *
+- * (*) depending on the umask all FPU counters may be used
++ * (*) depending on the umask all FPU counters may be used
++ * (**) only one unitmask enabled at a time
+ */
+
+ static struct event_constraint amd_f15_PMC0 = EVENT_CONSTRAINT(0, 0x01, 0);
+@@ -539,6 +542,12 @@ amd_get_event_constraints_f15h(struct cpu_hw_events *cpuc, struct perf_event *ev
+ return &amd_f15_PMC3;
+ case 0x02E:
+ return &amd_f15_PMC30;
++ case 0x031:
++ if (hweight_long(hwc->config & ARCH_PERFMON_EVENTSEL_UMASK) <= 1)
++ return &amd_f15_PMC20;
++ return &emptyconstraint;
++ case 0x1C0:
++ return &amd_f15_PMC53;
+ default:
+ return &amd_f15_PMC50;
+ }
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0063-USB-fix-resource-leak-in-xhci-power-loss-path.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0063-USB-fix-resource-leak-in-xhci-power-loss-path.patch
--- /dev/null
@@ -0,0 +1,74 @@
+From 51025bed29bdd5301f9028357e13707356ae9692 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.de>
+Date: Thu, 10 May 2012 10:19:21 +0200
+Subject: [PATCH 063/117] USB: fix resource leak in xhci power loss path
+
+commit f8a9e72d125f4e00ec529ba67b674321a1f3bf31 upstream.
+
+Some more data structures must be freed and counters
+reset if an XHCI controller has lost power. The failure
+to do so renders some chips inoperative after a certain number
+of S4 cycles.
+
+This patch should be backported to kernels as old as 3.2,
+that contain the commits c29eea621900f18287d50519f72cb9113746d75a
+"xhci: Implement HS/FS/LS bandwidth checking." and
+commit 839c817ce67178ca3c7c7ad534c571bba1e69ebe
+"xhci: Implement HS/FS/LS bandwidth checking."
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/xhci-mem.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 01c3800..a7b0676 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1699,6 +1699,14 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ {
+ struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+ struct dev_info *dev_info, *next;
++ struct list_head *tt_list_head;
++ struct list_head *tt;
++ struct list_head *endpoints;
++ struct list_head *ep, *q;
++ struct xhci_tt_bw_info *tt_info;
++ struct xhci_interval_bw_table *bwt;
++ struct xhci_virt_ep *virt_ep;
++
+ unsigned long flags;
+ int size;
+ int i;
+@@ -1757,8 +1765,26 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ }
+ spin_unlock_irqrestore(&xhci->lock, flags);
+
++ bwt = &xhci->rh_bw->bw_table;
++ for (i = 0; i < XHCI_MAX_INTERVAL; i++) {
++ endpoints = &bwt->interval_bw[i].endpoints;
++ list_for_each_safe(ep, q, endpoints) {
++ virt_ep = list_entry(ep, struct xhci_virt_ep, bw_endpoint_list);
++ list_del(&virt_ep->bw_endpoint_list);
++ kfree(virt_ep);
++ }
++ }
++
++ tt_list_head = &xhci->rh_bw->tts;
++ list_for_each_safe(tt, q, tt_list_head) {
++ tt_info = list_entry(tt, struct xhci_tt_bw_info, tt_list);
++ list_del(tt);
++ kfree(tt_info);
++ }
++
+ xhci->num_usb2_ports = 0;
+ xhci->num_usb3_ports = 0;
++ xhci->num_active_eps = 0;
+ kfree(xhci->usb2_ports);
+ kfree(xhci->usb3_ports);
+ kfree(xhci->port_array);
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0064-xhci-Reset-reserved-command-ring-TRBs-on-cleanup.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0064-xhci-Reset-reserved-command-ring-TRBs-on-cleanup.patch
--- /dev/null
@@ -0,0 +1,39 @@
+From 06abda2cc51b6f5ffcb67e7b7299ffd7e3af966b Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Tue, 8 May 2012 07:09:26 -0700
+Subject: [PATCH 064/117] xhci: Reset reserved command ring TRBs on cleanup.
+
+commit 33b2831ac870d50cc8e01c317b07fb1e69c13fe1 upstream.
+
+When the xHCI driver needs to clean up memory (perhaps due to a failed
+register restore on resume from S3 or resume from S4), it needs to reset
+the number of reserved TRBs on the command ring to zero. Otherwise,
+several resume cycles (about 30) with a UAS device attached will
+continually increment the number of reserved TRBs, until all command
+submissions fail because there isn't enough room on the command ring.
+
+This patch should be backported to kernels as old as 2.6.32,
+that contain the commit 913a8a344ffcaf0b4a586d6662a2c66a7106557d
+"USB: xhci: Change how xHCI commands are handled."
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/xhci-mem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index a7b0676..4232e868 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1723,6 +1723,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ xhci->event_ring = NULL;
+ xhci_dbg(xhci, "Freed event ring\n");
+
++ xhci->cmd_ring_reserved_trbs = 0;
+ if (xhci->cmd_ring)
+ xhci_ring_free(xhci, xhci->cmd_ring);
+ xhci->cmd_ring = NULL;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0065-USB-Remove-races-in-devio.c.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0065-USB-Remove-races-in-devio.c.patch
--- /dev/null
@@ -0,0 +1,132 @@
+From 13538bbeb4fc2e5f45d426579967a675474e4f16 Mon Sep 17 00:00:00 2001
+From: Huajun Li <huajun.li.lee@gmail.com>
+Date: Fri, 18 May 2012 20:12:51 +0800
+Subject: [PATCH 065/117] USB: Remove races in devio.c
+
+commit 4e09dcf20f7b5358615514c2ec8584b248ab8874 upstream.
+
+There exist races in devio.c, below is one case,
+and there are similar races in destroy_async()
+and proc_unlinkurb(). Remove these races.
+
+ cancel_bulk_urbs() async_completed()
+------------------- -----------------------
+ spin_unlock(&ps->lock);
+
+ list_move_tail(&as->asynclist,
+ &ps->async_completed);
+
+ wake_up(&ps->wait);
+
+ Lead to free_async() be triggered,
+ then urb and 'as' will be freed.
+
+ usb_unlink_urb(as->urb);
+ ===> refer to the freed 'as'
+
+Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Oncaphillis <oncaphillis@snafu.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/core/devio.c | 33 +++++++++++++++++++++++++--------
+ 1 file changed, 25 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 7abf060..f6ff837 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -295,17 +295,14 @@ static struct async *async_getcompleted(struct dev_state *ps)
+ static struct async *async_getpending(struct dev_state *ps,
+ void __user *userurb)
+ {
+- unsigned long flags;
+ struct async *as;
+
+- spin_lock_irqsave(&ps->lock, flags);
+ list_for_each_entry(as, &ps->async_pending, asynclist)
+ if (as->userurb == userurb) {
+ list_del_init(&as->asynclist);
+- spin_unlock_irqrestore(&ps->lock, flags);
+ return as;
+ }
+- spin_unlock_irqrestore(&ps->lock, flags);
++
+ return NULL;
+ }
+
+@@ -360,6 +357,7 @@ static void cancel_bulk_urbs(struct dev_state *ps, unsigned bulk_addr)
+ __releases(ps->lock)
+ __acquires(ps->lock)
+ {
++ struct urb *urb;
+ struct async *as;
+
+ /* Mark all the pending URBs that match bulk_addr, up to but not
+@@ -382,8 +380,11 @@ __acquires(ps->lock)
+ list_for_each_entry(as, &ps->async_pending, asynclist) {
+ if (as->bulk_status == AS_UNLINK) {
+ as->bulk_status = 0; /* Only once */
++ urb = as->urb;
++ usb_get_urb(urb);
+ spin_unlock(&ps->lock); /* Allow completions */
+- usb_unlink_urb(as->urb);
++ usb_unlink_urb(urb);
++ usb_put_urb(urb);
+ spin_lock(&ps->lock);
+ goto rescan;
+ }
+@@ -434,6 +435,7 @@ static void async_completed(struct urb *urb)
+
+ static void destroy_async(struct dev_state *ps, struct list_head *list)
+ {
++ struct urb *urb;
+ struct async *as;
+ unsigned long flags;
+
+@@ -441,10 +443,13 @@ static void destroy_async(struct dev_state *ps, struct list_head *list)
+ while (!list_empty(list)) {
+ as = list_entry(list->next, struct async, asynclist);
+ list_del_init(&as->asynclist);
++ urb = as->urb;
++ usb_get_urb(urb);
+
+ /* drop the spinlock so the completion handler can run */
+ spin_unlock_irqrestore(&ps->lock, flags);
+- usb_kill_urb(as->urb);
++ usb_kill_urb(urb);
++ usb_put_urb(urb);
+ spin_lock_irqsave(&ps->lock, flags);
+ }
+ spin_unlock_irqrestore(&ps->lock, flags);
+@@ -1350,12 +1355,24 @@ static int proc_submiturb(struct dev_state *ps, void __user *arg)
+
+ static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
+ {
++ struct urb *urb;
+ struct async *as;
++ unsigned long flags;
+
++ spin_lock_irqsave(&ps->lock, flags);
+ as = async_getpending(ps, arg);
+- if (!as)
++ if (!as) {
++ spin_unlock_irqrestore(&ps->lock, flags);
+ return -EINVAL;
+- usb_kill_urb(as->urb);
++ }
++
++ urb = as->urb;
++ usb_get_urb(urb);
++ spin_unlock_irqrestore(&ps->lock, flags);
++
++ usb_kill_urb(urb);
++ usb_put_urb(urb);
++
+ return 0;
+ }
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0066-md-using-GFP_NOIO-to-allocate-bio-for-flush-request.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0066-md-using-GFP_NOIO-to-allocate-bio-for-flush-request.patch
--- /dev/null
@@ -0,0 +1,37 @@
+From d4bae88d4fc370e24457c3cf69fb343316b8f759 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@kernel.org>
+Date: Mon, 21 May 2012 09:26:59 +1000
+Subject: [PATCH 066/117] md: using GFP_NOIO to allocate bio for flush request
+
+commit b5e1b8cee7ad58a15d2fa79bcd7946acb592602d upstream.
+
+A flush request is usually issued in transaction commit code path, so
+using GFP_KERNEL to allocate memory for flush request bio falls into
+the classic deadlock issue.
+
+This is suitable for any -stable kernel to which it applies as it
+avoids a possible deadlock.
+
+Signed-off-by: Shaohua Li <shli@fusionio.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/md/md.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index adcd850..700ecae 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -453,7 +453,7 @@ static void submit_flushes(struct work_struct *ws)
+ atomic_inc(&rdev->nr_pending);
+ atomic_inc(&rdev->nr_pending);
+ rcu_read_unlock();
+- bi = bio_alloc_mddev(GFP_KERNEL, 0, mddev);
++ bi = bio_alloc_mddev(GFP_NOIO, 0, mddev);
+ bi->bi_end_io = md_end_flush;
+ bi->bi_private = rdev;
+ bi->bi_bdev = rdev->bdev;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0067-um-Implement-a-custom-pte_same-function.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0067-um-Implement-a-custom-pte_same-function.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0067-um-Implement-a-custom-pte_same-function.patch
@@ -0,0 +1,41 @@
+From ed8e2c17d62006fb136c30abeb552673727c5eee Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Sat, 14 Apr 2012 17:29:30 +0200
+Subject: [PATCH 067/117] um: Implement a custom pte_same() function
+
+commit f15b9000eb1d09bbaa4b0a6b2089d7e1f64e84b3 upstream.
+
+UML uses the _PAGE_NEWPAGE flag to mark pages which are not jet
+installed on the host side using mmap().
+pte_same() has to ignore this flag, otherwise unuse_pte_range()
+is unable to unuse the page because two identical
+page tables entries with different _PAGE_NEWPAGE flags would not
+match and swapoff() would never return.
+
+Analyzed-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/um/include/asm/pgtable.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/um/include/asm/pgtable.h b/arch/um/include/asm/pgtable.h
+index 41474fb..0fea0ec 100644
+--- a/arch/um/include/asm/pgtable.h
++++ b/arch/um/include/asm/pgtable.h
+@@ -271,6 +271,12 @@ static inline void set_pte(pte_t *pteptr, pte_t pteval)
+ }
+ #define set_pte_at(mm,addr,ptep,pteval) set_pte(ptep,pteval)
+
++#define __HAVE_ARCH_PTE_SAME
++static inline int pte_same(pte_t pte_a, pte_t pte_b)
++{
++ return !((pte_val(pte_a) ^ pte_val(pte_b)) & ~_PAGE_NEWPAGE);
++}
++
+ /*
+ * Conversion functions: convert a page and protection to a page entry,
+ * and a page entry and page directory to the page they refer to.
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0068-um-Fix-__swp_type.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0068-um-Fix-__swp_type.patch
--- /dev/null
@@ -0,0 +1,39 @@
+From a8f0308ef13a60d8103b7635fdbd54e10a621a0a Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Sat, 14 Apr 2012 17:46:01 +0200
+Subject: [PATCH 068/117] um: Fix __swp_type()
+
+commit 2b76ebaa728f8a3967c52aa189261c72fe56a6f1 upstream.
+
+The current __swp_type() function uses a too small bitshift.
+Using more than one swap files causes bad pages because
+the type bits clash with other page flags.
+
+Analyzed-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/um/include/asm/pgtable.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/um/include/asm/pgtable.h b/arch/um/include/asm/pgtable.h
+index 0fea0ec..aa365c5 100644
+--- a/arch/um/include/asm/pgtable.h
++++ b/arch/um/include/asm/pgtable.h
+@@ -352,11 +352,11 @@ extern pte_t *virt_to_pte(struct mm_struct *mm, unsigned long addr);
+ #define update_mmu_cache(vma,address,ptep) do ; while (0)
+
+ /* Encode and de-code a swap entry */
+-#define __swp_type(x) (((x).val >> 4) & 0x3f)
++#define __swp_type(x) (((x).val >> 5) & 0x1f)
+ #define __swp_offset(x) ((x).val >> 11)
+
+ #define __swp_entry(type, offset) \
+- ((swp_entry_t) { ((type) << 4) | ((offset) << 11) })
++ ((swp_entry_t) { ((type) << 5) | ((offset) << 11) })
+ #define __pte_to_swp_entry(pte) \
+ ((swp_entry_t) { pte_val(pte_mkuptodate(pte)) })
+ #define __swp_entry_to_pte(x) ((pte_t) { (x).val })
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0069-swap-don-t-do-discard-if-no-discard-option-added.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0069-swap-don-t-do-discard-if-no-discard-option-added.patch
--- /dev/null
@@ -0,0 +1,41 @@
+From c3ad2b1e42ce62ce0b8aa5283e5f1eee851dd3fb Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@kernel.org>
+Date: Wed, 21 Mar 2012 16:34:17 -0700
+Subject: [PATCH 069/117] swap: don't do discard if no discard option added
+
+commit 052b1987faca3606109d88d96bce124851f7c4c2 upstream.
+
+When swapon() was not passed the SWAP_FLAG_DISCARD option, sys_swapon()
+will still perform a discard operation. This can cause problems if
+discard is slow or buggy.
+
+Reverse the order of the check so that a discard operation is performed
+only if the sys_swapon() caller is attempting to enable discard.
+
+Signed-off-by: Shaohua Li <shli@fusionio.com>
+Reported-by: Holger Kiehl <Holger.Kiehl@dwd.de>
+Tested-by: Holger Kiehl <Holger.Kiehl@dwd.de>
+Cc: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ mm/swapfile.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 2015a1e..d3955f2 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2102,7 +2102,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+ p->flags |= SWP_SOLIDSTATE;
+ p->cluster_next = 1 + (random32() % p->highest_bit);
+ }
+- if (discard_swap(p) == 0 && (swap_flags & SWAP_FLAG_DISCARD))
++ if ((swap_flags & SWAP_FLAG_DISCARD) && discard_swap(p) == 0)
+ p->flags |= SWP_DISCARDABLE;
+ }
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0070-Input-wacom-relax-Bamboo-stylus-ID-check.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0070-Input-wacom-relax-Bamboo-stylus-ID-check.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0070-Input-wacom-relax-Bamboo-stylus-ID-check.patch
@@ -0,0 +1,42 @@
+From ae03191fbcee985e26e744fc2e3b928077e647a1 Mon Sep 17 00:00:00 2001
+From: Chris Bagwell <chris@cnpbagwell.com>
+Date: Wed, 26 Oct 2011 22:28:34 -0700
+Subject: [PATCH 070/117] Input: wacom - relax Bamboo stylus ID check
+
+commit c5981411f60c31f0dff6f0f98d2d3711384badaf upstream.
+
+Bit 0x02 always means tip versus eraser. Bit 0x01 is something related
+to version of stylus and different values are starting to be used.
+
+Relaxing proximity check is required to be used with 3rd generation
+Bamboo Pen and Touch tablets.
+
+Signed-off-by: Chris Bagwell <chris@cnpbagwell.com>
+Acked-by: Ping Cheng <pingc@wacom.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/input/tablet/wacom_wac.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
+index 2ee47d0..f00c70e 100644
+--- a/drivers/input/tablet/wacom_wac.c
++++ b/drivers/input/tablet/wacom_wac.c
+@@ -843,12 +843,7 @@ static int wacom_bpt_pen(struct wacom_wac *wacom)
+ unsigned char *data = wacom->data;
+ int prox = 0, x = 0, y = 0, p = 0, d = 0, pen = 0, btn1 = 0, btn2 = 0;
+
+- /*
+- * Similar to Graphire protocol, data[1] & 0x20 is proximity and
+- * data[1] & 0x18 is tool ID. 0x30 is safety check to ignore
+- * 2 unused tool ID's.
+- */
+- prox = (data[1] & 0x30) == 0x30;
++ prox = (data[1] & 0x20) == 0x20;
+
+ /*
+ * All reports shared between PEN and RUBBER tool must be
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0071-ahci-Detect-Marvell-88SE9172-SATA-controller.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0071-ahci-Detect-Marvell-88SE9172-SATA-controller.patch
--- /dev/null
@@ -0,0 +1,35 @@
+From 3e4b4afbb70e3054734cacd6aacf50024f27c3dd Mon Sep 17 00:00:00 2001
+From: Matt Johnson <johnso87@illinois.edu>
+Date: Fri, 27 Apr 2012 01:42:30 -0500
+Subject: [PATCH 071/117] ahci: Detect Marvell 88SE9172 SATA controller
+
+commit 642d89252201c4155fc3946bf9cdea409e5d263e upstream.
+
+The Marvell 88SE9172 SATA controller (PCI ID 1b4b 917a) already worked
+once it was detected, but was missing an ahci_pci_tbl entry.
+
+Boot tested on a Gigabyte Z68X-UD3H-B3 motherboard.
+
+Signed-off-by: Matt Johnson <johnso87@illinois.edu>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/ata/ahci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index cf26222..fb65915 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -384,6 +384,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ .driver_data = board_ahci_yes_fbs }, /* 88se9128 */
+ { PCI_DEVICE(0x1b4b, 0x9125),
+ .driver_data = board_ahci_yes_fbs }, /* 88se9125 */
++ { PCI_DEVICE(0x1b4b, 0x917a),
++ .driver_data = board_ahci_yes_fbs }, /* 88se9172 */
+ { PCI_DEVICE(0x1b4b, 0x91a3),
+ .driver_data = board_ahci_yes_fbs },
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0072-ARM-7365-1-drop-unused-parameter-from-flush_cache_us.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0072-ARM-7365-1-drop-unused-parameter-from-flush_cache_us.patch
--- /dev/null
@@ -0,0 +1,59 @@
+From 06d6cd667991ac824b4e32c07ad4c382e202b920 Mon Sep 17 00:00:00 2001
+From: Dima Zavin <dima@android.com>
+Date: Thu, 29 Mar 2012 20:44:06 +0100
+Subject: [PATCH 072/117] ARM: 7365/1: drop unused parameter from
+ flush_cache_user_range
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 4542b6a0fa6b48d9ae6b41c1efeb618b7a221b2a upstream.
+
+vma isn't used and flush_cache_user_range isn't a standard macro that
+is used on several archs with the same prototype. In fact only unicore32
+has a macro with the same name (with an identical implementation and no
+in-tree users).
+
+This is a part of a patch proposed by Dima Zavin (with Message-id:
+1272439931-12795-1-git-send-email-dima@android.com) that didn't get
+accepted.
+
+Cc: Dima Zavin <dima@android.com>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/arm/include/asm/cacheflush.h | 2 +-
+ arch/arm/kernel/traps.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
+index d5d8d5c..1252a26 100644
+--- a/arch/arm/include/asm/cacheflush.h
++++ b/arch/arm/include/asm/cacheflush.h
+@@ -249,7 +249,7 @@ extern void flush_cache_page(struct vm_area_struct *vma, unsigned long user_addr
+ * Harvard caches are synchronised for the user space address range.
+ * This is used for the ARM private sys_cacheflush system call.
+ */
+-#define flush_cache_user_range(vma,start,end) \
++#define flush_cache_user_range(start,end) \
+ __cpuc_coherent_user_range((start) & PAGE_MASK, PAGE_ALIGN(end))
+
+ /*
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index 99a5727..f363ad9 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -488,7 +488,7 @@ do_cache_op(unsigned long start, unsigned long end, int flags)
+ if (end > vma->vm_end)
+ end = vma->vm_end;
+
+- flush_cache_user_range(vma, start, end);
++ flush_cache_user_range(start, end);
+ }
+ up_read(&mm->mmap_sem);
+ }
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0073-ARM-7409-1-Do-not-call-flush_cache_user_range-with-m.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0073-ARM-7409-1-Do-not-call-flush_cache_user_range-with-m.patch
--- /dev/null
@@ -0,0 +1,45 @@
+From bf1dbf3f545a79e9ac5ff460053283f2760f095b Mon Sep 17 00:00:00 2001
+From: Dima Zavin <dima@android.com>
+Date: Mon, 30 Apr 2012 10:26:14 +0100
+Subject: [PATCH 073/117] ARM: 7409/1: Do not call flush_cache_user_range with
+ mmap_sem held
+
+commit 435a7ef52db7d86e67a009b36cac1457f8972391 upstream.
+
+We can't be holding the mmap_sem while calling flush_cache_user_range
+because the flush can fault. If we fault on a user address, the
+page fault handler will try to take mmap_sem again. Since both places
+acquire the read lock, most of the time it succeeds. However, if another
+thread tries to acquire the write lock on the mmap_sem (e.g. mmap) in
+between the call to flush_cache_user_range and the fault, the down_read
+in do_page_fault will deadlock.
+
+[will: removed drop of vma parameter as already queued by rmk (7365/1)]
+
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Dima Zavin <dima@android.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/arm/kernel/traps.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index f363ad9..160cb16 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -488,7 +488,9 @@ do_cache_op(unsigned long start, unsigned long end, int flags)
+ if (end > vma->vm_end)
+ end = vma->vm_end;
+
++ up_read(&mm->mmap_sem);
+ flush_cache_user_range(start, end);
++ return;
+ }
+ up_read(&mm->mmap_sem);
+ }
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0074-sony-laptop-Enable-keyboard-backlight-by-default.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0074-sony-laptop-Enable-keyboard-backlight-by-default.patch
--- /dev/null
@@ -0,0 +1,48 @@
+From 444d2b8e5c56b431d2aa79db0c1742c6159b661a Mon Sep 17 00:00:00 2001
+From: Josh Boyer <jwboyer@redhat.com>
+Date: Wed, 2 Nov 2011 14:32:00 -0400
+Subject: [PATCH 074/117] sony-laptop: Enable keyboard backlight by default
+
+commit 6fe6ae56a7cebaebc2e6daa11c423e4692f9b592 upstream.
+
+When the keyboard backlight support was originally added, the commit said
+to default it to on with a 10 second timeout. That actually wasn't the
+case, as the default value is commented out for the kbd_backlight parameter.
+Because it is a static variable, it gets set to 0 by default without some
+other form of initialization.
+
+However, it seems the function to set the value wasn't actually called
+immediately, so whatever state the keyboard was in initially would remain.
+Then commit df410d522410e67660 was introduced during the 2.6.39 timeframe to
+immediately set whatever value was present (as well as attempt to
+restore/reset the state on module removal or resume). That seems to have
+now forced the light off immediately when the module is loaded unless
+the option kbd_backlight=1 is specified.
+
+Let's enable it by default again (for the first time). This should solve
+https://bugzilla.redhat.com/show_bug.cgi?id=728478
+
+Signed-off-by: Josh Boyer <jwboyer@redhat.com>
+Acked-by: Mattia Dongili <malattia@linux.it>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/platform/x86/sony-laptop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index c006dee..40c4705 100644
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -127,7 +127,7 @@ MODULE_PARM_DESC(minor,
+ "default is -1 (automatic)");
+ #endif
+
+-static int kbd_backlight; /* = 1 */
++static int kbd_backlight = 1;
+ module_param(kbd_backlight, int, 0444);
+ MODULE_PARM_DESC(kbd_backlight,
+ "set this to 0 to disable keyboard backlight, "
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0075-init-don-t-try-mounting-device-as-nfs-root-unless-ty.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0075-init-don-t-try-mounting-device-as-nfs-root-unless-ty.patch
--- /dev/null
@@ -0,0 +1,54 @@
+From b277e4c19f3668e1a58e03d8933a3c6cd612c5e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <levinsasha928@gmail.com>
+Date: Sat, 5 May 2012 17:06:35 +0200
+Subject: [PATCH 075/117] init: don't try mounting device as nfs root unless
+ type fully matches
+
+commit 377485f6244af255b04d662cf19cddbbc4ae4310 upstream.
+
+Currently, we'll try mounting any device who's major device number is
+UNNAMED_MAJOR as NFS root. This would happen for non-NFS devices as
+well (such as 9p devices) but it wouldn't cause any issues since
+mounting the device as NFS would fail quickly and the code proceeded to
+doing the proper mount:
+
+ [ 101.522716] VFS: Unable to mount root fs via NFS, trying floppy.
+ [ 101.534499] VFS: Mounted root (9p filesystem) on device 0:18.
+
+Commit 6829a048102a ("NFS: Retry mounting NFSROOT") introduced retries
+when mounting NFS root, which means that now we don't immediately fail
+and instead it takes an additional 90+ seconds until we stop retrying,
+which has revealed the issue this patch fixes.
+
+This meant that it would take an additional 90 seconds to boot when
+we're not using a device type which gets detected in order before NFS.
+
+This patch modifies the NFS type check to require device type to be
+'Root_NFS' instead of requiring the device to have an UNNAMED_MAJOR
+major. This makes boot process cleaner since we now won't go through
+the NFS mounting code at all when the device isn't an NFS root
+("/dev/nfs").
+
+Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ init/do_mounts.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/init/do_mounts.c b/init/do_mounts.c
+index db6e5ee..d6c229f 100644
+--- a/init/do_mounts.c
++++ b/init/do_mounts.c
+@@ -470,7 +470,7 @@ void __init change_floppy(char *fmt, ...)
+ void __init mount_root(void)
+ {
+ #ifdef CONFIG_ROOT_NFS
+- if (MAJOR(ROOT_DEV) == UNNAMED_MAJOR) {
++ if (ROOT_DEV == Root_NFS) {
+ if (mount_nfs_root())
+ return;
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0076-memcg-free-spare-array-to-avoid-memory-leak.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0076-memcg-free-spare-array-to-avoid-memory-leak.patch
--- /dev/null
@@ -0,0 +1,40 @@
+From 0b0f028ae418e6b772241ed68bee5f2d0c6bcb3a Mon Sep 17 00:00:00 2001
+From: Sha Zhengju <handai.szj@taobao.com>
+Date: Thu, 10 May 2012 13:01:45 -0700
+Subject: [PATCH 076/117] memcg: free spare array to avoid memory leak
+
+commit 8c7577637ca31385e92769a77e2ab5b428e8b99c upstream.
+
+When the last event is unregistered, there is no need to keep the spare
+array anymore. So free it to avoid memory leak.
+
+Signed-off-by: Sha Zhengju <handai.szj@taobao.com>
+Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Reviewed-by: Kirill A. Shutemov <kirill@shutemov.name>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ mm/memcontrol.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 778554f..c8425b1 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -4549,6 +4549,12 @@ static void mem_cgroup_usage_unregister_event(struct cgroup *cgrp,
+ swap_buffers:
+ /* Swap primary and spare array */
+ thresholds->spare = thresholds->primary;
++ /* If all events are unregistered, free the spare array */
++ if (!new) {
++ kfree(thresholds->spare);
++ thresholds->spare = NULL;
++ }
++
+ rcu_assign_pointer(thresholds->primary, new);
+
+ /* To be sure that nobody uses thresholds */
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0077-compat-Fix-RT-signal-mask-corruption-via-sigprocmask.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0077-compat-Fix-RT-signal-mask-corruption-via-sigprocmask.patch
--- /dev/null
@@ -0,0 +1,107 @@
+From 2ed9e3e61cd65b3a43998d48846744be1b263394 Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <jan.kiszka@siemens.com>
+Date: Thu, 10 May 2012 10:04:36 -0300
+Subject: [PATCH 077/117] compat: Fix RT signal mask corruption via
+ sigprocmask
+
+commit b7dafa0ef3145c31d7753be0a08b3cbda51f0209 upstream.
+
+compat_sys_sigprocmask reads a smaller signal mask from userspace than
+sigprogmask accepts for setting. So the high word of blocked.sig[0]
+will be cleared, releasing any potentially blocked RT signal.
+
+This was discovered via userspace code that relies on get/setcontext.
+glibc's i386 versions of those functions use sigprogmask instead of
+rt_sigprogmask to save/restore signal mask and caused RT signal
+unblocking this way.
+
+As suggested by Linus, this replaces the sys_sigprocmask based compat
+version with one that open-codes the required logic, including the merge
+of the existing blocked set with the new one provided on SIG_SETMASK.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ kernel/compat.c | 63 ++++++++++++++++++++++++++++++++++++++++---------------
+ 1 file changed, 46 insertions(+), 17 deletions(-)
+
+diff --git a/kernel/compat.c b/kernel/compat.c
+index f346ced..a6d0649 100644
+--- a/kernel/compat.c
++++ b/kernel/compat.c
+@@ -320,25 +320,54 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
+
+ #ifdef __ARCH_WANT_SYS_SIGPROCMASK
+
+-asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
+- compat_old_sigset_t __user *oset)
++/*
++ * sys_sigprocmask SIG_SETMASK sets the first (compat) word of the
++ * blocked set of signals to the supplied signal set
++ */
++static inline void compat_sig_setmask(sigset_t *blocked, compat_sigset_word set)
+ {
+- old_sigset_t s;
+- long ret;
+- mm_segment_t old_fs;
++ memcpy(blocked->sig, &set, sizeof(set));
++}
+
+- if (set && get_user(s, set))
+- return -EFAULT;
+- old_fs = get_fs();
+- set_fs(KERNEL_DS);
+- ret = sys_sigprocmask(how,
+- set ? (old_sigset_t __user *) &s : NULL,
+- oset ? (old_sigset_t __user *) &s : NULL);
+- set_fs(old_fs);
+- if (ret == 0)
+- if (oset)
+- ret = put_user(s, oset);
+- return ret;
++asmlinkage long compat_sys_sigprocmask(int how,
++ compat_old_sigset_t __user *nset,
++ compat_old_sigset_t __user *oset)
++{
++ old_sigset_t old_set, new_set;
++ sigset_t new_blocked;
++
++ old_set = current->blocked.sig[0];
++
++ if (nset) {
++ if (get_user(new_set, nset))
++ return -EFAULT;
++ new_set &= ~(sigmask(SIGKILL) | sigmask(SIGSTOP));
++
++ new_blocked = current->blocked;
++
++ switch (how) {
++ case SIG_BLOCK:
++ sigaddsetmask(&new_blocked, new_set);
++ break;
++ case SIG_UNBLOCK:
++ sigdelsetmask(&new_blocked, new_set);
++ break;
++ case SIG_SETMASK:
++ compat_sig_setmask(&new_blocked, new_set);
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ set_current_blocked(&new_blocked);
++ }
++
++ if (oset) {
++ if (put_user(old_set, oset))
++ return -EFAULT;
++ }
++
++ return 0;
+ }
+
+ #endif
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0078-ext3-Fix-error-handling-on-inode-bitmap-corruption.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0078-ext3-Fix-error-handling-on-inode-bitmap-corruption.patch
--- /dev/null
@@ -0,0 +1,43 @@
+From c95c67d82938539844654f8d12a831e06ddae45a Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Thu, 8 Dec 2011 21:13:46 +0100
+Subject: [PATCH 078/117] ext3: Fix error handling on inode bitmap corruption
+
+commit 1415dd8705394399d59a3df1ab48d149e1e41e77 upstream.
+
+When insert_inode_locked() fails in ext3_new_inode() it most likely
+means inode bitmap got corrupted and we allocated again inode which
+is already in use. Also doing unlock_new_inode() during error recovery
+is wrong since inode does not have I_NEW set. Fix the problem by jumping
+to fail: (instead of fail_drop:) which declares filesystem error and
+does not call unlock_new_inode().
+
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ext3/ialloc.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ext3/ialloc.c b/fs/ext3/ialloc.c
+index 5c866e0..adae962 100644
+--- a/fs/ext3/ialloc.c
++++ b/fs/ext3/ialloc.c
+@@ -525,8 +525,12 @@ got:
+ if (IS_DIRSYNC(inode))
+ handle->h_sync = 1;
+ if (insert_inode_locked(inode) < 0) {
+- err = -EINVAL;
+- goto fail_drop;
++ /*
++ * Likely a bitmap corruption causing inode to be allocated
++ * twice.
++ */
++ err = -EIO;
++ goto fail;
+ }
+ spin_lock(&sbi->s_next_gen_lock);
+ inode->i_generation = sbi->s_next_generation++;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0079-ext4-fix-error-handling-on-inode-bitmap-corruption.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0079-ext4-fix-error-handling-on-inode-bitmap-corruption.patch
--- /dev/null
@@ -0,0 +1,42 @@
+From 92d372ef4ce9cea8d08163f727e4eeac7e9a2472 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Sun, 18 Dec 2011 17:37:02 -0500
+Subject: [PATCH 079/117] ext4: fix error handling on inode bitmap corruption
+
+commit acd6ad83517639e8f09a8c5525b1dccd81cd2a10 upstream.
+
+When insert_inode_locked() fails in ext4_new_inode() it most likely means inode
+bitmap got corrupted and we allocated again inode which is already in use. Also
+doing unlock_new_inode() during error recovery is wrong since the inode does
+not have I_NEW set. Fix the problem by jumping to fail: (instead of fail_drop:)
+which declares filesystem error and does not call unlock_new_inode().
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ext4/ialloc.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 00beb4f..8fb6844 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -885,8 +885,12 @@ got:
+ if (IS_DIRSYNC(inode))
+ ext4_handle_sync(handle);
+ if (insert_inode_locked(inode) < 0) {
+- err = -EINVAL;
+- goto fail_drop;
++ /*
++ * Likely a bitmap corruption causing inode to be allocated
++ * twice.
++ */
++ err = -EIO;
++ goto fail;
+ }
+ spin_lock(&sbi->s_next_gen_lock);
+ inode->i_generation = sbi->s_next_generation++;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0080-ACPI-PM-Add-Sony-Vaio-VPCCW29FX-to-nonvs-blacklist.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0080-ACPI-PM-Add-Sony-Vaio-VPCCW29FX-to-nonvs-blacklist.patch
--- /dev/null
@@ -0,0 +1,42 @@
+From 1155d70b0cfab4cef0edb62753bc9b5053d6fa8e Mon Sep 17 00:00:00 2001
+From: Lan Tianyu <tianyu.lan@intel.com>
+Date: Sat, 21 Jan 2012 09:23:56 +0800
+Subject: [PATCH 080/117] ACPI / PM: Add Sony Vaio VPCCW29FX to nonvs
+ blacklist.
+
+commit 93f770846e8dedc5d9117bd4ad9d7efd18420627 upstream.
+
+Sony Vaio VPCCW29FX does not resume correctly without
+acpi_sleep=nonvs, so add it to the ACPI sleep blacklist.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=34722
+
+Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/acpi/sleep.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 0a7ed69..ca191ff 100644
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -438,6 +438,14 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
+ },
+ {
+ .callback = init_nvs_nosave,
++ .ident = "Sony Vaio VPCCW29FX",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "VPCCW29FX"),
++ },
++ },
++ {
++ .callback = init_nvs_nosave,
+ .ident = "Averatec AV1020-ED2",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "AVERATEC"),
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0081-hpsa-Add-IRQF_SHARED-back-in-for-the-non-MSI-X-inter.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0081-hpsa-Add-IRQF_SHARED-back-in-for-the-non-MSI-X-inter.patch
--- /dev/null
@@ -0,0 +1,42 @@
+From a9b96c2354127a1d9d0401564b6359403aecdb66 Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+Date: Mon, 28 Nov 2011 10:15:20 -0600
+Subject: [PATCH 081/117] hpsa: Add IRQF_SHARED back in for the non-MSI(X)
+ interrupt handler
+
+commit 45bcf018d1a4779d592764ef57517c92589d55d7 upstream.
+
+IRQF_SHARED is required for older controllers that don't support MSI(X)
+and which may end up sharing an interrupt. All the controllers hpsa
+normally supports have MSI(X) capability, but older controllers may be
+encountered via the hpsa_allow_any=1 module parameter.
+
+Also remove deprecated IRQF_DISABLED.
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/scsi/hpsa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index dc9dea3..b4d2c86 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -4068,10 +4068,10 @@ static int hpsa_request_irq(struct ctlr_info *h,
+
+ if (h->msix_vector || h->msi_vector)
+ rc = request_irq(h->intr[h->intr_mode], msixhandler,
+- IRQF_DISABLED, h->devname, h);
++ 0, h->devname, h);
+ else
+ rc = request_irq(h->intr[h->intr_mode], intxhandler,
+- IRQF_DISABLED, h->devname, h);
++ IRQF_SHARED, h->devname, h);
+ if (rc) {
+ dev_err(&h->pdev->dev, "unable to get irq %d for %s\n",
+ h->intr[h->intr_mode], h->devname);
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0082-wake-up-s_wait_unfrozen-when-freeze_fs-fails.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0082-wake-up-s_wait_unfrozen-when-freeze_fs-fails.patch
--- /dev/null
@@ -0,0 +1,42 @@
+From ab66f47089f09bceebe3bee38d5e76e08ec748d0 Mon Sep 17 00:00:00 2001
+From: Kazuya Mio <k-mio@sx.jp.nec.com>
+Date: Thu, 1 Dec 2011 16:51:07 +0900
+Subject: [PATCH 082/117] wake up s_wait_unfrozen when ->freeze_fs fails
+
+commit e1616300a20c80396109c1cf013ba9a36055a3da upstream.
+
+dd slept infinitely when fsfeeze failed because of EIO.
+To fix this problem, if ->freeze_fs fails, freeze_super() wakes up
+the tasks waiting for the filesystem to become unfrozen.
+
+When s_frozen isn't SB_UNFROZEN in __generic_file_aio_write(),
+the function sleeps until FITHAW ioctl wakes up s_wait_unfrozen.
+
+However, if ->freeze_fs fails, s_frozen is set to SB_UNFROZEN and then
+freeze_super() returns an error number. In this case, FITHAW ioctl returns
+EINVAL because s_frozen is already SB_UNFROZEN. There is no way to wake up
+s_wait_unfrozen, so __generic_file_aio_write() sleeps infinitely.
+
+Signed-off-by: Kazuya Mio <k-mio@sx.jp.nec.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/super.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/super.c b/fs/super.c
+index afd0f1a..2a698f6 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -1166,6 +1166,8 @@ int freeze_super(struct super_block *sb)
+ printk(KERN_ERR
+ "VFS:Filesystem freeze failed\n");
+ sb->s_frozen = SB_UNFROZEN;
++ smp_wmb();
++ wake_up(&sb->s_wait_unfrozen);
+ deactivate_locked_super(sb);
+ return ret;
+ }
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0083-cifs-fix-revalidation-test-in-cifs_llseek.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0083-cifs-fix-revalidation-test-in-cifs_llseek.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0083-cifs-fix-revalidation-test-in-cifs_llseek.patch
@@ -0,0 +1,35 @@
+From 3f974a0efbf9480d3a540a029f5a98da92ce772e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 30 Apr 2012 17:36:21 +0300
+Subject: [PATCH 083/117] cifs: fix revalidation test in cifs_llseek()
+
+commit 48a5730e5b71201e226ff06e245bf308feba5f10 upstream.
+
+This test is always true so it means we revalidate the length every
+time, which generates more network traffic. When it is SEEK_SET or
+SEEK_CUR, then we don't need to revalidate.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/cifs/cifsfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index b4c2c99..b1451af 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -703,7 +703,7 @@ static loff_t cifs_llseek(struct file *file, loff_t offset, int origin)
+ * origin == SEEK_END || SEEK_DATA || SEEK_HOLE => we must revalidate
+ * the cached file length
+ */
+- if (origin != SEEK_SET || origin != SEEK_CUR) {
++ if (origin != SEEK_SET && origin != SEEK_CUR) {
+ int rc;
+ struct inode *inode = file->f_path.dentry->d_inode;
+
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0084-dl2k-Clean-up-rio_ioctl.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0084-dl2k-Clean-up-rio_ioctl.patch
--- /dev/null
@@ -0,0 +1,123 @@
+From 69fa22d4b635612c73cb0427447c5916e18a217e Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Wed, 25 Apr 2012 14:32:09 +0000
+Subject: [PATCH 084/117] dl2k: Clean up rio_ioctl
+
+commit 1bb57e940e1958e40d51f2078f50c3a96a9b2d75 upstream.
+
+The dl2k driver's rio_ioctl call has a few issues:
+- No permissions checking
+- Implements SIOCGMIIREG and SIOCGMIIREG using the SIOCDEVPRIVATE numbers
+- Has a few ioctls that may have been used for debugging at one point
+ but have no place in the kernel proper.
+
+This patch removes all but the MII ioctls, renumbers them to use the
+standard ones, and adds the proper permission check for SIOCSMIIREG.
+
+We can also get rid of the dl2k-specific struct mii_data in favor of
+the generic struct mii_ioctl_data.
+
+Since we have the phyid on hand, we can add the SIOCGMIIPHY ioctl too.
+
+Most of the MII code for the driver could probably be converted to use
+the generic MII library but I don't have a device to test the results.
+
+Reported-by: Stephan Mueller <stephan.mueller@atsec.com>
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 52 +++++++------------------------------
+ drivers/net/ethernet/dlink/dl2k.h | 7 -----
+ 2 files changed, 9 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index b2dc2c8..2e09edb 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -1259,55 +1259,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
+ {
+ int phy_addr;
+ struct netdev_private *np = netdev_priv(dev);
+- struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru;
+-
+- struct netdev_desc *desc;
+- int i;
++ struct mii_ioctl_data *miidata = if_mii(rq);
+
+ phy_addr = np->phy_addr;
+ switch (cmd) {
+- case SIOCDEVPRIVATE:
+- break;
+-
+- case SIOCDEVPRIVATE + 1:
+- miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num);
++ case SIOCGMIIPHY:
++ miidata->phy_id = phy_addr;
+ break;
+- case SIOCDEVPRIVATE + 2:
+- mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value);
++ case SIOCGMIIREG:
++ miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num);
+ break;
+- case SIOCDEVPRIVATE + 3:
+- break;
+- case SIOCDEVPRIVATE + 4:
+- break;
+- case SIOCDEVPRIVATE + 5:
+- netif_stop_queue (dev);
++ case SIOCSMIIREG:
++ if (!capable(CAP_NET_ADMIN))
++ return -EPERM;
++ mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in);
+ break;
+- case SIOCDEVPRIVATE + 6:
+- netif_wake_queue (dev);
+- break;
+- case SIOCDEVPRIVATE + 7:
+- printk
+- ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n",
+- netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx,
+- np->old_rx);
+- break;
+- case SIOCDEVPRIVATE + 8:
+- printk("TX ring:\n");
+- for (i = 0; i < TX_RING_SIZE; i++) {
+- desc = &np->tx_ring[i];
+- printk
+- ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x",
+- i,
+- (u32) (np->tx_ring_dma + i * sizeof (*desc)),
+- (u32)le64_to_cpu(desc->next_desc),
+- (u32)le64_to_cpu(desc->status),
+- (u32)(le64_to_cpu(desc->fraginfo) >> 32),
+- (u32)le64_to_cpu(desc->fraginfo));
+- printk ("\n");
+- }
+- printk ("\n");
+- break;
+-
+ default:
+ return -EOPNOTSUPP;
+ }
+diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h
+index ba0adca..30c2da3 100644
+--- a/drivers/net/ethernet/dlink/dl2k.h
++++ b/drivers/net/ethernet/dlink/dl2k.h
+@@ -365,13 +365,6 @@ struct ioctl_data {
+ char *data;
+ };
+
+-struct mii_data {
+- __u16 reserved;
+- __u16 reg_num;
+- __u16 in_value;
+- __u16 out_value;
+-};
+-
+ /* The Rx and Tx buffer descriptors. */
+ struct netdev_desc {
+ __le64 next_desc;
+--
+1.7.9.5
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0085-OMAPDSS-VENC-fix-NULL-pointer-dereference-in-DSS2-VE.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.19/0085-OMAPDSS-VENC-fix-NULL-pointer-dereference-in-DSS2-VE.patch
--- /dev/null
@@ -0,0 +1,41 @@
+From ad7129ee930fa9b9efd04490a4ddcd5d5a9039a9 Mon Sep 17 00:00:00 2001
+From: Danny Kukawka <danny.kukawka@bisect.de>
+Date: Tue, 24 Jan 2012 16:44:42 +0100
+Subject: [PATCH 085/117] OMAPDSS: VENC: fix NULL pointer dereference in DSS2
+ VENC sysfs debug attr on OMAP4
+
+commit cc1d3e032df53d83d0ca4d537d8eb67eb5b3e808 upstream.
+
+Commit ba02fa37de80bea10d706f39f076dd848348320a disabled the
+venc driver registration on OMAP4. Since the driver never gets
+probed/initialised your get a dereferenceed NULL pointer if you
+try to get info from /sys/kernel/debug/omapdss/venc
+
+Return info message about disabled venc if venc_dump_regs() gets called.
+
+Signed-off-by: Danny Kukawka <danny.kukawka@bisect.de>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/video/omap2/dss/venc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/video/omap2/dss/venc.c b/drivers/video/omap2/dss/venc.c
+index 7533458..7152b53 100644
+--- a/drivers/video/omap2/dss/venc.c
++++ b/drivers/video/omap2/dss/venc.c
+@@ -679,6 +679,11 @@ void ven