summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: d9d51a1)
raw | patch | inline | side by side (parent: d9d51a1)
| author | Koen Kooi <koen@dominion.thruhere.net> | |
| Wed, 23 May 2012 09:20:07 +0000 (11:20 +0200) | ||
| committer | Denys Dmytriyenko <denys@ti.com> | |
| Wed, 30 May 2012 17:49:03 +0000 (13:49 -0400) |
Duplicate patches between PSP and 3.2.17 have been dropped from the 3.2.17 series
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
223 files changed:
index e04da03bf7ede392b46c3bd2ceda135f5c16fcb6..61ee65ebfaecaad164e27263e0fcc177f1b63ae8 100644 (file)
require conf/machine/include/tune-cortexa8.inc
PREFERRED_PROVIDER_virtual/kernel = "linux-ti33x-psp"
# Increase this everytime you change something in the kernel
-MACHINE_KERNEL_PR = "r11"
+MACHINE_KERNEL_PR = "r12"
KERNEL_IMAGETYPE = "uImage"
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0001-crypto-sha512-Fix-byte-counter-overflow-in-SHA-512.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0001-crypto-sha512-Fix-byte-counter-overflow-in-SHA-512.patch
--- /dev/null
@@ -0,0 +1,37 @@
+From 56ff3a4557bf6cd95220c643eb6fdf28db222370 Mon Sep 17 00:00:00 2001
+From: Kent Yoder <key@linux.vnet.ibm.com>
+Date: Thu, 5 Apr 2012 20:34:20 +0800
+Subject: [PATCH 001/165] crypto: sha512 - Fix byte counter overflow in
+ SHA-512
+
+commit 25c3d30c918207556ae1d6e663150ebdf902186b upstream.
+
+The current code only increments the upper 64 bits of the SHA-512 byte
+counter when the number of bytes hashed happens to hit 2^64 exactly.
+
+This patch increments the upper 64 bits whenever the lower 64 bits
+overflows.
+
+Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ crypto/sha512_generic.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
+index 107f6f7..dd30f40 100644
+--- a/crypto/sha512_generic.c
++++ b/crypto/sha512_generic.c
+@@ -174,7 +174,7 @@ sha512_update(struct shash_desc *desc, const u8 *data, unsigned int len)
+ index = sctx->count[0] & 0x7f;
+
+ /* Update number of bytes */
+- if (!(sctx->count[0] += len))
++ if ((sctx->count[0] += len) < len)
+ sctx->count[1]++;
+
+ part_len = 128 - index;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0002-ALSA-hda-conexant-Don-t-set-HP-pin-control-bit-uncon.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0002-ALSA-hda-conexant-Don-t-set-HP-pin-control-bit-uncon.patch
--- /dev/null
@@ -0,0 +1,43 @@
+From b5fdd927a3527e8ed9a882d3c72e32435fa71dd3 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 19 Apr 2012 15:15:25 +0200
+Subject: [PATCH 002/165] ALSA: hda/conexant - Don't set HP pin-control bit
+ unconditionally
+
+commit ca3649de026ff95c6f2847e8d096cf2f411c02b3 upstream.
+
+Some output pins on Conexant chips have no HP control bit, but the
+auto-parser initializes these pins unconditionally with PIN_HP.
+
+Check the pin-capability and avoid the HP bit if not supported.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ sound/pci/hda/patch_conexant.c | 9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index ae94929..99a3378 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -4003,9 +4003,14 @@ static void cx_auto_init_output(struct hda_codec *codec)
+ int i;
+
+ mute_outputs(codec, spec->multiout.num_dacs, spec->multiout.dac_nids);
+- for (i = 0; i < cfg->hp_outs; i++)
++ for (i = 0; i < cfg->hp_outs; i++) {
++ unsigned int val = PIN_OUT;
++ if (snd_hda_query_pin_caps(codec, cfg->hp_pins[i]) &
++ AC_PINCAP_HP_DRV)
++ val |= AC_PINCTL_HP_EN;
+ snd_hda_codec_write(codec, cfg->hp_pins[i], 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP);
++ AC_VERB_SET_PIN_WIDGET_CONTROL, val);
++ }
+ mute_outputs(codec, cfg->hp_outs, cfg->hp_pins);
+ mute_outputs(codec, cfg->line_outs, cfg->line_out_pins);
+ mute_outputs(codec, cfg->speaker_outs, cfg->speaker_pins);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0003-ALSA-hda-conexant-Set-up-the-missing-docking-station.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0003-ALSA-hda-conexant-Set-up-the-missing-docking-station.patch
--- /dev/null
@@ -0,0 +1,99 @@
+From 859f08d45339917d263a366170476c1f8389a2ea Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 19 Apr 2012 15:18:08 +0200
+Subject: [PATCH 003/165] ALSA: hda/conexant - Set up the missing
+ docking-station pins
+
+commit d70f363222ef373c2037412f09a600357cfa1c7a upstream.
+
+ThinkPad 410,420,510,520 and X201 with cx50585 & co chips have the
+docking-station ports, but BIOS doesn't initialize for these pins.
+Thus, like the former X200, we need to set up the pins manually in the
+driver.
+
+The odd part is that the same PCI SSID is used for X200 and T400, thus
+we need to prepare individual fixup tables for cx5051 and others.
+
+Bugzilla entries:
+ https://bugzilla.redhat.com/show_bug.cgi?id=808559
+ https://bugzilla.redhat.com/show_bug.cgi?id=806217
+ https://bugzilla.redhat.com/show_bug.cgi?id=810697
+
+Reported-by: Josh Boyer <jwboyer@redhat.com>
+Reported-by: Jens Taprogge <jens.taprogge@taprogge.org>
+Tested-by: Jens Taprogge <jens.taprogge@taprogge.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ sound/pci/hda/patch_conexant.c | 28 +++++++++++++++++++++++++---
+ 1 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 99a3378..51a1afc 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -4413,8 +4413,10 @@ static void apply_pin_fixup(struct hda_codec *codec,
+
+ enum {
+ CXT_PINCFG_LENOVO_X200,
++ CXT_PINCFG_LENOVO_TP410,
+ };
+
++/* ThinkPad X200 & co with cxt5051 */
+ static const struct cxt_pincfg cxt_pincfg_lenovo_x200[] = {
+ { 0x16, 0x042140ff }, /* HP (seq# overridden) */
+ { 0x17, 0x21a11000 }, /* dock-mic */
+@@ -4422,15 +4424,33 @@ static const struct cxt_pincfg cxt_pincfg_lenovo_x200[] = {
+ {}
+ };
+
++/* ThinkPad 410/420/510/520, X201 & co with cxt5066 */
++static const struct cxt_pincfg cxt_pincfg_lenovo_tp410[] = {
++ { 0x19, 0x042110ff }, /* HP (seq# overridden) */
++ { 0x1a, 0x21a190f0 }, /* dock-mic */
++ { 0x1c, 0x212140ff }, /* dock-HP */
++ {}
++};
++
+ static const struct cxt_pincfg *cxt_pincfg_tbl[] = {
+ [CXT_PINCFG_LENOVO_X200] = cxt_pincfg_lenovo_x200,
++ [CXT_PINCFG_LENOVO_TP410] = cxt_pincfg_lenovo_tp410,
+ };
+
+-static const struct snd_pci_quirk cxt_fixups[] = {
++static const struct snd_pci_quirk cxt5051_fixups[] = {
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
+ {}
+ };
+
++static const struct snd_pci_quirk cxt5066_fixups[] = {
++ SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
++ SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
++ SND_PCI_QUIRK(0x17aa, 0x215f, "Lenovo T510", CXT_PINCFG_LENOVO_TP410),
++ SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
++ SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
++ {}
++};
++
+ /* add "fake" mute amp-caps to DACs on cx5051 so that mixer mute switches
+ * can be created (bko#42825)
+ */
+@@ -4467,11 +4487,13 @@ static int patch_conexant_auto(struct hda_codec *codec)
+ break;
+ case 0x14f15051:
+ add_cx5051_fake_mutes(codec);
++ apply_pin_fixup(codec, cxt5051_fixups, cxt_pincfg_tbl);
++ break;
++ default:
++ apply_pin_fixup(codec, cxt5066_fixups, cxt_pincfg_tbl);
+ break;
+ }
+
+- apply_pin_fixup(codec, cxt_fixups, cxt_pincfg_tbl);
+-
+ err = cx_auto_search_adcs(codec);
+ if (err < 0)
+ return err;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0004-ARM-clps711x-serial-driver-hungs-are-a-result-of-cal.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0004-ARM-clps711x-serial-driver-hungs-are-a-result-of-cal.patch
--- /dev/null
@@ -0,0 +1,54 @@
+From 36a5e353678eb6856bf90e322b815865abf4c660 Mon Sep 17 00:00:00 2001
+From: Alexander Shiyan <shc_work@mail.ru>
+Date: Tue, 27 Mar 2012 12:22:49 +0400
+Subject: [PATCH 004/165] ARM: clps711x: serial driver hungs are a result of
+ call disable_irq within ISR
+
+commit 7a6fbc9a887193a1e9f8658703881c528040afbc upstream.
+
+Since 2.6.30-rc1 clps711x serial driver hungs system. This is a result
+of call disable_irq from ISR. synchronize_irq waits for end of interrupt
+and goes to infinite loop. This patch fix this problem.
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/serial/clps711x.c | 14 ++++++++------
+ 1 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/tty/serial/clps711x.c b/drivers/tty/serial/clps711x.c
+index e6c3dbd..836fe273 100644
+--- a/drivers/tty/serial/clps711x.c
++++ b/drivers/tty/serial/clps711x.c
+@@ -154,10 +154,9 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id)
+ port->x_char = 0;
+ return IRQ_HANDLED;
+ }
+- if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
+- clps711xuart_stop_tx(port);
+- return IRQ_HANDLED;
+- }
++
++ if (uart_circ_empty(xmit) || uart_tx_stopped(port))
++ goto disable_tx_irq;
+
+ count = port->fifosize >> 1;
+ do {
+@@ -171,8 +170,11 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id)
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ uart_write_wakeup(port);
+
+- if (uart_circ_empty(xmit))
+- clps711xuart_stop_tx(port);
++ if (uart_circ_empty(xmit)) {
++ disable_tx_irq:
++ disable_irq_nosync(TX_IRQ(port));
++ tx_enabled(port) = 0;
++ }
+
+ return IRQ_HANDLED;
+ }
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0005-ARM-OMAP1-DMTIMER-fix-broken-timer-clock-source-sele.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0005-ARM-OMAP1-DMTIMER-fix-broken-timer-clock-source-sele.patch
--- /dev/null
@@ -0,0 +1,58 @@
+From 69c74a3f01d30c6dd44991f6413a4f317f4591a7 Mon Sep 17 00:00:00 2001
+From: Paul Walmsley <paul@pwsan.com>
+Date: Tue, 10 Apr 2012 18:36:02 -0600
+Subject: [PATCH 005/165] ARM: OMAP1: DMTIMER: fix broken timer clock source
+ selection
+
+commit 6aaec67da1e41a0752a2b903b989e73b9f02e182 upstream.
+
+DMTIMER source selection on OMAP1 is broken. omap1_dm_timer_set_src()
+tries to use __raw_{read,write}l() to read from and write to physical
+addresses, but those functions take virtual addresses.
+
+sparse caught this:
+
+arch/arm/mach-omap1/timer.c:50:13: warning: incorrect type in argument 1 (different base types)
+arch/arm/mach-omap1/timer.c:50:13: expected void const volatile [noderef] <asn:2>*<noident>
+arch/arm/mach-omap1/timer.c:50:13: got unsigned int
+arch/arm/mach-omap1/timer.c:52:9: warning: incorrect type in argument 1 (different base types)
+arch/arm/mach-omap1/timer.c:52:9: expected void const volatile [noderef] <asn:2>*<noident>
+arch/arm/mach-omap1/timer.c:52:9: got unsigned int
+
+Fix by using omap_{read,writel}(), just like the other users of the
+MOD_CONF_CTRL_1 register in the OMAP1 codebase. Of course, in the long term,
+removing omap_{read,write}l() is the appropriate thing to do; but
+this will take some work to do this cleanly.
+
+Looks like this was caused by 97933d6 (ARM: OMAP1: dmtimer: conversion
+to platform devices) that dangerously moved code and changed it in
+the same patch.
+
+Signed-off-by: Paul Walmsley <paul@pwsan.com>
+Cc: Tarun Kanti DebBarma <tarun.kanti@ti.com>
+[tony@atomide.com: updated comments to include the breaking commit]
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/arm/mach-omap1/timer.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c
+index 6e90665..fb202af 100644
+--- a/arch/arm/mach-omap1/timer.c
++++ b/arch/arm/mach-omap1/timer.c
+@@ -47,9 +47,9 @@ static int omap1_dm_timer_set_src(struct platform_device *pdev,
+ int n = (pdev->id - 1) << 1;
+ u32 l;
+
+- l = __raw_readl(MOD_CONF_CTRL_1) & ~(0x03 << n);
++ l = omap_readl(MOD_CONF_CTRL_1) & ~(0x03 << n);
+ l |= source << n;
+- __raw_writel(l, MOD_CONF_CTRL_1);
++ omap_writel(l, MOD_CONF_CTRL_1);
+
+ return 0;
+ }
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0006-mmc-fixes-for-eMMC-v4.5-discard-operation.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0006-mmc-fixes-for-eMMC-v4.5-discard-operation.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0006-mmc-fixes-for-eMMC-v4.5-discard-operation.patch
@@ -0,0 +1,72 @@
+From 23e70c192386ff8d0e33f9b9225d984ae5eea97b Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 5 Apr 2012 14:45:47 +0300
+Subject: [PATCH 006/165] mmc: fixes for eMMC v4.5 discard operation
+
+commit 7194efb8f063ee3aa0cb50d9002348887e68ec10 upstream.
+
+eMMC v4.5 discard operation is significantly different from the
+existing trim operation because it is not guaranteed to work with
+the new sanitize operation. Consequently mmc_can_trim() is
+separated from mmc_can_discard().
+
+Also the new discard operation does not result in the sectors being
+set to all-zeros, so discard_zeroes_data must not be set.
+
+In addition, the new discard has the same timeout as trim, but from
+v4.5 trim is defined to use the hc timeout. The timeout calculation
+is adjusted accordingly.
+
+Fixes apply to linux 3.2 on.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/mmc/card/queue.c | 2 +-
+ drivers/mmc/core/core.c | 7 ++++---
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
+index dcad59c..78690f2 100644
+--- a/drivers/mmc/card/queue.c
++++ b/drivers/mmc/card/queue.c
+@@ -134,7 +134,7 @@ static void mmc_queue_setup_discard(struct request_queue *q,
+
+ queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
+ q->limits.max_discard_sectors = max_discard;
+- if (card->erased_byte == 0)
++ if (card->erased_byte == 0 && !mmc_can_discard(card))
+ q->limits.discard_zeroes_data = 1;
+ q->limits.discard_granularity = card->pref_erase << 9;
+ /* granularity must not be greater than max. discard */
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 950b97d..c420a9e 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1516,7 +1516,10 @@ static unsigned int mmc_mmc_erase_timeout(struct mmc_card *card,
+ {
+ unsigned int erase_timeout;
+
+- if (card->ext_csd.erase_group_def & 1) {
++ if (arg == MMC_DISCARD_ARG ||
++ (arg == MMC_TRIM_ARG && card->ext_csd.rev >= 6)) {
++ erase_timeout = card->ext_csd.trim_timeout;
++ } else if (card->ext_csd.erase_group_def & 1) {
+ /* High Capacity Erase Group Size uses HC timeouts */
+ if (arg == MMC_TRIM_ARG)
+ erase_timeout = card->ext_csd.trim_timeout;
+@@ -1788,8 +1791,6 @@ int mmc_can_trim(struct mmc_card *card)
+ {
+ if (card->ext_csd.sec_feature_support & EXT_CSD_SEC_GB_CL_EN)
+ return 1;
+- if (mmc_can_discard(card))
+- return 1;
+ return 0;
+ }
+ EXPORT_SYMBOL(mmc_can_trim);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0007-mmc-fixes-for-eMMC-v4.5-sanitize-operation.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0007-mmc-fixes-for-eMMC-v4.5-sanitize-operation.patch
--- /dev/null
@@ -0,0 +1,136 @@
+From 6e1972f1214d5827d22d15985bb50d1e05307e7e Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 5 Apr 2012 14:45:48 +0300
+Subject: [PATCH 007/165] mmc: fixes for eMMC v4.5 sanitize operation
+
+commit 283028122db37621b124f079ca8eae5b64807ad4 upstream.
+
+eMMC v4.5 sanitize operation erases all copies of unmapped
+data. However trim or erase operations must be used first
+to unmap the required sectors. That was not being done.
+
+Fixes apply to linux 3.2 on.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/mmc/card/block.c | 54 ++++++++++++++++++++++++++++++++-------------
+ drivers/mmc/core/core.c | 2 +
+ 2 files changed, 40 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index 60e8951..6679c4f 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -799,7 +799,7 @@ static int mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
+ {
+ struct mmc_blk_data *md = mq->data;
+ struct mmc_card *card = md->queue.card;
+- unsigned int from, nr, arg;
++ unsigned int from, nr, arg, trim_arg, erase_arg;
+ int err = 0, type = MMC_BLK_SECDISCARD;
+
+ if (!(mmc_can_secure_erase_trim(card) || mmc_can_sanitize(card))) {
+@@ -807,20 +807,26 @@ static int mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
+ goto out;
+ }
+
++ from = blk_rq_pos(req);
++ nr = blk_rq_sectors(req);
++
+ /* The sanitize operation is supported at v4.5 only */
+ if (mmc_can_sanitize(card)) {
+- err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+- EXT_CSD_SANITIZE_START, 1, 0);
+- goto out;
++ erase_arg = MMC_ERASE_ARG;
++ trim_arg = MMC_TRIM_ARG;
++ } else {
++ erase_arg = MMC_SECURE_ERASE_ARG;
++ trim_arg = MMC_SECURE_TRIM1_ARG;
+ }
+
+- from = blk_rq_pos(req);
+- nr = blk_rq_sectors(req);
+-
+- if (mmc_can_trim(card) && !mmc_erase_group_aligned(card, from, nr))
+- arg = MMC_SECURE_TRIM1_ARG;
+- else
+- arg = MMC_SECURE_ERASE_ARG;
++ if (mmc_erase_group_aligned(card, from, nr))
++ arg = erase_arg;
++ else if (mmc_can_trim(card))
++ arg = trim_arg;
++ else {
++ err = -EINVAL;
++ goto out;
++ }
+ retry:
+ if (card->quirks & MMC_QUIRK_INAND_CMD38) {
+ err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+@@ -830,25 +836,41 @@ retry:
+ INAND_CMD38_ARG_SECERASE,
+ 0);
+ if (err)
+- goto out;
++ goto out_retry;
+ }
++
+ err = mmc_erase(card, from, nr, arg);
+- if (!err && arg == MMC_SECURE_TRIM1_ARG) {
++ if (err == -EIO)
++ goto out_retry;
++ if (err)
++ goto out;
++
++ if (arg == MMC_SECURE_TRIM1_ARG) {
+ if (card->quirks & MMC_QUIRK_INAND_CMD38) {
+ err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+ INAND_CMD38_ARG_EXT_CSD,
+ INAND_CMD38_ARG_SECTRIM2,
+ 0);
+ if (err)
+- goto out;
++ goto out_retry;
+ }
++
+ err = mmc_erase(card, from, nr, MMC_SECURE_TRIM2_ARG);
++ if (err == -EIO)
++ goto out_retry;
++ if (err)
++ goto out;
+ }
+-out:
+- if (err == -EIO && !mmc_blk_reset(md, card->host, type))
++
++ if (mmc_can_sanitize(card))
++ err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
++ EXT_CSD_SANITIZE_START, 1, 0);
++out_retry:
++ if (err && !mmc_blk_reset(md, card->host, type))
+ goto retry;
+ if (!err)
+ mmc_blk_reset_success(md, type);
++out:
+ spin_lock_irq(&md->lock);
+ __blk_end_request(req, err, blk_rq_bytes(req));
+ spin_unlock_irq(&md->lock);
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index c420a9e..411a994 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1809,6 +1809,8 @@ EXPORT_SYMBOL(mmc_can_discard);
+
+ int mmc_can_sanitize(struct mmc_card *card)
+ {
++ if (!mmc_can_trim(card) && !mmc_can_erase(card))
++ return 0;
+ if (card->ext_csd.sec_feature_support & EXT_CSD_SEC_SANITIZE)
+ return 1;
+ return 0;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0008-mmc-unbreak-sdhci-esdhc-imx-on-i.MX25.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0008-mmc-unbreak-sdhci-esdhc-imx-on-i.MX25.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0008-mmc-unbreak-sdhci-esdhc-imx-on-i.MX25.patch
@@ -0,0 +1,40 @@
+From 5c4111343e2cb543a436cd23d7633a513fd8385d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Eric=20B=C3=A9nard?= <eric@eukrea.com>
+Date: Wed, 18 Apr 2012 02:30:20 +0200
+Subject: [PATCH 008/165] mmc: unbreak sdhci-esdhc-imx on i.MX25
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit b89152824f993a9572b47eb31f4579feadeac34c upstream.
+
+This was broken by me in 37865fe91582582a6f6c00652f6a2b1ff71f8a78
+("mmc: sdhci-esdhc-imx: fix timeout on i.MX's sdhci") where more
+extensive tests would have shown that read or write of data to the
+card were failing (even if the partition table was correctly read).
+
+Signed-off-by: Eric Bénard <eric@eukrea.com>
+Acked-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/mmc/host/sdhci-esdhc-imx.c | 3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index 4540e37..1b47937 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -467,8 +467,7 @@ static int __devinit sdhci_esdhc_imx_probe(struct platform_device *pdev)
+ clk_enable(clk);
+ pltfm_host->clk = clk;
+
+- if (!is_imx25_esdhc(imx_data))
+- host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
++ host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
+
+ if (is_imx25_esdhc(imx_data) || is_imx35_esdhc(imx_data))
+ /* Fix errata ENGcm07207 present on i.MX25 and i.MX35 */
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0009-xen-gntdev-do-not-set-VM_PFNMAP.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0009-xen-gntdev-do-not-set-VM_PFNMAP.patch
--- /dev/null
@@ -0,0 +1,37 @@
+From ccc1f53caca147badfafce099bd995a33d04880a Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Date: Tue, 3 Apr 2012 18:05:47 +0100
+Subject: [PATCH 009/165] xen/gntdev: do not set VM_PFNMAP
+
+commit e8e937be971d706061dc56220ff3605ab77622a7 upstream.
+
+Since we are using the m2p_override we do have struct pages
+corresponding to the user vma mmap'ed by gntdev.
+
+Removing the VM_PFNMAP flag makes get_user_pages work on that vma.
+An example test case would be using a Xen userspace block backend
+(QDISK) on a file on NFS using O_DIRECT.
+
+Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/xen/gntdev.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index afca14d..625890c 100644
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -692,7 +692,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
+ vma->vm_flags |= VM_RESERVED|VM_DONTEXPAND;
+
+ if (use_ptemod)
+- vma->vm_flags |= VM_DONTCOPY|VM_PFNMAP;
++ vma->vm_flags |= VM_DONTCOPY;
+
+ vma->vm_private_data = map;
+
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0010-xen-xenbus-Add-quirk-to-deal-with-misconfigured-back.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0010-xen-xenbus-Add-quirk-to-deal-with-misconfigured-back.patch
--- /dev/null
@@ -0,0 +1,151 @@
+From a3da8d9a1658c86fb74dbd35b8bda473d8fe0717 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Tue, 17 Apr 2012 22:21:38 -0400
+Subject: [PATCH 010/165] xen/xenbus: Add quirk to deal with misconfigured
+ backends.
+
+commit 3066616ce23aad5719c23a0f21f32676402cb44b upstream.
+
+A rather annoying and common case is when booting a PVonHVM guest
+and exposing the PV KBD and PV VFB - as broken toolstacks don't
+always initialize the backends correctly.
+
+Normally The HVM guest is using the VGA driver and the emulated
+keyboard for this (though upstream version of QEMU implements
+PV KBD, but still uses a VGA driver). We provide a very basic
+two-stage wait mechanism - where we wait for 30 seconds for all
+devices, and then for 270 for all them except the two mentioned.
+
+That allows us to wait for the essential devices, like network
+or disk for the full 6 minutes.
+
+To trigger this, put this in your guest config:
+
+vfb = [ 'vnc=1, vnclisten=0.0.0.0 ,vncunused=1']
+
+instead of this:
+vnc=1
+vnclisten="0.0.0.0"
+
+Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+[v3: Split delay in non-essential (30 seconds) and essential
+ devices per Ian and Stefano suggestion]
+[v4: Added comments per Stefano suggestion]
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/xen/xenbus/xenbus_probe_frontend.c | 69 +++++++++++++++++++++------
+ 1 files changed, 53 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
+index 2f73195..2ce95c0 100644
+--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
++++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
+@@ -129,7 +129,7 @@ static int read_backend_details(struct xenbus_device *xendev)
+ return xenbus_read_otherend_details(xendev, "backend-id", "backend");
+ }
+
+-static int is_device_connecting(struct device *dev, void *data)
++static int is_device_connecting(struct device *dev, void *data, bool ignore_nonessential)
+ {
+ struct xenbus_device *xendev = to_xenbus_device(dev);
+ struct device_driver *drv = data;
+@@ -146,16 +146,41 @@ static int is_device_connecting(struct device *dev, void *data)
+ if (drv && (dev->driver != drv))
+ return 0;
+
++ if (ignore_nonessential) {
++ /* With older QEMU, for PVonHVM guests the guest config files
++ * could contain: vfb = [ 'vnc=1, vnclisten=0.0.0.0']
++ * which is nonsensical as there is no PV FB (there can be
++ * a PVKB) running as HVM guest. */
++
++ if ((strncmp(xendev->nodename, "device/vkbd", 11) == 0))
++ return 0;
++
++ if ((strncmp(xendev->nodename, "device/vfb", 10) == 0))
++ return 0;
++ }
+ xendrv = to_xenbus_driver(dev->driver);
+ return (xendev->state < XenbusStateConnected ||
+ (xendev->state == XenbusStateConnected &&
+ xendrv->is_ready && !xendrv->is_ready(xendev)));
+ }
++static int essential_device_connecting(struct device *dev, void *data)
++{
++ return is_device_connecting(dev, data, true /* ignore PV[KBB+FB] */);
++}
++static int non_essential_device_connecting(struct device *dev, void *data)
++{
++ return is_device_connecting(dev, data, false);
++}
+
+-static int exists_connecting_device(struct device_driver *drv)
++static int exists_essential_connecting_device(struct device_driver *drv)
+ {
+ return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
+- is_device_connecting);
++ essential_device_connecting);
++}
++static int exists_non_essential_connecting_device(struct device_driver *drv)
++{
++ return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
++ non_essential_device_connecting);
+ }
+
+ static int print_device_status(struct device *dev, void *data)
+@@ -186,6 +211,23 @@ static int print_device_status(struct device *dev, void *data)
+ /* We only wait for device setup after most initcalls have run. */
+ static int ready_to_wait_for_devices;
+
++static bool wait_loop(unsigned long start, unsigned int max_delay,
++ unsigned int *seconds_waited)
++{
++ if (time_after(jiffies, start + (*seconds_waited+5)*HZ)) {
++ if (!*seconds_waited)
++ printk(KERN_WARNING "XENBUS: Waiting for "
++ "devices to initialise: ");
++ *seconds_waited += 5;
++ printk("%us...", max_delay - *seconds_waited);
++ if (*seconds_waited == max_delay)
++ return true;
++ }
++
++ schedule_timeout_interruptible(HZ/10);
++
++ return false;
++}
+ /*
+ * On a 5-minute timeout, wait for all devices currently configured. We need
+ * to do this to guarantee that the filesystems and / or network devices
+@@ -209,19 +251,14 @@ static void wait_for_devices(struct xenbus_driver *xendrv)
+ if (!ready_to_wait_for_devices || !xen_domain())
+ return;
+
+- while (exists_connecting_device(drv)) {
+- if (time_after(jiffies, start + (seconds_waited+5)*HZ)) {
+- if (!seconds_waited)
+- printk(KERN_WARNING "XENBUS: Waiting for "
+- "devices to initialise: ");
+- seconds_waited += 5;
+- printk("%us...", 300 - seconds_waited);
+- if (seconds_waited == 300)
+- break;
+- }
+-
+- schedule_timeout_interruptible(HZ/10);
+- }
++ while (exists_non_essential_connecting_device(drv))
++ if (wait_loop(start, 30, &seconds_waited))
++ break;
++
++ /* Skips PVKB and PVFB check.*/
++ while (exists_essential_connecting_device(drv))
++ if (wait_loop(start, 270, &seconds_waited))
++ break;
+
+ if (seconds_waited)
+ printk("\n");
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0011-USB-yurex-Remove-allocation-of-coherent-buffer-for-s.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0011-USB-yurex-Remove-allocation-of-coherent-buffer-for-s.patch
--- /dev/null
@@ -0,0 +1,48 @@
+From 607a2c7f4e227d472b7b1c6b69ec7112f5e8b142 Mon Sep 17 00:00:00 2001
+From: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
+Date: Fri, 30 Mar 2012 08:51:28 +0900
+Subject: [PATCH 011/165] USB: yurex: Remove allocation of coherent buffer for
+ setup-packet buffer
+
+commit 523fc5c14f6cad283e5a266eba0e343aed6e73d5 upstream.
+
+Removes allocation of coherent buffer for the control-request setup-packet
+buffer from the yurex driver. Using coherent buffers for setup-packet is
+obsolete and does not work with some USB host implementations.
+
+Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/misc/yurex.c | 8 ++------
+ 1 files changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index ac5bfd6..24bff37 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -99,9 +99,7 @@ static void yurex_delete(struct kref *kref)
+ usb_put_dev(dev->udev);
+ if (dev->cntl_urb) {
+ usb_kill_urb(dev->cntl_urb);
+- if (dev->cntl_req)
+- usb_free_coherent(dev->udev, YUREX_BUF_SIZE,
+- dev->cntl_req, dev->cntl_urb->setup_dma);
++ kfree(dev->cntl_req);
+ if (dev->cntl_buffer)
+ usb_free_coherent(dev->udev, YUREX_BUF_SIZE,
+ dev->cntl_buffer, dev->cntl_urb->transfer_dma);
+@@ -234,9 +232,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
+ }
+
+ /* allocate buffer for control req */
+- dev->cntl_req = usb_alloc_coherent(dev->udev, YUREX_BUF_SIZE,
+- GFP_KERNEL,
+- &dev->cntl_urb->setup_dma);
++ dev->cntl_req = kmalloc(YUREX_BUF_SIZE, GFP_KERNEL);
+ if (!dev->cntl_req) {
+ err("Could not allocate cntl_req");
+ goto error;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0012-USB-yurex-Fix-missing-URB_NO_TRANSFER_DMA_MAP-flag-i.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0012-USB-yurex-Fix-missing-URB_NO_TRANSFER_DMA_MAP-flag-i.patch
--- /dev/null
@@ -0,0 +1,35 @@
+From 52f84b7d4cbfe7fc0ed467312e405df648bb1dca Mon Sep 17 00:00:00 2001
+From: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
+Date: Fri, 30 Mar 2012 08:51:36 +0900
+Subject: [PATCH 012/165] USB: yurex: Fix missing URB_NO_TRANSFER_DMA_MAP flag
+ in urb
+
+commit 532f17b5d59bf0deb6f1ff9bc1fb27d5b5011c09 upstream.
+
+Current probing code is setting URB_NO_TRANSFER_DMA_MAP flag into a wrong urb
+structure, and this causes BUG_ON with some USB host implementations.
+This patch fixes the issue.
+
+Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/misc/yurex.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index 24bff37..2504694 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -282,7 +282,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
+ usb_rcvintpipe(dev->udev, dev->int_in_endpointAddr),
+ dev->int_buffer, YUREX_BUF_SIZE, yurex_interrupt,
+ dev, 1);
+- dev->cntl_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
++ dev->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+ if (usb_submit_urb(dev->urb, GFP_KERNEL)) {
+ retval = -EIO;
+ err("Could not submitting URB");
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0013-uwb-fix-use-of-del_timer_sync-in-interrupt.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0013-uwb-fix-use-of-del_timer_sync-in-interrupt.patch
--- /dev/null
@@ -0,0 +1,64 @@
+From 73b80f793567a6056f9265c82599b47bc5856db8 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Mon, 16 Apr 2012 15:28:28 +0200
+Subject: [PATCH 013/165] uwb: fix use of del_timer_sync() in interrupt
+
+commit 9426cd05682745d1024dbabdec5631309bd2f480 upstream.
+
+del_timer_sync() cannot be used in interrupt.
+Replace it with del_timer() and a flag
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/uwb/neh.c | 12 +++++++++++-
+ 1 files changed, 11 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/uwb/neh.c b/drivers/uwb/neh.c
+index a269937..8cb71bb 100644
+--- a/drivers/uwb/neh.c
++++ b/drivers/uwb/neh.c
+@@ -107,6 +107,7 @@ struct uwb_rc_neh {
+ u8 evt_type;
+ __le16 evt;
+ u8 context;
++ u8 completed;
+ uwb_rc_cmd_cb_f cb;
+ void *arg;
+
+@@ -409,6 +410,7 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size
+ struct device *dev = &rc->uwb_dev.dev;
+ struct uwb_rc_neh *neh;
+ struct uwb_rceb *notif;
++ unsigned long flags;
+
+ if (rceb->bEventContext == 0) {
+ notif = kmalloc(size, GFP_ATOMIC);
+@@ -422,7 +424,11 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size
+ } else {
+ neh = uwb_rc_neh_lookup(rc, rceb);
+ if (neh) {
+- del_timer_sync(&neh->timer);
++ spin_lock_irqsave(&rc->neh_lock, flags);
++ /* to guard against a timeout */
++ neh->completed = 1;
++ del_timer(&neh->timer);
++ spin_unlock_irqrestore(&rc->neh_lock, flags);
+ uwb_rc_neh_cb(neh, rceb, size);
+ } else
+ dev_warn(dev, "event 0x%02x/%04x/%02x (%zu bytes): nobody cared\n",
+@@ -568,6 +574,10 @@ static void uwb_rc_neh_timer(unsigned long arg)
+ unsigned long flags;
+
+ spin_lock_irqsave(&rc->neh_lock, flags);
++ if (neh->completed) {
++ spin_unlock_irqrestore(&rc->neh_lock, flags);
++ return;
++ }
+ if (neh->context)
+ __uwb_rc_neh_rm(rc, neh);
+ else
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0014-uwb-fix-error-handling.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0014-uwb-fix-error-handling.patch
--- /dev/null
@@ -0,0 +1,34 @@
+From 8a03e18a4ff4ab7f3a6da08bd3f564f8a7aa2c4e Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Wed, 18 Apr 2012 10:05:55 +0200
+Subject: [PATCH 014/165] uwb: fix error handling
+
+commit 5bd7b419ef2eb4989b207753e088c3437159618a upstream.
+
+Fatal errors such as a device disconnect must not trigger
+error handling. The error returns must be checked.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/uwb/hwa-rc.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
+index 2babcd4..86685e9 100644
+--- a/drivers/uwb/hwa-rc.c
++++ b/drivers/uwb/hwa-rc.c
+@@ -645,7 +645,8 @@ void hwarc_neep_cb(struct urb *urb)
+ dev_err(dev, "NEEP: URB error %d\n", urb->status);
+ }
+ result = usb_submit_urb(urb, GFP_ATOMIC);
+- if (result < 0) {
++ if (result < 0 && result != -ENODEV && result != -EPERM) {
++ /* ignoring unrecoverable errors */
+ dev_err(dev, "NEEP: Can't resubmit URB (%d) resetting device\n",
+ result);
+ goto error;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0015-davinci_mdio-Fix-MDIO-timeout-check.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0015-davinci_mdio-Fix-MDIO-timeout-check.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0015-davinci_mdio-Fix-MDIO-timeout-check.patch
@@ -0,0 +1,44 @@
+From e132279cab18984918fc3cc9f8f02c8bd71e2931 Mon Sep 17 00:00:00 2001
+From: Christian Riesch <christian.riesch@omicron.at>
+Date: Mon, 16 Apr 2012 04:35:25 +0000
+Subject: [PATCH 015/165] davinci_mdio: Fix MDIO timeout check
+
+commit 5b76d0600b2b08eef77f8e9226938b7b6bde3099 upstream.
+
+Under heavy load (flood ping) it is possible for the MDIO timeout to
+expire before the loop checks the GO bit again. This patch adds an
+additional check whether the operation was done before actually
+returning -ETIMEDOUT.
+
+To reproduce this bug, flood ping the device, e.g., ping -f -l 1000
+After some time, a "timed out waiting for user access" warning
+may appear. And even worse, link may go down since the PHY reported a
+timeout.
+
+Signed-off-by: Christian Riesch <christian.riesch@omicron.at>
+Cc: Cyril Chemparathy <cyril@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/ti/davinci_mdio.c | 5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/davinci_mdio.c b/drivers/net/ethernet/ti/davinci_mdio.c
+index 1f14be6..3802de3 100644
+--- a/drivers/net/ethernet/ti/davinci_mdio.c
++++ b/drivers/net/ethernet/ti/davinci_mdio.c
+@@ -185,6 +185,11 @@ static inline int wait_for_user_access(struct davinci_mdio_data *data)
+ __davinci_mdio_reset(data);
+ return -EAGAIN;
+ }
++
++ reg = __raw_readl(®s->user[0].access);
++ if ((reg & USERACCESS_GO) == 0)
++ return 0;
++
+ dev_err(data->dev, "timed out waiting for user access\n");
+ return -ETIMEDOUT;
+ }
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0016-mwifiex-update-pcie8766-scratch-register-addresses.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0016-mwifiex-update-pcie8766-scratch-register-addresses.patch
--- /dev/null
@@ -0,0 +1,50 @@
+From f0553ecfc94510617f6b54a980e86a197e0746ac Mon Sep 17 00:00:00 2001
+From: Bing Zhao <bzhao@marvell.com>
+Date: Thu, 12 Apr 2012 19:00:35 -0700
+Subject: [PATCH 016/165] mwifiex: update pcie8766 scratch register addresses
+
+commit 428ca8a7065354877db63ceabfc493107686eebe upstream.
+
+The scratch register addresses have been changed for newer chips.
+Since the old chip was never shipped and it will not be supported
+any more, just update register addresses to support the new chips.
+
+Signed-off-by: Bing Zhao <bzhao@marvell.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wireless/mwifiex/pcie.h | 18 +++++++++---------
+ 1 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h
+index 445ff21..2f218f9 100644
+--- a/drivers/net/wireless/mwifiex/pcie.h
++++ b/drivers/net/wireless/mwifiex/pcie.h
+@@ -48,15 +48,15 @@
+ #define PCIE_HOST_INT_STATUS_MASK 0xC3C
+ #define PCIE_SCRATCH_2_REG 0xC40
+ #define PCIE_SCRATCH_3_REG 0xC44
+-#define PCIE_SCRATCH_4_REG 0xCC0
+-#define PCIE_SCRATCH_5_REG 0xCC4
+-#define PCIE_SCRATCH_6_REG 0xCC8
+-#define PCIE_SCRATCH_7_REG 0xCCC
+-#define PCIE_SCRATCH_8_REG 0xCD0
+-#define PCIE_SCRATCH_9_REG 0xCD4
+-#define PCIE_SCRATCH_10_REG 0xCD8
+-#define PCIE_SCRATCH_11_REG 0xCDC
+-#define PCIE_SCRATCH_12_REG 0xCE0
++#define PCIE_SCRATCH_4_REG 0xCD0
++#define PCIE_SCRATCH_5_REG 0xCD4
++#define PCIE_SCRATCH_6_REG 0xCD8
++#define PCIE_SCRATCH_7_REG 0xCDC
++#define PCIE_SCRATCH_8_REG 0xCE0
++#define PCIE_SCRATCH_9_REG 0xCE4
++#define PCIE_SCRATCH_10_REG 0xCE8
++#define PCIE_SCRATCH_11_REG 0xCEC
++#define PCIE_SCRATCH_12_REG 0xCF0
+
+ #define CPU_INTR_DNLD_RDY BIT(0)
+ #define CPU_INTR_DOOR_BELL BIT(1)
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0017-brcm80211-smac-resume-transmit-fifo-upon-receiving-f.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0017-brcm80211-smac-resume-transmit-fifo-upon-receiving-f.patch
--- /dev/null
@@ -0,0 +1,57 @@
+From 97f7538da8a6b3e8cef6322b2024817759393079 Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend@broadcom.com>
+Date: Wed, 11 Apr 2012 11:52:51 +0200
+Subject: [PATCH 017/165] brcm80211: smac: resume transmit fifo upon receiving
+ frames
+
+commit badc4f07622f0f7093a201638f45e85765f1b5e4 upstream.
+
+There have been reports about not being able to use access-points
+on channel 12 and 13 or having connectivity issues when these channels
+were part of the selected regulatory domain. Upon switching to these
+channels the brcmsmac driver suspends the transmit dma fifos. This
+patch resumes them upon handing over the first received beacon to
+mac80211.
+
+This patch is to be applied to the stable tree for kernel versions
+3.2 and 3.3.
+
+Tested-by: Francesco Saverio Schiavarelli <fschiava@libero.it>
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Reviewed-by: Brett Rudley <brudley@broadcom.com>
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wireless/brcm80211/brcmsmac/main.c | 8 ++++++++
+ 1 files changed, 8 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+index 453f58e..f98becc 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+@@ -7865,6 +7865,7 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
+ {
+ int len_mpdu;
+ struct ieee80211_rx_status rx_status;
++ struct ieee80211_hdr *hdr;
+
+ memset(&rx_status, 0, sizeof(rx_status));
+ prep_mac80211_status(wlc, rxh, p, &rx_status);
+@@ -7874,6 +7875,13 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
+ skb_pull(p, D11_PHY_HDR_LEN);
+ __skb_trim(p, len_mpdu);
+
++ /* unmute transmit */
++ if (wlc->hw->suspended_fifos) {
++ hdr = (struct ieee80211_hdr *)p->data;
++ if (ieee80211_is_beacon(hdr->frame_control))
++ brcms_b_mute(wlc->hw, false);
++ }
++
+ memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
+ ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
+ }
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0018-rc-core-set-mode-for-winbond-cir.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0018-rc-core-set-mode-for-winbond-cir.patch
--- /dev/null
@@ -0,0 +1,37 @@
+From 6dd8dc1e17571cbe55630e5d1e85aa7e27a0b257 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20H=C3=A4rdeman?= <david@hardeman.nu>
+Date: Sun, 8 Apr 2012 06:13:04 -0300
+Subject: [PATCH 018/165] rc-core: set mode for winbond-cir
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit d9b786955f80fb306471fdb9ea24c6d03af6ca36 upstream.
+
+Setting the correct mode is required by rc-core or scancodes won't be
+generated (which isn't very user-friendly).
+
+This one-line fix should be suitable for 3.4-rc2.
+
+Signed-off-by: David Härdeman <david@hardeman.nu>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/media/rc/winbond-cir.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
+index 13f54b5..a7e7d6f 100644
+--- a/drivers/media/rc/winbond-cir.c
++++ b/drivers/media/rc/winbond-cir.c
+@@ -1046,6 +1046,7 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
+ goto exit_unregister_led;
+ }
+
++ data->dev->driver_type = RC_DRIVER_IR_RAW;
+ data->dev->driver_name = WBCIR_NAME;
+ data->dev->input_name = WBCIR_NAME;
+ data->dev->input_phys = "wbcir/cir0";
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0019-drxk-Does-not-unlock-mutex-if-sanity-check-failed-in.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0019-drxk-Does-not-unlock-mutex-if-sanity-check-failed-in.patch
--- /dev/null
@@ -0,0 +1,41 @@
+From d5cc94665b578e3e5e87884fb802e49b2f276298 Mon Sep 17 00:00:00 2001
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Thu, 5 Apr 2012 18:53:20 -0300
+Subject: [PATCH 019/165] drxk: Does not unlock mutex if sanity check failed
+ in scu_command()
+
+commit e4459e1682c107d7ee1bf102c1ba534230e9b50b upstream.
+
+If sanity check fails in scu_command(), goto error leads to unlock of
+an unheld mutex. The check should not fail in reality, but it nevertheless
+worth fixing.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/media/dvb/frontends/drxk_hard.c | 6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/dvb/frontends/drxk_hard.c b/drivers/media/dvb/frontends/drxk_hard.c
+index f6431ef..a1f5e3d 100644
+--- a/drivers/media/dvb/frontends/drxk_hard.c
++++ b/drivers/media/dvb/frontends/drxk_hard.c
+@@ -1523,8 +1523,10 @@ static int scu_command(struct drxk_state *state,
+ dprintk(1, "\n");
+
+ if ((cmd == 0) || ((parameterLen > 0) && (parameter == NULL)) ||
+- ((resultLen > 0) && (result == NULL)))
+- goto error;
++ ((resultLen > 0) && (result == NULL))) {
++ printk(KERN_ERR "drxk: Error %d on %s\n", status, __func__);
++ return status;
++ }
+
+ mutex_lock(&state->mutex);
+
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0020-cfg80211-fix-interface-combinations-check.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0020-cfg80211-fix-interface-combinations-check.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0020-cfg80211-fix-interface-combinations-check.patch
@@ -0,0 +1,30 @@
+From 9080bb10c5fa9dc3a8c358eec3bffc5e0dd29ea8 Mon Sep 17 00:00:00 2001
+From: Lukasz Kucharczyk <lukasz.kucharczyk@tieto.com>
+Date: Wed, 11 Apr 2012 14:55:10 +0200
+Subject: [PATCH 020/165] cfg80211: fix interface combinations check.
+
+commit e55a4046dab28c440c96890bdddcf02dc8981f2d upstream.
+
+Signed-off-by: Lukasz Kucharczyk <lukasz.kucharczyk@tieto.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/wireless/util.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 4dde429..8bf8902 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -996,7 +996,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+ if (rdev->wiphy.software_iftypes & BIT(iftype))
+ continue;
+ for (j = 0; j < c->n_limits; j++) {
+- if (!(limits[j].types & iftype))
++ if (!(limits[j].types & BIT(iftype)))
+ continue;
+ if (limits[j].max < num[iftype])
+ goto cont;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0021-Fix-modpost-failures-in-fedora-17.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0021-Fix-modpost-failures-in-fedora-17.patch
--- /dev/null
@@ -0,0 +1,54 @@
+From 3ff39b2411c6722c1ee6c490ac4ec7f90f026d64 Mon Sep 17 00:00:00 2001
+From: David Miller <davem@davemloft.net>
+Date: Wed, 25 Apr 2012 19:41:32 -0500
+Subject: [PATCH 021/165] Fix modpost failures in fedora 17
+
+commit e88aa7bbbe3046a125ea1936b16bb921cc9c6349 upstream.
+
+The symbol table on x86-64 starts to have entries that have names
+like:
+
+_GLOBAL__sub_I_65535_0___mod_x86cpu_device_table
+
+They are of type STT_FUNCTION and this one had a length of 18. This
+matched the device ID validation logic and it barfed because the
+length did not meet the device type's criteria.
+
+--------------------
+FATAL: arch/x86/crypto/aesni-intel: sizeof(struct x86cpu_device_id)=16 is not a modulo of the size of section __mod_x86cpu_device_table=18.
+Fix definition of struct x86cpu_device_id in mod_devicetable.h
+--------------------
+
+These are some kind of compiler tool internal stuff being emitted and
+not something we want to inspect in modpost's device ID table
+validation code.
+
+So skip the symbol if it is not of type STT_OBJECT.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Michal Marek <mmarek@suse.cz>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ scripts/mod/file2alias.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index f936d1f..d1d0ae8 100644
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -926,6 +926,10 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
+ if (!sym->st_shndx || get_secindex(info, sym) >= info->num_sections)
+ return;
+
++ /* We're looking for an object */
++ if (ELF_ST_TYPE(sym->st_info) != STT_OBJECT)
++ return;
++
+ /* Handle all-NULL symbols allocated into .bss */
+ if (info->sechdrs[get_secindex(info, sym)].sh_type & SHT_NOBITS) {
+ zeros = calloc(1, sym->st_size);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0022-mm-fix-s390-BUG-by-__set_page_dirty_no_writeback-on-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0022-mm-fix-s390-BUG-by-__set_page_dirty_no_writeback-on-.patch
--- /dev/null
@@ -0,0 +1,60 @@
+From 8afb43e5f076643f012d0267aebb215cc0f0767b Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Mon, 23 Apr 2012 11:14:50 -0700
+Subject: [PATCH 022/165] mm: fix s390 BUG by __set_page_dirty_no_writeback on
+ swap
+
+commit aca50bd3b4c4bb5528a1878158ba7abce41de534 upstream.
+
+Mel reports a BUG_ON(slot == NULL) in radix_tree_tag_set() on s390
+3.0.13: called from __set_page_dirty_nobuffers() when page_remove_rmap()
+tries to transfer dirty flag from s390 storage key to struct page and
+radix_tree.
+
+That would be because of reclaim's shrink_page_list() calling
+add_to_swap() on this page at the same time: first PageSwapCache is set
+(causing page_mapping(page) to appear as &swapper_space), then
+page->private set, then tree_lock taken, then page inserted into
+radix_tree - so there's an interval before taking the lock when the
+radix_tree slot is empty.
+
+We could fix this by moving __add_to_swap_cache()'s spin_lock_irq up
+before the SetPageSwapCache. But a better fix is simply to do what's
+five years overdue: Ken Chen introduced __set_page_dirty_no_writeback()
+(if !PageDirty TestSetPageDirty) for tmpfs to skip all the radix_tree
+overhead, and swap is just the same - it ignores the radix_tree tag, and
+does not participate in dirty page accounting, so should be using
+__set_page_dirty_no_writeback() too.
+
+s390 testing now confirms that this does indeed fix the problem.
+
+Reported-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Acked-by: Mel Gorman <mgorman@suse.de>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Ken Chen <kenchen@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ mm/swap_state.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/mm/swap_state.c b/mm/swap_state.c
+index 78cc4d1..7704d9c 100644
+--- a/mm/swap_state.c
++++ b/mm/swap_state.c
+@@ -27,7 +27,7 @@
+ */
+ static const struct address_space_operations swap_aops = {
+ .writepage = swap_writepage,
+- .set_page_dirty = __set_page_dirty_nobuffers,
++ .set_page_dirty = __set_page_dirty_no_writeback,
+ .migratepage = migrate_page,
+ };
+
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0023-md-fix-possible-corruption-of-array-metadata-on-shut.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0023-md-fix-possible-corruption-of-array-metadata-on-shut.patch
--- /dev/null
@@ -0,0 +1,51 @@
+From fd272b3336e1e535826cc345e10353eb104363e8 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 24 Apr 2012 10:23:16 +1000
+Subject: [PATCH 023/165] md: fix possible corruption of array metadata on
+ shutdown.
+
+commit 30b8aa9172dfeaac6d77897c67ee9f9fc574cdbb upstream.
+
+commit c744a65c1e2d59acc54333ce8
+ md: don't set md arrays to readonly on shutdown.
+
+removed the possibility of a 'BUG' when data is written to an array
+that has just been switched to read-only, but also introduced the
+possibility that the array metadata could be corrupted.
+
+If, when md_notify_reboot gets the mddev lock, the array is
+in a state where it is assembled but hasn't been started (as can
+happen if the personality module is not available, or in other unusual
+situations), then incorrect metadata will be written out making it
+impossible to re-assemble the array.
+
+So only call __md_stop_writes() if the array has actually been
+activated.
+
+This patch is needed for any stable kernel which has had the above
+commit applied.
+
+Reported-by: Christoph Nelles <evilazrael@evilazrael.de>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/md/md.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 6f37aa4..065ab4f 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -8100,7 +8100,8 @@ static int md_notify_reboot(struct notifier_block *this,
+
+ for_each_mddev(mddev, tmp) {
+ if (mddev_trylock(mddev)) {
+- __md_stop_writes(mddev);
++ if (mddev->pers)
++ __md_stop_writes(mddev);
+ mddev->safemode = 2;
+ mddev_unlock(mddev);
+ }
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0024-jbd2-use-GFP_NOFS-for-blkdev_issue_flush.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0024-jbd2-use-GFP_NOFS-for-blkdev_issue_flush.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0024-jbd2-use-GFP_NOFS-for-blkdev_issue_flush.patch
@@ -0,0 +1,45 @@
+From 6556e20032c10ba45a6101a9454265c0f8c0fbc6 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@kernel.org>
+Date: Fri, 13 Apr 2012 10:27:35 +0800
+Subject: [PATCH 024/165] jbd2: use GFP_NOFS for blkdev_issue_flush
+
+commit 99aa78466777083255b876293e9e83dec7cd809a upstream.
+
+flush request is issued in transaction commit code path, so looks using
+GFP_KERNEL to allocate memory for flush request bio falls into the classic
+deadlock issue. I saw btrfs and dm get it right, but ext4, xfs and md are
+using GFP.
+
+Signed-off-by: Shaohua Li <shli@fusionio.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/jbd2/commit.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index 68d704d..d751f04 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -683,7 +683,7 @@ start_journal_io:
+ if (commit_transaction->t_need_data_flush &&
+ (journal->j_fs_dev != journal->j_dev) &&
+ (journal->j_flags & JBD2_BARRIER))
+- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
++ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
+
+ /* Done it all: now write the commit record asynchronously. */
+ if (JBD2_HAS_INCOMPAT_FEATURE(journal,
+@@ -819,7 +819,7 @@ wait_for_iobuf:
+ if (JBD2_HAS_INCOMPAT_FEATURE(journal,
+ JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT) &&
+ journal->j_flags & JBD2_BARRIER) {
+- blkdev_issue_flush(journal->j_dev, GFP_KERNEL, NULL);
++ blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL);
+ }
+
+ if (err)
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0025-USB-serial-cp210x-Fixed-usb_control_msg-timeout-valu.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0025-USB-serial-cp210x-Fixed-usb_control_msg-timeout-valu.patch
--- /dev/null
@@ -0,0 +1,54 @@
+From f9515bb74e74a5f3f7cb963984bdd8c8731495ff Mon Sep 17 00:00:00 2001
+From: Yuri Matylitski <ym@tekinsoft.com>
+Date: Fri, 20 Apr 2012 12:38:32 +0300
+Subject: [PATCH 025/165] USB: serial: cp210x: Fixed usb_control_msg timeout
+ values
+
+commit 2d5733fcd33dd451022d197cb6b476e970519ca7 upstream.
+
+Fixed too small hardcoded timeout values for usb_control_msg
+in driver for SiliconLabs cp210x-based usb-to-serial adapters.
+Replaced with USB_CTRL_GET_TIMEOUT/USB_CTRL_SET_TIMEOUT.
+
+Signed-off-by: Yuri Matylitski <ym@tekinsoft.com>
+Acked-by: Kirill A. Shutemov <kirill@shutemov.name>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/serial/cp210x.c | 9 ++++++---
+ 1 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 4c12404..f2c57e0 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -285,7 +285,8 @@ static int cp210x_get_config(struct usb_serial_port *port, u8 request,
+ /* Issue the request, attempting to read 'size' bytes */
+ result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+ request, REQTYPE_DEVICE_TO_HOST, 0x0000,
+- port_priv->bInterfaceNumber, buf, size, 300);
++ port_priv->bInterfaceNumber, buf, size,
++ USB_CTRL_GET_TIMEOUT);
+
+ /* Convert data into an array of integers */
+ for (i = 0; i < length; i++)
+@@ -335,12 +336,14 @@ static int cp210x_set_config(struct usb_serial_port *port, u8 request,
+ result = usb_control_msg(serial->dev,
+ usb_sndctrlpipe(serial->dev, 0),
+ request, REQTYPE_HOST_TO_DEVICE, 0x0000,
+- port_priv->bInterfaceNumber, buf, size, 300);
++ port_priv->bInterfaceNumber, buf, size,
++ USB_CTRL_SET_TIMEOUT);
+ } else {
+ result = usb_control_msg(serial->dev,
+ usb_sndctrlpipe(serial->dev, 0),
+ request, REQTYPE_HOST_TO_DEVICE, data[0],
+- port_priv->bInterfaceNumber, NULL, 0, 300);
++ port_priv->bInterfaceNumber, NULL, 0,
++ USB_CTRL_SET_TIMEOUT);
+ }
+
+ kfree(buf);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0026-pch_uart-Fix-dma-channel-unallocated-issue.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0026-pch_uart-Fix-dma-channel-unallocated-issue.patch
--- /dev/null
@@ -0,0 +1,55 @@
+From 069f7216ddee90ddca6e1d040e58b6735f89fca6 Mon Sep 17 00:00:00 2001
+From: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Date: Thu, 12 Apr 2012 10:47:50 +0900
+Subject: [PATCH 026/165] pch_uart: Fix dma channel unallocated issue
+
+commit af6d17cdc8c89aeb3101f0d27cd32fc0592b40b2 upstream.
+
+This driver anticipates pch_uart_verify_port() is not called
+during installation.
+However, actually pch_uart_verify_port() is called during
+installation.
+As a result, memory access violation occurs like below.
+
+0. initial value: use_dma=0
+1. starup()
+ - dma channel is not allocated because use_dma=0
+2. pch_uart_verify_port()
+ - Set use_dma=1
+3. UART processing acts DMA mode because use_dma=1
+ - memory access violation occurs!
+
+This patch fixes the issue.
+
+Solution:
+Whenever pch_uart_verify_port() is called and then
+dma channel is not allocated, the channel should be allocated.
+
+Signed-off-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/serial/pch_uart.c | 4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
+index da776a0..a4b192d 100644
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -1356,9 +1356,11 @@ static int pch_uart_verify_port(struct uart_port *port,
+ __func__);
+ return -EOPNOTSUPP;
+ #endif
+- priv->use_dma = 1;
+ priv->use_dma_flag = 1;
+ dev_info(priv->port.dev, "PCH UART : Use DMA Mode\n");
++ if (!priv->use_dma)
++ pch_request_dma(port);
++ priv->use_dma = 1;
+ }
+
+ return 0;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0027-drivers-tty-amiserial.c-add-missing-tty_unlock.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0027-drivers-tty-amiserial.c-add-missing-tty_unlock.patch
--- /dev/null
@@ -0,0 +1,36 @@
+From fefc2c6916651c05eed1882c3a59a6468d91e417 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Thu, 19 Apr 2012 18:12:40 +0200
+Subject: [PATCH 027/165] drivers/tty/amiserial.c: add missing tty_unlock
+
+commit d3a7b83f865b46bb7b5e1ed18a129ce1af349db4 upstream.
+
+tty_unlock is used on all other exits from the function.
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Acked-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/amiserial.c | 4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/tty/amiserial.c b/drivers/tty/amiserial.c
+index b84c834..8daf073 100644
+--- a/drivers/tty/amiserial.c
++++ b/drivers/tty/amiserial.c
+@@ -1113,8 +1113,10 @@ static int set_serial_info(struct async_struct * info,
+ (new_serial.close_delay != state->close_delay) ||
+ (new_serial.xmit_fifo_size != state->xmit_fifo_size) ||
+ ((new_serial.flags & ~ASYNC_USR_MASK) !=
+- (state->flags & ~ASYNC_USR_MASK)))
++ (state->flags & ~ASYNC_USR_MASK))) {
++ tty_unlock();
+ return -EPERM;
++ }
+ state->flags = ((state->flags & ~ASYNC_USR_MASK) |
+ (new_serial.flags & ASYNC_USR_MASK));
+ info->flags = ((info->flags & ~ASYNC_USR_MASK) |
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0028-USB-sierra-avoid-QMI-wwan-interface-on-MC77xx.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0028-USB-sierra-avoid-QMI-wwan-interface-on-MC77xx.patch
--- /dev/null
@@ -0,0 +1,60 @@
+From 769a100618c82ac6e8e284cc14a5fbffe13e31ce Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Tue, 17 Apr 2012 21:37:29 +0200
+Subject: [PATCH 028/165] USB: sierra: avoid QMI/wwan interface on MC77xx
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 749541d19e70905e3971f2a08335a206a98e4d0c upstream.
+
+These devices have a number of non serial interfaces as well. Use
+the existing "Direct IP" blacklist to prevent binding to interfaces
+which are handled by other drivers.
+
+We also extend the "Direct IP" blacklist with with interfaces only
+seen in "QMI" mode, assuming that these devices use the same
+interface numbers for serial interfaces both in "Direct IP" and in
+"QMI" mode.
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/serial/sierra.c | 6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index 7c3ec9e..e093585 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -221,7 +221,7 @@ static const struct sierra_iface_info typeB_interface_list = {
+ };
+
+ /* 'blacklist' of interfaces not served by this driver */
+-static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11 };
++static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11, 19, 20 };
+ static const struct sierra_iface_info direct_ip_interface_blacklist = {
+ .infolen = ARRAY_SIZE(direct_ip_non_serial_ifaces),
+ .ifaceinfo = direct_ip_non_serial_ifaces,
+@@ -289,7 +289,6 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1199, 0x6856) }, /* Sierra Wireless AirCard 881 U */
+ { USB_DEVICE(0x1199, 0x6859) }, /* Sierra Wireless AirCard 885 E */
+ { USB_DEVICE(0x1199, 0x685A) }, /* Sierra Wireless AirCard 885 E */
+- { USB_DEVICE(0x1199, 0x68A2) }, /* Sierra Wireless MC7710 */
+ /* Sierra Wireless C885 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6880, 0xFF, 0xFF, 0xFF)},
+ /* Sierra Wireless C888, Air Card 501, USB 303, USB 304 */
+@@ -299,6 +298,9 @@ static const struct usb_device_id id_table[] = {
+ /* Sierra Wireless HSPA Non-Composite Device */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6892, 0xFF, 0xFF, 0xFF)},
+ { USB_DEVICE(0x1199, 0x6893) }, /* Sierra Wireless Device */
++ { USB_DEVICE(0x1199, 0x68A2), /* Sierra Wireless MC77xx in QMI mode */
++ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
++ },
+ { USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless Direct IP modems */
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0029-EHCI-fix-criterion-for-resuming-the-root-hub.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0029-EHCI-fix-criterion-for-resuming-the-root-hub.patch
--- /dev/null
@@ -0,0 +1,48 @@
+From 611589daeef0bd0f6b36f1fbb17f34b6abf05568 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 17 Apr 2012 15:24:15 -0400
+Subject: [PATCH 029/165] EHCI: fix criterion for resuming the root hub
+
+commit dc75ce9d929aabeb0843a6b1a4ab320e58ba1597 upstream.
+
+This patch (as1542) changes the criterion ehci-hcd uses to tell when
+it needs to resume the controller's root hub. A resume is needed when
+a port status change is detected, obviously, but only if the root hub
+is currently suspended.
+
+Right now the driver tests whether the root hub is running, and that
+is not the correct test. In particular, if the controller has died
+then the root hub should not be restarted. In addition, some buggy
+hardware occasionally requires the root hub to be running and
+sending out SOF packets even while it is nominally supposed to be
+suspended.
+
+In the end, the test needs to be changed. Rather than checking whether
+the root hub is currently running, the driver will now check whether
+the root hub is currently suspended. This will yield the correct
+behavior in all cases.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: Peter Chen <B29397@freescale.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/ehci-hcd.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index 3ff9f82..ffbbf54 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -867,7 +867,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
+ pcd_status = status;
+
+ /* resume root hub? */
+- if (!(cmd & CMD_RUN))
++ if (ehci->rh_state == EHCI_RH_SUSPENDED)
+ usb_hcd_resume_root_hub(hcd);
+
+ /* get per-port change detect bits */
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0030-EHCI-always-clear-the-STS_FLR-status-bit.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0030-EHCI-always-clear-the-STS_FLR-status-bit.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0030-EHCI-always-clear-the-STS_FLR-status-bit.patch
@@ -0,0 +1,46 @@
+From 2259a159b9b3861dcc0c8cd9c52ef85cb11ad2a5 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 18 Apr 2012 11:33:00 -0400
+Subject: [PATCH 030/165] EHCI: always clear the STS_FLR status bit
+
+commit 2fbe2bf1fd37f9d99950bd8d8093623cf22cf08b upstream.
+
+This patch (as1544) fixes a problem affecting some EHCI controllers.
+They can generate interrupts whenever the STS_FLR status bit is turned
+on, even though that bit is masked out in the Interrupt Enable
+register.
+
+Since the driver doesn't use STS_FLR anyway, the patch changes the
+interrupt routine to clear that bit whenever it is set, rather than
+leaving it alone.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/ehci-hcd.c | 7 ++++++-
+ 1 files changed, 6 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index ffbbf54..da2f711 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -815,8 +815,13 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
+ goto dead;
+ }
+
++ /*
++ * We don't use STS_FLR, but some controllers don't like it to
++ * remain on, so mask it out along with the other status bits.
++ */
++ masked_status = status & (INTR_MASK | STS_FLR);
++
+ /* Shared IRQ? */
+- masked_status = status & INTR_MASK;
+ if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) {
+ spin_unlock(&ehci->lock);
+ return IRQ_NONE;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0031-USB-fix-deadlock-in-bConfigurationValue-attribute-me.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0031-USB-fix-deadlock-in-bConfigurationValue-attribute-me.patch
--- /dev/null
@@ -0,0 +1,116 @@
+From 770feb782844457789a51d13d2933cca141bb487 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 17 Apr 2012 15:22:39 -0400
+Subject: [PATCH 031/165] USB: fix deadlock in bConfigurationValue attribute
+ method
+
+commit 8963c487a80b4688c9e68dcc504a90074aacc145 upstream.
+
+This patch (as154) fixes a self-deadlock that occurs when userspace
+writes to the bConfigurationValue sysfs attribute for a hub with
+children. The task tries to lock the bandwidth_mutex at a time when
+it already owns the lock:
+
+ The attribute's method calls usb_set_configuration(),
+ which calls usb_disable_device() with the bandwidth_mutex
+ held.
+
+ usb_disable_device() unregisters the existing interfaces,
+ which causes the hub driver to be unbound.
+
+ The hub_disconnect() routine calls hub_quiesce(), which
+ calls usb_disconnect() for each of the hub's children.
+
+ usb_disconnect() attempts to acquire the bandwidth_mutex
+ around a call to usb_disable_device().
+
+The solution is to make usb_disable_device() acquire the mutex for
+itself instead of requiring the caller to hold it. Then the mutex can
+cover only the bandwidth deallocation operation and not the region
+where the interfaces are unregistered.
+
+This has the potential to change system behavior slightly when a
+config change races with another config or altsetting change. Some of
+the bandwidth released from the old config might get claimed by the
+other config or altsetting, make it impossible to restore the old
+config in case of a failure. But since we don't try to recover from
+config-change failures anyway, this doesn't matter.
+
+[This should be marked for stable kernels that contain the commit
+fccf4e86200b8f5edd9a65da26f150e32ba79808 "USB: Free bandwidth when
+usb_disable_device is called."
+That commit was marked for stable kernels as old as 2.6.32.]
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/core/hub.c | 3 ---
+ drivers/usb/core/message.c | 6 +++---
+ 2 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 18373ec..ab4e49f 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1644,7 +1644,6 @@ void usb_disconnect(struct usb_device **pdev)
+ {
+ struct usb_device *udev = *pdev;
+ int i;
+- struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+
+ /* mark the device as inactive, so any further urb submissions for
+ * this device (and any of its children) will fail immediately.
+@@ -1667,9 +1666,7 @@ void usb_disconnect(struct usb_device **pdev)
+ * so that the hardware is now fully quiesced.
+ */
+ dev_dbg (&udev->dev, "unregistering device\n");
+- mutex_lock(hcd->bandwidth_mutex);
+ usb_disable_device(udev, 0);
+- mutex_unlock(hcd->bandwidth_mutex);
+ usb_hcd_synchronize_unlinks(udev);
+
+ usb_remove_ep_devs(&udev->ep0);
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index aed3e07..ca717da 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1136,8 +1136,6 @@ void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
+ * Deallocates hcd/hardware state for the endpoints (nuking all or most
+ * pending urbs) and usbcore state for the interfaces, so that usbcore
+ * must usb_set_configuration() before any interfaces could be used.
+- *
+- * Must be called with hcd->bandwidth_mutex held.
+ */
+ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+ {
+@@ -1190,7 +1188,9 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+ usb_disable_endpoint(dev, i + USB_DIR_IN, false);
+ }
+ /* Remove endpoints from the host controller internal state */
++ mutex_lock(hcd->bandwidth_mutex);
+ usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
++ mutex_unlock(hcd->bandwidth_mutex);
+ /* Second pass: remove endpoint pointers */
+ }
+ for (i = skip_ep0; i < 16; ++i) {
+@@ -1750,7 +1750,6 @@ free_interfaces:
+ /* if it's already configured, clear out old state first.
+ * getting rid of old interfaces means unbinding their drivers.
+ */
+- mutex_lock(hcd->bandwidth_mutex);
+ if (dev->state != USB_STATE_ADDRESS)
+ usb_disable_device(dev, 1); /* Skip ep0 */
+
+@@ -1763,6 +1762,7 @@ free_interfaces:
+ * host controller will not allow submissions to dropped endpoints. If
+ * this call fails, the device state is unchanged.
+ */
++ mutex_lock(hcd->bandwidth_mutex);
+ ret = usb_hcd_alloc_bandwidth(dev, cp, NULL, NULL);
+ if (ret < 0) {
+ mutex_unlock(hcd->bandwidth_mutex);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0032-usb-gadget-eliminate-NULL-pointer-dereference-bugfix.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0032-usb-gadget-eliminate-NULL-pointer-dereference-bugfix.patch
--- /dev/null
@@ -0,0 +1,56 @@
+From fadd4263bca7146d233ff944c17cb0f42a6e2112 Mon Sep 17 00:00:00 2001
+From: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
+Date: Wed, 28 Mar 2012 09:30:50 +0200
+Subject: [PATCH 032/165] usb: gadget: eliminate NULL pointer dereference
+ (bugfix)
+
+commit 92b0abf80c5c5f0e0d71d1309688a330fd74731b upstream.
+
+usb: gadget: eliminate NULL pointer dereference (bugfix)
+
+This patch fixes a bug which causes NULL pointer dereference in
+ffs_ep0_ioctl. The bug happens when the FunctionFS is not bound (either
+has not been bound yet or has been bound and then unbound) and can be
+reproduced with running the following commands:
+
+$ insmod g_ffs.ko
+$ mount -t functionfs func /dev/usbgadget
+$ ./null
+
+where null.c is:
+
+#include <fcntl.h>
+#include <linux/usb/functionfs.h>
+
+int main(void)
+{
+ int fd = open("/dev/usbgadget/ep0", O_RDWR);
+ ioctl(fd, FUNCTIONFS_CLEAR_HALT);
+
+ return 0;
+}
+
+Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
+Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/gadget/f_fs.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
+index acb3800..0e641a1 100644
+--- a/drivers/usb/gadget/f_fs.c
++++ b/drivers/usb/gadget/f_fs.c
+@@ -712,7 +712,7 @@ static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
+ if (code == FUNCTIONFS_INTERFACE_REVMAP) {
+ struct ffs_function *func = ffs->func;
+ ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
+- } else if (gadget->ops->ioctl) {
++ } else if (gadget && gadget->ops->ioctl) {
+ ret = gadget->ops->ioctl(gadget, code, value);
+ } else {
+ ret = -ENOTTY;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0033-usb-musb-omap-fix-crash-when-musb-glue-omap-gets-ini.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0033-usb-musb-omap-fix-crash-when-musb-glue-omap-gets-ini.patch
--- /dev/null
@@ -0,0 +1,44 @@
+From 839226b88ef2954d750d72f3ce2c6657393b8a09 Mon Sep 17 00:00:00 2001
+From: Kishon Vijay Abraham I <kishon@ti.com>
+Date: Wed, 21 Mar 2012 21:30:20 +0530
+Subject: [PATCH 033/165] usb: musb: omap: fix crash when musb glue (omap)
+ gets initialized
+
+commit 3006dc8c627d738693e910c159630e4368c9e86c upstream.
+
+pm_runtime_enable is being called after omap2430_musb_init. Hence
+pm_runtime_get_sync in omap2430_musb_init does not have any effect (does
+not enable clocks) resulting in a crash during register access. It is
+fixed here.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/musb/omap2430.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
+index dd907d5..bd93e9f 100644
+--- a/drivers/usb/musb/omap2430.c
++++ b/drivers/usb/musb/omap2430.c
+@@ -463,14 +463,14 @@ static int __init omap2430_probe(struct platform_device *pdev)
+ goto err2;
+ }
+
++ pm_runtime_enable(&pdev->dev);
++
+ ret = platform_device_add(musb);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to register musb device\n");
+ goto err2;
+ }
+
+- pm_runtime_enable(&pdev->dev);
+-
+ return 0;
+
+ err2:
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0034-usb-musb-omap-fix-the-error-check-for-pm_runtime_get.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0034-usb-musb-omap-fix-the-error-check-for-pm_runtime_get.patch
--- /dev/null
@@ -0,0 +1,48 @@
+From 150f1a9111e30cc70efdac57e72af7d537754099 Mon Sep 17 00:00:00 2001
+From: Shubhrajyoti D <shubhrajyoti@ti.com>
+Date: Thu, 22 Mar 2012 12:48:06 +0530
+Subject: [PATCH 034/165] usb: musb: omap: fix the error check for
+ pm_runtime_get_sync
+
+commit ad579699c4f0274bf522a9252ff9b20c72197e48 upstream.
+
+pm_runtime_get_sync returns a signed integer. In case of errors
+it returns a negative value. This patch fixes the error check
+by making it signed instead of unsigned thus preventing register
+access if get_sync_fails. Also passes the error cause to the
+debug message.
+
+Cc: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Shubhrajyoti D <shubhrajyoti@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/musb/omap2430.c | 5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
+index bd93e9f..522ac37 100644
+--- a/drivers/usb/musb/omap2430.c
++++ b/drivers/usb/musb/omap2430.c
+@@ -283,7 +283,8 @@ static void musb_otg_notifier_work(struct work_struct *data_notifier_work)
+
+ static int omap2430_musb_init(struct musb *musb)
+ {
+- u32 l, status = 0;
++ u32 l;
++ int status = 0;
+ struct device *dev = musb->controller;
+ struct musb_hdrc_platform_data *plat = dev->platform_data;
+ struct omap_musb_board_data *data = plat->board_data;
+@@ -302,7 +303,7 @@ static int omap2430_musb_init(struct musb *musb)
+
+ status = pm_runtime_get_sync(dev);
+ if (status < 0) {
+- dev_err(dev, "pm_runtime_get_sync FAILED");
++ dev_err(dev, "pm_runtime_get_sync FAILED %d\n", status);
+ goto err1;
+ }
+
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0035-PCI-Add-quirk-for-still-enabled-interrupts-on-Intel-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0035-PCI-Add-quirk-for-still-enabled-interrupts-on-Intel-.patch
--- /dev/null
@@ -0,0 +1,89 @@
+From 9a9c948f1f3fdf421e090b10dc1fe15308d325d0 Mon Sep 17 00:00:00 2001
+From: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Date: Wed, 7 Dec 2011 22:08:11 +0100
+Subject: [PATCH 035/165] PCI: Add quirk for still enabled interrupts on Intel
+ Sandy Bridge GPUs
+
+commit f67fd55fa96f7d7295b43ffbc4a97d8f55e473aa upstream.
+
+Some BIOS implementations leave the Intel GPU interrupts enabled,
+even though no one is handling them (f.e. i915 driver is never loaded).
+Additionally the interrupt destination is not set up properly
+and the interrupt ends up -somewhere-.
+
+These spurious interrupts are "sticky" and the kernel disables
+the (shared) interrupt line after 100.000+ generated interrupts.
+
+Fix it by disabling the still enabled interrupts.
+This resolves crashes often seen on monitor unplug.
+
+Tested on the following boards:
+- Intel DH61CR: Affected
+- Intel DH67BL: Affected
+- Intel S1200KP server board: Affected
+- Asus P8H61-M LE: Affected, but system does not crash.
+ Probably the IRQ ends up somewhere unnoticed.
+
+According to reports on the net, the Intel DH61WW board is also affected.
+
+Many thanks to Jesse Barnes from Intel for helping
+with the register configuration and to Intel in general
+for providing public hardware documentation.
+
+Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Tested-by: Charlie Suffin <charlie.suffin@stratus.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/pci/quirks.c | 34 ++++++++++++++++++++++++++++++++++
+ 1 files changed, 34 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 6476547..78fda9c 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2906,6 +2906,40 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f8, quirk_intel_mc_errata);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f9, quirk_intel_mc_errata);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65fa, quirk_intel_mc_errata);
+
++/*
++ * Some BIOS implementations leave the Intel GPU interrupts enabled,
++ * even though no one is handling them (f.e. i915 driver is never loaded).
++ * Additionally the interrupt destination is not set up properly
++ * and the interrupt ends up -somewhere-.
++ *
++ * These spurious interrupts are "sticky" and the kernel disables
++ * the (shared) interrupt line after 100.000+ generated interrupts.
++ *
++ * Fix it by disabling the still enabled interrupts.
++ * This resolves crashes often seen on monitor unplug.
++ */
++#define I915_DEIER_REG 0x4400c
++static void __devinit disable_igfx_irq(struct pci_dev *dev)
++{
++ void __iomem *regs = pci_iomap(dev, 0, 0);
++ if (regs == NULL) {
++ dev_warn(&dev->dev, "igfx quirk: Can't iomap PCI device\n");
++ return;
++ }
++
++ /* Check if any interrupt line is still enabled */
++ if (readl(regs + I915_DEIER_REG) != 0) {
++ dev_warn(&dev->dev, "BIOS left Intel GPU interrupts enabled; "
++ "disabling\n");
++
++ writel(0, regs + I915_DEIER_REG);
++ }
++
++ pci_iounmap(dev, regs);
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
++
+ static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
+ struct pci_fixup *end)
+ {
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0036-ext4-fix-endianness-breakage-in-ext4_split_extent_at.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0036-ext4-fix-endianness-breakage-in-ext4_split_extent_at.patch
--- /dev/null
@@ -0,0 +1,33 @@
+From 7ae05a044d79254f47ba9cb8772f5c3137a9d17d Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Thu, 12 Apr 2012 20:32:25 -0400
+Subject: [PATCH 036/165] ext4: fix endianness breakage in
+ ext4_split_extent_at()
+
+commit af1584f570b19b0285e4402a0b54731495d31784 upstream.
+
+->ee_len is __le16, so assigning cpu_to_le32() to it is going to do
+Bad Things(tm) on big-endian hosts...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ext4/extents.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index c2a2012..54f2bdc 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -2812,7 +2812,7 @@ static int ext4_split_extent_at(handle_t *handle,
+ if (err)
+ goto fix_extent_len;
+ /* update the extent length and mark as initialized */
+- ex->ee_len = cpu_to_le32(ee_len);
++ ex->ee_len = cpu_to_le16(ee_len);
+ ext4_ext_try_to_merge(inode, path, ex);
+ err = ext4_ext_dirty(handle, inode, path + depth);
+ goto out;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0037-KVM-unmap-pages-from-the-iommu-when-slots-are-remove.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0037-KVM-unmap-pages-from-the-iommu-when-slots-are-remove.patch
--- /dev/null
@@ -0,0 +1,109 @@
+From f6b20107e527f8d57ec7c2c745109f4609d68abf Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Fri, 27 Apr 2012 16:54:08 -0500
+Subject: [PATCH 037/165] KVM: unmap pages from the iommu when slots are
+ removed
+
+commit 32f6daad4651a748a58a3ab6da0611862175722f upstream.
+
+We've been adding new mappings, but not destroying old mappings.
+This can lead to a page leak as pages are pinned using
+get_user_pages, but only unpinned with put_page if they still
+exist in the memslots list on vm shutdown. A memslot that is
+destroyed while an iommu domain is enabled for the guest will
+therefore result in an elevated page reference count that is
+never cleared.
+
+Additionally, without this fix, the iommu is only programmed
+with the first translation for a gpa. This can result in
+peer-to-peer errors if a mapping is destroyed and replaced by a
+new mapping at the same gpa as the iommu will still be pointing
+to the original, pinned memory address.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ include/linux/kvm_host.h | 6 ++++++
+ virt/kvm/iommu.c | 12 ++++++++----
+ virt/kvm/kvm_main.c | 5 +++--
+ 3 files changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index d526231..35410ef 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -562,6 +562,7 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id);
+
+ #ifdef CONFIG_IOMMU_API
+ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
++void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
+ int kvm_iommu_map_guest(struct kvm *kvm);
+ int kvm_iommu_unmap_guest(struct kvm *kvm);
+ int kvm_assign_device(struct kvm *kvm,
+@@ -575,6 +576,11 @@ static inline int kvm_iommu_map_pages(struct kvm *kvm,
+ return 0;
+ }
+
++static inline void kvm_iommu_unmap_pages(struct kvm *kvm,
++ struct kvm_memory_slot *slot)
++{
++}
++
+ static inline int kvm_iommu_map_guest(struct kvm *kvm)
+ {
+ return -ENODEV;
+diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
+index a195c07..fd817a2 100644
+--- a/virt/kvm/iommu.c
++++ b/virt/kvm/iommu.c
+@@ -309,6 +309,11 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
+ }
+ }
+
++void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
++{
++ kvm_iommu_put_pages(kvm, slot->base_gfn, slot->npages);
++}
++
+ static int kvm_iommu_unmap_memslots(struct kvm *kvm)
+ {
+ int i, idx;
+@@ -317,10 +322,9 @@ static int kvm_iommu_unmap_memslots(struct kvm *kvm)
+ idx = srcu_read_lock(&kvm->srcu);
+ slots = kvm_memslots(kvm);
+
+- for (i = 0; i < slots->nmemslots; i++) {
+- kvm_iommu_put_pages(kvm, slots->memslots[i].base_gfn,
+- slots->memslots[i].npages);
+- }
++ for (i = 0; i < slots->nmemslots; i++)
++ kvm_iommu_unmap_pages(kvm, &slots->memslots[i]);
++
+ srcu_read_unlock(&kvm->srcu, idx);
+
+ return 0;
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index d9cfb78..e401c1b 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -802,12 +802,13 @@ skip_lpage:
+ if (r)
+ goto out_free;
+
+- /* map the pages in iommu page table */
++ /* map/unmap the pages in iommu page table */
+ if (npages) {
+ r = kvm_iommu_map_pages(kvm, &new);
+ if (r)
+ goto out_free;
+- }
++ } else
++ kvm_iommu_unmap_pages(kvm, &old);
+
+ r = -ENOMEM;
+ slots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0038-dell-laptop-add-3-machines-that-has-touchpad-LED.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0038-dell-laptop-add-3-machines-that-has-touchpad-LED.patch
--- /dev/null
@@ -0,0 +1,58 @@
+From bbfc688f2500196757c1d7334d25e335308798c5 Mon Sep 17 00:00:00 2001
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Thu, 17 Nov 2011 15:30:42 +0800
+Subject: [PATCH 038/165] dell-laptop: add 3 machines that has touchpad LED
+
+commit 2a748853ca395c48ea75baa250f7cea6f0f23dbf upstream.
+
+Add "Vostro 3555", "Inspiron N311z", and "Inspiron M5110" into quirks,
+so that they could have touchpad LED function work.
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/platform/x86/dell-laptop.c | 27 +++++++++++++++++++++++++++
+ 1 files changed, 27 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index d93e962..7621ac2 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -184,6 +184,33 @@ static struct dmi_system_id __devinitdata dell_quirks[] = {
+ },
+ .driver_data = &quirk_dell_vostro_v130,
+ },
++ {
++ .callback = dmi_matched,
++ .ident = "Dell Vostro 3555",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3555"),
++ },
++ .driver_data = &quirk_dell_vostro_v130,
++ },
++ {
++ .callback = dmi_matched,
++ .ident = "Dell Inspiron N311z",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron N311z"),
++ },
++ .driver_data = &quirk_dell_vostro_v130,
++ },
++ {
++ .callback = dmi_matched,
++ .ident = "Dell Inspiron M5110",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron M5110"),
++ },
++ .driver_data = &quirk_dell_vostro_v130,
++ },
+ };
+
+ static struct calling_interface_buffer *buffer;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0039-dell-laptop-touchpad-LED-should-persist-its-status-a.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0039-dell-laptop-touchpad-LED-should-persist-its-status-a.patch
--- /dev/null
@@ -0,0 +1,34 @@
+From 7a2e5d46e7959528fb4a7b45fc3ca55339a2445f Mon Sep 17 00:00:00 2001
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Tue, 17 Jan 2012 16:18:06 +0800
+Subject: [PATCH 039/165] dell-laptop: touchpad LED should persist its status
+ after S3
+
+commit 2d5de9e84928e35b4d9b46b4d8d5dcaac1cff1fa upstream.
+
+Touchpad LED will not turn on after S3, it will make the touchpad status
+doesn't consist with the LED.
+By adding one flag to let the LED device restore it's status.
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/platform/x86/dell-laptop.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index 7621ac2..92e42d4 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -642,6 +642,7 @@ static void touchpad_led_set(struct led_classdev *led_cdev,
+ static struct led_classdev touchpad_led = {
+ .name = "dell-laptop::touchpad",
+ .brightness_set = touchpad_led_set,
++ .flags = LED_CORE_SUSPENDRESUME,
+ };
+
+ static int __devinit touchpad_led_init(struct device *dev)
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0040-Bluetooth-Add-support-for-Atheros-04ca-3005.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0040-Bluetooth-Add-support-for-Atheros-04ca-3005.patch
--- /dev/null
@@ -0,0 +1,64 @@
+From cfa160178e6da132b537331ff5fc6f091a02e44a Mon Sep 17 00:00:00 2001
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Wed, 28 Mar 2012 10:25:36 +0800
+Subject: [PATCH 040/165] Bluetooth: Add support for Atheros [04ca:3005]
+
+commit 55ed7d4d1469eafbe3ad7e8fcd44f5af27845a81 upstream.
+
+Add another vendor specific ID for Atheros AR3012 device.
+This chip is wrapped by Lite-On Technology Corp.
+
+output of usb-devices:
+T: Bus=04 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=04ca ProdID=3005 Rev=00.02
+S: Manufacturer=Atheros Communications
+S: Product=Bluetooth USB Host Controller
+S: SerialNumber=Alaska Day 2006
+C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
+I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/bluetooth/ath3k.c | 2 ++
+ drivers/bluetooth/btusb.c | 1 +
+ 2 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 003cd8d..99fefbd 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -73,6 +73,7 @@ static struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x0CF3, 0x3004) },
+ { USB_DEVICE(0x0CF3, 0x311D) },
+ { USB_DEVICE(0x13d3, 0x3375) },
++ { USB_DEVICE(0x04CA, 0x3005) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE02C) },
+@@ -91,6 +92,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+
+ { } /* Terminating entry */
+ };
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index db44ad5..e56da6a 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -129,6 +129,7 @@ static struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0041-Don-t-limit-non-nested-epoll-paths.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0041-Don-t-limit-non-nested-epoll-paths.patch
--- /dev/null
@@ -0,0 +1,45 @@
+From 53d02f37f9e87191afdb511e740fa506af1fe2fb Mon Sep 17 00:00:00 2001
+From: Jason Baron <jbaron@redhat.com>
+Date: Fri, 16 Mar 2012 16:34:03 -0400
+Subject: [PATCH 041/165] Don't limit non-nested epoll paths
+
+commit 93dc6107a76daed81c07f50215fa6ae77691634f upstream.
+
+Commit 28d82dc1c4ed ("epoll: limit paths") that I did to limit the
+number of possible wakeup paths in epoll is causing a few applications
+to longer work (dovecot for one).
+
+The original patch is really about limiting the amount of epoll nesting
+(since epoll fds can be attached to other fds). Thus, we probably can
+allow an unlimited number of paths of depth 1. My current patch limits
+it at 1000. And enforce the limits on paths that have a greater depth.
+
+This is captured in: https://bugzilla.redhat.com/show_bug.cgi?id=681578
+
+Signed-off-by: Jason Baron <jbaron@redhat.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/eventpoll.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index ea54cde..4d9d3a4 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -988,6 +988,10 @@ static int path_count[PATH_ARR_SIZE];
+
+ static int path_count_inc(int nests)
+ {
++ /* Allow an arbitrary number of depth 1 paths */
++ if (nests == 0)
++ return 0;
++
+ if (++path_count[nests] > path_limits[nests])
+ return -1;
+ return 0;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0042-spi-Fix-device-unregistration-when-unregistering-the.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0042-spi-Fix-device-unregistration-when-unregistering-the.patch
--- /dev/null
@@ -0,0 +1,38 @@
+From e98347051c4edde97c0dfbc704660d9d0e4e0641 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 12 Dec 2011 01:15:06 +0100
+Subject: [PATCH 042/165] spi: Fix device unregistration when unregistering
+ the bus master
+
+commit 178db7d30f94707efca1a189753c105ef69942ed upstream.
+
+Device are added as children of the bus master's parent device, but
+spi_unregister_master() looks for devices to unregister in the bus
+master's children. This results in the child devices not being
+unregistered.
+
+Fix this by registering devices as direct children of the bus master.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/spi/spi.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 77eae99..b2ccdea 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -319,7 +319,7 @@ struct spi_device *spi_alloc_device(struct spi_master *master)
+ }
+
+ spi->master = master;
+- spi->dev.parent = dev;
++ spi->dev.parent = &master->dev;
+ spi->dev.bus = &spi_bus_type;
+ spi->dev.release = spidev_release;
+ device_initialize(&spi->dev);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0043-spi-mpc83xx-fix-NULL-pdata-dereference-bug.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0043-spi-mpc83xx-fix-NULL-pdata-dereference-bug.patch
--- /dev/null
@@ -0,0 +1,42 @@
+From bc5969d96482b42246a0143d3f36744c8d06c8cf Mon Sep 17 00:00:00 2001
+From: Kenth Eriksson <kenth.eriksson@transmode.com>
+Date: Fri, 30 Mar 2012 17:05:30 +0200
+Subject: [PATCH 043/165] spi/mpc83xx: fix NULL pdata dereference bug
+
+commit 5039a86973cd35bdb2f64d28ee12f13fe2bb5a4c upstream.
+
+Commit 178db7d3, "spi: Fix device unregistration when unregistering
+the bus master", changed device initialization to be children of the
+bus master, not children of the bus masters parent device. The pdata
+pointer used in fsl_spi_chipselect must updated to reflect the changed
+initialization.
+
+Signed-off-by: Kenth Eriksson <kenth.eriksson@transmode.com>
+Acked-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/spi/spi-fsl-spi.c | 4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 24cacff..5f748c0 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -139,10 +139,12 @@ static void fsl_spi_change_mode(struct spi_device *spi)
+ static void fsl_spi_chipselect(struct spi_device *spi, int value)
+ {
+ struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master);
+- struct fsl_spi_platform_data *pdata = spi->dev.parent->platform_data;
++ struct fsl_spi_platform_data *pdata;
+ bool pol = spi->mode & SPI_CS_HIGH;
+ struct spi_mpc8xxx_cs *cs = spi->controller_state;
+
++ pdata = spi->dev.parent->parent->platform_data;
++
+ if (value == BITBANG_CS_INACTIVE) {
+ if (pdata->cs_control)
+ pdata->cs_control(spi, !pol);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0044-rt2800-Add-support-for-the-Fujitsu-Stylistic-Q550.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0044-rt2800-Add-support-for-the-Fujitsu-Stylistic-Q550.patch
--- /dev/null
@@ -0,0 +1,33 @@
+From 81eef1db7c237ecc52f165049d7b128f081bc1f1 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Mon, 19 Dec 2011 21:07:33 +0000
+Subject: [PATCH 044/165] rt2800: Add support for the Fujitsu Stylistic Q550
+
+commit 3ac44670ad0fca8b6c43b3e4d8494c67c419f494 upstream.
+
+Just another USB identifier.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wireless/rt2x00/rt2800usb.c | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index cb71e88..c49b8bf 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -1161,6 +1161,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x7392, 0x7722) },
+ /* Encore */
+ { USB_DEVICE(0x203d, 0x14a1) },
++ /* Fujitsu Stylistic 550 */
++ { USB_DEVICE(0x1690, 0x0761) },
+ /* Gemtek */
+ { USB_DEVICE(0x15a9, 0x0010) },
+ /* Gigabyte */
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0045-rt2x00-Identify-rt2800usb-chipsets.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0045-rt2x00-Identify-rt2800usb-chipsets.patch
--- /dev/null
@@ -0,0 +1,148 @@
+From 5d35a9613dc2f1483a1b1c8327f7050299363dee Mon Sep 17 00:00:00 2001
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+Date: Wed, 28 Dec 2011 01:53:18 +0100
+Subject: [PATCH 045/165] rt2x00: Identify rt2800usb chipsets.
+
+commit bc93eda7e903ff75cefcb6e247ed9b8e9f8e9783 upstream.
+
+According to the latest USB ID database these are all RT2770 / RT2870 / RT307x
+devices.
+
+Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+[bwh: Backported to 3.2: adjust context for previously cherry-picked
+ commit d42a179b941a9e4cc6cf41d0f3cbadd75fc48a89 'rt2x00: Add support
+ for D-Link DWA-127 to rt2800usb']
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wireless/rt2x00/rt2800usb.c | 26 ++++++++++++--------------
+ 1 files changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index c49b8bf..0ffa111 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -914,12 +914,14 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x050d, 0x8053) },
+ { USB_DEVICE(0x050d, 0x805c) },
+ { USB_DEVICE(0x050d, 0x815c) },
++ { USB_DEVICE(0x050d, 0x825a) },
+ { USB_DEVICE(0x050d, 0x825b) },
+ { USB_DEVICE(0x050d, 0x935a) },
+ { USB_DEVICE(0x050d, 0x935b) },
+ /* Buffalo */
+ { USB_DEVICE(0x0411, 0x00e8) },
+ { USB_DEVICE(0x0411, 0x0158) },
++ { USB_DEVICE(0x0411, 0x015d) },
+ { USB_DEVICE(0x0411, 0x016f) },
+ { USB_DEVICE(0x0411, 0x01a2) },
+ /* Corega */
+@@ -934,6 +936,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x07d1, 0x3c0e) },
+ { USB_DEVICE(0x07d1, 0x3c0f) },
+ { USB_DEVICE(0x07d1, 0x3c11) },
++ { USB_DEVICE(0x07d1, 0x3c13) },
++ { USB_DEVICE(0x07d1, 0x3c15) },
+ { USB_DEVICE(0x07d1, 0x3c16) },
+ { USB_DEVICE(0x2001, 0x3c1b) },
+ /* Draytek */
+@@ -944,6 +948,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x7392, 0x7711) },
+ { USB_DEVICE(0x7392, 0x7717) },
+ { USB_DEVICE(0x7392, 0x7718) },
++ { USB_DEVICE(0x7392, 0x7722) },
+ /* Encore */
+ { USB_DEVICE(0x203d, 0x1480) },
+ { USB_DEVICE(0x203d, 0x14a9) },
+@@ -978,6 +983,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x1737, 0x0070) },
+ { USB_DEVICE(0x1737, 0x0071) },
+ { USB_DEVICE(0x1737, 0x0077) },
++ { USB_DEVICE(0x1737, 0x0078) },
+ /* Logitec */
+ { USB_DEVICE(0x0789, 0x0162) },
+ { USB_DEVICE(0x0789, 0x0163) },
+@@ -1001,9 +1007,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x0db0, 0x871b) },
+ { USB_DEVICE(0x0db0, 0x871c) },
+ { USB_DEVICE(0x0db0, 0x899a) },
++ /* Ovislink */
++ { USB_DEVICE(0x1b75, 0x3071) },
++ { USB_DEVICE(0x1b75, 0x3072) },
+ /* Para */
+ { USB_DEVICE(0x20b8, 0x8888) },
+ /* Pegatron */
++ { USB_DEVICE(0x1d4d, 0x0002) },
+ { USB_DEVICE(0x1d4d, 0x000c) },
+ { USB_DEVICE(0x1d4d, 0x000e) },
+ { USB_DEVICE(0x1d4d, 0x0011) },
+@@ -1056,7 +1066,9 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ /* Sparklan */
+ { USB_DEVICE(0x15a9, 0x0006) },
+ /* Sweex */
++ { USB_DEVICE(0x177f, 0x0153) },
+ { USB_DEVICE(0x177f, 0x0302) },
++ { USB_DEVICE(0x177f, 0x0313) },
+ /* U-Media */
+ { USB_DEVICE(0x157e, 0x300e) },
+ { USB_DEVICE(0x157e, 0x3013) },
+@@ -1140,25 +1152,20 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x13d3, 0x3322) },
+ /* Belkin */
+ { USB_DEVICE(0x050d, 0x1003) },
+- { USB_DEVICE(0x050d, 0x825a) },
+ /* Buffalo */
+ { USB_DEVICE(0x0411, 0x012e) },
+ { USB_DEVICE(0x0411, 0x0148) },
+ { USB_DEVICE(0x0411, 0x0150) },
+- { USB_DEVICE(0x0411, 0x015d) },
+ /* Corega */
+ { USB_DEVICE(0x07aa, 0x0041) },
+ { USB_DEVICE(0x07aa, 0x0042) },
+ { USB_DEVICE(0x18c5, 0x0008) },
+ /* D-Link */
+ { USB_DEVICE(0x07d1, 0x3c0b) },
+- { USB_DEVICE(0x07d1, 0x3c13) },
+- { USB_DEVICE(0x07d1, 0x3c15) },
+ { USB_DEVICE(0x07d1, 0x3c17) },
+ { USB_DEVICE(0x2001, 0x3c17) },
+ /* Edimax */
+ { USB_DEVICE(0x7392, 0x4085) },
+- { USB_DEVICE(0x7392, 0x7722) },
+ /* Encore */
+ { USB_DEVICE(0x203d, 0x14a1) },
+ /* Fujitsu Stylistic 550 */
+@@ -1174,19 +1181,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ /* LevelOne */
+ { USB_DEVICE(0x1740, 0x0605) },
+ { USB_DEVICE(0x1740, 0x0615) },
+- /* Linksys */
+- { USB_DEVICE(0x1737, 0x0078) },
+ /* Logitec */
+ { USB_DEVICE(0x0789, 0x0168) },
+ { USB_DEVICE(0x0789, 0x0169) },
+ /* Motorola */
+ { USB_DEVICE(0x100d, 0x9032) },
+- /* Ovislink */
+- { USB_DEVICE(0x1b75, 0x3071) },
+- { USB_DEVICE(0x1b75, 0x3072) },
+ /* Pegatron */
+ { USB_DEVICE(0x05a6, 0x0101) },
+- { USB_DEVICE(0x1d4d, 0x0002) },
+ { USB_DEVICE(0x1d4d, 0x0010) },
+ /* Planex */
+ { USB_DEVICE(0x2019, 0x5201) },
+@@ -1205,9 +1206,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ { USB_DEVICE(0x083a, 0xc522) },
+ { USB_DEVICE(0x083a, 0xd522) },
+ { USB_DEVICE(0x083a, 0xf511) },
+- /* Sweex */
+- { USB_DEVICE(0x177f, 0x0153) },
+- { USB_DEVICE(0x177f, 0x0313) },
+ /* Zyxel */
+ { USB_DEVICE(0x0586, 0x341a) },
+ #endif
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0046-nfsd-fix-b0rken-error-value-for-setattr-on-read-only.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0046-nfsd-fix-b0rken-error-value-for-setattr-on-read-only.patch
--- /dev/null
@@ -0,0 +1,45 @@
+From 41e39c9a0a6aa1e152db9dfd4019e20a9de8dce6 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 27 Apr 2012 17:42:43 -0500
+Subject: [PATCH 046/165] nfsd: fix b0rken error value for setattr on
+ read-only mount
+
+commit 96f6f98501196d46ce52c2697dd758d9300c63f5 upstream.
+
+..._want_write() returns -EROFS on failure, _not_ an NFS error value.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfsd/nfs4proc.c | 7 ++++---
+ 1 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index fa38336..35840aa 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -827,6 +827,7 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ struct nfsd4_setattr *setattr)
+ {
+ __be32 status = nfs_ok;
++ int err;
+
+ if (setattr->sa_iattr.ia_valid & ATTR_SIZE) {
+ nfs4_lock_state();
+@@ -838,9 +839,9 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ return status;
+ }
+ }
+- status = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt);
+- if (status)
+- return status;
++ err = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt);
++ if (err)
++ return nfserrno(err);
+ status = nfs_ok;
+
+ status = check_attr_support(rqstp, cstate, setattr->sa_bmval,
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0047-nfsd-fix-error-values-returned-by-nfsd4_lockt-when-n.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0047-nfsd-fix-error-values-returned-by-nfsd4_lockt-when-n.patch
--- /dev/null
@@ -0,0 +1,73 @@
+From d0fb6592c02971a290d199c1e9ee06624fd17c1c Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 00:00:04 -0400
+Subject: [PATCH 047/165] nfsd: fix error values returned by nfsd4_lockt()
+ when nfsd_open() fails
+
+commit 04da6e9d63427b2d0fd04766712200c250b3278f upstream.
+
+nfsd_open() already returns an NFS error value; only vfs_test_lock()
+result needs to be fed through nfserrno(). Broken by commit 55ef12
+(nfsd: Ensure nfsv4 calls the underlying filesystem on LOCKT)
+three years ago...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfsd/nfs4state.c | 23 +++++++++--------------
+ 1 files changed, 9 insertions(+), 14 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 5abced7..4cfe260 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -4080,16 +4080,14 @@ out:
+ * vfs_test_lock. (Arguably perhaps test_lock should be done with an
+ * inode operation.)
+ */
+-static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
++static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
+ {
+ struct file *file;
+- int err;
+-
+- err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
+- if (err)
+- return err;
+- err = vfs_test_lock(file, lock);
+- nfsd_close(file);
++ __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
++ if (!err) {
++ err = nfserrno(vfs_test_lock(file, lock));
++ nfsd_close(file);
++ }
+ return err;
+ }
+
+@@ -4103,7 +4101,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ struct inode *inode;
+ struct file_lock file_lock;
+ struct nfs4_lockowner *lo;
+- int error;
+ __be32 status;
+
+ if (locks_in_grace())
+@@ -4149,12 +4146,10 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+
+ nfs4_transform_lock_offset(&file_lock);
+
+- status = nfs_ok;
+- error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
+- if (error) {
+- status = nfserrno(error);
++ status = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
++ if (status)
+ goto out;
+- }
++
+ if (file_lock.fl_type != F_UNLCK) {
+ status = nfserr_denied;
+ nfs4_set_lock_denied(&file_lock, &lockt->lt_denied);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0048-nfsd-fix-endianness-breakage-in-TEST_STATEID-handlin.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0048-nfsd-fix-endianness-breakage-in-TEST_STATEID-handlin.patch
--- /dev/null
@@ -0,0 +1,36 @@
+From c0326b2209aa31faeb2369d7311d0754d7b6d202 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 00:10:34 -0400
+Subject: [PATCH 048/165] nfsd: fix endianness breakage in TEST_STATEID
+ handling
+
+commit 02f5fde5df0ea930e70f93763dd48beff182b208 upstream.
+
+->ts_id_status gets nfs errno, i.e. it's already big-endian; no need
+to apply htonl() to it. Broken by commit 174568 (NFSD: Added TEST_STATEID
+operation) last year...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Cc: "J. Bruce Fields" <bfields@fieldses.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfsd/nfs4xdr.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index b6fa792..9cfa60a 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -3411,7 +3411,7 @@ nfsd4_encode_test_stateid(struct nfsd4_compoundres *resp, int nfserr,
+ nfsd4_decode_stateid(argp, &si);
+ valid = nfs4_validate_stateid(cl, &si);
+ RESERVE_SPACE(4);
+- *p++ = htonl(valid);
++ *p++ = valid;
+ resp->p = p;
+ }
+ nfs4_unlock_state();
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0049-nfsd-fix-compose_entry_fh-failure-exits.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0049-nfsd-fix-compose_entry_fh-failure-exits.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0049-nfsd-fix-compose_entry_fh-failure-exits.patch
@@ -0,0 +1,92 @@
+From 58c574420bacc1f5dc171dff6f0915ebc5749ee3 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 00:32:14 -0400
+Subject: [PATCH 049/165] nfsd: fix compose_entry_fh() failure exits
+
+commit efe39651f08813180f37dc508d950fc7d92b29a8 upstream.
+
+Restore the original logics ("fail on mountpoints, negatives and in
+case of fh_compose() failures"). Since commit 8177e (nfsd: clean up
+readdirplus encoding) that got broken -
+ rv = fh_compose(fhp, exp, dchild, &cd->fh);
+ if (rv)
+ goto out;
+ if (!dchild->d_inode)
+ goto out;
+ rv = 0;
+out:
+is equivalent to
+ rv = fh_compose(fhp, exp, dchild, &cd->fh);
+out:
+and the second check has no effect whatsoever...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfsd/nfs3xdr.c | 22 ++++++++--------------
+ 1 files changed, 8 insertions(+), 14 deletions(-)
+
+diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
+index 08c6e36..43f46cd 100644
+--- a/fs/nfsd/nfs3xdr.c
++++ b/fs/nfsd/nfs3xdr.c
+@@ -803,13 +803,13 @@ encode_entry_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name,
+ return p;
+ }
+
+-static int
++static __be32
+ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
+ const char *name, int namlen)
+ {
+ struct svc_export *exp;
+ struct dentry *dparent, *dchild;
+- int rv = 0;
++ __be32 rv = nfserr_noent;
+
+ dparent = cd->fh.fh_dentry;
+ exp = cd->fh.fh_export;
+@@ -817,26 +817,20 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
+ if (isdotent(name, namlen)) {
+ if (namlen == 2) {
+ dchild = dget_parent(dparent);
+- if (dchild == dparent) {
+- /* filesystem root - cannot return filehandle for ".." */
+- dput(dchild);
+- return -ENOENT;
+- }
++ /* filesystem root - cannot return filehandle for ".." */
++ if (dchild == dparent)
++ goto out;
+ } else
+ dchild = dget(dparent);
+ } else
+ dchild = lookup_one_len(name, dparent, namlen);
+ if (IS_ERR(dchild))
+- return -ENOENT;
+- rv = -ENOENT;
++ return rv;
+ if (d_mountpoint(dchild))
+ goto out;
+- rv = fh_compose(fhp, exp, dchild, &cd->fh);
+- if (rv)
+- goto out;
+ if (!dchild->d_inode)
+ goto out;
+- rv = 0;
++ rv = fh_compose(fhp, exp, dchild, &cd->fh);
+ out:
+ dput(dchild);
+ return rv;
+@@ -845,7 +839,7 @@ out:
+ static __be32 *encode_entryplus_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name, int namlen)
+ {
+ struct svc_fh fh;
+- int err;
++ __be32 err;
+
+ fh_init(&fh, NFS3_FHSIZE);
+ err = compose_entry_fh(cd, &fh, name, namlen);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0050-btrfs-btrfs_root_readonly-broken-on-big-endian.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0050-btrfs-btrfs_root_readonly-broken-on-big-endian.patch
--- /dev/null
@@ -0,0 +1,33 @@
+From f34178385ffae408ee0ade44819875816104a99a Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 11:49:04 -0400
+Subject: [PATCH 050/165] btrfs: btrfs_root_readonly() broken on big-endian
+
+commit 6ed3cf2cdfce4c9f1d73171bd3f27d9cb77b734e upstream.
+
+->root_flags is __le64 and all accesses to it go through the helpers
+that do proper conversions. Except for btrfs_root_readonly(), which
+checks bit 0 as in host-endian...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/btrfs/ctree.h | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 6738503..83a871f 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -2025,7 +2025,7 @@ BTRFS_SETGET_STACK_FUNCS(root_last_snapshot, struct btrfs_root_item,
+
+ static inline bool btrfs_root_readonly(struct btrfs_root *root)
+ {
+- return root->root_item.flags & BTRFS_ROOT_SUBVOL_RDONLY;
++ return (root->root_item.flags & cpu_to_le64(BTRFS_ROOT_SUBVOL_RDONLY)) != 0;
+ }
+
+ /* struct btrfs_root_backup */
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0051-ocfs2-l_next_free_req-breakage-on-big-endian.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0051-ocfs2-l_next_free_req-breakage-on-big-endian.patch
--- /dev/null
@@ -0,0 +1,53 @@
+From e72fdd80481fa4848f1d90be6e8bcdc24db469f8 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 12:22:00 -0400
+Subject: [PATCH 051/165] ocfs2: ->l_next_free_req breakage on big-endian
+
+commit 3a251f04fe97c3d335b745c98e4b377e3c3899f2 upstream.
+
+It's le16, not le32...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ocfs2/alloc.c | 2 +-
+ fs/ocfs2/refcounttree.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
+index 3165aeb..31b9463 100644
+--- a/fs/ocfs2/alloc.c
++++ b/fs/ocfs2/alloc.c
+@@ -1134,7 +1134,7 @@ static int ocfs2_adjust_rightmost_branch(handle_t *handle,
+ }
+
+ el = path_leaf_el(path);
+- rec = &el->l_recs[le32_to_cpu(el->l_next_free_rec) - 1];
++ rec = &el->l_recs[le16_to_cpu(el->l_next_free_rec) - 1];
+
+ ocfs2_adjust_rightmost_records(handle, et, path, rec);
+
+diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
+index cf78233..a7b7217 100644
+--- a/fs/ocfs2/refcounttree.c
++++ b/fs/ocfs2/refcounttree.c
+@@ -1036,14 +1036,14 @@ static int ocfs2_get_refcount_cpos_end(struct ocfs2_caching_info *ci,
+
+ tmp_el = left_path->p_node[subtree_root].el;
+ blkno = left_path->p_node[subtree_root+1].bh->b_blocknr;
+- for (i = 0; i < le32_to_cpu(tmp_el->l_next_free_rec); i++) {
++ for (i = 0; i < le16_to_cpu(tmp_el->l_next_free_rec); i++) {
+ if (le64_to_cpu(tmp_el->l_recs[i].e_blkno) == blkno) {
+ *cpos_end = le32_to_cpu(tmp_el->l_recs[i+1].e_cpos);
+ break;
+ }
+ }
+
+- BUG_ON(i == le32_to_cpu(tmp_el->l_next_free_rec));
++ BUG_ON(i == le16_to_cpu(tmp_el->l_next_free_rec));
+
+ out:
+ ocfs2_free_path(left_path);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0052-ocfs-rl_used-breakage-on-big-endian.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0052-ocfs-rl_used-breakage-on-big-endian.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0052-ocfs-rl_used-breakage-on-big-endian.patch
@@ -0,0 +1,58 @@
+From 88f1278427aa9c75c6b4c7f59b160a9a29ae8f17 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 12:27:11 -0400
+Subject: [PATCH 052/165] ocfs: ->rl_used breakage on big-endian
+
+commit e1bf4cc620fd143766ddfcee3b004a1d1bb34fd0 upstream.
+
+it's le16, not le32 or le64...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ocfs2/refcounttree.c | 8 ++++----
+ 1 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
+index a7b7217..bc90ebc 100644
+--- a/fs/ocfs2/refcounttree.c
++++ b/fs/ocfs2/refcounttree.c
+@@ -1468,7 +1468,7 @@ static int ocfs2_divide_leaf_refcount_block(struct buffer_head *ref_leaf_bh,
+
+ trace_ocfs2_divide_leaf_refcount_block(
+ (unsigned long long)ref_leaf_bh->b_blocknr,
+- le32_to_cpu(rl->rl_count), le32_to_cpu(rl->rl_used));
++ le32_to_cpu(rl->rl_count), le16_to_cpu(rl->rl_used));
+
+ /*
+ * XXX: Improvement later.
+@@ -2411,7 +2411,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
+ rb = (struct ocfs2_refcount_block *)
+ prev_bh->b_data;
+
+- if (le64_to_cpu(rb->rf_records.rl_used) +
++ if (le16_to_cpu(rb->rf_records.rl_used) +
+ recs_add >
+ le16_to_cpu(rb->rf_records.rl_count))
+ ref_blocks++;
+@@ -2476,7 +2476,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
+ if (prev_bh) {
+ rb = (struct ocfs2_refcount_block *)prev_bh->b_data;
+
+- if (le64_to_cpu(rb->rf_records.rl_used) + recs_add >
++ if (le16_to_cpu(rb->rf_records.rl_used) + recs_add >
+ le16_to_cpu(rb->rf_records.rl_count))
+ ref_blocks++;
+
+@@ -3629,7 +3629,7 @@ int ocfs2_refcounted_xattr_delete_need(struct inode *inode,
+ * one will split a refcount rec, so totally we need
+ * clusters * 2 new refcount rec.
+ */
+- if (le64_to_cpu(rb->rf_records.rl_used) + clusters * 2 >
++ if (le16_to_cpu(rb->rf_records.rl_used) + clusters * 2 >
+ le16_to_cpu(rb->rf_records.rl_count))
+ ref_blocks++;
+
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0053-ocfs2-rl_count-endianness-breakage.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0053-ocfs2-rl_count-endianness-breakage.patch
--- /dev/null
@@ -0,0 +1,31 @@
+From de962467d8b4d7cd0903b5151bc5fbde4f09552f Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 12:28:21 -0400
+Subject: [PATCH 053/165] ocfs2: ->rl_count endianness breakage
+
+commit 28748b325dc2d730ccc312830a91c4ae0c0d9379 upstream.
+
+le16, not le32...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ocfs2/refcounttree.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
+index bc90ebc..9f32d7c 100644
+--- a/fs/ocfs2/refcounttree.c
++++ b/fs/ocfs2/refcounttree.c
+@@ -1468,7 +1468,7 @@ static int ocfs2_divide_leaf_refcount_block(struct buffer_head *ref_leaf_bh,
+
+ trace_ocfs2_divide_leaf_refcount_block(
+ (unsigned long long)ref_leaf_bh->b_blocknr,
+- le32_to_cpu(rl->rl_count), le16_to_cpu(rl->rl_used));
++ le16_to_cpu(rl->rl_count), le16_to_cpu(rl->rl_used));
+
+ /*
+ * XXX: Improvement later.
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0054-ocfs2-e_leaf_clusters-endianness-breakage.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0054-ocfs2-e_leaf_clusters-endianness-breakage.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0054-ocfs2-e_leaf_clusters-endianness-breakage.patch
@@ -0,0 +1,40 @@
+From c38877f92a9e0858b5a4902440cef2c0df1b1632 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 12:30:02 -0400
+Subject: [PATCH 054/165] ocfs2: ->e_leaf_clusters endianness breakage
+
+commit 72094e43e3af5020510f920321d71f1798fa896d upstream.
+
+le16, not le32...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ocfs2/suballoc.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
+index ba5d97e..f169da4 100644
+--- a/fs/ocfs2/suballoc.c
++++ b/fs/ocfs2/suballoc.c
+@@ -600,7 +600,7 @@ static void ocfs2_bg_alloc_cleanup(handle_t *handle,
+ ret = ocfs2_free_clusters(handle, cluster_ac->ac_inode,
+ cluster_ac->ac_bh,
+ le64_to_cpu(rec->e_blkno),
+- le32_to_cpu(rec->e_leaf_clusters));
++ le16_to_cpu(rec->e_leaf_clusters));
+ if (ret)
+ mlog_errno(ret);
+ /* Try all the clusters to free */
+@@ -1628,7 +1628,7 @@ static int ocfs2_bg_discontig_fix_by_rec(struct ocfs2_suballoc_result *res,
+ {
+ unsigned int bpc = le16_to_cpu(cl->cl_bpc);
+ unsigned int bitoff = le32_to_cpu(rec->e_cpos) * bpc;
+- unsigned int bitcount = le32_to_cpu(rec->e_leaf_clusters) * bpc;
++ unsigned int bitcount = le16_to_cpu(rec->e_leaf_clusters) * bpc;
+
+ if (res->sr_bit_offset < bitoff)
+ return 0;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0055-lockd-fix-the-endianness-bug.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0055-lockd-fix-the-endianness-bug.patch
--- /dev/null
@@ -0,0 +1,45 @@
+From 3257f4da731bb45c2117beda34ed3202df1c74e4 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 13:49:47 -0400
+Subject: [PATCH 055/165] lockd: fix the endianness bug
+
+commit e847469bf77a1d339274074ed068d461f0c872bc upstream.
+
+comparing be32 values for < is not doing the right thing...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/lockd/clnt4xdr.c | 2 +-
+ fs/lockd/clntxdr.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c
+index f848b52..046bb77 100644
+--- a/fs/lockd/clnt4xdr.c
++++ b/fs/lockd/clnt4xdr.c
+@@ -241,7 +241,7 @@ static int decode_nlm4_stat(struct xdr_stream *xdr, __be32 *stat)
+ p = xdr_inline_decode(xdr, 4);
+ if (unlikely(p == NULL))
+ goto out_overflow;
+- if (unlikely(*p > nlm4_failed))
++ if (unlikely(ntohl(*p) > ntohl(nlm4_failed)))
+ goto out_bad_xdr;
+ *stat = *p;
+ return 0;
+diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c
+index 180ac34..36057ce 100644
+--- a/fs/lockd/clntxdr.c
++++ b/fs/lockd/clntxdr.c
+@@ -236,7 +236,7 @@ static int decode_nlm_stat(struct xdr_stream *xdr,
+ p = xdr_inline_decode(xdr, 4);
+ if (unlikely(p == NULL))
+ goto out_overflow;
+- if (unlikely(*p > nlm_lck_denied_grace_period))
++ if (unlikely(ntohl(*p) > ntohl(nlm_lck_denied_grace_period)))
+ goto out_enum;
+ *stat = *p;
+ return 0;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0056-usb-dwc3-ep0-increment-actual-on-bounced-ep0-case.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0056-usb-dwc3-ep0-increment-actual-on-bounced-ep0-case.patch
--- /dev/null
@@ -0,0 +1,41 @@
+From ab98d1498e030766394cbc78259a2a9a1aa5edbe Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Wed, 21 Mar 2012 11:44:00 +0200
+Subject: [PATCH 056/165] usb: dwc3: ep0: increment "actual" on bounced ep0
+ case
+
+commit cd423dd3634a5232a3019eb372b144619a61cd16 upstream.
+
+due to a HW limitation we have a bounce buffer for ep0
+out transfers which are not aligned with MaxPacketSize.
+
+On such case we were not increment r->actual as we should.
+
+This patch fixes that mistake.
+
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/dwc3/ep0.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index 27bd50a..c0dcf69 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -572,9 +572,10 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
+ dwc->ep0_bounced = false;
+ } else {
+ transferred = ur->length - trb.length;
+- ur->actual += transferred;
+ }
+
++ ur->actual += transferred;
++
+ if ((epnum & 1) && ur->actual < ur->length) {
+ /* for some reason we did not get everything out */
+
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0057-net-fix-proc-net-dev-regression.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0057-net-fix-proc-net-dev-regression.patch
--- /dev/null
@@ -0,0 +1,185 @@
+From 83b74fb7bfab64f75ff56f20f3736c44b035c823 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Mon, 2 Apr 2012 22:33:02 +0000
+Subject: [PATCH 057/165] net: fix /proc/net/dev regression
+
+[ Upstream commit 2def16ae6b0c77571200f18ba4be049b03d75579 ]
+
+Commit f04565ddf52 (dev: use name hash for dev_seq_ops) added a second
+regression, as some devices are missing from /proc/net/dev if many
+devices are defined.
+
+When seq_file buffer is filled, the last ->next/show() method is
+canceled (pos value is reverted to value prior ->next() call)
+
+Problem is after above commit, we dont restart the lookup at right
+position in ->start() method.
+
+Fix this by removing the internal 'pos' pointer added in commit, since
+we need to use the 'loff_t *pos' provided by seq_file layer.
+
+This also reverts commit 5cac98dd0 (net: Fix corruption
+in /proc/*/net/dev_mcast), since its not needed anymore.
+
+Reported-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Mihai Maruseac <mmaruseac@ixiacom.com>
+Tested-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ include/linux/netdevice.h | 2 -
+ net/core/dev.c | 58 ++++++++++----------------------------------
+ net/core/dev_addr_lists.c | 3 +-
+ 3 files changed, 15 insertions(+), 48 deletions(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index a82ad4d..cbeb586 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2536,8 +2536,6 @@ extern void net_disable_timestamp(void);
+ extern void *dev_seq_start(struct seq_file *seq, loff_t *pos);
+ extern void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos);
+ extern void dev_seq_stop(struct seq_file *seq, void *v);
+-extern int dev_seq_open_ops(struct inode *inode, struct file *file,
+- const struct seq_operations *ops);
+ #endif
+
+ extern int netdev_class_create_file(struct class_attribute *class_attr);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 55cd370..cd5050e 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4102,54 +4102,41 @@ static int dev_ifconf(struct net *net, char __user *arg)
+
+ #ifdef CONFIG_PROC_FS
+
+-#define BUCKET_SPACE (32 - NETDEV_HASHBITS)
+-
+-struct dev_iter_state {
+- struct seq_net_private p;
+- unsigned int pos; /* bucket << BUCKET_SPACE + offset */
+-};
++#define BUCKET_SPACE (32 - NETDEV_HASHBITS - 1)
+
+ #define get_bucket(x) ((x) >> BUCKET_SPACE)
+ #define get_offset(x) ((x) & ((1 << BUCKET_SPACE) - 1))
+ #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o))
+
+-static inline struct net_device *dev_from_same_bucket(struct seq_file *seq)
++static inline struct net_device *dev_from_same_bucket(struct seq_file *seq, loff_t *pos)
+ {
+- struct dev_iter_state *state = seq->private;
+ struct net *net = seq_file_net(seq);
+ struct net_device *dev;
+ struct hlist_node *p;
+ struct hlist_head *h;
+- unsigned int count, bucket, offset;
++ unsigned int count = 0, offset = get_offset(*pos);
+
+- bucket = get_bucket(state->pos);
+- offset = get_offset(state->pos);
+- h = &net->dev_name_head[bucket];
+- count = 0;
++ h = &net->dev_name_head[get_bucket(*pos)];
+ hlist_for_each_entry_rcu(dev, p, h, name_hlist) {
+- if (count++ == offset) {
+- state->pos = set_bucket_offset(bucket, count);
++ if (++count == offset)
+ return dev;
+- }
+ }
+
+ return NULL;
+ }
+
+-static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
++static inline struct net_device *dev_from_bucket(struct seq_file *seq, loff_t *pos)
+ {
+- struct dev_iter_state *state = seq->private;
+ struct net_device *dev;
+ unsigned int bucket;
+
+- bucket = get_bucket(state->pos);
+ do {
+- dev = dev_from_same_bucket(seq);
++ dev = dev_from_same_bucket(seq, pos);
+ if (dev)
+ return dev;
+
+- bucket++;
+- state->pos = set_bucket_offset(bucket, 0);
++ bucket = get_bucket(*pos) + 1;
++ *pos = set_bucket_offset(bucket, 1);
+ } while (bucket < NETDEV_HASHENTRIES);
+
+ return NULL;
+@@ -4162,33 +4149,20 @@ static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
+ void *dev_seq_start(struct seq_file *seq, loff_t *pos)
+ __acquires(RCU)
+ {
+- struct dev_iter_state *state = seq->private;
+-
+ rcu_read_lock();
+ if (!*pos)
+ return SEQ_START_TOKEN;
+
+- /* check for end of the hash */
+- if (state->pos == 0 && *pos > 1)
++ if (get_bucket(*pos) >= NETDEV_HASHENTRIES)
+ return NULL;
+
+- return dev_from_new_bucket(seq);
++ return dev_from_bucket(seq, pos);
+ }
+
+ void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+- struct net_device *dev;
+-
+ ++*pos;
+-
+- if (v == SEQ_START_TOKEN)
+- return dev_from_new_bucket(seq);
+-
+- dev = dev_from_same_bucket(seq);
+- if (dev)
+- return dev;
+-
+- return dev_from_new_bucket(seq);
++ return dev_from_bucket(seq, pos);
+ }
+
+ void dev_seq_stop(struct seq_file *seq, void *v)
+@@ -4287,13 +4261,7 @@ static const struct seq_operations dev_seq_ops = {
+ static int dev_seq_open(struct inode *inode, struct file *file)
+ {
+ return seq_open_net(inode, file, &dev_seq_ops,
+- sizeof(struct dev_iter_state));
+-}
+-
+-int dev_seq_open_ops(struct inode *inode, struct file *file,
+- const struct seq_operations *ops)
+-{
+- return seq_open_net(inode, file, ops, sizeof(struct dev_iter_state));
++ sizeof(struct seq_net_private));
+ }
+
+ static const struct file_operations dev_seq_fops = {
+diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
+index febba51..277faef 100644
+--- a/net/core/dev_addr_lists.c
++++ b/net/core/dev_addr_lists.c
+@@ -696,7 +696,8 @@ static const struct seq_operations dev_mc_seq_ops = {
+
+ static int dev_mc_seq_open(struct inode *inode, struct file *file)
+ {
+- return dev_seq_open_ops(inode, file, &dev_mc_seq_ops);
++ return seq_open_net(inode, file, &dev_mc_seq_ops,
++ sizeof(struct seq_net_private));
+ }
+
+ static const struct file_operations dev_mc_seq_fops = {
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0058-nfsd-don-t-fail-unchecked-creates-of-non-special-fil.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0058-nfsd-don-t-fail-unchecked-creates-of-non-special-fil.patch
--- /dev/null
@@ -0,0 +1,75 @@
+From 5a9807ef2e73be0be4b878dbec1691f91d875585 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Mon, 9 Apr 2012 18:06:49 -0400
+Subject: [PATCH 058/165] nfsd: don't fail unchecked creates of non-special
+ files
+
+commit 9dc4e6c4d1182d34604ea40fef641775f5b15456 upstream.
+
+Allow a v3 unchecked open of a non-regular file succeed as if it were a
+lookup; typically a client in such a case will want to fall back on a
+local open, so succeeding and giving it the filehandle is more useful
+than failing with nfserr_exist, which makes it appear that nothing at
+all exists by that name.
+
+Similarly for v4, on an open-create, return the same errors we would on
+an attempt to open a non-regular file, instead of returning
+nfserr_exist.
+
+This fixes a problem found doing a v4 open of a symlink with
+O_RDONLY|O_CREAT, which resulted in the current client returning EEXIST.
+
+Thanks also to Trond for analysis.
+
+Reported-by: Orion Poplawski <orion@cora.nwra.com>
+Tested-by: Orion Poplawski <orion@cora.nwra.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+[bwh: Backported to 3.2: use &resfh, not resfh]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfsd/nfs4proc.c | 8 ++++----
+ fs/nfsd/vfs.c | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 35840aa..b8c5538 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -231,17 +231,17 @@ do_open_lookup(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_o
+ */
+ if (open->op_createmode == NFS4_CREATE_EXCLUSIVE && status == 0)
+ open->op_bmval[1] = (FATTR4_WORD1_TIME_ACCESS |
+- FATTR4_WORD1_TIME_MODIFY);
++ FATTR4_WORD1_TIME_MODIFY);
+ } else {
+ status = nfsd_lookup(rqstp, current_fh,
+ open->op_fname.data, open->op_fname.len, &resfh);
+ fh_unlock(current_fh);
+- if (status)
+- goto out;
+- status = nfsd_check_obj_isreg(&resfh);
+ }
+ if (status)
+ goto out;
++ status = nfsd_check_obj_isreg(&resfh);
++ if (status)
++ goto out;
+
+ if (is_create_with_attrs(open) && open->op_acl != NULL)
+ do_set_nfs4_acl(rqstp, &resfh, open->op_acl, open->op_bmval);
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 7a2e442..5c3cd82 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1439,7 +1439,7 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ switch (createmode) {
+ case NFS3_CREATE_UNCHECKED:
+ if (! S_ISREG(dchild->d_inode->i_mode))
+- err = nfserr_exist;
++ goto out;
+ else if (truncp) {
+ /* in nfsv4, we need to treat this case a little
+ * differently. we don't want to truncate the
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0059-ppp-Don-t-stop-and-restart-queue-on-every-TX-packet.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0059-ppp-Don-t-stop-and-restart-queue-on-every-TX-packet.patch
--- /dev/null
@@ -0,0 +1,65 @@
+From 8d46ef3ec21fd542ad3165d165a6db90427e61d8 Mon Sep 17 00:00:00 2001
+From: David Woodhouse <David.Woodhouse@intel.com>
+Date: Tue, 24 Apr 2012 22:09:47 -0400
+Subject: [PATCH 059/165] ppp: Don't stop and restart queue on every TX packet
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ This combines upstream commit
+ e675f0cc9a872fd152edc0c77acfed19bf28b81e and follow-on bug fix
+ commit 9a5d2bd99e0dfe9a31b3c160073ac445ba3d773f ]
+
+For every transmitted packet, ppp_start_xmit() will stop the netdev
+queue and then, if appropriate, restart it. This causes the TX softirq
+to run, entirely gratuitously.
+
+This is "only" a waste of CPU time in the normal case, but it's actively
+harmful when the PPP device is a TEQL slave — the wakeup will cause the
+offending device to receive the next TX packet from the TEQL queue, when
+it *should* have gone to the next slave in the list. We end up seeing
+large bursts of packets on just *one* slave device, rather than using
+the full available bandwidth over all slaves.
+
+This patch fixes the problem by *not* unconditionally stopping the queue
+in ppp_start_xmit(). It adds a return value from ppp_xmit_process()
+which indicates whether the queue should be stopped or not.
+
+It *doesn't* remove the call to netif_wake_queue() from
+ppp_xmit_process(), because other code paths (especially from
+ppp_output_wakeup()) need it there and it's messy to push it out to the
+other callers to do it based on the return value. So we leave it in
+place — it's a no-op in the case where the queue wasn't stopped, so it's
+harmless in the TX path.
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ppp/ppp_generic.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 486b404..3ed983c 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -968,7 +968,6 @@ ppp_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ proto = npindex_to_proto[npi];
+ put_unaligned_be16(proto, pp);
+
+- netif_stop_queue(dev);
+ skb_queue_tail(&ppp->file.xq, skb);
+ ppp_xmit_process(ppp);
+ return NETDEV_TX_OK;
+@@ -1063,6 +1062,8 @@ ppp_xmit_process(struct ppp *ppp)
+ code that we can accept some more. */
+ if (!ppp->xmit_pending && !skb_peek(&ppp->file.xq))
+ netif_wake_queue(ppp->dev);
++ else
++ netif_stop_queue(ppp->dev);
+ }
+ ppp_xmit_unlock(ppp);
+ }
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0060-tcp-allow-splice-to-build-full-TSO-packets.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0060-tcp-allow-splice-to-build-full-TSO-packets.patch
--- /dev/null
@@ -0,0 +1,129 @@
+From 2d09c2df4957a8d73ea24c4464ad6942efedf590 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 24 Apr 2012 22:12:06 -0400
+Subject: [PATCH 060/165] tcp: allow splice() to build full TSO packets
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ This combines upstream commit
+ 2f53384424251c06038ae612e56231b96ab610ee and the follow-on bug fix
+ commit 35f9c09fe9c72eb8ca2b8e89a593e1c151f28fc2 ]
+
+vmsplice()/splice(pipe, socket) call do_tcp_sendpages() one page at a
+time, adding at most 4096 bytes to an skb. (assuming PAGE_SIZE=4096)
+
+The call to tcp_push() at the end of do_tcp_sendpages() forces an
+immediate xmit when pipe is not already filled, and tso_fragment() try
+to split these skb to MSS multiples.
+
+4096 bytes are usually split in a skb with 2 MSS, and a remaining
+sub-mss skb (assuming MTU=1500)
+
+This makes slow start suboptimal because many small frames are sent to
+qdisc/driver layers instead of big ones (constrained by cwnd and packets
+in flight of course)
+
+In fact, applications using sendmsg() (adding an additional memory copy)
+instead of vmsplice()/splice()/sendfile() are a bit faster because of
+this anomaly, especially if serving small files in environments with
+large initial [c]wnd.
+
+Call tcp_push() only if MSG_MORE is not set in the flags parameter.
+
+This bit is automatically provided by splice() internals but for the
+last page, or on all pages if user specified SPLICE_F_MORE splice()
+flag.
+
+In some workloads, this can reduce number of sent logical packets by an
+order of magnitude, making zero-copy TCP actually faster than
+one-copy :)
+
+Reported-by: Tom Herbert <therbert@google.com>
+Cc: Nandita Dukkipati <nanditad@google.com>
+Cc: Neal Cardwell <ncardwell@google.com>
+Cc: Tom Herbert <therbert@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Cc: H.K. Jerry Chu <hkchu@google.com>
+Cc: Maciej Żenczykowski <maze@google.com>
+Cc: Mahesh Bandewar <maheshb@google.com>
+Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/splice.c | 5 ++++-
+ include/linux/socket.h | 2 +-
+ net/ipv4/tcp.c | 2 +-
+ net/socket.c | 6 +++---
+ 4 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/fs/splice.c b/fs/splice.c
+index fa2defa..6d0dfb8 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -31,6 +31,7 @@
+ #include <linux/uio.h>
+ #include <linux/security.h>
+ #include <linux/gfp.h>
++#include <linux/socket.h>
+
+ /*
+ * Attempt to steal a page from a pipe buffer. This should perhaps go into
+@@ -691,7 +692,9 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
+ if (!likely(file->f_op && file->f_op->sendpage))
+ return -EINVAL;
+
+- more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
++ more = (sd->flags & SPLICE_F_MORE) ? MSG_MORE : 0;
++ if (sd->len < sd->total_len)
++ more |= MSG_SENDPAGE_NOTLAST;
+ return file->f_op->sendpage(file, buf->page, buf->offset,
+ sd->len, &pos, more);
+ }
+diff --git a/include/linux/socket.h b/include/linux/socket.h
+index d0e77f6..ad919e0 100644
+--- a/include/linux/socket.h
++++ b/include/linux/socket.h
+@@ -265,7 +265,7 @@ struct ucred {
+ #define MSG_NOSIGNAL 0x4000 /* Do not generate SIGPIPE */
+ #define MSG_MORE 0x8000 /* Sender will send more */
+ #define MSG_WAITFORONE 0x10000 /* recvmmsg(): block until 1+ packets avail */
+-
++#define MSG_SENDPAGE_NOTLAST 0x20000 /* sendpage() internal : not the last page */
+ #define MSG_EOF MSG_FIN
+
+ #define MSG_CMSG_CLOEXEC 0x40000000 /* Set close_on_exit for file
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 34f5db1..36611ab 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -860,7 +860,7 @@ wait_for_memory:
+ }
+
+ out:
+- if (copied)
++ if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
+ tcp_push(sk, flags, mss_now, tp->nonagle);
+ return copied;
+
+diff --git a/net/socket.c b/net/socket.c
+index 2dce67a..273cbce 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -791,9 +791,9 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
+
+ sock = file->private_data;
+
+- flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
+- if (more)
+- flags |= MSG_MORE;
++ flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
++ /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
++ flags |= more;
+
+ return kernel_sendpage(sock, page, offset, size, flags);
+ }
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0061-sctp-Allow-struct-sctp_event_subscribe-to-grow-witho.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0061-sctp-Allow-struct-sctp_event_subscribe-to-grow-witho.patch
--- /dev/null
@@ -0,0 +1,56 @@
+From 8dda68d22ab01e2780f80a6afb814387fb904aa2 Mon Sep 17 00:00:00 2001
+From: Thomas Graf <tgraf@infradead.org>
+Date: Tue, 3 Apr 2012 22:17:53 +0000
+Subject: [PATCH 061/165] sctp: Allow struct sctp_event_subscribe to grow
+ without breaking binaries
+
+[ Upstream commit acdd5985364f8dc511a0762fab2e683f29d9d692 ]
+
+getsockopt(..., SCTP_EVENTS, ...) performs a length check and returns
+an error if the user provides less bytes than the size of struct
+sctp_event_subscribe.
+
+Struct sctp_event_subscribe needs to be extended by an u8 for every
+new event or notification type that is added.
+
+This obviously makes getsockopt fail for binaries that are compiled
+against an older versions of <net/sctp/user.h> which do not contain
+all event types.
+
+This patch changes getsockopt behaviour to no longer return an error
+if not enough bytes are being provided by the user. Instead, it
+returns as much of sctp_event_subscribe as fits into the provided buffer.
+
+This leads to the new behavior that users see what they have been aware
+of at compile time.
+
+The setsockopt(..., SCTP_EVENTS, ...) API is already behaving like this.
+
+Signed-off-by: Thomas Graf <tgraf@suug.ch>
+Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/sctp/socket.c | 5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 54a7cd2..0075554 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4133,9 +4133,10 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
+ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
+ int __user *optlen)
+ {
+- if (len < sizeof(struct sctp_event_subscribe))
++ if (len <= 0)
+ return -EINVAL;
+- len = sizeof(struct sctp_event_subscribe);
++ if (len > sizeof(struct sctp_event_subscribe))
++ len = sizeof(struct sctp_event_subscribe);
+ if (put_user(len, optlen))
+ return -EFAULT;
+ if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0062-bridge-Do-not-send-queries-on-multicast-group-leaves.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0062-bridge-Do-not-send-queries-on-multicast-group-leaves.patch
--- /dev/null
@@ -0,0 +1,199 @@
+From 9f8774d2e33d8c44b98e76db91cfc0d35b187f58 Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Wed, 4 Apr 2012 01:01:20 +0000
+Subject: [PATCH 062/165] bridge: Do not send queries on multicast group
+ leaves
+
+[ Upstream commit 996304bbea3d2a094b7ba54c3bd65d3fffeac57b ]
+
+As it stands the bridge IGMP snooping system will respond to
+group leave messages with queries for remaining membership.
+This is both unnecessary and undesirable. First of all any
+multicast routers present should be doing this rather than us.
+What's more the queries that we send may end up upsetting other
+multicast snooping swithces in the system that are buggy.
+
+In fact, we can simply remove the code that send these queries
+because the existing membership expiry mechanism doesn't rely
+on them anyway.
+
+So this patch simply removes all code associated with group
+queries in response to group leave messages.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/bridge/br_multicast.c | 81 ---------------------------------------------
+ net/bridge/br_private.h | 4 --
+ 2 files changed, 0 insertions(+), 85 deletions(-)
+
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 8eb6b15..5ac1811 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -241,7 +241,6 @@ static void br_multicast_group_expired(unsigned long data)
+ hlist_del_rcu(&mp->hlist[mdb->ver]);
+ mdb->size--;
+
+- del_timer(&mp->query_timer);
+ call_rcu_bh(&mp->rcu, br_multicast_free_group);
+
+ out:
+@@ -271,7 +270,6 @@ static void br_multicast_del_pg(struct net_bridge *br,
+ rcu_assign_pointer(*pp, p->next);
+ hlist_del_init(&p->mglist);
+ del_timer(&p->timer);
+- del_timer(&p->query_timer);
+ call_rcu_bh(&p->rcu, br_multicast_free_pg);
+
+ if (!mp->ports && !mp->mglist &&
+@@ -507,74 +505,6 @@ static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
+ return NULL;
+ }
+
+-static void br_multicast_send_group_query(struct net_bridge_mdb_entry *mp)
+-{
+- struct net_bridge *br = mp->br;
+- struct sk_buff *skb;
+-
+- skb = br_multicast_alloc_query(br, &mp->addr);
+- if (!skb)
+- goto timer;
+-
+- netif_rx(skb);
+-
+-timer:
+- if (++mp->queries_sent < br->multicast_last_member_count)
+- mod_timer(&mp->query_timer,
+- jiffies + br->multicast_last_member_interval);
+-}
+-
+-static void br_multicast_group_query_expired(unsigned long data)
+-{
+- struct net_bridge_mdb_entry *mp = (void *)data;
+- struct net_bridge *br = mp->br;
+-
+- spin_lock(&br->multicast_lock);
+- if (!netif_running(br->dev) || !mp->mglist ||
+- mp->queries_sent >= br->multicast_last_member_count)
+- goto out;
+-
+- br_multicast_send_group_query(mp);
+-
+-out:
+- spin_unlock(&br->multicast_lock);
+-}
+-
+-static void br_multicast_send_port_group_query(struct net_bridge_port_group *pg)
+-{
+- struct net_bridge_port *port = pg->port;
+- struct net_bridge *br = port->br;
+- struct sk_buff *skb;
+-
+- skb = br_multicast_alloc_query(br, &pg->addr);
+- if (!skb)
+- goto timer;
+-
+- br_deliver(port, skb);
+-
+-timer:
+- if (++pg->queries_sent < br->multicast_last_member_count)
+- mod_timer(&pg->query_timer,
+- jiffies + br->multicast_last_member_interval);
+-}
+-
+-static void br_multicast_port_group_query_expired(unsigned long data)
+-{
+- struct net_bridge_port_group *pg = (void *)data;
+- struct net_bridge_port *port = pg->port;
+- struct net_bridge *br = port->br;
+-
+- spin_lock(&br->multicast_lock);
+- if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
+- pg->queries_sent >= br->multicast_last_member_count)
+- goto out;
+-
+- br_multicast_send_port_group_query(pg);
+-
+-out:
+- spin_unlock(&br->multicast_lock);
+-}
+-
+ static struct net_bridge_mdb_entry *br_multicast_get_group(
+ struct net_bridge *br, struct net_bridge_port *port,
+ struct br_ip *group, int hash)
+@@ -690,8 +620,6 @@ rehash:
+ mp->addr = *group;
+ setup_timer(&mp->timer, br_multicast_group_expired,
+ (unsigned long)mp);
+- setup_timer(&mp->query_timer, br_multicast_group_query_expired,
+- (unsigned long)mp);
+
+ hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
+ mdb->size++;
+@@ -746,8 +674,6 @@ static int br_multicast_add_group(struct net_bridge *br,
+ hlist_add_head(&p->mglist, &port->mglist);
+ setup_timer(&p->timer, br_multicast_port_group_expired,
+ (unsigned long)p);
+- setup_timer(&p->query_timer, br_multicast_port_group_query_expired,
+- (unsigned long)p);
+
+ rcu_assign_pointer(*pp, p);
+
+@@ -1291,9 +1217,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
+ time_after(mp->timer.expires, time) :
+ try_to_del_timer_sync(&mp->timer) >= 0)) {
+ mod_timer(&mp->timer, time);
+-
+- mp->queries_sent = 0;
+- mod_timer(&mp->query_timer, now);
+ }
+
+ goto out;
+@@ -1310,9 +1233,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
+ time_after(p->timer.expires, time) :
+ try_to_del_timer_sync(&p->timer) >= 0)) {
+ mod_timer(&p->timer, time);
+-
+- p->queries_sent = 0;
+- mod_timer(&p->query_timer, now);
+ }
+
+ break;
+@@ -1680,7 +1600,6 @@ void br_multicast_stop(struct net_bridge *br)
+ hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
+ hlist[ver]) {
+ del_timer(&mp->timer);
+- del_timer(&mp->query_timer);
+ call_rcu_bh(&mp->rcu, br_multicast_free_group);
+ }
+ }
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index d7d6fb0..93264df 100644
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -82,9 +82,7 @@ struct net_bridge_port_group {
+ struct hlist_node mglist;
+ struct rcu_head rcu;
+ struct timer_list timer;
+- struct timer_list query_timer;
+ struct br_ip addr;
+- u32 queries_sent;
+ };
+
+ struct net_bridge_mdb_entry
+@@ -94,10 +92,8 @@ struct net_bridge_mdb_entry
+ struct net_bridge_port_group __rcu *ports;
+ struct rcu_head rcu;
+ struct timer_list timer;
+- struct timer_list query_timer;
+ struct br_ip addr;
+ bool mglist;
+- u32 queries_sent;
+ };
+
+ struct net_bridge_mdb_htable
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0063-ipv6-fix-array-index-in-ip6_mc_add_src.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0063-ipv6-fix-array-index-in-ip6_mc_add_src.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0063-ipv6-fix-array-index-in-ip6_mc_add_src.patch
@@ -0,0 +1,39 @@
+From dda800eb86fb88c28f63c0136cc76b1346322feb Mon Sep 17 00:00:00 2001
+From: "RongQing.Li" <roy.qing.li@gmail.com>
+Date: Wed, 4 Apr 2012 16:47:04 +0000
+Subject: [PATCH 063/165] ipv6: fix array index in ip6_mc_add_src()
+
+[ Upstream commit 78d50217baf36093ab320f95bae0d6452daec85c ]
+
+Convert array index from the loop bound to the loop index.
+
+And remove the void type conversion to ip6_mc_del1_src() return
+code, seem it is unnecessary, since ip6_mc_del1_src() does not
+use __must_check similar attribute, no compiler will report the
+warning when it is removed.
+
+v2: enrich the commit header
+
+Signed-off-by: RongQing.Li <roy.qing.li@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv6/mcast.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index 2257366..f2d74ea 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2054,7 +2054,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
+ if (!delta)
+ pmc->mca_sfcount[sfmode]--;
+ for (j=0; j<i; j++)
+- (void) ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
++ ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]);
+ } else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
+ struct ip6_sf_list *psf;
+
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0064-phonet-Check-input-from-user-before-allocating.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0064-phonet-Check-input-from-user-before-allocating.patch
--- /dev/null
@@ -0,0 +1,78 @@
+From 636e8de47aae86650672a0065eb401e918544d34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <levinsasha928@gmail.com>
+Date: Thu, 5 Apr 2012 12:07:45 +0000
+Subject: [PATCH 064/165] phonet: Check input from user before allocating
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit bcf1b70ac6eb0ed8286c66e6bf37cb747cbaa04c ]
+
+A phonet packet is limited to USHRT_MAX bytes, this is never checked during
+tx which means that the user can specify any size he wishes, and the kernel
+will attempt to allocate that size.
+
+In the good case, it'll lead to the following warning, but it may also cause
+the kernel to kick in the OOM and kill a random task on the server.
+
+[ 8921.744094] WARNING: at mm/page_alloc.c:2255 __alloc_pages_slowpath+0x65/0x730()
+[ 8921.749770] Pid: 5081, comm: trinity Tainted: G W 3.4.0-rc1-next-20120402-sasha #46
+[ 8921.756672] Call Trace:
+[ 8921.758185] [<ffffffff810b2ba7>] warn_slowpath_common+0x87/0xb0
+[ 8921.762868] [<ffffffff810b2be5>] warn_slowpath_null+0x15/0x20
+[ 8921.765399] [<ffffffff8117eae5>] __alloc_pages_slowpath+0x65/0x730
+[ 8921.769226] [<ffffffff81179c8a>] ? zone_watermark_ok+0x1a/0x20
+[ 8921.771686] [<ffffffff8117d045>] ? get_page_from_freelist+0x625/0x660
+[ 8921.773919] [<ffffffff8117f3a8>] __alloc_pages_nodemask+0x1f8/0x240
+[ 8921.776248] [<ffffffff811c03e0>] kmalloc_large_node+0x70/0xc0
+[ 8921.778294] [<ffffffff811c4bd4>] __kmalloc_node_track_caller+0x34/0x1c0
+[ 8921.780847] [<ffffffff821b0e3c>] ? sock_alloc_send_pskb+0xbc/0x260
+[ 8921.783179] [<ffffffff821b3c65>] __alloc_skb+0x75/0x170
+[ 8921.784971] [<ffffffff821b0e3c>] sock_alloc_send_pskb+0xbc/0x260
+[ 8921.787111] [<ffffffff821b002e>] ? release_sock+0x7e/0x90
+[ 8921.788973] [<ffffffff821b0ff0>] sock_alloc_send_skb+0x10/0x20
+[ 8921.791052] [<ffffffff824cfc20>] pep_sendmsg+0x60/0x380
+[ 8921.792931] [<ffffffff824cb4a6>] ? pn_socket_bind+0x156/0x180
+[ 8921.794917] [<ffffffff824cb50f>] ? pn_socket_autobind+0x3f/0x90
+[ 8921.797053] [<ffffffff824cb63f>] pn_socket_sendmsg+0x4f/0x70
+[ 8921.798992] [<ffffffff821ab8e7>] sock_aio_write+0x187/0x1b0
+[ 8921.801395] [<ffffffff810e325e>] ? sub_preempt_count+0xae/0xf0
+[ 8921.803501] [<ffffffff8111842c>] ? __lock_acquire+0x42c/0x4b0
+[ 8921.805505] [<ffffffff821ab760>] ? __sock_recv_ts_and_drops+0x140/0x140
+[ 8921.807860] [<ffffffff811e07cc>] do_sync_readv_writev+0xbc/0x110
+[ 8921.809986] [<ffffffff811958e7>] ? might_fault+0x97/0xa0
+[ 8921.811998] [<ffffffff817bd99e>] ? security_file_permission+0x1e/0x90
+[ 8921.814595] [<ffffffff811e17e2>] do_readv_writev+0xe2/0x1e0
+[ 8921.816702] [<ffffffff810b8dac>] ? do_setitimer+0x1ac/0x200
+[ 8921.818819] [<ffffffff810e2ec1>] ? get_parent_ip+0x11/0x50
+[ 8921.820863] [<ffffffff810e325e>] ? sub_preempt_count+0xae/0xf0
+[ 8921.823318] [<ffffffff811e1926>] vfs_writev+0x46/0x60
+[ 8921.825219] [<ffffffff811e1a3f>] sys_writev+0x4f/0xb0
+[ 8921.827127] [<ffffffff82658039>] system_call_fastpath+0x16/0x1b
+[ 8921.829384] ---[ end trace dffe390f30db9eb7 ]---
+
+Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
+Acked-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/phonet/pep.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/net/phonet/pep.c b/net/phonet/pep.c
+index 2ba6e9f..007546d 100644
+--- a/net/phonet/pep.c
++++ b/net/phonet/pep.c
+@@ -1046,6 +1046,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
+ int flags = msg->msg_flags;
+ int err, done;
+
++ if (len > USHRT_MAX)
++ return -EMSGSIZE;
++
+ if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
+ MSG_CMSG_COMPAT)) ||
+ !(msg->msg_flags & MSG_EOR))
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0065-bonding-properly-unset-current_arp_slave-on-slave-li.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0065-bonding-properly-unset-current_arp_slave-on-slave-li.patch
--- /dev/null
@@ -0,0 +1,45 @@
+From 1413698b8d47c7fb2783cafd906ac1db9b1723d7 Mon Sep 17 00:00:00 2001
+From: Veaceslav Falico <vfalico@redhat.com>
+Date: Thu, 5 Apr 2012 03:47:43 +0000
+Subject: [PATCH 065/165] bonding: properly unset current_arp_slave on slave
+ link up
+
+[ Upstream commit 5a4309746cd74734daa964acb02690c22b3c8911 ]
+
+When a slave comes up, we're unsetting the current_arp_slave without
+removing active flags from it, which can lead to situations where we have
+more than one slave with active flags in active-backup mode.
+
+To avoid this situation we must remove the active flags from a slave before
+removing it as a current_arp_slave.
+
+Signed-off-by: Veaceslav Falico <vfalico@redhat.com>
+Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
+Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
+Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/bonding/bond_main.c | 6 +++++-
+ 1 files changed, 5 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index e58aa2b..f65e0b9 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2982,7 +2982,11 @@ static void bond_ab_arp_commit(struct bonding *bond, int delta_in_ticks)
+ trans_start + delta_in_ticks)) ||
+ bond->curr_active_slave != slave) {
+ slave->link = BOND_LINK_UP;
+- bond->current_arp_slave = NULL;
++ if (bond->current_arp_slave) {
++ bond_set_slave_inactive_flags(
++ bond->current_arp_slave);
++ bond->current_arp_slave = NULL;
++ }
+
+ pr_info("%s: link status definitely up for interface %s.\n",
+ bond->dev->name, slave->dev->name);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0066-wimax-i2400m-prevent-a-possible-kernel-bug-due-to-mi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0066-wimax-i2400m-prevent-a-possible-kernel-bug-due-to-mi.patch
--- /dev/null
@@ -0,0 +1,37 @@
+From 5454ccf43f7636614fc378283890bf911c2e2058 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil.sutter@viprinet.com>
+Date: Mon, 26 Mar 2012 09:01:30 +0000
+Subject: [PATCH 066/165] wimax: i2400m - prevent a possible kernel bug due to
+ missing fw_name string
+
+[ Upstream commit 4eee6a3a04e8bb53fbe7de0f64d0524d3fbe3f80 ]
+
+This happened on a machine with a custom hotplug script calling nameif,
+probably due to slow firmware loading. At the time nameif uses ethtool
+to gather interface information, i2400m->fw_name is zero and so a null
+pointer dereference occurs from within i2400m_get_drvinfo().
+
+Signed-off-by: Phil Sutter <phil.sutter@viprinet.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wimax/i2400m/netdev.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wimax/i2400m/netdev.c b/drivers/net/wimax/i2400m/netdev.c
+index 64a1106..4697cf3 100644
+--- a/drivers/net/wimax/i2400m/netdev.c
++++ b/drivers/net/wimax/i2400m/netdev.c
+@@ -607,7 +607,8 @@ static void i2400m_get_drvinfo(struct net_device *net_dev,
+ struct i2400m *i2400m = net_dev_to_i2400m(net_dev);
+
+ strncpy(info->driver, KBUILD_MODNAME, sizeof(info->driver) - 1);
+- strncpy(info->fw_version, i2400m->fw_name, sizeof(info->fw_version) - 1);
++ strncpy(info->fw_version,
++ i2400m->fw_name ? : "", sizeof(info->fw_version) - 1);
+ if (net_dev->dev.parent)
+ strncpy(info->bus_info, dev_name(net_dev->dev.parent),
+ sizeof(info->bus_info) - 1);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0067-netlink-fix-races-after-skb-queueing.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0067-netlink-fix-races-after-skb-queueing.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0067-netlink-fix-races-after-skb-queueing.patch
@@ -0,0 +1,82 @@
+From 0f7eb8a3cb853edf31ec23d26623b195603814b2 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Thu, 5 Apr 2012 22:17:46 +0000
+Subject: [PATCH 067/165] netlink: fix races after skb queueing
+
+[ Upstream commit 4a7e7c2ad540e54c75489a70137bf0ec15d3a127 ]
+
+As soon as an skb is queued into socket receive_queue, another thread
+can consume it, so we are not allowed to reference skb anymore, or risk
+use after free.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/netlink/af_netlink.c | 24 +++++++++++++-----------
+ 1 files changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 1201b6d..a99fb41 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -830,12 +830,19 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
+ return 0;
+ }
+
+-int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
++static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+ {
+ int len = skb->len;
+
+ skb_queue_tail(&sk->sk_receive_queue, skb);
+ sk->sk_data_ready(sk, len);
++ return len;
++}
++
++int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
++{
++ int len = __netlink_sendskb(sk, skb);
++
+ sock_put(sk);
+ return len;
+ }
+@@ -960,8 +967,7 @@ static inline int netlink_broadcast_deliver(struct sock *sk,
+ if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
+ !test_bit(0, &nlk->state)) {
+ skb_set_owner_r(skb, sk);
+- skb_queue_tail(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
++ __netlink_sendskb(sk, skb);
+ return atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf;
+ }
+ return -1;
+@@ -1684,10 +1690,8 @@ static int netlink_dump(struct sock *sk)
+
+ if (sk_filter(sk, skb))
+ kfree_skb(skb);
+- else {
+- skb_queue_tail(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
+- }
++ else
++ __netlink_sendskb(sk, skb);
+ return 0;
+ }
+
+@@ -1701,10 +1705,8 @@ static int netlink_dump(struct sock *sk)
+
+ if (sk_filter(sk, skb))
+ kfree_skb(skb);
+- else {
+- skb_queue_tail(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
+- }
++ else
++ __netlink_sendskb(sk, skb);
+
+ if (cb->done)
+ cb->done(cb);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0068-net-fix-a-race-in-sock_queue_err_skb.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0068-net-fix-a-race-in-sock_queue_err_skb.patch
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0068-net-fix-a-race-in-sock_queue_err_skb.patch
@@ -0,0 +1,43 @@
+From 86e0251999e198af9ae73f58db4d5689f14862ec Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Fri, 6 Apr 2012 10:49:10 +0200
+Subject: [PATCH 068/165] net: fix a race in sock_queue_err_skb()
+
+[ Upstream commit 110c43304db6f06490961529536c362d9ac5732f ]
+
+As soon as an skb is queued into socket error queue, another thread
+can consume it, so we are not allowed to reference skb anymore, or risk
+use after free.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/core/skbuff.c | 4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 3c30ee4..29cb392 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3111,6 +3111,8 @@ static void sock_rmem_free(struct sk_buff *skb)
+ */
+ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+ {
++ int len = skb->len;
++
+ if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
+ (unsigned)sk->sk_rcvbuf)
+ return -ENOMEM;
+@@ -3125,7 +3127,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+
+ skb_queue_tail(&sk->sk_error_queue, skb);
+ if (!sock_flag(sk, SOCK_DEAD))
+- sk->sk_data_ready(sk, skb->len);
++ sk->sk_data_ready(sk, len);
+ return 0;
+ }
+ EXPORT_SYMBOL(sock_queue_err_skb);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0069-tcp-fix-tcp_rcv_rtt_update-use-of-an-unscaled-RTT-sa.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0069-tcp-fix-tcp_rcv_rtt_update-use-of-an-unscaled-RTT-sa.patch
--- /dev/null
@@ -0,0 +1,50 @@
+From e371feec366591f88fd4df14f701359bd08d33e7 Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Tue, 10 Apr 2012 07:59:20 +0000
+Subject: [PATCH 069/165] tcp: fix tcp_rcv_rtt_update() use of an unscaled RTT
+ sample
+
+[ Upstream commit 18a223e0b9ec8979320ba364b47c9772391d6d05 ]
+
+Fix a code path in tcp_rcv_rtt_update() that was comparing scaled and
+unscaled RTT samples.
+
+The intent in the code was to only use the 'm' measurement if it was a
+new minimum. However, since 'm' had not yet been shifted left 3 bits
+but 'new_sample' had, this comparison would nearly always succeed,
+leading us to erroneously set our receive-side RTT estimate to the 'm'
+sample when that sample could be nearly 8x too high to use.
+
+The overall effect is to often cause the receive-side RTT estimate to
+be significantly too large (up to 40% too large for brief periods in
+my tests).
+
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv4/tcp_input.c | 7 +++++--
+ 1 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index e4d1e4a..4c46fa7 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -473,8 +473,11 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
+ if (!win_dep) {
+ m -= (new_sample >> 3);
+ new_sample += m;
+- } else if (m < new_sample)
+- new_sample = m << 3;
++ } else {
++ m <<= 3;
++ if (m < new_sample)
++ new_sample = m;
++ }
+ } else {
+ /* No previous measure. */
+ new_sample = m << 3;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0070-net-allow-pskb_expand_head-to-get-maximum-tailroom.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0070-net-allow-pskb_expand_head-to-get-maximum-tailroom.patch
--- /dev/null
@@ -0,0 +1,48 @@
+From 03bdfc1371ae4ad8b2bbe50475baa6d983f62511 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 10 Apr 2012 20:08:39 +0000
+Subject: [PATCH 070/165] net: allow pskb_expand_head() to get maximum
+ tailroom
+
+[ Upstream commit 87151b8689d890dfb495081f7be9b9e257f7a2df ]
+
+Marc Merlin reported many order-1 allocations failures in TX path on its
+wireless setup, that dont make any sense with MTU=1500 network, and non
+SG capable hardware.
+
+Turns out part of the problem comes from pskb_expand_head() not using
+ksize() to get exact head size given by kmalloc(). Doing the same thing
+than __alloc_skb() allows more tailroom in skb and can prevent future
+reallocations.
+
+As a bonus, struct skb_shared_info becomes cache line aligned.
+
+Reported-by: Marc MERLIN <marc@merlins.org>
+Tested-by: Marc MERLIN <marc@merlins.org>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/core/skbuff.c | 4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 29cb392..2ec200de 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -903,9 +903,11 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
+ goto adjust_others;
+ }
+
+- data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask);
++ data = kmalloc(size + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)),
++ gfp_mask);
+ if (!data)
+ goto nodata;
++ size = SKB_WITH_OVERHEAD(ksize(data));
+
+ /* Copy only real data... and, alas, header. This should be
+ * optimized for the cases when header is void.
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0071-tcp-fix-tcp_trim_head.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0071-tcp-fix-tcp_trim_head.patch
--- /dev/null
@@ -0,0 +1,57 @@
+From 137530e7322e536a814836856ef12183cd786e5f Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Sun, 4 Dec 2011 08:51:08 +0000
+Subject: [PATCH 071/165] tcp: fix tcp_trim_head()
+
+[ Upstream commit 4fa48bf3c75069d636fc8830743c929a062e80dc ]
+
+commit f07d960df3 (tcp: avoid frag allocation for small frames)
+breaked assumption in tcp stack that skb is either linear (skb->data_len
+== 0), or fully fragged (skb->data_len == skb->len)
+
+tcp_trim_head() made this assumption, we must fix it.
+
+Thanks to Vijay for providing a very detailed explanation.
+
+Reported-by: Vijay Subramanian <subramanian.vijay@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv4/tcp_output.c | 13 ++++++++-----
+ 1 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 097e0c7..7413437 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1093,6 +1093,13 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
+ {
+ int i, k, eat;
+
++ eat = min_t(int, len, skb_headlen(skb));
++ if (eat) {
++ __skb_pull(skb, eat);
++ len -= eat;
++ if (!len)
++ return;
++ }
+ eat = len;
+ k = 0;
+ for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+@@ -1124,11 +1131,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
+ if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+ return -ENOMEM;
+
+- /* If len == headlen, we avoid __skb_pull to preserve alignment. */
+- if (unlikely(len < skb_headlen(skb)))
+- __skb_pull(skb, len);
+- else
+- __pskb_trim_head(skb, len - skb_headlen(skb));
++ __pskb_trim_head(skb, len);
+
+ TCP_SKB_CB(skb)->seq += len;
+ skb->ip_summed = CHECKSUM_PARTIAL;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0072-tcp-avoid-order-1-allocations-on-wifi-and-tx-path.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0072-tcp-avoid-order-1-allocations-on-wifi-and-tx-path.patch
--- /dev/null
@@ -0,0 +1,134 @@
+From f5e6c8aa4ebb62b560068b1636d889b4932c4dbc Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 24 Apr 2012 23:01:22 -0400
+Subject: [PATCH 072/165] tcp: avoid order-1 allocations on wifi and tx path
+
+[ This combines upstream commit
+ a21d45726acacc963d8baddf74607d9b74e2b723 and the follow-on bug fix
+ commit 22b4a4f22da4b39c6f7f679fd35f3d35c91bf851 ]
+
+Marc Merlin reported many order-1 allocations failures in TX path on its
+wireless setup, that dont make any sense with MTU=1500 network, and non
+SG capable hardware.
+
+After investigation, it turns out TCP uses sk_stream_alloc_skb() and
+used as a convention skb_tailroom(skb) to know how many bytes of data
+payload could be put in this skb (for non SG capable devices)
+
+Note : these skb used kmalloc-4096 (MTU=1500 + MAX_HEADER +
+sizeof(struct skb_shared_info) being above 2048)
+
+Later, mac80211 layer need to add some bytes at the tail of skb
+(IEEE80211_ENCRYPT_TAILROOM = 18 bytes) and since no more tailroom is
+available has to call pskb_expand_head() and request order-1
+allocations.
+
+This patch changes sk_stream_alloc_skb() so that only
+sk->sk_prot->max_header bytes of headroom are reserved, and use a new
+skb field, avail_size to hold the data payload limit.
+
+This way, order-0 allocations done by TCP stack can leave more than 2 KB
+of tailroom and no more allocation is performed in mac80211 layer (or
+any layer needing some tailroom)
+
+avail_size is unioned with mark/dropcount, since mark will be set later
+in IP stack for output packets. Therefore, skb size is unchanged.
+
+Reported-by: Marc MERLIN <marc@merlins.org>
+Tested-by: Marc MERLIN <marc@merlins.org>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[bwh: Correct commit hash for follow-on bug fix]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ include/linux/skbuff.h | 13 +++++++++++++
+ net/ipv4/tcp.c | 8 ++++----
+ net/ipv4/tcp_output.c | 3 ++-
+ 3 files changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 6cf8b53..e689b47 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -458,6 +458,7 @@ struct sk_buff {
+ union {
+ __u32 mark;
+ __u32 dropcount;
++ __u32 avail_size;
+ };
+
+ __u16 vlan_tci;
+@@ -1326,6 +1327,18 @@ static inline int skb_tailroom(const struct sk_buff *skb)
+ }
+
+ /**
++ * skb_availroom - bytes at buffer end
++ * @skb: buffer to check
++ *
++ * Return the number of bytes of free space at the tail of an sk_buff
++ * allocated by sk_stream_alloc()
++ */
++static inline int skb_availroom(const struct sk_buff *skb)
++{
++ return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len;
++}
++
++/**
+ * skb_reserve - adjust headroom
+ * @skb: buffer to alter
+ * @len: bytes to move
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 36611ab..7904db4 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -701,11 +701,12 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
+ skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp);
+ if (skb) {
+ if (sk_wmem_schedule(sk, skb->truesize)) {
++ skb_reserve(skb, sk->sk_prot->max_header);
+ /*
+ * Make sure that we have exactly size bytes
+ * available to the caller, no more, no less.
+ */
+- skb_reserve(skb, skb_tailroom(skb) - size);
++ skb->avail_size = size;
+ return skb;
+ }
+ __kfree_skb(skb);
+@@ -995,10 +996,9 @@ new_segment:
+ copy = seglen;
+
+ /* Where to copy to? */
+- if (skb_tailroom(skb) > 0) {
++ if (skb_availroom(skb) > 0) {
+ /* We have some space in skb head. Superb! */
+- if (copy > skb_tailroom(skb))
+- copy = skb_tailroom(skb);
++ copy = min_t(int, copy, skb_availroom(skb));
+ err = skb_add_data_nocache(sk, skb, from, copy);
+ if (err)
+ goto do_fault;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 7413437..c51dd5b 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1096,6 +1096,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
+ eat = min_t(int, len, skb_headlen(skb));
+ if (eat) {
+ __skb_pull(skb, eat);
++ skb->avail_size -= eat;
+ len -= eat;
+ if (!len)
+ return;
+@@ -2060,7 +2061,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
+ /* Punt if not enough space exists in the first SKB for
+ * the data in the second
+ */
+- if (skb->len > skb_tailroom(to))
++ if (skb->len > skb_availroom(to))
+ break;
+
+ if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp)))
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0073-atl1-fix-kernel-panic-in-case-of-DMA-errors.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0073-atl1-fix-kernel-panic-in-case-of-DMA-errors.patch
--- /dev/null
@@ -0,0 +1,106 @@
+From 9785af56c9a0c73e462058b63999df1c95cf6ce7 Mon Sep 17 00:00:00 2001
+From: Tony Zelenoff <antonz@parallels.com>
+Date: Wed, 11 Apr 2012 06:15:03 +0000
+Subject: [PATCH 073/165] atl1: fix kernel panic in case of DMA errors
+
+[ Upstream commit 03662e41c7cff64a776bfb1b3816de4be43de881 ]
+
+Problem:
+There was two separate work_struct structures which share one
+handler. Unfortunately getting atl1_adapter structure from
+work_struct in case of DMA error was done from incorrect
+offset which cause kernel panics.
+
+Solution:
+The useless work_struct for DMA error removed and
+handler name changed to more generic one.
+
+Signed-off-by: Tony Zelenoff <antonz@parallels.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/atheros/atlx/atl1.c | 12 +++++-------
+ drivers/net/ethernet/atheros/atlx/atl1.h | 3 +--
+ drivers/net/ethernet/atheros/atlx/atlx.c | 2 +-
+ 3 files changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c
+index 33a4e35..ee532e1 100644
+--- a/drivers/net/ethernet/atheros/atlx/atl1.c
++++ b/drivers/net/ethernet/atheros/atlx/atl1.c
+@@ -2473,7 +2473,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
+ "pcie phy link down %x\n", status);
+ if (netif_running(adapter->netdev)) { /* reset MAC */
+ iowrite32(0, adapter->hw.hw_addr + REG_IMR);
+- schedule_work(&adapter->pcie_dma_to_rst_task);
++ schedule_work(&adapter->reset_dev_task);
+ return IRQ_HANDLED;
+ }
+ }
+@@ -2485,7 +2485,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
+ "pcie DMA r/w error (status = 0x%x)\n",
+ status);
+ iowrite32(0, adapter->hw.hw_addr + REG_IMR);
+- schedule_work(&adapter->pcie_dma_to_rst_task);
++ schedule_work(&adapter->reset_dev_task);
+ return IRQ_HANDLED;
+ }
+
+@@ -2630,10 +2630,10 @@ static void atl1_down(struct atl1_adapter *adapter)
+ atl1_clean_rx_ring(adapter);
+ }
+
+-static void atl1_tx_timeout_task(struct work_struct *work)
++static void atl1_reset_dev_task(struct work_struct *work)
+ {
+ struct atl1_adapter *adapter =
+- container_of(work, struct atl1_adapter, tx_timeout_task);
++ container_of(work, struct atl1_adapter, reset_dev_task);
+ struct net_device *netdev = adapter->netdev;
+
+ netif_device_detach(netdev);
+@@ -3032,12 +3032,10 @@ static int __devinit atl1_probe(struct pci_dev *pdev,
+ (unsigned long)adapter);
+ adapter->phy_timer_pending = false;
+
+- INIT_WORK(&adapter->tx_timeout_task, atl1_tx_timeout_task);
++ INIT_WORK(&adapter->reset_dev_task, atl1_reset_dev_task);
+
+ INIT_WORK(&adapter->link_chg_task, atlx_link_chg_task);
+
+- INIT_WORK(&adapter->pcie_dma_to_rst_task, atl1_tx_timeout_task);
+-
+ err = register_netdev(netdev);
+ if (err)
+ goto err_common;
+diff --git a/drivers/net/ethernet/atheros/atlx/atl1.h b/drivers/net/ethernet/atheros/atlx/atl1.h
+index 109d6da..e04bf4d 100644
+--- a/drivers/net/ethernet/atheros/atlx/atl1.h
++++ b/drivers/net/ethernet/atheros/atlx/atl1.h
+@@ -758,9 +758,8 @@ struct atl1_adapter {
+ u16 link_speed;
+ u16 link_duplex;
+ spinlock_t lock;
+- struct work_struct tx_timeout_task;
++ struct work_struct reset_dev_task;
+ struct work_struct link_chg_task;
+- struct work_struct pcie_dma_to_rst_task;
+
+ struct timer_list phy_config_timer;
+ bool phy_timer_pending;
+diff --git a/drivers/net/ethernet/atheros/atlx/atlx.c b/drivers/net/ethernet/atheros/atlx/atlx.c
+index aabcf4b..41c6d83 100644
+--- a/drivers/net/ethernet/atheros/atlx/atlx.c
++++ b/drivers/net/ethernet/atheros/atlx/atlx.c
+@@ -193,7 +193,7 @@ static void atlx_tx_timeout(struct net_device *netdev)
+ {
+ struct atlx_adapter *adapter = netdev_priv(netdev);
+ /* Do the reset outside of interrupt context */
+- schedule_work(&adapter->tx_timeout_task);
++ schedule_work(&adapter->reset_dev_task);
+ }
+
+ /*
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0074-8139cp-set-intr-mask-after-its-handler-is-registered.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0074-8139cp-set-intr-mask-after-its-handler-is-registered.patch
--- /dev/null
@@ -0,0 +1,67 @@
+From d3b5873235963930f20f0900871e72ff3b80274b Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Wed, 11 Apr 2012 22:10:54 +0000
+Subject: [PATCH 074/165] 8139cp: set intr mask after its handler is
+ registered
+
+[ Upstream commit a8c9cb106fe79c28d6b7f1397652cadd228715ff ]
+
+We set intr mask before its handler is registered, this does not work well when
+8139cp is sharing irq line with other devices. As the irq could be enabled by
+the device before 8139cp's hander is registered which may lead unhandled
+irq. Fix this by introducing an helper cp_irq_enable() and call it after
+request_irq().
+
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Flavio Leitner <fbl@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/realtek/8139cp.c | 10 ++++++++--
+ 1 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
+index aba4f67..8f47907 100644
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -961,6 +961,11 @@ static inline void cp_start_hw (struct cp_private *cp)
+ cpw8(Cmd, RxOn | TxOn);
+ }
+
++static void cp_enable_irq(struct cp_private *cp)
++{
++ cpw16_f(IntrMask, cp_intr_mask);
++}
++
+ static void cp_init_hw (struct cp_private *cp)
+ {
+ struct net_device *dev = cp->dev;
+@@ -1000,8 +1005,6 @@ static void cp_init_hw (struct cp_private *cp)
+
+ cpw16(MultiIntr, 0);
+
+- cpw16_f(IntrMask, cp_intr_mask);
+-
+ cpw8_f(Cfg9346, Cfg9346_Lock);
+ }
+
+@@ -1133,6 +1136,8 @@ static int cp_open (struct net_device *dev)
+ if (rc)
+ goto err_out_hw;
+
++ cp_enable_irq(cp);
++
+ netif_carrier_off(dev);
+ mii_check_media(&cp->mii_if, netif_msg_link(cp), true);
+ netif_start_queue(dev);
+@@ -2034,6 +2039,7 @@ static int cp_resume (struct pci_dev *pdev)
+ /* FIXME: sh*t may happen if the Rx ring buffer is depleted */
+ cp_init_rings_index (cp);
+ cp_init_hw (cp);
++ cp_enable_irq(cp);
+ netif_start_queue (dev);
+
+ spin_lock_irqsave (&cp->lock, flags);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0075-net-smsc911x-fix-skb-handling-in-receive-path.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0075-net-smsc911x-fix-skb-handling-in-receive-path.patch
--- /dev/null
@@ -0,0 +1,78 @@
+From d886ddd4ea18bd874325e888d3272a8db0a972ea Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Thu, 12 Apr 2012 05:54:09 +0000
+Subject: [PATCH 075/165] net: smsc911x: fix skb handling in receive path
+
+[ Upstream commit 3c5e979bd037888dd7d722da22da4b43659af485 ]
+
+The SMSC911x driver resets the ->head, ->data and ->tail pointers in the
+skb on the reset path in order to avoid buffer overflow due to packet
+padding performed by the hardware.
+
+This patch fixes the receive path so that the skb pointers are fixed up
+after the data has been read from the device, The error path is also
+fixed to use number of words consistently and prevent erroneous FIFO
+fastforwarding when skipping over bad data.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/smsc/smsc911x.c | 14 +++++---------
+ 1 files changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index 8843071..8c7dd21 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -1089,10 +1089,8 @@ smsc911x_rx_counterrors(struct net_device *dev, unsigned int rxstat)
+
+ /* Quickly dumps bad packets */
+ static void
+-smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktbytes)
++smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktwords)
+ {
+- unsigned int pktwords = (pktbytes + NET_IP_ALIGN + 3) >> 2;
+-
+ if (likely(pktwords >= 4)) {
+ unsigned int timeout = 500;
+ unsigned int val;
+@@ -1156,7 +1154,7 @@ static int smsc911x_poll(struct napi_struct *napi, int budget)
+ continue;
+ }
+
+- skb = netdev_alloc_skb(dev, pktlength + NET_IP_ALIGN);
++ skb = netdev_alloc_skb(dev, pktwords << 2);
+ if (unlikely(!skb)) {
+ SMSC_WARN(pdata, rx_err,
+ "Unable to allocate skb for rx packet");
+@@ -1166,14 +1164,12 @@ static int smsc911x_poll(struct napi_struct *napi, int budget)
+ break;
+ }
+
+- skb->data = skb->head;
+- skb_reset_tail_pointer(skb);
++ pdata->ops->rx_readfifo(pdata,
++ (unsigned int *)skb->data, pktwords);
+
+ /* Align IP on 16B boundary */
+ skb_reserve(skb, NET_IP_ALIGN);
+ skb_put(skb, pktlength - 4);
+- pdata->ops->rx_readfifo(pdata,
+- (unsigned int *)skb->head, pktwords);
+ skb->protocol = eth_type_trans(skb, dev);
+ skb_checksum_none_assert(skb);
+ netif_receive_skb(skb);
+@@ -1396,7 +1392,7 @@ static int smsc911x_open(struct net_device *dev)
+ smsc911x_reg_write(pdata, FIFO_INT, temp);
+
+ /* set RX Data offset to 2 bytes for alignment */
+- smsc911x_reg_write(pdata, RX_CFG, (2 << 8));
++ smsc911x_reg_write(pdata, RX_CFG, (NET_IP_ALIGN << 8));
+
+ /* enable NAPI polling before enabling RX interrupts */
+ napi_enable(&pdata->napi);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0076-net-ethernet-ks8851_mll-fix-rx-frame-buffer-overflow.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0076-net-ethernet-ks8851_mll-fix-rx-frame-buffer-overflow.patch
--- /dev/null
@@ -0,0 +1,46 @@
+From 64adebf7ebe78704f2a1f09614184f1ede7631b2 Mon Sep 17 00:00:00 2001
+From: Davide Ciminaghi <ciminaghi@gnudd.com>
+Date: Fri, 13 Apr 2012 04:48:25 +0000
+Subject: [PATCH 076/165] net/ethernet: ks8851_mll fix rx frame buffer
+ overflow
+
+[ Upstream commit 8a9a0ea6032186e3030419262678d652b88bf6a8 ]
+
+At the beginning of ks_rcv(), a for loop retrieves the
+header information relevant to all the frames stored
+in the mac's internal buffers. The number of pending
+frames is stored as an 8 bits field in KS_RXFCTR.
+If interrupts are disabled long enough to allow for more than
+32 frames to accumulate in the MAC's internal buffers, a buffer
+overflow occurs.
+This patch fixes the problem by making the
+driver's frame_head_info buffer big enough.
+Well actually, since the chip appears to have 12K of
+internal rx buffers and the shortest ethernet frame should
+be 64 bytes long, maybe the limit could be set to
+12*1024/64 = 192 frames, but 255 should be safer.
+
+Signed-off-by: Davide Ciminaghi <ciminaghi@gnudd.com>
+Signed-off-by: Raffaele Recalcati <raffaele.recalcati@bticino.it>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/micrel/ks8851_mll.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index d19c849..77241b6 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -40,7 +40,7 @@
+ #define DRV_NAME "ks8851_mll"
+
+ static u8 KS_DEFAULT_MAC_ADDRESS[] = { 0x00, 0x10, 0xA1, 0x86, 0x95, 0x11 };
+-#define MAX_RECV_FRAMES 32
++#define MAX_RECV_FRAMES 255
+ #define MAX_BUF_SIZE 2048
+ #define TX_BUF_SIZE 2000
+ #define RX_BUF_SIZE 2000
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0077-net_sched-gred-Fix-oops-in-gred_dump-in-WRED-mode.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0077-net_sched-gred-Fix-oops-in-gred_dump-in-WRED-mode.patch
--- /dev/null
@@ -0,0 +1,54 @@
+From fad0985a19b237d9b48ab19b767413a95314b90d Mon Sep 17 00:00:00 2001
+From: David Ward <david.ward@ll.mit.edu>
+Date: Sun, 15 Apr 2012 12:31:45 +0000
+Subject: [PATCH 077/165] net_sched: gred: Fix oops in gred_dump() in WRED
+ mode
+
+[ Upstream commit 244b65dbfede788f2fa3fe2463c44d0809e97c6b ]
+
+A parameter set exists for WRED mode, called wred_set, to hold the same
+values for qavg and qidlestart across all VQs. The WRED mode values had
+been previously held in the VQ for the default DP. After these values
+were moved to wred_set, the VQ for the default DP was no longer created
+automatically (so that it could be omitted on purpose, to have packets
+in the default DP enqueued directly to the device without using RED).
+
+However, gred_dump() was overlooked during that change; in WRED mode it
+still reads qavg/qidlestart from the VQ for the default DP, which might
+not even exist. As a result, this command sequence will cause an oops:
+
+tc qdisc add dev $DEV handle $HANDLE parent $PARENT gred setup \
+ DPs 3 default 2 grio
+tc qdisc change dev $DEV handle $HANDLE gred DP 0 prio 8 $RED_OPTIONS
+tc qdisc change dev $DEV handle $HANDLE gred DP 1 prio 8 $RED_OPTIONS
+
+This fixes gred_dump() in WRED mode to use the values held in wred_set.
+
+Signed-off-by: David Ward <david.ward@ll.mit.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/sched/sch_gred.c | 7 ++-----
+ 1 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
+index 6cd8ddf..e1afe0c 100644
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -544,11 +544,8 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
+ opt.packets = q->packetsin;
+ opt.bytesin = q->bytesin;
+
+- if (gred_wred_mode(table)) {
+- q->parms.qidlestart =
+- table->tab[table->def]->parms.qidlestart;
+- q->parms.qavg = table->tab[table->def]->parms.qavg;
+- }
++ if (gred_wred_mode(table))
++ gred_load_wred_set(table, q);
+
+ opt.qave = red_calc_qavg(&q->parms, q->parms.qavg);
+
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0078-net-usb-smsc75xx-fix-mtu.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0078-net-usb-smsc75xx-fix-mtu.patch
--- /dev/null
@@ -0,0 +1,39 @@
+From a242d0ff40b2ef87f4c23c4676441ed1c4ee20cd Mon Sep 17 00:00:00 2001
+From: Stephane Fillod <fillods@users.sf.net>
+Date: Sun, 15 Apr 2012 11:38:29 +0000
+Subject: [PATCH 078/165] net: usb: smsc75xx: fix mtu
+
+[ Upstream commit a99ff7d0123b19ecad3b589480b6542716ab6b52 ]
+
+Make smsc75xx recalculate the hard_mtu after adjusting the
+hard_header_len.
+
+Without this, usbnet adjusts the MTU down to 1492 bytes, and the host is
+unable to receive standard 1500-byte frames from the device.
+
+Inspired by same fix on cdc_eem 78fb72f7936c01d5b426c03a691eca082b03f2b9.
+
+Tested on ARM/Omap3 with EVB-LAN7500-LC.
+
+Signed-off-by: Stephane Fillod <fillods@users.sf.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/usb/smsc75xx.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index a5b9b12..7bd219b 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -1050,6 +1050,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ dev->net->ethtool_ops = &smsc75xx_ethtool_ops;
+ dev->net->flags |= IFF_MULTICAST;
+ dev->net->hard_header_len += SMSC75XX_TX_OVERHEAD;
++ dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+ return 0;
+ }
+
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0079-dummy-Add-ndo_uninit.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0079-dummy-Add-ndo_uninit.patch
--- /dev/null
@@ -0,0 +1,55 @@
+From ee79f6838bd3f230ebf00849029dac3b9be112e5 Mon Sep 17 00:00:00 2001
+From: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
+Date: Sun, 15 Apr 2012 13:26:01 +0000
+Subject: [PATCH 079/165] dummy: Add ndo_uninit().
+
+commit 890fdf2a0cb88202d1427589db2cf29c1bdd3c1d upstream.
+
+In register_netdevice(), when ndo_init() is successful and later
+some error occurred, ndo_uninit() will be called.
+So dummy deivce is desirable to implement ndo_uninit() method
+to free percpu stats for this case.
+And, ndo_uninit() is also called along with dev->destructor() when
+device is unregistered, so in order to prevent dev->dstats from
+being freed twice, dev->destructor is modified to free_netdev().
+
+Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/dummy.c | 6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
+index a7c5e88..eeac9ca 100644
+--- a/drivers/net/dummy.c
++++ b/drivers/net/dummy.c
+@@ -106,14 +106,14 @@ static int dummy_dev_init(struct net_device *dev)
+ return 0;
+ }
+
+-static void dummy_dev_free(struct net_device *dev)
++static void dummy_dev_uninit(struct net_device *dev)
+ {
+ free_percpu(dev->dstats);
+- free_netdev(dev);
+ }
+
+ static const struct net_device_ops dummy_netdev_ops = {
+ .ndo_init = dummy_dev_init,
++ .ndo_uninit = dummy_dev_uninit,
+ .ndo_start_xmit = dummy_xmit,
+ .ndo_validate_addr = eth_validate_addr,
+ .ndo_set_rx_mode = set_multicast_list,
+@@ -127,7 +127,7 @@ static void dummy_setup(struct net_device *dev)
+
+ /* Initialize the device structure. */
+ dev->netdev_ops = &dummy_netdev_ops;
+- dev->destructor = dummy_dev_free;
++ dev->destructor = free_netdev;
+
+ /* Fill in device structure with ethernet-generic values. */
+ dev->tx_queue_len = 0;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0080-tcp-fix-tcp_grow_window-for-large-incoming-frames.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0080-tcp-fix-tcp_grow_window-for-large-incoming-frames.patch
--- /dev/null
@@ -0,0 +1,40 @@
+From 57c5b1028d7bffa4d7784dd4bd8743710dc62d0c Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 16 Apr 2012 23:28:07 +0000
+Subject: [PATCH 080/165] tcp: fix tcp_grow_window() for large incoming frames
+
+[ Upstream commit 4d846f02392a710f9604892ac3329e628e60a230 ]
+
+tcp_grow_window() has to grow rcv_ssthresh up to window_clamp, allowing
+sender to increase its window.
+
+tcp_grow_window() still assumes a tcp frame is under MSS, but its no
+longer true with LRO/GRO.
+
+This patch fixes one of the performance issue we noticed with GRO on.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Neal Cardwell <ncardwell@google.com>
+Cc: Tom Herbert <therbert@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv4/tcp_input.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 4c46fa7..daedc07 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -334,6 +334,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
+ incr = __tcp_grow_window(sk, skb);
+
+ if (incr) {
++ incr = max_t(int, incr, 2 * skb->len);
+ tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
+ tp->window_clamp);
+ inet_csk(sk)->icsk_ack.quick |= 1;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0081-netns-do-not-leak-net_generic-data-on-failed-init.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0081-netns-do-not-leak-net_generic-data-on-failed-init.patch
--- /dev/null
@@ -0,0 +1,79 @@
+From 4637103c9e0f2f7cef243c369f6b451550a4944d Mon Sep 17 00:00:00 2001
+From: Julian Anastasov <ja@ssi.bg>
+Date: Mon, 16 Apr 2012 04:43:15 +0000
+Subject: [PATCH 081/165] netns: do not leak net_generic data on failed init
+
+[ Upstream commit b922934d017f1cc831b017913ed7d1a56c558b43 ]
+
+ops_init should free the net_generic data on
+init failure and __register_pernet_operations should not
+call ops_free when NET_NS is not enabled.
+
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/core/net_namespace.c | 33 ++++++++++++++++++---------------
+ 1 files changed, 18 insertions(+), 15 deletions(-)
+
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 0e950fd..31a5ae5 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -83,21 +83,29 @@ assign:
+
+ static int ops_init(const struct pernet_operations *ops, struct net *net)
+ {
+- int err;
++ int err = -ENOMEM;
++ void *data = NULL;
++
+ if (ops->id && ops->size) {
+- void *data = kzalloc(ops->size, GFP_KERNEL);
++ data = kzalloc(ops->size, GFP_KERNEL);
+ if (!data)
+- return -ENOMEM;
++ goto out;
+
+ err = net_assign_generic(net, *ops->id, data);
+- if (err) {
+- kfree(data);
+- return err;
+- }
++ if (err)
++ goto cleanup;
+ }
++ err = 0;
+ if (ops->init)
+- return ops->init(net);
+- return 0;
++ err = ops->init(net);
++ if (!err)
++ return 0;
++
++cleanup:
++ kfree(data);
++
++out:
++ return err;
+ }
+
+ static void ops_free(const struct pernet_operations *ops, struct net *net)
+@@ -448,12 +456,7 @@ static void __unregister_pernet_operations(struct pernet_operations *ops)
+ static int __register_pernet_operations(struct list_head *list,
+ struct pernet_operations *ops)
+ {
+- int err = 0;
+- err = ops_init(ops, &init_net);
+- if (err)
+- ops_free(ops, &init_net);
+- return err;
+-
++ return ops_init(ops, &init_net);
+ }
+
+ static void __unregister_pernet_operations(struct pernet_operations *ops)
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0082-ksz884x-don-t-copy-too-much-in-netdev_set_mac_addres.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0082-ksz884x-don-t-copy-too-much-in-netdev_set_mac_addres.patch
--- /dev/null
@@ -0,0 +1,36 @@
+From 921c1088587031a14b41d53e69c15ea76d4124ce Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 19 Apr 2012 10:00:19 +0300
+Subject: [PATCH 082/165] ksz884x: don't copy too much in
+ netdev_set_mac_address()
+
+[ Upstream commit 716af4abd6e6370226f567af50bfaca274515980 ]
+
+MAX_ADDR_LEN is 32. ETH_ALEN is 6. mac->sa_data is a 14 byte array, so
+the memcpy() is doing a read past the end of the array. I asked about
+this on netdev and Ben Hutchings told me it's supposed to be copying
+ETH_ALEN bytes (thanks Ben).
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/micrel/ksz884x.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
+index 7ece990..4b9f4bd 100644
+--- a/drivers/net/ethernet/micrel/ksz884x.c
++++ b/drivers/net/ethernet/micrel/ksz884x.c
+@@ -5679,7 +5679,7 @@ static int netdev_set_mac_address(struct net_device *dev, void *addr)
+ memcpy(hw->override_addr, mac->sa_data, MAC_ADDR_LEN);
+ }
+
+- memcpy(dev->dev_addr, mac->sa_data, MAX_ADDR_LEN);
++ memcpy(dev->dev_addr, mac->sa_data, ETH_ALEN);
+
+ interrupt = hw_block_intr(hw);
+
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0083-net-ax25-Reorder-ax25_exit-to-remove-races.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0083-net-ax25-Reorder-ax25_exit-to-remove-races.patch
--- /dev/null
@@ -0,0 +1,58 @@
+From 5d2236761edc280d899b5721a6aa29d2cd1d1718 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Wed, 18 Apr 2012 16:11:23 +0000
+Subject: [PATCH 083/165] net ax25: Reorder ax25_exit to remove races.
+
+[ Upstream commit 3adadc08cc1e2cbcc15a640d639297ef5fcb17f5 ]
+
+While reviewing the sysctl code in ax25 I spotted races in ax25_exit
+where it is possible to receive notifications and packets after already
+freeing up some of the data structures needed to process those
+notifications and updates.
+
+Call unregister_netdevice_notifier early so that the rest of the cleanup
+code does not need to deal with network devices. This takes advantage
+of my recent enhancement to unregister_netdevice_notifier to send
+unregister notifications of all network devices that are current
+registered.
+
+Move the unregistration for packet types, socket types and protocol
+types before we cleanup any of the ax25 data structures to remove the
+possibilities of other races.
+
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ax25/af_ax25.c | 9 +++++----
+ 1 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index e7c69f4..b04a6ef 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -2006,16 +2006,17 @@ static void __exit ax25_exit(void)
+ proc_net_remove(&init_net, "ax25_route");
+ proc_net_remove(&init_net, "ax25");
+ proc_net_remove(&init_net, "ax25_calls");
+- ax25_rt_free();
+- ax25_uid_free();
+- ax25_dev_free();
+
+- ax25_unregister_sysctl();
+ unregister_netdevice_notifier(&ax25_dev_notifier);
++ ax25_unregister_sysctl();
+
+ dev_remove_pack(&ax25_packet_type);
+
+ sock_unregister(PF_AX25);
+ proto_unregister(&ax25_proto);
++
++ ax25_rt_free();
++ ax25_uid_free();
++ ax25_dev_free();
+ }
+ module_exit(ax25_exit);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0084-tcp-fix-TCP_MAXSEG-for-established-IPv6-passive-sock.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0084-tcp-fix-TCP_MAXSEG-for-established-IPv6-passive-sock.patch
--- /dev/null
@@ -0,0 +1,41 @@
+From 0f6ddd1f2a2e87994e797d2877e7270cfc7ec03c Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Sun, 22 Apr 2012 09:45:47 +0000
+Subject: [PATCH 084/165] tcp: fix TCP_MAXSEG for established IPv6 passive
+ sockets
+
+[ Upstream commit d135c522f1234f62e81be29cebdf59e9955139ad ]
+
+Commit f5fff5d forgot to fix TCP_MAXSEG behavior IPv6 sockets, so IPv6
+TCP server sockets that used TCP_MAXSEG would find that the advmss of
+child sockets would be incorrect. This commit mirrors the advmss logic
+from tcp_v4_syn_recv_sock in tcp_v6_syn_recv_sock. Eventually this
+logic should probably be shared between IPv4 and IPv6, but this at
+least fixes this issue.
+
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv6/tcp_ipv6.c | 4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index b859e4a..4a56574 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1494,6 +1494,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
+ tcp_mtup_init(newsk);
+ tcp_sync_mss(newsk, dst_mtu(dst));
+ newtp->advmss = dst_metric_advmss(dst);
++ if (tcp_sk(sk)->rx_opt.user_mss &&
++ tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
++ newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
++
+ tcp_initialize_rcv_mss(newsk);
+ if (tcp_rsk(req)->snt_synack)
+ tcp_valid_rtt_meas(newsk,
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0085-nfs-Enclose-hostname-in-brackets-when-needed-in-nfs_.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0085-nfs-Enclose-hostname-in-brackets-when-needed-in-nfs_.patch
--- /dev/null
@@ -0,0 +1,49 @@
+From 5d341b71950df3cbd21a7abf61ab903aac90531b Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Sat, 3 Sep 2011 01:09:43 +0200
+Subject: [PATCH 085/165] nfs: Enclose hostname in brackets when needed in
+ nfs_do_root_mount
+
+commit 98a2139f4f4d7b5fcc3a54c7fddbe88612abed20 upstream.
+
+When hostname contains colon (e.g. when it is an IPv6 address) it needs
+to be enclosed in brackets to make parsing of NFS device string possible.
+Fix nfs_do_root_mount() to enclose hostname properly when needed. NFS code
+actually does not need this as it does not parse the string passed by
+nfs_do_root_mount() but the device string is exposed to userspace in
+/proc/mounts.
+
+CC: Josh Boyer <jwboyer@redhat.com>
+CC: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfs/super.c | 8 ++++++--
+ 1 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 3ada13c..376cd65 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -2708,11 +2708,15 @@ static struct vfsmount *nfs_do_root_mount(struct file_system_type *fs_type,
+ char *root_devname;
+ size_t len;
+
+- len = strlen(hostname) + 3;
++ len = strlen(hostname) + 5;
+ root_devname = kmalloc(len, GFP_KERNEL);
+ if (root_devname == NULL)
+ return ERR_PTR(-ENOMEM);
+- snprintf(root_devname, len, "%s:/", hostname);
++ /* Does hostname needs to be enclosed in brackets? */
++ if (strchr(hostname, ':'))
++ snprintf(root_devname, len, "[%s]:/", hostname);
++ else
++ snprintf(root_devname, len, "%s:/", hostname);
+ root_mnt = vfs_kern_mount(fs_type, flags, root_devname, data);
+ kfree(root_devname);
+ return root_mnt;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0086-NFSv4-Ensure-that-the-LOCK-code-sets-exception-inode.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0086-NFSv4-Ensure-that-the-LOCK-code-sets-exception-inode.patch
--- /dev/null
@@ -0,0 +1,54 @@
+From 4fd3b67b3816e020c889f75e986ba290110c3224 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Wed, 18 Apr 2012 12:20:10 -0400
+Subject: [PATCH 086/165] NFSv4: Ensure that the LOCK code sets
+ exception->inode
+
+commit 05ffe24f5290dc095f98fbaf84afe51ef404ccc5 upstream.
+
+All callers of nfs4_handle_exception() that need to handle
+NFS4ERR_OPENMODE correctly should set exception->inode
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfs/nfs4proc.c | 9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 757293b..57f9971 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -4453,7 +4453,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
+ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
+ {
+ struct nfs_server *server = NFS_SERVER(state->inode);
+- struct nfs4_exception exception = { };
++ struct nfs4_exception exception = {
++ .inode = state->inode,
++ };
+ int err;
+
+ do {
+@@ -4471,7 +4473,9 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request
+ static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
+ {
+ struct nfs_server *server = NFS_SERVER(state->inode);
+- struct nfs4_exception exception = { };
++ struct nfs4_exception exception = {
++ .inode = state->inode,
++ };
+ int err;
+
+ err = nfs4_set_lock_state(state, request);
+@@ -4551,6 +4555,7 @@ static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *
+ {
+ struct nfs4_exception exception = {
+ .state = state,
++ .inode = state->inode,
+ };
+ int err;
+
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0087-NFSv4-Ensure-that-we-check-lock-exclusive-shared-typ.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0087-NFSv4-Ensure-that-we-check-lock-exclusive-shared-typ.patch
--- /dev/null
@@ -0,0 +1,45 @@
+From 2057efde24445d1ca4d192617bf7d5f4fe0f38ce Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Wed, 18 Apr 2012 12:48:35 -0400
+Subject: [PATCH 087/165] NFSv4: Ensure that we check lock exclusive/shared
+ type against open modes
+
+commit 55725513b5ef9d462aa3e18527658a0362aaae83 upstream.
+
+Since we may be simulating flock() locks using NFS byte range locks,
+we can't rely on the VFS having checked the file open mode for us.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfs/nfs4proc.c | 14 ++++++++++++++
+ 1 files changed, 14 insertions(+), 0 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 57f9971..51f6a40 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -4601,6 +4601,20 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
+
+ if (state == NULL)
+ return -ENOLCK;
++ /*
++ * Don't rely on the VFS having checked the file open mode,
++ * since it won't do this for flock() locks.
++ */
++ switch (request->fl_type & (F_RDLCK|F_WRLCK|F_UNLCK)) {
++ case F_RDLCK:
++ if (!(filp->f_mode & FMODE_READ))
++ return -EBADF;
++ break;
++ case F_WRLCK:
++ if (!(filp->f_mode & FMODE_WRITE))
++ return -EBADF;
++ }
++
+ do {
+ status = nfs4_proc_setlk(state, cmd, request);
+ if ((status != -EAGAIN) || IS_SETLK(cmd))
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0088-NFS-put-open-context-on-error-in-nfs_pagein_multi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0088-NFS-put-open-context-on-error-in-nfs_pagein_multi.patch
--- /dev/null
@@ -0,0 +1,30 @@
+From 24f8b6b7ed6a71c4bb6b7c586a1cfa9d70e9775e Mon Sep 17 00:00:00 2001
+From: Fred Isaman <iisaman@netapp.com>
+Date: Fri, 20 Apr 2012 14:47:34 -0400
+Subject: [PATCH 088/165] NFS: put open context on error in nfs_pagein_multi
+
+commit 73fb7bc7c57d971b11f2e00536ac2d3e316e0609 upstream.
+
+Signed-off-by: Fred Isaman <iisaman@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfs/read.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/nfs/read.c b/fs/nfs/read.c
+index cfa175c..41bae32 100644
+--- a/fs/nfs/read.c
++++ b/fs/nfs/read.c
+@@ -324,7 +324,7 @@ out_bad:
+ while (!list_empty(res)) {
+ data = list_entry(res->next, struct nfs_read_data, list);
+ list_del(&data->list);
+- nfs_readdata_free(data);
++ nfs_readdata_release(data);
+ }
+ nfs_readpage_release(req);
+ return -ENOMEM;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0089-NFS-put-open-context-on-error-in-nfs_flush_multi.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0089-NFS-put-open-context-on-error-in-nfs_flush_multi.patch
--- /dev/null
@@ -0,0 +1,30 @@
+From dbef91f49d543a546ee1cbe3e839c97c69486744 Mon Sep 17 00:00:00 2001
+From: Fred Isaman <iisaman@netapp.com>
+Date: Fri, 20 Apr 2012 14:47:35 -0400
+Subject: [PATCH 089/165] NFS: put open context on error in nfs_flush_multi
+
+commit 8ccd271f7a3a846ce6f85ead0760d9d12994a611 upstream.
+
+Signed-off-by: Fred Isaman <iisaman@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfs/write.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 1dda78d..4efd421 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -974,7 +974,7 @@ out_bad:
+ while (!list_empty(res)) {
+ data = list_entry(res->next, struct nfs_write_data, list);
+ list_del(&data->list);
+- nfs_writedata_free(data);
++ nfs_writedata_release(data);
+ }
+ nfs_redirty_request(req);
+ return -ENOMEM;
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0090-x86-microcode-Fix-sysfs-warning-during-module-unload.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0090-x86-microcode-Fix-sysfs-warning-during-module-unload.patch
--- /dev/null
@@ -0,0 +1,71 @@
+From e7e6ba91db68ef0028d61a2bf8b9f3965595b944 Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Thu, 12 Apr 2012 16:48:01 +0200
+Subject: [PATCH 090/165] x86, microcode: Fix sysfs warning during module
+ unload on unsupported CPUs
+
+commit a956bd6f8583326b18348ab1452b4686778f785d upstream.
+
+Loading the microcode driver on an unsupported CPU and subsequently
+unloading the driver causes
+
+ WARNING: at fs/sysfs/group.c:138 mc_device_remove+0x5f/0x70 [microcode]()
+ Hardware name: 01972NG
+ sysfs group ffffffffa00013d0 not found for kobject 'cpu0'
+ Modules linked in: snd_hda_codec_hdmi snd_hda_codec_conexant snd_hda_intel btusb snd_hda_codec bluetooth thinkpad_acpi rfkill microcode(-) [last unloaded: cfg80211]
+ Pid: 4560, comm: modprobe Not tainted 3.4.0-rc2-00002-g258f742 #5
+ Call Trace:
+ [<ffffffff8103113b>] ? warn_slowpath_common+0x7b/0xc0
+ [<ffffffff81031235>] ? warn_slowpath_fmt+0x45/0x50
+ [<ffffffff81120e74>] ? sysfs_remove_group+0x34/0x120
+ [<ffffffffa00000ef>] ? mc_device_remove+0x5f/0x70 [microcode]
+ [<ffffffff81331eb9>] ? subsys_interface_unregister+0x69/0xa0
+ [<ffffffff81563526>] ? mutex_lock+0x16/0x40
+ [<ffffffffa0000c3e>] ? microcode_exit+0x50/0x92 [microcode]
+ [<ffffffff8107051d>] ? sys_delete_module+0x16d/0x260
+ [<ffffffff810a0065>] ? wait_iff_congested+0x45/0x110
+ [<ffffffff815656af>] ? page_fault+0x1f/0x30
+ [<ffffffff81565ba2>] ? system_call_fastpath+0x16/0x1b
+
+on recent kernels.
+
+This is due to commit 8a25a2fd126c ("cpu: convert 'cpu' and
+'machinecheck' sysdev_class to a regular subsystem") which renders
+commit 6c53cbfced04 ("x86, microcode: Correct sysdev_add error path")
+useless.
+
+See http://marc.info/?l=linux-kernel&m=133416246406478
+
+Avoid above warning by restoring the old driver behaviour before
+6c53cbfced04 ("x86, microcode: Correct sysdev_add error path").
+
+Cc: Tigran Aivazian <tigran@aivazian.fsnet.co.uk>
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: http://lkml.kernel.org/r/20120411163849.GE4794@alberich.amd.com
+Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
+[bwh: Backported to 3.2: deleted line uses sys_dev, not dev]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/kernel/microcode_core.c | 4 +---
+ 1 files changed, 1 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/microcode_core.c
+index 9d46f5e..563a09d 100644
+--- a/arch/x86/kernel/microcode_core.c
++++ b/arch/x86/kernel/microcode_core.c
+@@ -418,10 +418,8 @@ static int mc_sysdev_add(struct sys_device *sys_dev)
+ if (err)
+ return err;
+
+- if (microcode_init_cpu(cpu) == UCODE_ERROR) {
+- sysfs_remove_group(&sys_dev->kobj, &mc_attr_group);
++ if (microcode_init_cpu(cpu) == UCODE_ERROR)
+ return -EINVAL;
+- }
+
+ return err;
+ }
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0091-x86-apic-APIC-code-touches-invalid-MSR-on-P5-class-m.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0091-x86-apic-APIC-code-touches-invalid-MSR-on-P5-class-m.patch
--- /dev/null
@@ -0,0 +1,91 @@
+From 46ed52ce8ccfe7b4b4edf99fb0aeed2fbf817727 Mon Sep 17 00:00:00 2001
+From: Bryan O'Donoghue <bryan.odonoghue@linux.intel.com>
+Date: Wed, 18 Apr 2012 17:37:39 +0100
+Subject: [PATCH 091/165] x86, apic: APIC code touches invalid MSR on P5 class
+ machines
+
+commit cbf2829b61c136edcba302a5e1b6b40e97d32c00 upstream.
+
+Current APIC code assumes MSR_IA32_APICBASE is present for all systems.
+Pentium Classic P5 and friends didn't have this MSR. MSR_IA32_APICBASE
+was introduced as an architectural MSR by Intel @ P6.
+
+Code paths that can touch this MSR invalidly are when vendor == Intel &&
+cpu-family == 5 and APIC bit is set in CPUID - or when you simply pass
+lapic on the kernel command line, on a P5.
+
+The below patch stops Linux incorrectly interfering with the
+MSR_IA32_APICBASE for P5 class machines. Other code paths exist that
+touch the MSR - however those paths are not currently reachable for a
+conformant P5.
+
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linux.intel.com>
+Link: http://lkml.kernel.org/r/4F8EEDD3.1080404@linux.intel.com
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/kernel/apic/apic.c | 34 ++++++++++++++++++++--------------
+ 1 files changed, 20 insertions(+), 14 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index f98d84c..c4e3581 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1577,9 +1577,11 @@ static int __init apic_verify(void)
+ mp_lapic_addr = APIC_DEFAULT_PHYS_BASE;
+
+ /* The BIOS may have set up the APIC at some other address */
+- rdmsr(MSR_IA32_APICBASE, l, h);
+- if (l & MSR_IA32_APICBASE_ENABLE)
+- mp_lapic_addr = l & MSR_IA32_APICBASE_BASE;
++ if (boot_cpu_data.x86 >= 6) {
++ rdmsr(MSR_IA32_APICBASE, l, h);
++ if (l & MSR_IA32_APICBASE_ENABLE)
++ mp_lapic_addr = l & MSR_IA32_APICBASE_BASE;
++ }
+
+ pr_info("Found and enabled local APIC!\n");
+ return 0;
+@@ -1597,13 +1599,15 @@ int __init apic_force_enable(unsigned long addr)
+ * MSR. This can only be done in software for Intel P6 or later
+ * and AMD K7 (Model > 1) or later.
+ */
+- rdmsr(MSR_IA32_APICBASE, l, h);
+- if (!(l & MSR_IA32_APICBASE_ENABLE)) {
+- pr_info("Local APIC disabled by BIOS -- reenabling.\n");
+- l &= ~MSR_IA32_APICBASE_BASE;
+- l |= MSR_IA32_APICBASE_ENABLE | addr;
+- wrmsr(MSR_IA32_APICBASE, l, h);
+- enabled_via_apicbase = 1;
++ if (boot_cpu_data.x86 >= 6) {
++ rdmsr(MSR_IA32_APICBASE, l, h);
++ if (!(l & MSR_IA32_APICBASE_ENABLE)) {
++ pr_info("Local APIC disabled by BIOS -- reenabling.\n");
++ l &= ~MSR_IA32_APICBASE_BASE;
++ l |= MSR_IA32_APICBASE_ENABLE | addr;
++ wrmsr(MSR_IA32_APICBASE, l, h);
++ enabled_via_apicbase = 1;
++ }
+ }
+ return apic_verify();
+ }
+@@ -2149,10 +2153,12 @@ static void lapic_resume(void)
+ * FIXME! This will be wrong if we ever support suspend on
+ * SMP! We'll need to do this as part of the CPU restore!
+ */
+- rdmsr(MSR_IA32_APICBASE, l, h);
+- l &= ~MSR_IA32_APICBASE_BASE;
+- l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
+- wrmsr(MSR_IA32_APICBASE, l, h);
++ if (boot_cpu_data.x86 >= 6) {
++ rdmsr(MSR_IA32_APICBASE, l, h);
++ l &= ~MSR_IA32_APICBASE_BASE;
++ l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
++ wrmsr(MSR_IA32_APICBASE, l, h);
++ }
+ }
+
+ maxlvt = lapic_get_maxlvt();
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0092-Revert-autofs-work-around-unhappy-compat-problem-on-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0092-Revert-autofs-work-around-unhappy-compat-problem-on-.patch
--- /dev/null
@@ -0,0 +1,135 @@
+From 57ae2e2d36a3b53fa55c4e1e6cf073f566921c40 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Sat, 28 Apr 2012 08:29:56 -0700
+Subject: [PATCH 092/165] Revert "autofs: work around unhappy compat problem
+ on x86-64"
+
+commit fcbf94b9dedd2ce08e798a99aafc94fec8668161 upstream.
+
+This reverts commit a32744d4abae24572eff7269bc17895c41bd0085.
+
+While that commit was technically the right thing to do, and made the
+x86-64 compat mode work identically to native 32-bit mode (and thus
+fixing the problem with a 32-bit systemd install on a 64-bit kernel), it
+turns out that the automount binaries had workarounds for this compat
+problem.
+
+Now, the workarounds are disgusting: doing an "uname()" to find out the
+architecture of the kernel, and then comparing it for the 64-bit cases
+and fixing up the size of the read() in automount for those. And they
+were confused: it's not actually a generic 64-bit issue at all, it's
+very much tied to just x86-64, which has different alignment for an
+'u64' in 64-bit mode than in 32-bit mode.
+
+But the end result is that fixing the compat layer actually breaks the
+case of a 32-bit automount on a x86-64 kernel.
+
+There are various approaches to fix this (including just doing a
+"strcmp()" on current->comm and comparing it to "automount"), but I
+think that I will do the one that teaches pipes about a special "packet
+mode", which will allow user space to not have to care too deeply about
+the padding at the end of the autofs packet.
+
+That change will make the compat workaround unnecessary, so let's revert
+it first, and get automount working again in compat mode. The
+packetized pipes will then fix autofs for systemd.
+
+Reported-and-requested-by: Michael Tokarev <mjt@tls.msk.ru>
+Cc: Ian Kent <raven@themaw.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/autofs4/autofs_i.h | 1 -
+ fs/autofs4/dev-ioctl.c | 1 -
+ fs/autofs4/inode.c | 2 --
+ fs/autofs4/waitq.c | 22 +++-------------------
+ 4 files changed, 3 insertions(+), 23 deletions(-)
+
+diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
+index 308a98b..326dc08 100644
+--- a/fs/autofs4/autofs_i.h
++++ b/fs/autofs4/autofs_i.h
+@@ -110,7 +110,6 @@ struct autofs_sb_info {
+ int sub_version;
+ int min_proto;
+ int max_proto;
+- int compat_daemon;
+ unsigned long exp_timeout;
+ unsigned int type;
+ int reghost_enabled;
+diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
+index 56bac70..509fe1e 100644
+--- a/fs/autofs4/dev-ioctl.c
++++ b/fs/autofs4/dev-ioctl.c
+@@ -385,7 +385,6 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
+ sbi->pipefd = pipefd;
+ sbi->pipe = pipe;
+ sbi->catatonic = 0;
+- sbi->compat_daemon = is_compat_task();
+ }
+ out:
+ mutex_unlock(&sbi->wq_mutex);
+diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
+index 98a5695..8179f1a 100644
+--- a/fs/autofs4/inode.c
++++ b/fs/autofs4/inode.c
+@@ -19,7 +19,6 @@
+ #include <linux/parser.h>
+ #include <linux/bitops.h>
+ #include <linux/magic.h>
+-#include <linux/compat.h>
+ #include "autofs_i.h"
+ #include <linux/module.h>
+
+@@ -225,7 +224,6 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
+ set_autofs_type_indirect(&sbi->type);
+ sbi->min_proto = 0;
+ sbi->max_proto = 0;
+- sbi->compat_daemon = is_compat_task();
+ mutex_init(&sbi->wq_mutex);
+ spin_lock_init(&sbi->fs_lock);
+ sbi->queues = NULL;
+diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
+index 6861f61..e1fbdee 100644
+--- a/fs/autofs4/waitq.c
++++ b/fs/autofs4/waitq.c
+@@ -90,24 +90,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
+
+ return (bytes > 0);
+ }
+-
+-/*
+- * The autofs_v5 packet was misdesigned.
+- *
+- * The packets are identical on x86-32 and x86-64, but have different
+- * alignment. Which means that 'sizeof()' will give different results.
+- * Fix it up for the case of running 32-bit user mode on a 64-bit kernel.
+- */
+-static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi)
+-{
+- size_t pktsz = sizeof(struct autofs_v5_packet);
+-#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT)
+- if (sbi->compat_daemon > 0)
+- pktsz -= 4;
+-#endif
+- return pktsz;
+-}
+-
++
+ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
+ struct autofs_wait_queue *wq,
+ int type)
+@@ -164,7 +147,8 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
+ {
+ struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
+
+- pktsz = autofs_v5_packet_size(sbi);
++ pktsz = sizeof(*packet);
++
+ packet->wait_queue_token = wq->wait_queue_token;
+ packet->len = wq->name.len;
+ memcpy(packet->name, wq->name.name, wq->name.len);
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0093-xen-correctly-check-for-pending-events-when-restorin.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0093-xen-correctly-check-for-pending-events-when-restorin.patch
--- /dev/null
@@ -0,0 +1,47 @@
+From d989ae8669c297a7873a9b5c7e406bc467323388 Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel@citrix.com>
+Date: Thu, 26 Apr 2012 19:44:06 +0100
+Subject: [PATCH 093/165] xen: correctly check for pending events when
+ restoring irq flags
+
+commit 7eb7ce4d2e8991aff4ecb71a81949a907ca755ac upstream.
+
+In xen_restore_fl_direct(), xen_force_evtchn_callback() was being
+called even if no events were pending. This resulted in (depending on
+workload) about a 100 times as many xen_version hypercalls as
+necessary.
+
+Fix this by correcting the sense of the conditional jump.
+
+This seems to give a significant performance benefit for some
+workloads.
+
+There is some subtle tricksy "..since the check here is trying to
+check both pending and masked in a single cmpw, but I think this is
+correct. It will call check_events now only when the combined
+mask+pending word is 0x0001 (aka unmasked, pending)." (Ian)
+
+Acked-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/xen/xen-asm.S | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S
+index 79d7362..3e45aa0 100644
+--- a/arch/x86/xen/xen-asm.S
++++ b/arch/x86/xen/xen-asm.S
+@@ -96,7 +96,7 @@ ENTRY(xen_restore_fl_direct)
+
+ /* check for unmasked and pending */
+ cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_pending
+- jz 1f
++ jnz 1f
+ 2: call check_events
+ 1:
+ ENDPATCH(xen_restore_fl_direct)
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0094-xen-smp-Fix-crash-when-booting-with-ACPI-hotplug-CPU.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0094-xen-smp-Fix-crash-when-booting-with-ACPI-hotplug-CPU.patch
--- /dev/null
@@ -0,0 +1,99 @@
+From 7e7b9fb05d7e36d2d585a422de52c3b2e3345cdf Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Thu, 26 Apr 2012 13:50:03 -0400
+Subject: [PATCH 094/165] xen/smp: Fix crash when booting with ACPI hotplug
+ CPUs.
+
+commit cf405ae612b0f7e2358db7ff594c0e94846137aa upstream.
+
+When we boot on a machine that can hotplug CPUs and we
+are using 'dom0_max_vcpus=X' on the Xen hypervisor line
+to clip the amount of CPUs available to the initial domain,
+we get this:
+
+(XEN) Command line: com1=115200,8n1 dom0_mem=8G noreboot dom0_max_vcpus=8 sync_console mce_verbosity=verbose console=com1,vga loglvl=all guest_loglvl=all
+.. snip..
+DMI: Intel Corporation S2600CP/S2600CP, BIOS SE5C600.86B.99.99.x032.072520111118 07/25/2011
+.. snip.
+SMP: Allowing 64 CPUs, 32 hotplug CPUs
+installing Xen timer for CPU 7
+cpu 7 spinlock event irq 361
+NMI watchdog: disabled (cpu7): hardware events not enabled
+Brought up 8 CPUs
+.. snip..
+ [acpi processor finds the CPUs are not initialized and starts calling
+ arch_register_cpu, which creates /sys/devices/system/cpu/cpu8/online]
+CPU 8 got hotplugged
+CPU 9 got hotplugged
+CPU 10 got hotplugged
+.. snip..
+initcall 1_acpi_battery_init_async+0x0/0x1b returned 0 after 406 usecs
+calling erst_init+0x0/0x2bb @ 1
+
+ [and the scheduler sticks newly started tasks on the new CPUs, but
+ said CPUs cannot be initialized b/c the hypervisor has limited the
+ amount of vCPUS to 8 - as per the dom0_max_vcpus=8 flag.
+ The spinlock tries to kick the other CPU, but the structure for that
+ is not initialized and we crash.]
+BUG: unable to handle kernel paging request at fffffffffffffed8
+IP: [<ffffffff81035289>] xen_spin_lock+0x29/0x60
+PGD 180d067 PUD 180e067 PMD 0
+Oops: 0002 [#1] SMP
+CPU 7
+Modules linked in:
+
+Pid: 1, comm: swapper/0 Not tainted 3.4.0-rc2upstream-00001-gf5154e8 #1 Intel Corporation S2600CP/S2600CP
+RIP: e030:[<ffffffff81035289>] [<ffffffff81035289>] xen_spin_lock+0x29/0x60
+RSP: e02b:ffff8801fb9b3a70 EFLAGS: 00010282
+
+With this patch, we cap the amount of vCPUS that the initial domain
+can run, to exactly what dom0_max_vcpus=X has specified.
+
+In the future, if there is a hypercall that will allow a running
+domain to expand past its initial set of vCPUS, this patch should
+be re-evaluated.
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/xen/smp.c | 15 +++++++++++++++
+ 1 files changed, 15 insertions(+), 0 deletions(-)
+
+diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
+index 041d4fe..9a23fff 100644
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -172,6 +172,7 @@ static void __init xen_fill_possible_map(void)
+ static void __init xen_filter_cpu_maps(void)
+ {
+ int i, rc;
++ unsigned int subtract = 0;
+
+ if (!xen_initial_domain())
+ return;
+@@ -186,8 +187,22 @@ static void __init xen_filter_cpu_maps(void)
+ } else {
+ set_cpu_possible(i, false);
+ set_cpu_present(i, false);
++ subtract++;
+ }
+ }
++#ifdef CONFIG_HOTPLUG_CPU
++ /* This is akin to using 'nr_cpus' on the Linux command line.
++ * Which is OK as when we use 'dom0_max_vcpus=X' we can only
++ * have up to X, while nr_cpu_ids is greater than X. This
++ * normally is not a problem, except when CPU hotplugging
++ * is involved and then there might be more than X CPUs
++ * in the guest - which will not work as there is no
++ * hypercall to expand the max number of VCPUs an already
++ * running guest has. So cap it up to X. */
++ if (subtract)
++ nr_cpu_ids = nr_cpu_ids - subtract;
++#endif
++
+ }
+
+ static void __init xen_smp_prepare_boot_cpu(void)
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0095-ASoC-dapm-Ensure-power-gets-managed-for-line-widgets.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0095-ASoC-dapm-Ensure-power-gets-managed-for-line-widgets.patch
--- /dev/null
@@ -0,0 +1,43 @@
+From 5cf5b5db94847bec15c83a7ba69697a74e5248e0 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Thu, 12 Apr 2012 17:29:36 +0100
+Subject: [PATCH 095/165] ASoC: dapm: Ensure power gets managed for line
+ widgets
+
+commit 7e1f7c8a6e517900cd84da1b8ae020f08f286c3b upstream.
+
+Line widgets had not been included in either the power up or power down
+sequences so if a widget had an event associated with it that event would
+never be run. Fix this minimally by adding them to the sequences, we
+should probably be doing away with the specific widget types as they all
+have the same priority anyway.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ sound/soc/soc-dapm.c | 2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index ea909c5..90e93bf 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -69,6 +69,7 @@ static int dapm_up_seq[] = {
+ [snd_soc_dapm_out_drv] = 10,
+ [snd_soc_dapm_hp] = 10,
+ [snd_soc_dapm_spk] = 10,
++ [snd_soc_dapm_line] = 10,
+ [snd_soc_dapm_post] = 11,
+ };
+
+@@ -77,6 +78,7 @@ static int dapm_down_seq[] = {
+ [snd_soc_dapm_adc] = 1,
+ [snd_soc_dapm_hp] = 2,
+ [snd_soc_dapm_spk] = 2,
++ [snd_soc_dapm_line] = 2,
+ [snd_soc_dapm_out_drv] = 2,
+ [snd_soc_dapm_pga] = 4,
+ [snd_soc_dapm_mixer_named_ctl] = 5,
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0096-ASoC-wm8994-Improve-sequencing-of-AIF-channel-enable.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0096-ASoC-wm8994-Improve-sequencing-of-AIF-channel-enable.patch
--- /dev/null
@@ -0,0 +1,389 @@
+From 18ea02a9ec95869c1210e6ea2f10dee99c36edbd Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Thu, 12 Apr 2012 19:47:11 +0100
+Subject: [PATCH 096/165] ASoC: wm8994: Improve sequencing of AIF channel
+ enables
+
+commit 1a38336b8611a04f0a624330c1f815421f4bf5f4 upstream.
+
+This ensures a clean startup of the channels, without this change some
+use cases could result in issues in a small proportion of cases.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ sound/soc/codecs/wm8994.c | 276 ++++++++++++++++++++++++++++++++++++---------
+ 1 files changed, 222 insertions(+), 54 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index 2f1f5f8..7806301 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -883,61 +883,170 @@ static void wm8994_update_class_w(struct snd_soc_codec *codec)
+ }
+ }
+
+-static int late_enable_ev(struct snd_soc_dapm_widget *w,
+- struct snd_kcontrol *kcontrol, int event)
++static int aif1clk_ev(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
+ {
+ struct snd_soc_codec *codec = w->codec;
+- struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
++ struct wm8994 *control = codec->control_data;
++ int mask = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC1R_ENA;
++ int dac;
++ int adc;
++ int val;
++
++ switch (control->type) {
++ case WM8994:
++ case WM8958:
++ mask |= WM8994_AIF1DAC2L_ENA | WM8994_AIF1DAC2R_ENA;
++ break;
++ default:
++ break;
++ }
+
+ switch (event) {
+ case SND_SOC_DAPM_PRE_PMU:
+- if (wm8994->aif1clk_enable) {
+- snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
+- WM8994_AIF1CLK_ENA_MASK,
+- WM8994_AIF1CLK_ENA);
+- wm8994->aif1clk_enable = 0;
+- }
+- if (wm8994->aif2clk_enable) {
+- snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
+- WM8994_AIF2CLK_ENA_MASK,
+- WM8994_AIF2CLK_ENA);
+- wm8994->aif2clk_enable = 0;
+- }
++ val = snd_soc_read(codec, WM8994_AIF1_CONTROL_1);
++ if ((val & WM8994_AIF1ADCL_SRC) &&
++ (val & WM8994_AIF1ADCR_SRC))
++ adc = WM8994_AIF1ADC1R_ENA | WM8994_AIF1ADC2R_ENA;
++ else if (!(val & WM8994_AIF1ADCL_SRC) &&
++ !(val & WM8994_AIF1ADCR_SRC))
++ adc = WM8994_AIF1ADC1L_ENA | WM8994_AIF1ADC2L_ENA;
++ else
++ adc = WM8994_AIF1ADC1R_ENA | WM8994_AIF1ADC2R_ENA |
++ WM8994_AIF1ADC1L_ENA | WM8994_AIF1ADC2L_ENA;
++
++ val = snd_soc_read(codec, WM8994_AIF1_CONTROL_2);
++ if ((val & WM8994_AIF1DACL_SRC) &&
++ (val & WM8994_AIF1DACR_SRC))
++ dac = WM8994_AIF1DAC1R_ENA | WM8994_AIF1DAC2R_ENA;
++ else if (!(val & WM8994_AIF1DACL_SRC) &&
++ !(val & WM8994_AIF1DACR_SRC))
++ dac = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC2L_ENA;
++ else
++ dac = WM8994_AIF1DAC1R_ENA | WM8994_AIF1DAC2R_ENA |
++ WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC2L_ENA;
++
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
++ mask, adc);
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++ mask, dac);
++ snd_soc_update_bits(codec, WM8994_CLOCKING_1,
++ WM8994_AIF1DSPCLK_ENA |
++ WM8994_SYSDSPCLK_ENA,
++ WM8994_AIF1DSPCLK_ENA |
++ WM8994_SYSDSPCLK_ENA);
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4, mask,
++ WM8994_AIF1ADC1R_ENA |
++ WM8994_AIF1ADC1L_ENA |
++ WM8994_AIF1ADC2R_ENA |
++ WM8994_AIF1ADC2L_ENA);
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, mask,
++ WM8994_AIF1DAC1R_ENA |
++ WM8994_AIF1DAC1L_ENA |
++ WM8994_AIF1DAC2R_ENA |
++ WM8994_AIF1DAC2L_ENA);
++ break;
++
++ case SND_SOC_DAPM_PRE_PMD:
++ case SND_SOC_DAPM_POST_PMD:
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++ mask, 0);
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
++ mask, 0);
++
++ val = snd_soc_read(codec, WM8994_CLOCKING_1);
++ if (val & WM8994_AIF2DSPCLK_ENA)
++ val = WM8994_SYSDSPCLK_ENA;
++ else
++ val = 0;
++ snd_soc_update_bits(codec, WM8994_CLOCKING_1,
++ WM8994_SYSDSPCLK_ENA |
++ WM8994_AIF1DSPCLK_ENA, val);
+ break;
+ }
+
+- /* We may also have postponed startup of DSP, handle that. */
+- wm8958_aif_ev(w, kcontrol, event);
+-
+ return 0;
+ }
+
+-static int late_disable_ev(struct snd_soc_dapm_widget *w,
+- struct snd_kcontrol *kcontrol, int event)
++static int aif2clk_ev(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
+ {
+ struct snd_soc_codec *codec = w->codec;
+- struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
++ int dac;
++ int adc;
++ int val;
+
+ switch (event) {
++ case SND_SOC_DAPM_PRE_PMU:
++ val = snd_soc_read(codec, WM8994_AIF2_CONTROL_1);
++ if ((val & WM8994_AIF2ADCL_SRC) &&
++ (val & WM8994_AIF2ADCR_SRC))
++ adc = WM8994_AIF2ADCR_ENA;
++ else if (!(val & WM8994_AIF2ADCL_SRC) &&
++ !(val & WM8994_AIF2ADCR_SRC))
++ adc = WM8994_AIF2ADCL_ENA;
++ else
++ adc = WM8994_AIF2ADCL_ENA | WM8994_AIF2ADCR_ENA;
++
++
++ val = snd_soc_read(codec, WM8994_AIF2_CONTROL_2);
++ if ((val & WM8994_AIF2DACL_SRC) &&
++ (val & WM8994_AIF2DACR_SRC))
++ dac = WM8994_AIF2DACR_ENA;
++ else if (!(val & WM8994_AIF2DACL_SRC) &&
++ !(val & WM8994_AIF2DACR_SRC))
++ dac = WM8994_AIF2DACL_ENA;
++ else
++ dac = WM8994_AIF2DACL_ENA | WM8994_AIF2DACR_ENA;
++
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
++ WM8994_AIF2ADCL_ENA |
++ WM8994_AIF2ADCR_ENA, adc);
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++ WM8994_AIF2DACL_ENA |
++ WM8994_AIF2DACR_ENA, dac);
++ snd_soc_update_bits(codec, WM8994_CLOCKING_1,
++ WM8994_AIF2DSPCLK_ENA |
++ WM8994_SYSDSPCLK_ENA,
++ WM8994_AIF2DSPCLK_ENA |
++ WM8994_SYSDSPCLK_ENA);
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
++ WM8994_AIF2ADCL_ENA |
++ WM8994_AIF2ADCR_ENA,
++ WM8994_AIF2ADCL_ENA |
++ WM8994_AIF2ADCR_ENA);
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++ WM8994_AIF2DACL_ENA |
++ WM8994_AIF2DACR_ENA,
++ WM8994_AIF2DACL_ENA |
++ WM8994_AIF2DACR_ENA);
++ break;
++
++ case SND_SOC_DAPM_PRE_PMD:
+ case SND_SOC_DAPM_POST_PMD:
+- if (wm8994->aif1clk_disable) {
+- snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
+- WM8994_AIF1CLK_ENA_MASK, 0);
+- wm8994->aif1clk_disable = 0;
+- }
+- if (wm8994->aif2clk_disable) {
+- snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
+- WM8994_AIF2CLK_ENA_MASK, 0);
+- wm8994->aif2clk_disable = 0;
+- }
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++ WM8994_AIF2DACL_ENA |
++ WM8994_AIF2DACR_ENA, 0);
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++ WM8994_AIF2ADCL_ENA |
++ WM8994_AIF2ADCR_ENA, 0);
++
++ val = snd_soc_read(codec, WM8994_CLOCKING_1);
++ if (val & WM8994_AIF1DSPCLK_ENA)
++ val = WM8994_SYSDSPCLK_ENA;
++ else
++ val = 0;
++ snd_soc_update_bits(codec, WM8994_CLOCKING_1,
++ WM8994_SYSDSPCLK_ENA |
++ WM8994_AIF2DSPCLK_ENA, val);
+ break;
+ }
+
+ return 0;
+ }
+
+-static int aif1clk_ev(struct snd_soc_dapm_widget *w,
+- struct snd_kcontrol *kcontrol, int event)
++static int aif1clk_late_ev(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
+ {
+ struct snd_soc_codec *codec = w->codec;
+ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+@@ -954,8 +1063,8 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
+ return 0;
+ }
+
+-static int aif2clk_ev(struct snd_soc_dapm_widget *w,
+- struct snd_kcontrol *kcontrol, int event)
++static int aif2clk_late_ev(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
+ {
+ struct snd_soc_codec *codec = w->codec;
+ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+@@ -972,6 +1081,63 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
+ return 0;
+ }
+
++static int late_enable_ev(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
++{
++ struct snd_soc_codec *codec = w->codec;
++ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
++
++ switch (event) {
++ case SND_SOC_DAPM_PRE_PMU:
++ if (wm8994->aif1clk_enable) {
++ aif1clk_ev(w, kcontrol, event);
++ snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
++ WM8994_AIF1CLK_ENA_MASK,
++ WM8994_AIF1CLK_ENA);
++ wm8994->aif1clk_enable = 0;
++ }
++ if (wm8994->aif2clk_enable) {
++ aif2clk_ev(w, kcontrol, event);
++ snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
++ WM8994_AIF2CLK_ENA_MASK,
++ WM8994_AIF2CLK_ENA);
++ wm8994->aif2clk_enable = 0;
++ }
++ break;
++ }
++
++ /* We may also have postponed startup of DSP, handle that. */
++ wm8958_aif_ev(w, kcontrol, event);
++
++ return 0;
++}
++
++static int late_disable_ev(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
++{
++ struct snd_soc_codec *codec = w->codec;
++ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
++
++ switch (event) {
++ case SND_SOC_DAPM_POST_PMD:
++ if (wm8994->aif1clk_disable) {
++ snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
++ WM8994_AIF1CLK_ENA_MASK, 0);
++ aif1clk_ev(w, kcontrol, event);
++ wm8994->aif1clk_disable = 0;
++ }
++ if (wm8994->aif2clk_disable) {
++ snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
++ WM8994_AIF2CLK_ENA_MASK, 0);
++ aif2clk_ev(w, kcontrol, event);
++ wm8994->aif2clk_disable = 0;
++ }
++ break;
++ }
++
++ return 0;
++}
++
+ static int adc_mux_ev(struct snd_soc_dapm_widget *w,
+ struct snd_kcontrol *kcontrol, int event)
+ {
+@@ -1268,9 +1434,9 @@ static const struct snd_kcontrol_new aif2dacr_src_mux =
+ SOC_DAPM_ENUM("AIF2DACR Mux", aif2dacr_src_enum);
+
+ static const struct snd_soc_dapm_widget wm8994_lateclk_revd_widgets[] = {
+-SND_SOC_DAPM_SUPPLY("AIF1CLK", SND_SOC_NOPM, 0, 0, aif1clk_ev,
++SND_SOC_DAPM_SUPPLY("AIF1CLK", SND_SOC_NOPM, 0, 0, aif1clk_late_ev,
+ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+-SND_SOC_DAPM_SUPPLY("AIF2CLK", SND_SOC_NOPM, 0, 0, aif2clk_ev,
++SND_SOC_DAPM_SUPPLY("AIF2CLK", SND_SOC_NOPM, 0, 0, aif2clk_late_ev,
+ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+
+ SND_SOC_DAPM_PGA_E("Late DAC1L Enable PGA", SND_SOC_NOPM, 0, 0, NULL, 0,
+@@ -1299,8 +1465,10 @@ SND_SOC_DAPM_POST("Late Disable PGA", late_disable_ev)
+ };
+
+ static const struct snd_soc_dapm_widget wm8994_lateclk_widgets[] = {
+-SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, NULL, 0),
+-SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, NULL, 0),
++SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, aif1clk_ev,
++ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
++SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, aif2clk_ev,
++ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
+ SND_SOC_DAPM_PGA("Direct Voice", SND_SOC_NOPM, 0, 0, NULL, 0),
+ SND_SOC_DAPM_MIXER("SPKL", WM8994_POWER_MANAGEMENT_3, 8, 0,
+ left_speaker_mixer, ARRAY_SIZE(left_speaker_mixer)),
+@@ -1353,30 +1521,30 @@ SND_SOC_DAPM_SUPPLY("VMID", SND_SOC_NOPM, 0, 0, vmid_event,
+ SND_SOC_DAPM_SUPPLY("CLK_SYS", SND_SOC_NOPM, 0, 0, clk_sys_event,
+ SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+
+-SND_SOC_DAPM_SUPPLY("DSP1CLK", WM8994_CLOCKING_1, 3, 0, NULL, 0),
+-SND_SOC_DAPM_SUPPLY("DSP2CLK", WM8994_CLOCKING_1, 2, 0, NULL, 0),
+-SND_SOC_DAPM_SUPPLY("DSPINTCLK", WM8994_CLOCKING_1, 1, 0, NULL, 0),
++SND_SOC_DAPM_SUPPLY("DSP1CLK", SND_SOC_NOPM, 3, 0, NULL, 0),
++SND_SOC_DAPM_SUPPLY("DSP2CLK", SND_SOC_NOPM, 2, 0, NULL, 0),
++SND_SOC_DAPM_SUPPLY("DSPINTCLK", SND_SOC_NOPM, 1, 0, NULL, 0),
+
+ SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", NULL,
+- 0, WM8994_POWER_MANAGEMENT_4, 9, 0),
++ 0, SND_SOC_NOPM, 9, 0),
+ SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", NULL,
+- 0, WM8994_POWER_MANAGEMENT_4, 8, 0),
++ 0, SND_SOC_NOPM, 8, 0),
+ SND_SOC_DAPM_AIF_IN_E("AIF1DAC1L", NULL, 0,
+- WM8994_POWER_MANAGEMENT_5, 9, 0, wm8958_aif_ev,
++ SND_SOC_NOPM, 9, 0, wm8958_aif_ev,
+ SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+ SND_SOC_DAPM_AIF_IN_E("AIF1DAC1R", NULL, 0,
+- WM8994_POWER_MANAGEMENT_5, 8, 0, wm8958_aif_ev,
++ SND_SOC_NOPM, 8, 0, wm8958_aif_ev,
+ SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+
+ SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", NULL,
+- 0, WM8994_POWER_MANAGEMENT_4, 11, 0),
++ 0, SND_SOC_NOPM, 11, 0),
+ SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", NULL,
+- 0, WM8994_POWER_MANAGEMENT_4, 10, 0),
++ 0, SND_SOC_NOPM, 10, 0),
+ SND_SOC_DAPM_AIF_IN_E("AIF1DAC2L", NULL, 0,
+- WM8994_POWER_MANAGEMENT_5, 11, 0, wm8958_aif_ev,
++ SND_SOC_NOPM, 11, 0, wm8958_aif_ev,
+ SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+ SND_SOC_DAPM_AIF_IN_E("AIF1DAC2R", NULL, 0,
+- WM8994_POWER_MANAGEMENT_5, 10, 0, wm8958_aif_ev,
++ SND_SOC_NOPM, 10, 0, wm8958_aif_ev,
+ SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+
+ SND_SOC_DAPM_MIXER("AIF1ADC1L Mixer", SND_SOC_NOPM, 0, 0,
+@@ -1403,14 +1571,14 @@ SND_SOC_DAPM_MIXER("DAC1R Mixer", SND_SOC_NOPM, 0, 0,
+ dac1r_mix, ARRAY_SIZE(dac1r_mix)),
+
+ SND_SOC_DAPM_AIF_OUT("AIF2ADCL", NULL, 0,
+- WM8994_POWER_MANAGEMENT_4, 13, 0),
++ SND_SOC_NOPM, 13, 0),
+ SND_SOC_DAPM_AIF_OUT("AIF2ADCR", NULL, 0,
+- WM8994_POWER_MANAGEMENT_4, 12, 0),
++ SND_SOC_NOPM, 12, 0),
+ SND_SOC_DAPM_AIF_IN_E("AIF2DACL", NULL, 0,
+- WM8994_POWER_MANAGEMENT_5, 13, 0, wm8958_aif_ev,
++ SND_SOC_NOPM, 13, 0, wm8958_aif_ev,
+ SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+ SND_SOC_DAPM_AIF_IN_E("AIF2DACR", NULL, 0,
+- WM8994_POWER_MANAGEMENT_5, 12, 0, wm8958_aif_ev,
++ SND_SOC_NOPM, 12, 0, wm8958_aif_ev,
+ SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+
+ SND_SOC_DAPM_AIF_IN("AIF1DACDAT", "AIF1 Playback", 0, SND_SOC_NOPM, 0, 0),
+--
+1.7.7.6
+
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0097-dmaengine-at_hdmac-remove-clear-on-read-in-atc_dosta.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.17/0097-dmaengine-at_hdmac-remove-clear-on-read-in-atc_dosta.patch
--- /dev/null
@@ -0,0 +1,40 @@
+From 461507ae293668a6dd1543092d2506fa4524d8ec Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Mon, 16 Apr 2012 14:46:30 +0200
+Subject: [PATCH 097/165] dmaengine: at_hdmac: remove clear-on-read in
+ atc_dostart()
+
+commit ed8b0d67f33518a16c6b2450fe5ebebf180c2d04 upstream.
+
+This loop on EBCISR register was designed to clear IRQ sources before enabling
+a DMA channel. This register is clear-on-read so a race condition can appear if
+another channel is already active and has just finished its transfer.
+Removing this read on EBCISR is fixing the issue as there is no case where an IRQ
+could be pending: we already make sure that this register is drained at probe()
+time and during resume.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/dma/at_hdmac.c | 4 ----
+ 1 files changed, 0 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index a60adbf..79dcf6e 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -239,10 +239,6 @@ static void atc_dostart(struct at_dma_chan *atchan, struct at_desc *first)
+
+ vdbg_dump_regs(atchan);
+
+- /* clear any pending interrupt */
+- while (dma_readl(atdma, EBCISR))
+-&nb